Hacking BD-C5500/XAA (serial console, firmware dump, etc...)

[habee]

Ok, let?s start with hacking the Samsung Blueray Player BD-C5500.

This is what I?ve done so far, i will further describe the steps:

- Added serial console interface to get bootlogs
- Getting cfe-console access
- Getting root serial console access
- dumped complete firmware



Step 1: Getting a serial console output:

The BD-C5500 has a Connector CN7 on the Mainboard, where the serial console cable can be connected . I used a Nokia Data Cable CA-42, because it also includes
an Serial to USB Adapter. Refer to the following picture for connecting the cable:



Uploaded with ImageShack.us

Using Putty as terminal I get the following bootlog:

Code: Select all

BCM76300010
Setting NAND Params

CFE starting from ROM
Chip specific init
TLB init
Board init
Starting memory configuration
Extracting memory configuration info
Checking strap value
Setting up PLL
Enable DDR encryption
SoooooooooooooR
Preparing to copy code to RAM
Prepare for NAND loading


Starting code in RAM
Booting Secured CFE... 


BCM97630 B0-SEC  CFE v2.1.8 (CFE core v2.1, BSP_REV 8), Endian Mode: Little
Build Date: Wed Jan 20 19:46:20 KST 2010 (gyu@localhost.localdomain)
Copyright (C) Broadcom Corporation.



DDR                        : Bank0:128MB@667MHz | Bank1:256MB@667MHz 
NAND Boot                  : FlashSize 256MB on CS0, BlkSize 128KB, PgSize 2048B
NAND vendor timing         : 20da1095 Numonyx NAND02GW3B2D/ST NAND02GW3B SLC  t1(33535238) t2(80000b78)
Secure boot                : Enabled

Reading flash0.macadr to V:0x87917b80 
Reading flash0.rawnvr to V:0x8709275c 
booting ARM...
Reading flash0.ofefw0 to V:0x80000000 from offset 0 len 786432 
Reading flash0.ofews to V:0x800c0000 from offset 0 len 32768 
Reading flash0.ofews1 to V:0x800c8000 from offset 0 len 32768 
booting ARM...ofefw@0x2fd00000 
done 
check service mode

Display splash screen
[ Default Video ] :  Current Video Output : Component @ Resolution : 480p 
Loading NTSC SD image only to 0x02bf4800 size 691200 bytes
Reading flash0.splash to V:0xa2bf4800 from offset 0 len 691200 
Done displaying splash screen
Loader:elf Filesys:raw Dev:flash0.kernel File: Options:root=/dev/romblock2 console=0,115200n8 BDVD_BOOT_AUTOSTART=y BAPP_OUT=/dev/console memcfg=384 ro
Loading: 0x80008000/4645696 0x80476340/304416 
Successfully loaded secure elf image....
Entry address is 0x8000c330

current time (1793031 uS), 1793 ms

Timestamp started ...
Starting program at 0x8000c330

[    0.000000] -- DDR Bank 0: 128 MB
[    0.000000] -- DDR Bank 1: 256 MB
[    0.000000] Linux version 2.6.28.9 (root@BdManager) (gcc version 4.2.0 20070124 (prerelease) - BRCM 10ts-20080721) #279 Mon Aug 30 18:12:17 KST 2010
[    0.000000] Kernel command line: root=/dev/romblock2 console=0,115200n8 BDVD_BOOT_AUTOSTART=y BAPP_OUT=/dev/console memcfg=384 ro
[4294667.389000] checker_0 control 0x00000008 addr low 0x00001000 hi 0x00345000 
[4294667.396000] read rights _0 0xffffffff _1 0xffffffff write rights _0 0x00000000 _1 0x00000000 
[4294667.405000] checker_1 control 0x00000008 addr low 0x00346000 hi 0x021fff80 
[4294667.412000] read rights _0 0xffffffff _1 0xffffffff write rights _0 0x00000000 _1 0x00e4fca0 
[4294667.421000] checker_2 control 0x00000008 addr low 0x20000000 hi 0x241fff80 
[4294667.428000] read rights _0 0xffffffff _1 0xffffffff write rights _0 0x00000000 _1 0x00e4fca0 
[4294667.437000] checker_3 control 0x00000018 addr low 0x2fd00000 hi 0x2fdfff80 
[4294667.444000] read rights _0 0xffffffff _1 0xffffffff write rights _0 0x00000000 _1 0x00010000 
[4294667.465000] Driver 'sd' needs updating - please use bus_type methods
[4294667.472000] Driver 'sr' needs updating - please use bus_type methods
[4294667.479000] vide_ofe_probe: FE SECURITY NOT ENABLED
[4294667.492000] scsi 0:0:0:0: CD-ROM            SAMSUNG  SPE-400          0106 PQ: 0 ANSI: 5
[4294667.501000] sr 0:0:0:0: Attached scsi generic sg0 type 5
[4294667.548000] brcmnand_probe: Found SLC device ST NAND02GW3B
[4294667.553000] brcmnand_probe() oobSize: 0,  pageSize : 2048, blockSize: 131072<7>Writing nand config register 0x01402848 with 0x16152300
[4294667.566000]  allocating this->pLocalOob<3> allocating this->ecc mask<6>BrcmNAND version = 0x80000304 256MB @00000000
[4294667.599000] Creating 22 MTD partitions on "bcm7xxx-nand":
[4294667.605000] 0x00000000-0x00100000 : "cfe"
[4294667.610000] 0x00100000-0x00600000 : "kernel"
[4294667.615000] 0x00600000-0x04600000 : "rootfs"
[4294667.620000] 0x04600000-0x04800000 : "ofefw0"
[4294667.626000] 0x04800000-0x04a00000 : "splash"
[4294667.631000] 0x04a00000-0x04c00000 : "splashS"
[4294667.636000] 0x04c00000-0x04e00000 : "splashU"
[4294667.641000] 0x04e00000-0x05000000 : "bootsound"
[4294667.646000] 0x05000000-0x05080000 : "macadr"
[4294667.651000] 0x05080000-0x05100000 : "nvram"
[4294667.657000] 0x05100000-0x05180000 : "rawnvr"
[4294667.662000] 0x05180000-0x05200000 : "drmregion"
[4294667.667000] 0x05200000-0x05280000 : "drmregion1"
[4294667.673000] 0x05280000-0x05300000 : "ofews"
[4294667.678000] 0x05300000-0x05380000 : "ofews1"
[4294667.683000] 0x05380000-0x06280000 : "tmp"
[4294667.688000] 0x06280000-0x06780000 : "kernel1"
[4294667.693000] 0x06780000-0x0a780000 : "rootfs1"
[4294667.699000] 0x0a780000-0x0a980000 : "ofefw1"
[4294667.704000] 0x0a980000-0x0f980000 : "widget"
[4294667.710000] 0x0f980000-0x0ff00000 : "pstor"
[4294667.715000] 0x00000000-0x10000000 : "all"
rcS: BDVD_BOOT_AUTOSTART<y>  BQ<y>  BAPP<./app_player>  BAPP_OUT</dev/console>  BNET<>  BNET_DLY<0> OFE_SB<n>
[4294668.285000] yaffs: restored from checkpoint
[4294668.434000] yaffs: restored from checkpoint
Wed Jun 11 00:00:00 UTC 2008
[4294668.597000] front: module license '<1>Dual BSD/GPL' taints kernel.
[4294668.607000] front device driver v0.24
[4294668.610000] Made by Samsung Electronics
[4294668.615000] For BRCM7630 Bx
[4294668.618000] Model : BD Player
[4294668.621000] Complete : Insert Front device Module 
[4294668.621000] 
[4294668.621000] 
[4294669.897000] BCMDRV: Initializing bcmdriver version $ bdvd_v3.0/3 $
[4294669.903000] BCMDRV: Using Interrupt Definition for 7630 (uname -a)
[4294669.910000] BCMDRV: Total intc words=2,Total Irqs=65
[4294669.915000] IRQ handler type mismatch for IRQ 19
[4294669.915000] current handler: Front_SRQ
[4294669.924000] bcmdriver: request irq failed 0x-16
[4294669.929000] irq: 19 flags 0x00000020 name UPG_CPU_INTR
[4294669.934000] BCMDRV: Global Interrupt Mask 0:0xD09E3FEF,1:0x0EB20003,2:0x00000000,3:0x00000000
[4294669.943000] BCMDRV: Initialization complete...
/etc/init.d/rcS: =================================================================: command not found
app_player START
2.80 0.57
[CALL][CMediaManager::CMediaManager():34] ... 

