FreeCalypso > hg > freecalypso-sw

annotate rvinterf/doc/tfc139.usage @ 983:7166c8311b0d

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
tfc139 reworked to support both ARM and Thumb entry
author Mychaela Falconia <falcon@ivan.Harhan.ORG>
date Thu, 10 Dec 2015 08:07:47 +0000
parents 2d8ab1b0df8d
children
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
433
2d8ab1b0df8d rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
1 The tfc139 hack-utility (see ../../doc/Compal-unlock) is based on the
2d8ab1b0df8d rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
2 rvinterf/rvtdump skeleton, and it needs to be invoked as follows:
2d8ab1b0df8d rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
3
2d8ab1b0df8d rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
4 tfc139 [options] /dev/ttyXXX
2d8ab1b0df8d rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
5
2d8ab1b0df8d rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
6 In the well-tested use case of breaking into TFC139 phones with fw version
2d8ab1b0df8d rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
7 8.8.17, no options are normally needed, but the following options are supported:
2d8ab1b0df8d rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
8
2d8ab1b0df8d rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
9 -a address
2d8ab1b0df8d rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
10
2d8ab1b0df8d rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
11 This option changes the RAM address into which the "shellcode" is to be
2d8ab1b0df8d rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
12 written; the argument is always interpreted as hex. The default is
2d8ab1b0df8d rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
13 0x800000, as used by the mot931c.exe closed source tool on whose
2d8ab1b0df8d rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
14 reverse-engineering our hack-utility is based.
2d8ab1b0df8d rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
15
2d8ab1b0df8d rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
16 -B baud
2d8ab1b0df8d rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
17
2d8ab1b0df8d rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
18 This option changes the serial baud rate just like in rvinterf and
2d8ab1b0df8d rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
19 rvtdump, but the default is 57600 as needed for breaking into TFC139
2d8ab1b0df8d rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
20 firmware.
2d8ab1b0df8d rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
21
2d8ab1b0df8d rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
22 -l logfile
2d8ab1b0df8d rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
23
2d8ab1b0df8d rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
24 Log activity in a file, just like rvinterf and rvtdump.
2d8ab1b0df8d rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
25
2d8ab1b0df8d rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
26 -s address
2d8ab1b0df8d rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
27
2d8ab1b0df8d rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
28 Just like mot931c.exe has been observed to do, we start our stack
2d8ab1b0df8d rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
29 smashing attempts at a certain address, and keep incrementing by 4
2d8ab1b0df8d rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
30 until we either succeed or crash the fw in some other way that does not
2d8ab1b0df8d rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
31 help us. This option changes the starting address for these stack
2d8ab1b0df8d rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
32 smashing attempts; the argument is always interpreted as hex. The
2d8ab1b0df8d rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
33 default is 0x837C54, as observed from the reverse engineering of
2d8ab1b0df8d rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
34 mot931c.
2d8ab1b0df8d rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
35
2d8ab1b0df8d rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
36 -w number_in_seconds
2d8ab1b0df8d rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
37
2d8ab1b0df8d rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
38 See rvinterf.usage; the option is the same for tfc139 as for rvinterf.