Random Noise

cat /dev/random >> /dev/dsp

Archive for the ‘Hardware’ Category

Linksys EA9500 Stuff

leave a comment »

Firmware Source: 

http://downloads.linksys.com/downloads/gpl/EA9500_v1.1.7.177204.tar.gz

Hardware Info:

CPU Broadcom BCM4709C0KFEBG dual-core @ 1.4 GHz
Switch in BCM4709C0KFEBG & BCM53125
RAM 256 MB
Flash 128 MB
2.4 GHz Radio BCM4366 4×4 2.4/5G single chip 802.11ac SoC
Skyworks SE2623L 2.4 GHz power amp (x4)
5 GHz radio BCM4366 4×4 2.4/5G single chip 802.11ac SoC
RFMD RFPA5542 5 GHz PA module (x4)
NOTE: There are two 5 GHz radios.
PCIe PLX Technology PEX8603 3-lane, 3-port PCIe switch

Serial Port:

20170201_160511

Possible JTAGs:

Blue seems to be the possible JTAG for BCM4709 SoC

Green, Red and Purple seem to be related to the BCM4366 radio SoCs.

20170201_161445

Flash Layout:

Notice this router has two copies of the firmware. You can force the router to boot from one or the other by partially booting the router 3 times.

cat /proc/mtd:
 dev: size erasesize name
 mtd0: 00080000 00020000 "boot"
 mtd1: 00180000 00020000 "nvram"
 mtd2: 01d00000 00020000 "linux"
 mtd3: 01ad2504 00020000 "rootfs"
 mtd4: 03300000 00020000 "linux2"
 mtd5: 030d245c 00020000 "rootfs2"
 mtd6: 02e00000 00020000 "brcmnand"

You can confirm partial boots from CFE/NVRam

CFE> nvram show | grep -i boot

bootpartition=0 
boot_wait=on 
maxpartialboots=3 
nvram_reboot=0 
partialboots=1

———

Found a Toshiba NAND flash:
Total size: 128MB
Block size: 128KB
Page Size: 2048B
OOB Size: 64B
Sector size: 512B
Spare size: 16B
ECC level: 8 (8-bit)
Device ID: 0x98 0xf1 0x80 0x15 0xf2 0x16
find_devinfo: devinfo block found at 0x00180000!

———

CFE> show devices
Device Name          Description
-------------------  ---------------------------------------------------------
uart0                NS16550 UART at 0x18000300
uart1                NS16550 UART at 0x18000400
nflash0              Toshiba NAND flash size 131072KB
nflash0.boot         Toshiba NAND flash offset 0 size 512KB
nflash0.nvram        Toshiba NAND flash offset 80000 size 1024KB
nflash0.devinfo      Toshiba NAND flash offset 180000 size 512KB
nflash0.trx          Toshiba NAND flash offset 200000 size 1KB
nflash0.os           Toshiba NAND flash offset 20001C size 29696KB
nflash0.trx2         Toshiba NAND flash offset 1F00000 size 1KB
nflash0.os2          Toshiba NAND flash offset 1F0001C size 29696KB
nflash1.boot         Toshiba NAND flash offset 0 size 512KB
nflash1.nvram        Toshiba NAND flash offset 80000 size 1024KB
nflash1.devinfo      Toshiba NAND flash offset 180000 size 512KB
nflash1.trx          Toshiba NAND flash offset 200000 size 29696KB
nflash1.trx2         Toshiba NAND flash offset 1F00000 size 29696KB
nflash1.brcmnand     Toshiba NAND flash offset 3C00000 size 69632KB
eth0                 Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller

VLAN Configs:

br0_ifnames=vlan1 eth1 eth2 eth3
vlan2ports=4 8
vlan1_ifname=br0
fwd_wlandevs=eth1 eth2 eth3
lan1_ifname=br1
lan1_hwnames=
vlan2hwname=et2
lan_ifnames=vlan1 eth1 eth2 eth3
lan_ipaddr=192.168.1.1
vlan1hwname=et2
vlan1ports=2 1 3 0 5 7 8*
lan_ifname=br0
evlan1ports=0 2 4 1 3 8
landevs=vlan1 wl0 wl1 wl2
lan_hwnames=
lan1_ifnames=wl1.1

 

GPIOs:

reset_gpio=17
gpio3=wps_button
gpio13=usbport1
gpio14=usbport2
gpio22=wps_led

 

