SAT8801 / RS8801 - MIPS OR ARM?

[babayaga]

Hi, not sure where to post, as there are no coding threads on this forum, but i started yesterday coding a firmware tool, just for fun, and dumped my firmware after hours of probing on a SAT8801 / RS8801 platform, though i wish to know which chipset its using, if its MIPS or ARM, or something completely different, I use IDA as a disassembler. It's quite fun, i'm a coder, but haven't spent time on firmware or hardware in this context before, unless you ask about 6502, which i can give a run for your money Im not trying to compete with any other flasher tool, this is just for my own amusement.

[Coopervid]

Hi, not sure where to post, as there are no coding threads on this forum, but i started yesterday coding a firmware tool, just for fun, and dumped my firmware after hours of probing on a SAT8801 / RS8801 platform, though i wish to know which chipset its using, if its MIPS or ARM, or something completely different, I use IDA as a disassembler. It's quite fun, i'm a coder, but haven't spent time on firmware or hardware in this context before, unless you ask about 6502, which i can give a run for your money Im not trying to compete with any other flasher tool, this is just for my own amusement.

Can't help you with that but I could send the kernel and firmware files for comparison. Therefore you could just compare. Firmware is 1.53. Which model did you use as there are S11s and 211s?

[OneDay]

check this link out for more information on the chips.
https://www.reddit.com/r/AskElectronics ... his_board/

[keydb_helper]

Hi, not sure where to post, as there are no coding threads on this forum, but i started yesterday coding a firmware tool, just for fun, and dumped my firmware after hours of probing on a SAT8801 / RS8801 platform, though i wish to know which chipset its using, if its MIPS or ARM, or something completely different, I use IDA as a disassembler.

Hey babayaga, the modern Pioneer drives use a Renesas/Hitachi ISA. I'm not sure of the exact variant but it is pretty close to the H8S/2600.

IDA Pro can be used as a disassembler and there are out of tree plugins for Ghidra. If you'd like to use GNU binutils or GCC, the h8300s architecture is a solid choice for both (dis)assembly and compilation.

[babayaga]

Thanks! Coppervid: i'd very much like to see the original firmware 1.53 for the 211 to compare to what i have dumped, the pioneer drive is very tricky, i tried extracting the firmware from the official flasher, but what i got was 8kbs of data about digital certificates.... but that was only a quick code to try, haven't tried to dive really into that yet - still most code is towards the drive itself.

Code: Select all

0r07.5.3.1http:/
/crl3.digicert.c
om/EVCodeSigning
SHA2-g1.crl07.5.
3.1http://crl4.d
igicert.com/EVCo
deSigningSHA2-g1
.crl0K..U. .D0B0
7..`.H...l..0*0(
..+.........http
s://www.digicert
.com/CPS0...g...

etc..

Oneday: Alright! Im still in the process of parsing every data i have dumped so far, and getting different dumps depending on the drive state etc. I looked at the H8S assembly and it seems easy enough to read when i get it disassembled

this is the first time since the xbox 360 i've really tried to look at firmwares and dvd/bd drive firmware and hardware, and only 2 days into it, i think i've made good progress in a short time, but man, there are so much to understand, im usually coding for the c64 and retro coding in ms-dos (for the demoscene) =)

[Coopervid]

Thanks! Coppervid: i'd very much like to see the original firmware 1.53 for the 211 to compare to what i have dumped, the pioneer drive is very tricky, i tried extracting the firmware from the official flasher, but what i got was 8kbs of data about digital certificates.... but that was only a quick code to try, haven't tried to dive really into that yet - still most code is towards the drive itself.

Oneday: Alright! Im still in the process of parsing every data i have dumped so far, and getting different dumps depending on the drive state etc. I looked at the H8S assembly and it seems easy enough to read when i get it disassembled

this is the first time since the xbox 360 i've really tried to look at firmwares and dvd/bd drive firmware and hardware, and only 2 days into it, i think i've made good progress in a short time, but man, there are so much to understand, im usually coding for the c64 and retro coding in ms-dos (for the demoscene) =)

PM sent.

[Billycar11]

To get fw out of the flasher it's pretty easy you just went a bit to complicated for it

With a extraction tool like 7zip just extract the exe
And then again extract the updater.exe

Then in the rsc and then bin folder there will be kernel and fw

But this fw won't work with bdr flash it has to be modified to work

[babayaga]

To get fw out of the flasher it's pretty easy you just went a bit to complicated for it

With a extraction tool like 7zip just extract the exe
And then again extract the updater.exe

Then in the rsc and then bin folder there will be kernel and fw

But this fw won't work with bdr flash it has to be modified to work

Thanks! I have no plan to try and flash anything just yet, too afraid og bricking anything, just see if i might can. I didn't think the extra .exe also was able to being extracted like that I extracted the file, and got two files, so seems correct, can i assume that the main firmware portion of the file does not contain a ascii header, but plain firmware executable? at least its what it looks like here

[babayaga]

the data extracted from all the pioneer executables .text and .data also have x86 headers/executable, the firmware must be either encrypted or compressed further it seems, think I'm gonna run the whole launcher through a debugger and see what it does at a low level, but that's for another time, at least the drive is in service mode now, or at least partially - bit unsure about the payload i send funny project nonetheless!

[Billycar11]

the data extracted from all the pioneer executables .text and .data also have x86 headers/executable, the firmware must be either encrypted or compressed further it seems, think I'm gonna run the whole launcher through a debugger and see what it does at a low level, but that's for another time, at least the drive is in service mode now, or at least partially - bit unsure about the payload i send funny project nonetheless!

the fw is right here :


yes it is encrypted you have to find away around that but thats the full fw and kernel

[Coopervid]

Older firmwaers and kernels are not encrypted if that information helps.