+
−The tfc139 hack-utility (see ../../doc/Compal-unlock) is based on the
+
−rvinterf/rvtdump skeleton, and it needs to be invoked as follows:
+
−
+
−tfc139 [options] /dev/ttyXXX
+
−
+
−In the well-tested use case of breaking into TFC139 phones with fw version
+
−8.8.17, no options are normally needed, but the following options are supported:
+
−
+
−-a address
+
−
+
−	This option changes the RAM address into which the "shellcode" is to be
+
−	written; the argument is always interpreted as hex.  The default is
+
−	0x800000, as used by the mot931c.exe closed source tool on whose
+
−	reverse-engineering our hack-utility is based.
+
−
+
−-B baud
+
−
+
−	This option changes the serial baud rate just like in rvinterf and
+
−	rvtdump, but the default is 57600 as needed for breaking into TFC139
+
−	firmware.
+
−
+
−-l logfile
+
−
+
−	Log activity in a file, just like rvinterf and rvtdump.
+
−
+
−-s address
+
−
+
−	Just like mot931c.exe has been observed to do, we start our stack
+
−	smashing attempts at a certain address, and keep incrementing by 4
+
−	until we either succeed or crash the fw in some other way that does not
+
−	help us.  This option changes the starting address for these stack
+
−	smashing attempts; the argument is always interpreted as hex.  The
+
−	default is 0x837C54, as observed from the reverse engineering of
+
−	mot931c.
+
−
+
−-w number_in_seconds
+
−
+
−	See rvinterf.usage; the option is the same for tfc139 as for rvinterf.