[HostMgr_StartEvaluateTime] Start time (tick) : 0xa5f415
[HostMgr_PrintEvaluateTime] Host_Main Start : (0xa5f4e6, 209, 209)


Build Date: Oct 28 2010  22:23:04
[SystemHalIF_GetModel] find '-' >>>>>>
Model Type : C5500
sByerName Type : XAA
C5500 Model_XAA : ModelModel Number ====> 0x3001
[HostMgr_PrintEvaluateTime] Mopt_LoadModelOptions : (0xa6231e, 12041, 11832)
[HostMgr_PrintEvaluateTime] HostMgr_LoadSystemParameter : (0xa627ab, 13206, 1165)
Time Zone... 5. setenv result : 0.
Time Zone... Time Zone : 5.
Date : Tue Jun 10 18:00:09 2008

vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv
>>>                 Object Address Information                    <<<
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 [ System :  Linux or POSIX support system ]
 [ Memory :  Raw system memory ]
 [ Service:   pandora service is running ...  ]
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
get info from flash ---------- DHCP: 1 
get info from flash ---------- DNS : 0 
get info from flash ---------- PX  : 0 
get info from flash ---------- COOK: 1 
net config.. SET COOKIE :: 1..
get info from flash ---------- THRP: 1 
get info from flash ---------- NTP : 0 
===============================================================
         N E T W O R K   C O N F I G U R A T I O N             
===============================================================
nmNetworkConfig.isDHCPEnable: 1
nmNetworkConfig.isDNSManual : 0
DHCP ENABLE..
DNS automatic mode..
nmProxyConfig.isProxyEnable : 0 
nmProxyConfig.isUserEnable  : 0 
nmProxyConfig.serverName    :  
nmProxyConfig.port          : 0 
nmProxyConfig.user          :  
nmProxyConfig.passwd        :  
nmAcceptCookies             : 1 
NetworkThroughput           : 29 
nmNTPServerEnable           : 0 
nmUserProfile.userId        :  
nmUserProfile.userPass      :  
nmUserProfile.userEmail     :  
===============================================================
 [ Get NET info from Flash: COMPLETE ]
Net Config.. httpConfig_SetLoopbackAddress :: ifconfig lo 127.0.0.1..
[system_and_wait] - ifconfig lo 127.0.0.1
httpConfig_SetHostsFile in config_SetHostsFile
Net Config.. config_SetHostsFile :: /var/config/hosts..

[[4294678.606000] ### not start front###
[4294678.606000] 

 Heaps created
Heap XPT Handle 0x03f0c298, PA 0x02200000/ 34M, Size 0x00300000/  3M BW 0
Heap RAP Handle 0x03f0c7d8, PA 0x24200000/578M, Size 0x00800000/  8M BW 0
Heap CTX Handle 0x03f0cd18, PA 0x03d00000/ 61M, Size 0x00880000/  8M BW 0
Heap XVD Handle 0x03f0d258, PA 0x04580000/ 69M, Size 0x01c80000/ 28M BW 0
Heap PBK Handle 0x03f0d798, PA 0x06200000/ 98M, Size 0x00e00000/ 14M BW 0
Heap SUB Handle 0x03f0dcd8, PA 0x07000000/112M, Size 0x00c80000/ 12M BW 0
Heap VDC Handle 0x03f0e218, PA 0x02500000/ 37M, Size 0x01800000/ 24M BW 1
Heap GPI Handle 0x03f0e758, PA 0x24a00000/586M, Size 0x00980000/  9M BW 0
Heap GFX Handle 0x03f0ec98, PA 0x25380000/595M, Size 0x0a500000/165M BW 0
Heap PIC Handle 0x03f0f1d8, PA 0x03d00000/ 61M, Size 0x03f80000/ 63M BW 1

### Null image pointer!!!
### 
Error in Opening the Image Interface for FW_ID =129 

### Null image pointer!!!
### 
Error in Opening the Image Interface for FW_ID =129 

### bdvd_audio_output_open_sound failed -- audio_output_settings.state != bdvd_audio_output_state_open

### bdvd_bmem_destroy_avc_heap: AVC 5.1 heap memory was not freed because it was never allocated!
config_SetHostsFile] Can't open /var/config/hosts@ END of bdvd_init()
[DRMKEY] Set Drm Key  : C5500
*bdvd_init(BDVD_VERSION) 0!
================================   * Model Name        :  C5500         
   * BDP SW Version   :  BSP-C5500WWB-1019 
================================enabling realtime scheduling
Osal_TaskSpawnParam:	VCTimerThread00, 48
Osal_ProtoTimerCreate - 0 Launched VCTimerThread00 with PID 67218704

