SamyGO

Hi!
I make GDB with "bitbake gdb" command from SamyGO OpenEmbedded SVN (thanks aquadran) and run exeDSP with it.
exeDSP will generate segmentation fault in a minute (is could problem about gdb 7.0.1? needed to try with gdb 6.x.x which I believe more stable than v7), but until then I can debug exeDSP for a while.
Now can debug exeDSP for small time (which is enough for this), and about to start write application.

KeyCommon::RecordKey(int) function is looks good location to handle.
r1 value return 0x49 if I press record button and 0x46 for stop button.
This is enough for primitive recording.

Need to look some ARM Thumb instructions pdf and try to generate program hooks in ASM. mprotects applications are beautiful source also. But here we needed to keep everything in place and inject our code without harming original one. Is it possible to change original function address and use my injection function location? Might be I needed to try this. If it possible I can inject my function between 2 original function.
I think I also needed to handle gtask_manager thing and needed to create a thread for recording. If I try record stream with event thread, than exeDSP will freeze.

I didn't decide where to write file. First version will be primal PVR and require constant file name/patch for recording. Might be file names are Recording001.ts, and if exist Recording002.ts....
I am planning to use /mtd_ram/recording directory, which could be linked to USB flash drive and or NFS/CIFS mount from the Application with symbolic link. Later, some one will code GUIed PVR Application too which you can make select recording directory etc...

Hi SamyGo fans,
I read this forum since some months now with interests without posting anything. I'm kinda new into firmware unpacking and reversing.
This is a really interesting project from the technical point of view because you work on complete different CPU architecture (ARM not x86). That's a pretty hard but nice challenge. Anyway just wanted to thank you for all the hard work done so far. I was really impressed to see a ExeDsp reversing to implement AVRFix by NewAgeHun. People able to do this stuff are not many at all, at least from my point of view.
Now about this thread and PVR i think it's a big step forward in the samygo project. It will be a must have feature for numbers of people in the world bringing samygo more and more notoriety which i think can be good. Reading your post erdem_ua, if i understand: you found a way to execute ExeDsp through Gdb for real into the TV, put breakpoints, and all the stuff. That's a huge step into the analyzing process for a better knowledge of the firmware. Maybe it's opening the door to more and more interesting discoveries! This firmware is full of mysteries...
Regards

almar10 wrote:For hooking: maybe you can use the GOT offset table, look up the specific functions and do a redirect. It can be done totaly in memory without modifying the flash (i believe).

I made application on my mind. Also make some injection practice on x86 ASM. Now stating to write application. Patch will placed on memory, not hard coded into exeDSP.

antartide wrote:I hope that you can find a way to run this also on b6000 device that no have content library menu =).

It's possible IF you have Record Stream option on your Debug Menu and have a shell access.
Thanks.

xer21 wrote:erdem_ua,
You don't think it would be a better Idea to put a program together that registers hooks into exeDSP so a more complete PVR can be developed? A lot of these functions needed to develop the PVR tools seem to be exposed already by exeDSP, I just don't know about writing to the screen, but I know there are event's to detect when the change is changed, so you can store a flag if your recording and cancel the channel change if you forgot for some reason... and scheduling etc...

I don't clearly understand you. But for a first step, I try to put dummy PVR recorder. When recording, It will discard any other remote commands (I wish I can made it) until stop button is pressed. Utility just detects record button press and initiate spI_Stream_Record() like function with defined target. And when you press stop it deactivates it. There also flags in exeDSP that indicates recording. Mechanism uses /mtd_rwarea/keyRecording? like file (I don't remember exact name now) for mutex...