Board Info:

boardnum=20150630
boardrev=0x1100
boardtype=0xA72F
boardflags=0x00000110
1:boardflags=0x10001000
1:boardflags2=0x00000004
1:boardflags3=0x0
1:boardflags4=0x0000000E
3:boardflags=0x10001000
2:boardflags=0x10001000
boardflags2=0x00000000
2:boardflags2=0x00000004
2:boardflags3=0x0
2:boardflags4=0x0000000E
3:boardflags2=0x00000004
3:boardflags3=0x0
3:boardflags4=0x0000000E

 

CFE boot options

boot -raw -z -addr=0x8000 -max=0xef8000 nflash0.os2

root=/dev/mtdblock2 console=ttyS0,115200 init=/sbin/preinit earlyprintk debug blueLED=1

 

Flashing Custom Firmware is possible

1. Set machines IP to 192.168.1.10/255.255.255.0 with Gateway = 192.168.1.1
2. Run Putty and connect to serial port (115200 8-bits per character, no parity, and 1 stop bit)
3. Ctrl+C to CFE prompt
4. Run TFTP Server and point to 192.168.1.10 to use it as server address.


5. Click Show Dir and select the file the transfer and click “Copy”
6. On CFE console type following commands one at a time and wait for each of them to finish. Make sure Image is not more than 28MB for this router or else you end up overwriting important partitions.

CFE> flash -noheader 192.168.1.10:/image.trx nflash0.trx
CFE> flash -noheader 192.168.1.10:/image.trx nflash1.trx

I tried to flash a generic dd-wrt firmware. It did boot however got kernel panics as expected.

Written by Vivek Unune

February 1, 2017 at 9:44 pm

Posted in Hardware, linux, openwrt

Tagged with , ,

Print TRX Header (Router Firmware)

leave a comment »


[StructLayout(LayoutKind.Sequential, Pack = 1)]
public struct TRXHeader
{
    public UInt32 Magic;                 /* "HDR0" */
    public UInt32 Len;                   /* Length of file including header */
    public UInt32 CRC32;                 /* 32-bit CRC from flag_version to end of file */
    public UInt16 Flag;                  /* flags */
    public UInt16 Version;               /* version */
    
    public UInt32 LzmaLoaderOffset;
    public UInt32 KernelOffset;
    public UInt32 RootFSOffset;
    public UInt32 BinHeaderOffset;       /* Only valid for V2 */
};

void Main()
{
    PrintTRXHeader(@"ea9500.img");
}

public static void PrintTRXHeader(string path)
{
    using (FileStream fileStream = new FileStream(path, FileMode.Open, System.IO.FileAccess.Read))
    {
        Console.WriteLine("\r\n************ {0} ***************\r\n", path);

        var header = fileStream.ReadStruct<TRXHeader>();
        Console.WriteLine("TRX Magic = 0x{0:X}", header.Magic);
        Console.WriteLine("File Length = {0}", header.Len);
        Console.WriteLine("CRC = 0x{0:X}", header.CRC32);
        Console.WriteLine("Flag = {0}", Convert.ToString(header.Flag, 2));
        Console.WriteLine("Version = {0}", header.Version);
        Console.WriteLine("LzmaLoaderOffset = 0x{0:X}", header.LzmaLoaderOffset);
        Console.WriteLine("KernelOffset = 0x{0:X}", header.KernelOffset);
        Console.WriteLine("RootFSOffset = 0x{0:X}", header.RootFSOffset);
        Console.WriteLine("BinHeaderOffset = 0x{0:X}\r\n", header.BinHeaderOffset);
    }
}

public static class StreamExtensions
{
    public static T ReadStruct<T>(this Stream stream) where T : struct
    {
        var sz = Marshal.SizeOf(typeof(T));
        var buffer = new byte[sz];
        stream.Read(buffer, 0, sz);
        var pinnedBuffer = GCHandle.Alloc(buffer, GCHandleType.Pinned);
        var structure = (T)Marshal.PtrToStructure(
            pinnedBuffer.AddrOfPinnedObject(), typeof(T));
        pinnedBuffer.Free();
        return structure;
    }
}

Written by Vivek Unune

February 1, 2017 at 8:34 pm

Posted in .NET, Hardware, openwrt

Tagged with , ,

Asus G1S CPU, GPU and Arctic Silver 5

with 6 comments

My laptop usually got very hot and CPU and GPU idle temperatures were in the range of ~75C and ~80C respectively. Its about eight months I bought my laptop and I finally decided to open it up and apply thermal paste to both CPU and GPU.

Getting to the CPU was fairly simple just remove 2+4 screws and apply the thermal paste.

But, getting to the GPU was real pain. So, I decided to write a post to describe it in simple steps and gotchas that I discovered.