##### FrontHal_StartInit #####
Gaal_GetSetupMenuParams: BD_setup.Resoultion = 1

Gaal_GetSetupMenuParams: BD_setup.HdmiResolution = 3

 [SystemHalIF_VideoOutInitialize] resolution = 1
VideoHalIF_GetVideoInfoData PictureCtrl:2, Sharp:0, NoiseReduc:0 
VideoHal_SetVideoMute : ========> 1 
VideoHalIF_GetVideoInfoData PictureCtrl:2, Sharp:0, NoiseReduc:0 
VideoDriver_GetPictureCtlParm : Basic(1), Picture Control(2):, Sharpness(0), NR(0),Contrast(10), Brightness(10),Color(10), StreamType(0) 
VideoDriver_GetPictureCtlParm : sharp(1):-14000, m_noise(1):-99, b_noise(1):-99, Contrast(0), Brightness(0),Color(0) 
VideoHal_SetPictureControl : Set Picture Control ==> 2 
VideoDriver_GetPictureCtlParm : Basic(1), Picture Control(2):, Sharpness(0), NR(0),Contrast(10), Brightness(10),Color(10), StreamType(0) 
VideoDriver_GetPictureCtlParm : sharp(1):-14000, m_noise(1):-99, b_noise(1):-99, Contrast(0), Brightness(0),Color(0) 
VideoHal_SetPictureControl : 0x2 
VideoHal_SetProgressiveMode - Level:0x2300, ThreshHold:0x1400 



  Set Macrovision :
 Scal 0 : 0 ,Scal 1 3: 


AudioHal_SetCopyRightToSpdif : AudioDriver_SetCopyRightToSpdif Error
	[pharos/src/Hal/Audio/AudioHal.c:405]
Spdif Copyright Setting failure



  Set Macrovision :
 Scal 0 : 0 ,Scal 1 0: 


AudioHal_SetCopyRightToSpdif : AudioDriver_SetCopyRightToSpdif Error
	[pharos/src/Hal/Audio/AudioHal.c:405]
Spdif Copyright Setting failure
Hdmi_IsWiseSyncSupport : ERROR. HDMI is not initiated 
	[pharos/src/Hal/Hdmi/Hdmi_Main.c:3382]
VideoHal_SetAspectRatio: VIDEOHALE_ASPECT_RATIO_16x9
[VideoHal_SetAspectRatio] 1995 :: aspect_ratio :: 1.. 
(!) DirectFB/Config: Unknown option '--dfb:mouse-source'!

       ---------------------- DirectFB v0.9.22 ---------------------
             (c) 2000-2002  convergence integrated media GmbH  
             (c) 2002-2004  convergence GmbH                   
        -----------------------------------------------------------

(*) DirectFB/Core: Single Application Core. (2010-10-28 13:08) 
(*) DirectFB/BCMCore/system_p_init: video memory size is 173014940
(*) DirectFB/BCMCore/system_p_init: using cached memory for surfaces, cache flush is required
bdvd_graphics: Doing HD full resolution graphics planes
bdvd_graphics: Doing HD full resolution graphics planes
(*) DirectFB/BCMCore/system_p_init: display is set to video_format 9
bdvd_graphics: Using Anisotropic filtering
(*) DirectFB/BCMCore/system_p_init: using mixer compositor for flip-blit
(*) DirectFB/BCMCore/system_p_init: Flip with do a forcefull DSFLIP_WAITFORSYNC
(*) DirectFB/BCMCore/system_p_init: using compositor M2MC for both mixer and driver
(*) DirectFB/BCMGfx/driver_init_driver: driver compositor area threshold is 0
(*) DirectFB/BCMGfx/driver_init_driver: surface memory will not be cleared
(*) DirectFB/Graphics: Broadcom Corporation BCM7438/xxxAPI 0.1 (Broadcom Corporation)
(*) VideoRamSize = 173014940
(*) DirectFB/BCMCore/BCMCoreInitLayer: output layer primary buffer mode is triple
(*) DirectFB/Core/WM: Default 0.2 (Convergence GmbH)
 (!!!)  *** UNIMPLEMENTED [fusion_reactor_set_lock] *** [reactor.c:802]
------------------- bdvd_audio_output_action_sound_buffer_available
SpeakerSettings.SpkCenter= 0
SpeakerSettings.SpkFront = 1
SpeakerSettings.SpkSurround = 0
SpeakerSettings.SpkSurroundBack = 0
SpeakerSettings.SpkWoofer = 4
[AudioDriver_SetSpeakerSettings] 1993 :: m_SpeakerSize.m_Left = size 2.
[AudioDriver_SetSpeakerSettings] 1994 :: m_SpeakerSize.m_Right = size 2.
[AudioDriver_SetSpeakerSettings] 1995 :: m_SpeakerSize.m_Center = size 0.
[AudioDriver_SetSpeakerSettings] 1996 :: m_SpeakerSize.m_LeftSurround = size 0.
[AudioDriver_SetSpeakerSettings] 1997 :: m_SpeakerSize.m_RightSurround = size 0.
[AudioDriver_SetSpeakerSettings] 1998 :: m_SpeakerSize.m_LFE = size 0.
[AudioDriver_SetSpeakerSettings] 1999 :: m_SpeakerSize.m_LeftBack = size 0.
[AudioDriver_SetSpeakerSettings] 2000 :: m_SpeakerSize.m_RightBack = size 0.

Now System initializing now

When you hit STRG+C right in the beginning, the you get a cfe-Console:

Code: Select all

BCM76300010
Setting NAND Params

CFE starting from ROM
Chip specific init
TLB init
Board init
Starting memory configuration
Extracting memory configuration info
Checking strap value
Setting up PLL
Enable DDR encryption
SooooooooooooooR
Preparing to copy code to RAM
Prepare for NAND loading


Starting code in RAM
Booting Secured CFE... 


BCM97630 B0-SEC  CFE v2.1.8 (CFE core v2.1, BSP_REV 8), Endian Mode: Little
Build Date: Wed Jan 20 19:46:20 KST 2010 (gyu@localhost.localdomain)
Copyright (C) Broadcom Corporation.



