FreeCalypso > hg > freecalypso-sw
annotate rvinterf/doc/tfc139.usage @ 501:da8248e23aca
osx.c: int_osx_free_mem() done
author | Michael Spacefalcon <msokolov@ivan.Harhan.ORG> |
---|---|
date | Tue, 01 Jul 2014 18:32:41 +0000 |
parents | 2d8ab1b0df8d |
children |
rev | line source |
---|---|
433
2d8ab1b0df8d
rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
1 The tfc139 hack-utility (see ../../doc/Compal-unlock) is based on the |
2d8ab1b0df8d
rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
2 rvinterf/rvtdump skeleton, and it needs to be invoked as follows: |
2d8ab1b0df8d
rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
3 |
2d8ab1b0df8d
rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
4 tfc139 [options] /dev/ttyXXX |
2d8ab1b0df8d
rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
5 |
2d8ab1b0df8d
rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
6 In the well-tested use case of breaking into TFC139 phones with fw version |
2d8ab1b0df8d
rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
7 8.8.17, no options are normally needed, but the following options are supported: |
2d8ab1b0df8d
rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
8 |
2d8ab1b0df8d
rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
9 -a address |
2d8ab1b0df8d
rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
10 |
2d8ab1b0df8d
rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
11 This option changes the RAM address into which the "shellcode" is to be |
2d8ab1b0df8d
rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
12 written; the argument is always interpreted as hex. The default is |
2d8ab1b0df8d
rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
13 0x800000, as used by the mot931c.exe closed source tool on whose |
2d8ab1b0df8d
rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
14 reverse-engineering our hack-utility is based. |
2d8ab1b0df8d
rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
15 |
2d8ab1b0df8d
rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
16 -B baud |
2d8ab1b0df8d
rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
17 |
2d8ab1b0df8d
rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
18 This option changes the serial baud rate just like in rvinterf and |
2d8ab1b0df8d
rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
19 rvtdump, but the default is 57600 as needed for breaking into TFC139 |
2d8ab1b0df8d
rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
20 firmware. |
2d8ab1b0df8d
rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
21 |
2d8ab1b0df8d
rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
22 -l logfile |
2d8ab1b0df8d
rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
23 |
2d8ab1b0df8d
rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
24 Log activity in a file, just like rvinterf and rvtdump. |
2d8ab1b0df8d
rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
25 |
2d8ab1b0df8d
rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
26 -s address |
2d8ab1b0df8d
rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
27 |
2d8ab1b0df8d
rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
28 Just like mot931c.exe has been observed to do, we start our stack |
2d8ab1b0df8d
rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
29 smashing attempts at a certain address, and keep incrementing by 4 |
2d8ab1b0df8d
rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
30 until we either succeed or crash the fw in some other way that does not |
2d8ab1b0df8d
rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
31 help us. This option changes the starting address for these stack |
2d8ab1b0df8d
rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
32 smashing attempts; the argument is always interpreted as hex. The |
2d8ab1b0df8d
rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
33 default is 0x837C54, as observed from the reverse engineering of |
2d8ab1b0df8d
rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
34 mot931c. |
2d8ab1b0df8d
rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
35 |
2d8ab1b0df8d
rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
36 -w number_in_seconds |
2d8ab1b0df8d
rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
37 |
2d8ab1b0df8d
rvinterf/doc/tfc139.usage: written
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
38 See rvinterf.usage; the option is the same for tfc139 as for rvinterf. |