Disclaimer: Opening and applying thermal paste to CPU or GPU will void your laptop’s warranty! Author assumes absolutely no liability for these opinions nor for any damages that may result from reading and/or implementing following steps.

Before starting anything, unplug the power 🙂 and remove the battery.

1. Remove the keyboard. For this remove the two screws that are labeled ‘K’ from the under side of the laptop, then using a small flat(slotted) screw driver, un-clip three plastic holders at the top edge of the keyboard . Then tilt it over and unplug two flat cables and one connector with wires grouped together.

2. Then remove the covers of the ram and the hard drive compartment. Carefully remove the rams modules and hard drive and keep it a side. If you haven’t removed CPU compartment cover do it now.
* In the CPU compartment, there is a screw hidden just between the heat sink exhaust and the edge of the laptop. The is covered by the aluminum foil so you have to peel it to remove it.
* Also don’t forget to remove a screw just beneath the hard drive!

3. Remove 3-4 tiny steel screws from the battery compartment. Then remove the rest of the screws from the laptop base. Also remove six screws from the under side of the hinges. Two hinge covers will come off.

4. Remove screws from backside and remove the lid covering the LCD cables. Carefully remove two screws under this lid. Then unplug the two connectors.

5. Tilt screen to the max and remove two long screws that hold the LCD panel in the grooves. Carefully remove the LCD panel and keep it aside.

6. Now slowly lift the upper cover. It should come off w/o problem. You’ll get a first look at the motherboard. But you still don’t see the GPU!!!

7. You have to remove couple more screws and unplug speaker cables and the DVD drive. And volia! you can lift the motherboard and turn it over. And there you’ll see the other heat sink.

8. Go ahead and remove the screws from the GPU heat sink, unplug the fan power connector and carefully detach the heatsink. You’ll see that the underside of the GPU heat sink has a thin aluminum foil that according to me prevents thermal paste short circuiting the connectors on the GPU. There is another reason for doing it this way. During laptop assembly the person gets hardly few minutes to apply the paste and set the heatsink, it is easy to just use the foil to cover the die and apply paste and slap the sink on to it – quick and dirty huh? But as I told earlier it does prevents thermal paste spreading over the GPU circuitry around the die!

9. Remove the foil and the thermal paste. Observe how excessive paste was used! I used a plastic card to get rid of it and finally cleaned it up with some 90% isopropyl alcohol (picked it from local Wallgreens for $2) and cotton swabs. The copper heat sink was now smooth and clean like a mirror. The die should be clean as new – but just to make sure clean it as well using a new cotton swab and alcohol.

Written by Vivek Unune

June 21, 2008 at 4:29 am

Posted in G1S, Hardware

Tagged with , , , ,

Ripped opened FreeAgent Pro 750 GB, finally!

leave a comment »

I don’t generally give reviews for any products as there are plenty out there. But I have had some complaints with FreeAgent Pro 750Gb external drive since I bought it.
Mainly related to
1. Over heating of the base (the detachable module)
2. System lockups
3. Choppy performance, performance drop after running the drive for few hours.

The performance is good when you turn on the drive then it gradually degrades 😦 I’ve tried moving/copying several GBs of stuff on to the drive and it does work great (when it does).

I bought this drive mainly because of it has the eSATA port and can deliver up to 300MB/sec bandwith (I doubt usb or firewire for that matter anything can beat this. Stats for the same).
You need eSATA port on your PC/Laptop as well to use this. My Asus G1S-A1 has one.

I tried installing various drivers but in vane, the drive still show signs of problems.

Finally I gave up and decided to shell out few more bucks on an external eSATA enclosure. I bought MagDog 3.5″ eSATA enclosure for $28. You have to be careful while removing the drive from the Seagate FreeAgent enclosure. You can find instructions on the web. There’s a youtube video that shows how to open this baby. Once I transfered the drive (which is Segate barracuda 7200.11) the performance has been consistent and haven’t had heating issues.

I was able to run some tests on it using the HD Tach utility and the drive gives me about 244MB/sec! (Note: For some reason HD Tach utility kept running after I had closed it – finally had to kill and eventually uninstall it).