DDR                        : Bank0:128MB@667MHz | Bank1:256MB@667MHz 
NAND Boot                  : FlashSize 256MB on CS0, BlkSize 128KB, PgSize 2048B
NAND vendor timing         : 20da1095 Numonyx NAND02GW3B2D/ST NAND02GW3B SLC  t1(33535238) t2(80000b78)
Secure boot                : Enabled

Reading flash0.macadr to V:0x87917b80 
Reading flash0.rawnvr to V:0x8709275c 
booting ARM...
Reading flash0.ofefw0 to V:0x80000000 from offset 0 len 786432 
Reading flash0.ofews to V:0x800c0000 from offset 0 len 32768 
Reading flash0.ofews1 to V:0x800c8000 from offset 0 len 32768 
booting ARM...ofefw@0x2fd00000 
done 
check service mode

Automatic startup canceled via Ctrl-C
CFE>

entering "help" gives you a list of available commands:

Code: Select all

CFE> help
Available commands:

info                Show CFE configuration information
splashsd            Load's and Display's yuv:422 Splash Screen image
splash              Load's and Display's yuv:422 Splash Screen image
loop                Loop a command
dir                 List the directory of a FAT file system
macprog             Program MAC addresses.
macprog2            Program a specific MAC address.
envwrite            Program a env.
macwrite            Program a specific MAC address & model
bsound              play the audio boot sound
bsplash             Load's and Display's yuv:422 Splash Screen image
flashmarkbb         Marks a specified block bad 
flasherase          Erases a flash partition
flasheeprom         Update the EEPROM device on board
flash               Update a flash memory device
memtest             Test memory.
f                   Fill contents of memory.
e                   Modify contents of memory.
d                   Dump memory.
u                   Disassemble instructions.
reboot              Invoke hardware reboot.
batch               Load a batch file into memory and execute it
go                  Start a previously loaded program.
load                Load an executable file into memory without executing it
save                Save a region of memory to a remote file via TFTP
boot                Load an executable file into memory and execute it
ping                Ping a remote IP host.
ifconfig            Configure the Ethernet interface
sleep               Sleep for specified milliseconds.
show heap           Display information about CFE's heap
show memory         Display the system physical memory map.
show devices        Display information about the installed devices.
unsetenv            Delete an environment variable.
printenv            Display the environment variables
setenv              Set an environment variable.
help                Obtain help for CFE commands

For more information about a command, enter 'help command-name'
*** command status = 0

"printenv" gives you the personal device-information (MAC-Adress Xed):

Code: Select all

CFE> printenv
Variable Name        Value
-------------------- --------------------------------------------------
        BOOT_CONSOLE uart0
         ETH0_HWADDR 00:23:99:XX:XX:XX
         CFE_VERSION 2.1.8
       CFE_BOARDNAME BCM97630 B0-SEC
      CFE_MEMORYSIZE 128
            BD_MODEL C5500-XAA
             STARTUP bsplash;bsound;boot -elf -z flash0.kernel: 'root=/dev/romblock2 console=0,115200n8 BDVD_BOOT_AUTOSTART=y BAPP_OUT=/dev/console memcfg=384 ro'
*** command status = 0

When you hit STRG+C after the CFE initializes, you get a linux console prompt, which ask you for a login:

Using "root" as username and "tkfkddlf" as password you get access to the console

Further information of how to dump flash contents can be read here, as the LG560/570 is based on the same processor.

http://bd560.000space.com/index.html

and the Samsung BD-P1620 has been hacked in the same way:

http://www.avforums.com/forums/blu-ray- ... p3600.html

Unfortunately LG has a different flash-Layout, so the firmwares are not interchangeable. So be careful what you do.

It would be nice, if someone who has a european version of this player could post the bootlogs, to see what is different.

So maybe I could manage to switch it to an european model...

Thanke

habee

[habee]

Here is the content of /etc/init.d/rcS:

Code: Select all

#! /bin/sh
#########################################################################
#  Copyright (c) 2006-2010, Broadcom Corporation
#  All Rights Reserved
#  Confidential Property of Broadcom Corporation
#
#  THIS SOFTWARE MAY ONLY BE USED SUBJECT TO AN EXECUTED SOFTWARE LICENSE
#  AGREEMENT  BETWEEN THE USER AND BROADCOM.  YOU HAVE NO RIGHT TO USE OR
#  EXPLOIT THIS MATERIAL EXCEPT SUBJECT TO THE TERMS OF SUCH AN AGREEMENT.
#
# bdvd_rootfs_prep.pl Version 5
#
#########################################################################


####vvvv####vvvv#################################################
# BRCM VARIABLES THAT CAN BE SET ON BOOT PARAM LINE
####vvvv####vvvv#########################################vvvv####
#
# BDVD_BOOT_AUTOSTART 
#    This is more of a "mode" than a variable setting. When 
#    set to 'y', it directs this script to go into "production"
#    mode settings.  See the actual code below for what the
#    actual settings are.  Note that this "mode" will not 
#    set any variable that already has a non-null value.
#
# BQ
#    BQ is an acronym for 'Broadcom Quiet'.  When set to 'y'
#    it squelches most of the console output from this script.
#    Note that if you want the Linux kernel to be quiet, you 
#    should specify  'quiet' on the boot line.  
#
# BNET 
#    If this is set to a 'y', the network will be brought up.
#
# BNET_DLY
#    Delays the network bringup by ${BNET_DLY} seconds. If
#    not set, there is no delay.
#
# BAPP  
#    Specifies a program to run at the end of this script.
#    If BAPP is null, no program is started.
#
# BAPP_OUT 
#    Specifies a file to store the Application output, both
#    stdout and stderr.  By default, ${BAPP} output will be 
#    redirected to /tmp/app.out.
#
# OFE_SB
#    If this is not set to 'n', the 7620 Sideband Protocol
#    application "app_ofe_sb" will be started in the
#    background.
#
# Size of /var tmpfs file system, in kbytes.
# BTMPFS_SIZE=384  - original
BTMPFS_SIZE=640
#
# Size allocated for syslogd log, in kbyptes.  Must be a good
# deal less than BTMPFS_SIZE.
BDEVLOG_SIZE=64
####^^^^####^^^^####



####vvvv####vvvv#################################################
# BDVD_BOOT_AUTOSTART mode settings.
####vvvv####vvvv#########################################vvvv####
#
if [ "y" = "${BDVD_BOOT_AUTOSTART}" ] ; then
  [ "${BAPP}" ]     || BAPP=./app_player
  [ "${BQ}"   ]     || BQ=y
  [ "${BLOG}"   ]   || BLOG=n
  [ "${BNET_DLY}" ] || BNET_DLY=0
  [ "${BAPP_OUT}" ] || BAPP_OUT=/dev/null
  [ "${OFE_SB}" ] || OFE_SB=n
fi
[ "${BAPP_OUT}" ]   || BAPP_OUT=/tmp/app.out
[ "$BQ" != "y" ] && BQ=
#
echo "rcS: BDVD_BOOT_AUTOSTART<$BDVD_BOOT_AUTOSTART>  BQ<$BQ>  BAPP<$BAPP>  BAPP_OUT<$BAPP_OUT>  BNET<$BNET>  BNET_DLY<$BNET_DLY> OFE_SB<$OFE_SB>"
[ "$BQ" ] || echo "rcS: Starting at `date`"
#
####^^^^####^^^^####



####vvvv####vvvv#################################################
# VARIABLES
####vvvv####vvvv#########################################vvvv####
export PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin
export LD_LIBRARY_PATH=/usr/local/lib:/lib:/usr/lib
export CSD_01=y  # historical artifact of app_player
BDVD_PSTOR_DIR=/mnt/pstor
BDVD_PSNV_DIR=/mnt/psnv
########/*PKG56 Ref add*/
export FONTCONFIG_FILE=/usr/local/etc/fonts/fonts.conf
export DFBARGS="--dfb:mouse-source=/dev/input/mice --dfb:motion-compression --dfb:mouse-protocol=MS3"
####^^^^####^^^^####



####vvvv####vvvv#################################################
# Mounts, set BDVD_ROOT_ATTR
####vvvv####vvvv#########################################vvvv####
#
# Mount /proc.
[ "$BQ" ] || echo "rcS: Mount /proc fs"
mount -t proc none /proc
# This gets the root mount attribute (eg 'ro', 'rw').
BDVD_ROOT_ATTR=`awk '$1 == "/dev/root" { print $4 }' /proc/mounts`
# Mount /dev/pts.
[ "$BQ" ] || echo "rcS: Mount /dev/pts"
mount -t devpts none /dev/pts
# Now allow user interrupt
# stty brkint

#bozlo.add 091003
#Mount /sys
[ "$BQ" ] || echo "rcS: Mount /sys fs"
mount -t sysfs none /sys
####^^^^####^^^^####



####vvvv####vvvv#################################################
# Mount the player settings partition from flash and the
# persistent storage directory as soon as possible.
#
# PSTOR CAN TAKE A LONG TIME TO MOUNT (15 - 20 seconds) !!
# LAUNCH THE MOUNT COMMAND IN THE BACKGROUND AND DO NOT
# WAIT FOR IT HERE. THE APPLICATION WILL SYNC TO THE MOUNT
# WHEN THE PSTOR DIRECTORIES ARE REQUIRED. ASSUME THAT PSTOR
# IS YAFFS2.
#
####vvvv####vvvv#########################################vvvv####

mount -t yaffs2 /dev/mtdblock20 /mnt/pstor

# <<<<< Added by draco.lee for widget temporily
mount -t yaffs2 /dev/mtdblock19 /mtd_down


##vv PR_6394 vv##
#mkdir -p ${BDVD_PSTOR_DIR}/etc
#mkdir -p ${BDVD_PSTOR_DIR}/ps
#mkdir -p ${BDVD_PSTOR_DIR}/bd_vfs/lstor
#mkdir -p ${BDVD_PSTOR_DIR}/bd_vfs/bd_lstor
#mkdir -p ${BDVD_PSTOR_DIR}/bd_vfs/bd_pstor  
#mkdir -p ${BDVD_PSTOR_DIR}/bd_vfs/mnt/vfs_a
#mkdir -p ${BDVD_PSTOR_DIR}/bd_vfs/mnt/vfs_b
##^^ PR_6394 ^^##


# <<<<< Added by htkwak for BD-J tango 2008-10-17
#mkdir -p ${BDVD_PSTOR_DIR}/PST
mkdir -p ${BDVD_PSTOR_DIR}/ramJava
# Added by htkwak for BD-J tango >>>>>

mkdir -p ${BDVD_PSTOR_DIR}/mtd_rwarea 
# Added by draco.lee for widget

####vvvv####vvvv#################################################
# Creation of tmpfs, mount of /tmp
####vvvv####vvvv#########################################vvvv####
# This is the strategy: /var is mounted on a tmpfs.  Nothing
# stored under it will persist after a reboot.  /tmp will be a
# symlink to /var/tmp.  Note: If you would like to have some
# type of persistance for the files in /var (or /tmp), you must
# you must set up a daemon that periodically copies files 
# and/or directoriess from /var to ${BDVD_PSTOR_DIR}.  
#
# Similarly, at boot, /etc is copied to /var/etc, and /var/etc
# is mounted on top of /etc.  Anything stored in /etc will not
# be persistant across boots unless externally preserved.
####vvvv####vvvv#########################################vvvv####
[ "ro" != "${BDVD_ROOT_ATTR}" -a -d /var ] && rm -fr /var/*
cd /
[ "$BQ" ] || echo "rcS: Mounting /var (tmpfs)."
mount -t tmpfs -o size=${BTMPFS_SIZE}k  none /var  
mkdir -p /var/run /var/log /var/tmp /var/lock
[ -d /tmp ] && rm -fr /tmp/*
# Mount /tmp as subdir of /var
    mount -o bind /var/tmp /tmp  
# Mount /etc as subdir of /var
if [ "ro" == "${BDVD_ROOT_ATTR}" ] ; then
  cp -af /etc /var/etc
  mount -o bind /var/etc /etc
fi
####^^^^####^^^^####

# set real time scheduling limit to the max

if [ -f /proc/sys/kernel/sched_rt_period_us ]; then
    cat /proc/sys/kernel/sched_rt_period_us > /proc/sys/kernel/sched_rt_runtime_us
fi

####vvvv####vvvv#################################################
# Clean up utmp/wtmp, start system logging.
####vvvv####vvvv#########################################vvvv####
[ "$BQ" ] || echo "rcS: Init of utmp and wtmp, start of syslogd."
> /var/run/utmp
> /var/log/wtmp
chgrp utmp /var/run/utmp /var/log/wtmp
chmod 0664 /var/run/utmp /var/log/wtmp
if [ "ro" = "${BDVD_ROOT_ATTR}" ] ; then 
  # Note: Syslog size must be smaller than tmpfs size.  The 
  #       number specified with -s is in kbytes.  
  syslogd -s ${BDEVLOG_SIZE} &  
else
  syslogd &
fi
####^^^^####^^^^####



############################################################
# Ensure that our current date is not older than an arbitrary
# recent date (Jun 11,2008).
# This snippet should be placed in /etc/init.d/rcS.
####vvvv####vvvv####vvvv####vvvv####vvvv####vvvv####vvvv####
if [ `date +%s` -lt 1213142525 ] ; then 
  date 061100002008
fi
####^^^^####^^^^####