Written by Vivek Unune

May 4, 2008 at 5:51 am

Posted in Hardware

Tagged with , , ,

Asus G1S-A1 1.3M Pixel webcam adventure

with 3 comments

I use gentoo linux on my laptop (G1S-A1). Everything is working including wireless, bluetooth, media keys etc.
The only thing that annoys me is when I use skype beta (with video) or any other webcam utility. The webcam image is 180° inverted!! I know it sounds funny..but its annoying after a while… Anyway, as usual I set out on the quest 😀 to find out the cause and possible remedy. A quick lsusb gives tells me that the device id and vendor id information.

localhost ~# lsusb
Bus 002 Device 001: ID 0000:0000
Bus 007 Device 002: ID 0b05:1712 ASUSTek Computer, Inc.
Bus 007 Device 001: ID 0000:0000
Bus 006 Device 001: ID 0000:0000
Bus 005 Device 002: ID 046d:c521 Logitech, Inc.
Bus 005 Device 001: ID 0000:0000
Bus 001 Device 003: ID 0b05:1726 ASUSTek Computer, Inc.
Bus 001 Device 002: ID 174f:5a35
Bus 001 Device 001: ID 0000:0000
Bus 004 Device 001: ID 0000:0000
Bus 003 Device 001: ID 0000:0000

To get more information about the webcam from vendor/device id

localhost ~ # lsusb -v -d 174f:5a35

iManufacturer 2 Sonix Technology Co., Ltd.
iProduct 1 USB 2.0 Camera

I tried to google the combination of device id and sonix to find any information about the camera. But it turned out that there is no such device manufactured/assembled by Sonix. I was curious and I thought lets see what the windows driver for this webcam has to say. I rebooted into Vista and bingo! the device information clearly mentions D-Max/Sonix 1.3M pixel camera. All the description regarding their camera modules can be found their website. Two weeks ago I was able to find the module along with device id mentioned. Unfortunately today I’m unable to locate the 5A35 module on that page because all the camera modules have generic names now(e.g 1.3M_UVC 5). I couldn’t find any cached page on google either. Looks like they D-Max doesn’t want to disclose that information.

On further digging through windows driver files, snp2uvc.inf (version 04/18/2007, 6.21.70.001) reveals some cool information.

[SN.NTx86.5.1]
;1.3M
%SN.USBVideo.DeviceDesc% = SN.USBVideo.XP,USB\VID_174f&PID_5a35 ;GD-5A35A(Ov9655)
%SN.USBVideo.DeviceDesc% = SN.USBVideo.XP,USB\VID_174f&PID_5a31 ;GD-5A31A(MI1320)
;2M
%SN.USBVideo2M.DeviceDesc% = SN.USBVideo2M.XP,USB\VID_174f&PID_5a51 ;GD-5A51A
;VGA
%SN.USBVideoVGA.DeviceDesc% = SN.USBVideoVGA.XP,USB\VID_174f&PID_5a11 ;GD-5A11A(Ov7670)

Hmm…After searching for GD-5A35A I found this cached link that links 5A35 to the generic model number that is 1.3M_UVC 1. So, here are the specifications:

1.3M_UVC 1 USB 2.0 1.3MP Camera Module Support UVC

SPECIFICATION:

• SXGA Resolution Image Sensor
•Video Resolution:
1280 x 1024, 1280 x 800
1204 x 768, 800 x 600
640 x 480, 352 x 288
320 x 240.
•Frame Rate:
640 x 480 at 30fps maximum
1280 x 1024 at 8fps maximum
•Video Format: YUY2
•LED Indicator
•DOF on 30~80cm
•Support UVC
•Auto Exposure
•Auto White Balance Control
•High Speed USB 2.0 Interface
•Low Power Consumption
•RoHS Compliant
•Dimension(LxWxH) 60 x 8.5 x 7.05mm

On careful inspection of snp2uvc.inf you can see that my webcam uses OV9655 sensor – cool! And the datasheet for that can be found here: http://rapidshare.com/files/94672360/OV9655-datasheet.pdf.html

Interestingly the newer version of the webcam driver doesn’t specify the sensor (OV9655) or the model number (GD-5A35A) information.

Most of the datasheet information went over my head except some interesting bits.
If you skip to “Register Set” and checkout register 1E :

1E MVFP 00 RW  Mirror / Vertical Flip Enable                

Bit[7:6] Reserved                
Bit[5]   Mirror                  
    0: Normal Image                  
    1: Mirror Image                
Bit[4]   Vertical Flip                  
    0: Vertical Flip Disable                  
    1: Vertical Flip Enable                
Bit[3:0] Reserved

Default value for bit[4] is 0, i.e VFlip is disabled. We get upside down image which means that the webcam module is installed upside down on G1S-A1, so the linux uvc driver must find a way to set the bit[4] of this register.

I’m reading through uvc-linux source to understand the driver and make appropriate changes. But it can take sometime… Sole purpose of this blog entry is to inform you guys about my findings, so someone with the right knowledge can add the vflip support for this webcam.

Written by Vivek Unune

February 24, 2008 at 11:08 pm