####vvvv####vvvv#################################################
# Added by bozlo for Widget
####vvvv####vvvv#########################################vvvv####
export MAPLE_DATA_PATH=/usr/local/bin/widget
export MAPLE_DEFAULT_PATH=/usr/local/lib
export MAPLE_MANAGER_WIDGET_PATH=/mtd_down/widgets/manager
export MAPLE_NORMAL_WIDGET_PATH=/mtd_down/widgets/normal
export MAPLE_WIDGET_DATA_PATH=/mtd_down
export MAPLE_WIDGET_INCLUDE_PATH=/mtd_down/widgets/inc
export MAPLE_PLUGIN_DATA_PATH=/usr/local/lib

#by gyu
#export bdvd_heap_alloc_trace=1
####vvvv####vvvv#################################################
# Insmods go here.  Insmods may also be invoked in /root/rc.user.
####vvvv####vvvv#########################################vvvv####
[ "$BQ" ] || echo "rcS: Beg of insmod"
#D_DRIVERS=/lib/modules/`uname -r`/kernel/drivers
#insmod $D_DRIVERS/cdrom/cdrom.ko
#insmod $D_DRIVERS/scsi/scsi_mod.ko
#insmod $D_DRIVERS/scsi/libata.ko
#insmod $D_DRIVERS/scsi/sata_svw.ko
#insmod $D_DRIVERS/scsi/sg.ko
#insmod $D_DRIVERS/scsi/ide-scsi.ko
#insmod $D_DRIVERS/scsi/sr_mod.ko
#insmod $D_DRIVERS/scsi/sd_mod.ko

#sync; echo 3 > /proc/sys/vm/drop_caches
#sync; echo 4096 > /proc/sys/vm/min_free_kbytes

insmod front.ko
insmod rt3572sta.ko
insmod usbabs.ko 
insmod wl.ko 
insmod /lib/modules/bcmdriver.*o || insmod /usr/local/lib/modules/bcmdriver.*o 
[ "$BQ" ] || echo "rcS: End of insmod list"
####^^^^####^^^^####

#JHY : using the cache at loader
echo 1 >> /proc/readahead/sr0

export MSG_MODULE="ALL"
export ERR_MODULE="ALL"

ulimit -s 1024

echo 256 256 > /proc/sys/vm/lowmem_reserve_ratio
echo 3 > /proc/sys/vm/drop_caches
echo 2048 > /proc/sys/vm/min_free_kbytes
echo 100000 > /proc/sys/vm/vfs_cache_pressure
echo 1 > /proc/sys/vm/overcommit_memory



 
####vvvv####vvvv#################################################
# BDVD DHCPCD FUNCTION
####vvvv####vvvv#########################################vvvv####
bdvd_dhcpcd()
{
    [ "${BNET_DLY}" ] && sleep $BNET_DLY
    [ "$BQ" ] || echo "rcS: dhcpcd -t 300 -Hd $1 &"
    # The option '-t 300' gives the user 5 minutes to connect the ethernet.
    dhcpcd -t 300 -Hd $1 
    sleep 2               
    [ "$BQ" ] || echo "rcS: portmap &"
    portmap &
}



####vvvv####vvvv#################################################
# BDVD NETUP FUNCTION
####vvvv####vvvv#########################################vvvv####
bdvd_net_up()
{
    [ "$BQ" ] || echo "rcS: Starting NFS/net."
    # If we boot from NFS, then we don't need the Network, use whatever
    # was set up by NFS, otherwise look at the kernel parameter 
    # network=<device>,<ip>
    #
    if [ -z "`cat /proc/mounts |grep /dev/root |grep '\<nfs\>'`" ]; then
        if [ -z "$netconf" ]; then
            ifconfig lo 127.0.0.1 netmask 255.0.0.0
            rm -f /etc/resolv.conf
            if [ -f /var/run/dhcpcd-eth0.pid ]; then
                rm -f /var/run/dhcpcd-eth0.pid
            fi
            [ "$BQ" ] || echo 'rcS: bdvd_dhcpcd eth0 &'
            bdvd_dhcpcd eth0 & 
        else
            netdev=`echo "$netconf" | cut -f1 -d','`
            ip=`echo "$netconf" | cut -f2 -d','`

            case "$ip" in
              none)
                  echo "rcS: Network not started"
                  ;;
              dhcp)
                  ifconfig lo 127.0.0.1 netmask 255.0.0.0
                  rm -f /etc/resolv.conf
                  if [ -f /var/run/dhcpcd-${netdev}.pid ]; then
                      rm -f /var/run/dhcpcd-${netdev}.pid
                  fi
                  [ "$BQ" ] || echo "rcS: bdvd_dhcpcd $netdev &"
                  bdvd_dhcpcd "$netdev" &
                  ;;
  
              *)  # If the user specifies the wrong syntax, there is not much we can do
                  ipaddr=`echo "$ip" | cut -f1 -d':'`
                  netmask=`echo "$ip" | cut -f2 -d':'`
                  echo "rcS: ifconfig $netdev $ipaddr netmask $netmask up"
                  ifconfig "$netdev" "$ipaddr" netmask "$netmask" up
                  ifconfig lo 127.0.0.1 netmask 255.0.0.0
                  ;;
            esac
        fi
    else
        [ "$BQ" ] || echo "rcS: NFS is up, no need to start network"
        # Just add the loopback config
        ifconfig lo 127.0.0.1 netmask 255.0.0.0
        [ "$BQ" ] || echo "rcS: portmap &"
        portmap &
    fi
}



####vvvv####vvvv#################################################
# Connect to the net and start net services.
####vvvv####vvvv#########################################vvvv####
[ "y" = "${BNET}" ] && bdvd_net_up
####^^^^####^^^^####


####vvvv####vvvv#################################################
# Final steps
####vvvv####vvvv#########################################vvvv####
cd /usr/local/bin  || echo "rcS: ERROR: could not chdir to /usr/local/bin!"

if [ -f bdvd_custom_target_prep.sh ] ; then
    # This file, if present, is generated automatically when
    # 'make bdvd_target_tarball_new' is invoked in the build.
    # It combines the commands of all custom shell files.
    [ "$BQ" ] || echo "rcS: source bdvd_custom_target_prep.sh"
    . bdvd_custom_target_prep.sh
else 
    echo "rcS: WARNING: could not chdir find 'bdvd_custom_target_prep.sh'."
fi

# Invoke user script.
if [ -f /root/rc.user ]; then
    [ "$BQ" ] || echo "rcS: Source /root/rc.user."
    . /root/rc.user
fi
#
if [ "" != "${BAPP}" ] ; then
    # BAPP_OUT == Broadcom APplication Output 
    [ "${BAPP_OUT}" ] || BAPP_OUT="/dev/null"

    [ "$BQ" ] || echo "rcS: [ ${BAPP:-./app_player} > $BAPP_OUT 2>&1 & ] at `date`"

# core dump =================================================================
#ulimit -c unlimited
#echo "/mnt/usbremovable/usba/sda1/core_%t" > /proc/sys/kernel/core_pattern
=================================================================
#by bozlo
	if [ "y" = "${CORE_DUMP}" ]; then
		ulimit -c unlimited
		/sbin/utelnetd -d
		echo "Debug version start by bozlo"
		echo "/mnt/pstor/bd_vfs/lstor/core_%t" > /proc/sys/kernel/core_pattern
	fi

#TEST_SONG for csp_333733
#export msg_modules=BGRC

echo "app_player START"
cat /proc/uptime

    if [ "/dev/console" = "$BAPP_OUT" ] ; then
      if [ "n" == "${BLOG}" ] ; then
        ${BAPP:-./app_player} < /dev/console > /dev/console 2>&1
      else
        ${BAPP:-./app_player} < /dev/console 2>&1 | app_syslog
      fi
    else 
      # Note: You will still get a login prompt by putting app_player in the background.
      #       If you don't want this, don't put it in the background, and put 
      #       error-recover code immediately after (e.g. restart or reboot, etc).
      ${BAPP:-./app_player} > $BAPP_OUT  2>&1 &
    fi
fi

cat /proc/uptime
echo " app_player END"

[ "$BQ" ] || echo "rcS: Exiting at `date`"
####^^^^####^^^^####

The main problem to get a permanent telnet access is, that every change in the filesystem will not survive a reboot:

Code: Select all

####vvvv####vvvv#################################################
# Creation of tmpfs, mount of /tmp
####vvvv####vvvv#########################################vvvv####
# This is the strategy: /var is mounted on a tmpfs.  Nothing
# stored under it will persist after a reboot.  /tmp will be a
# symlink to /var/tmp.  Note: If you would like to have some
# type of persistance for the files in /var (or /tmp), you must
# you must set up a daemon that periodically copies files 
# and/or directoriess from /var to ${BDVD_PSTOR_DIR}.  
#
# Similarly, at boot, /etc is copied to /var/etc, and /var/etc
# is mounted on top of /etc.  Anything stored in /etc will not
# be persistant across boots unless externally preserved.
####vvvv####vvvv#########################################vvvv####

A script /root/rc.user will be executed at boot time if it is there:

Code: Select all

# Invoke user script.
if [ -f /root/rc.user ]; then
    [ "$BQ" ] || echo "rcS: Source /root/rc.user."
    . /root/rc.user
fi

but unfortunately I cannot save it due to readonly filesystem...

Any hints?

[habee]

Getting access to the serial console is the starting point for hacking of almost every linux-based embedded device.

Things you should start with if you are really interested in hacking you C-8200:

1. Try to find a service manual for the device itself or a similar one (with almost the same features)
2. Open your device and look what?s inside. Make high quality pictures of mainboard, main processor and describing texts.
3. Try to find RX/TX for the serial console. Almost every embedded processor has a serial console for debug processes. Often you can stop the boot process by hitting STRG+C in a terminal program like PUTTY or Hyperterminal. A nice explanation of how to build a cable is here http://www.nslu2-linux.org/wiki/HowTo/AddASerialPort
4. When you have access to the console you can dump the firmware for further modification or investigation. So for instance you can enable telnet for easier access over a network. Or enable things which are made for higher priced models

Right now (thanks to piorun from avsforum) I have managed to dump the Firmware and boot the player from the network using an nfs-mounted rootfs. So i can now safely edit files in the rootfs and see what happens.

Bye

habee

[habee]

Be careful with the "envwrite"-command. I ended up with a Model-CODE "UNKNOWN" and a deleted STARTUP-Variable, which leads to that the device stops at the CFE-Prompt.
Fortunately I had logs of what I did, so i could restore the STARTUP-Variable.

Code: Select all

Variable Name        Value
-------------------- --------------------------------------------------
        BOOT_CONSOLE uart0
         ETH0_HWADDR 00:23:99:XX:XX:XX
         CFE_VERSION 2.1.8
       CFE_BOARDNAME BCM97630 B0-SEC
      CFE_MEMORYSIZE 128
            BD_MODEL UNKNOWN-UNKNOWN
             STARTUP bsplash;bsound;boot -elf -z flash0.kernel: 'root=/dev/romblock2 console=0,115200n8 BDVD_BOOT_AUTOSTART=y BAPP_OUT=/dev/console memcfg=384 ro'
*** command status = 0

The Variable "BD-MODEL" is read only, so you cannot change it using the envwrite-command.

Code: Select all

CFE> setenv BD_MODEL C5500-XAA
Could not set environment variable 'BD_MODEL': Environment variable is read-only

I think that you could program the variable with the macwrite-command:

I successfully restored my BD_MODEL-variable with the following command:

Code: Select all

macwrite 00-23-99-XX-XX-XX 5151

The "5151" is a model-code, which is mandatory for the macwrite-command. I have no idea what the other model-codes sould be:

Code: Select all

CFE>help macwrite

 SUMMARY

     Program a specific MAC address & model

  USAGE

     macwrite <macaddress> <ModelCode>
     
     This command programs board specific MAC addresses & model 
     to the flash. (ex. macwrite 00-60-6E-70-0D-A2 5151)

But if you want to change your C5300 to a C5500 you should take a closer look to the Service-Manual on Page 7-15 (7-12 Front Micom (Main PCB)) and on the Mainboard of your C-5300.
If you are good in SMD-Soldering, you could try to change the SMD-Resistors, so that they fit the C-5500-Layout.

Here?s a picture:



Uploaded with ImageShack.us

I suppose that on your Model the resistors are set on R148 and R212. So changing the Resistor from R148 on R147 would probably enable the missing DLNA-Feature.

But first I am very interested in your firmware dumps (before you broke your player ... )

Here?s what you should do when you have your serial-cable ready and access to the cfe-prompt.

1. Get access to CFE-Prompt by pressing CTRL+C at boot

2. Start player in single mode with the command "boot -elf -z flash0.kernel: 'root=/dev/romblock2 console=0,115200n8 BDVD_BOOT_AUTOSTART=y BAPP_OUT=/dev/console memcfg=384 single ro'

3. You shoul get a prompt #

4. mount the mtd-filesystem with the command "mount -t proc none /proc"

5. Make sure that it is mounted correct wiht the command "cat /proc/mtd", it should look like this

Code: Select all

# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00100000 00020000 "cfe"
mtd1: 00500000 00020000 "kernel"
mtd2: 04000000 00020000 "rootfs"
mtd3: 00200000 00020000 "ofefw0"
mtd4: 00200000 00020000 "splash"
mtd5: 00200000 00020000 "splashS"
mtd6: 00200000 00020000 "splashU"
mtd7: 00200000 00020000 "bootsound"
mtd8: 00080000 00020000 "macadr"
mtd9: 00080000 00020000 "nvram"
mtd10: 00080000 00020000 "rawnvr"
mtd11: 00080000 00020000 "drmregion"
mtd12: 00080000 00020000 "drmregion1"
mtd13: 00080000 00020000 "ofews"
mtd14: 00080000 00020000 "ofews1"
mtd15: 00f00000 00020000 "tmp"
mtd16: 00500000 00020000 "kernel1"
mtd17: 04000000 00020000 "rootfs1"
mtd18: 00200000 00020000 "ofefw1"
mtd19: 05000000 00020000 "widget"
mtd20: 00580000 00020000 "pstor"
mtd21: 10000000 00020000 "all"

5. attach a FAT32-USB-Stick, wait for the Message which comes up

Code: Select all

# [4294750.982000] scsi 1:0:0:0: Direct-Access     SanDisk  U3 Cruzer Micro  2.18 PQ: 0 ANSI: 2
[4294750.993000] sd 1:0:0:0: [sda] 2006673 512-byte hardware sectors: (1.02 GB/979 MiB)
[4294751.001000] sd 1:0:0:0: [sda] Write Protect is off
[4294751.006000] sd 1:0:0:0: [sda] Assuming drive cache: write through
[4294751.015000] sd 1:0:0:0: [sda] 2006673 512-byte hardware sectors: (1.02 GB/979 MiB)
[4294751.024000] sd 1:0:0:0: [sda] Write Protect is off
[4294751.029000] sd 1:0:0:0: [sda] Assuming drive cache: write through
[4294751.040000] sd 1:0:0:0: [sda] Attached SCSI removable disk
[4294751.046000] sd 1:0:0:0: Attached scsi generic sg1 type 0

6. mount USB-stick with the command "mount /dev/sda1 /var"

7. cd to /var with the command "cd /var"

8. dump MTD with entering the following command

Code: Select all

for n in `seq 0 21`; do nanddump -f mtd$n.dump /dev/mtd$n; done

on the console

9. wait until you get a prompt

10. turn off Player and detach USB. There should be mt0.dump to mtd21.dump on it

Store it in a safe place, as you might could restore the player with this.

mtd0 holds the cfe
mtd1 holds kernel.gz
mtd2 holds rootfs (squashfs)

Thanks

habee (btw, I am german...)

[habee]

I have a bd-c6900 with internet@tv. I tried to root it with the same approach as for C650 tv set but it failed.

Any idea what happens ? What is the mount point in the root file system of the usb stick ?

Is the usb-stick read-only, when it gets mounted ?

This is the info from the serial console when you connect a USB-Device:

Code: Select all

>>>@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
The Size of USB Device List (App) = 1
	Device Type = MSC Device
	Device ID = 0
	Device model = U3 Cruzer Micro
	Device vendor = SanDisk
		Partition ID = 0
		Scsi Device Path = /dev/sda1
		Partition Path = /mnt/usbremovable/usba/sda1
		Partition FS = vfat
		Partition Serial = 0000060435072162
		Partition Devpath = 
		Partition Lun = 00
		Capacity = [618168/999208]
		Storage ID = 0x0
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@<<<

So the path is different from the one used in the C650.

This is the output of ls -all on the console:

Code: Select all

ls -all
drwxr-xr-x   20 root     root          363 Oct 28  2010 .
drwxr-xr-x   20 root     root          363 Oct 28  2010 ..
drwxr-xr-x    2 root     root         1529 Apr 17  2010 bin
drwxr-xr-x    3 root     root         3996 Oct 28  2010 dev
lrwxrwxrwx    1 root     root            8 Oct 28  2010 dtv -> etc/dtv/
drwxr-xr-x    9 root     root          480 Oct 28  2010 etc
-rw-r--r--    1 root     root       143360 Apr 17  2010 etc.img
-rwxr-xr-x    1 root     root        25311 May 12  2010 front.ko
drwxr-xr-x    2 root     root            3 Apr 17  2010 home
-rwxr-xr-x    1 root     root         6349 Apr 17  2010 init
drwxr-xr-x    4 root     root         1053 Oct 28  2010 lib
lrwxrwxrwx    1 root     root           11 Oct 28  2010 linuxrc -> bin/busybox
drwxr-xr-x   11 root     root          142 Oct 28  2010 mnt
drwxr-xr-x    4 root     root           69 Jul  2  2010 mtd_appdata
drwxr-xr-x    3 root     root           25 Apr 17  2010 mtd_cmmlib
drwxr-xr-x    2 root     root            3 Apr 17  2010 mtd_contents
drw-rw-rw-    1 root     root         2048 Jan  1 00:00 mtd_down
drwxr-xr-x    3 root     root           25 Apr 17  2010 mtd_rocommon
lrwxrwxrwx    1 root     root           20 Oct 28  2010 mtd_rwarea -> mnt/pstor/mtd_rwarea
dr-xr-xr-x   38 root     root            0 Jan  1 00:00 proc
drwxr-xr-x    2 root     root            3 Oct 12  2010 root
-rw-r--r--    1 root     root      1279052 May 12  2010 rt3572sta.ko
drwxr-xr-x    2 root     root          248 Apr 17  2010 sbin
drwxr-xr-x    2 root     root            3 Apr 17  2010 share
drwxr-xr-x   12 root     root            0 Jan  1 00:00 sys
lrwxrwxrwx    1 root     root            7 Oct 28  2010 tmp -> var/tmp
-rw-r--r--    1 root     root         5080 May 12  2010 usbabs.ko
drwxr-xr-x   10 root     root          103 Oct 28  2010 usr
drwxrwxrwt    7 root     root          140 Jan  1 00:14 var
-rwxr--r--    1 root     root      1494571 Aug 30  2010 wl.ko

The directory "lrwxrwxrwx 1 root root 20 Oct 28 2010 mtd_rwarea -> mnt/pstor/mtd_rwarea" is writeable and persistent.

I did not yet figured out if there is a possibility to automatically run files from an usb-stick.

this is the content of mtd_rwarea:

Code: Select all

# cd mtd_rwarea/
# ls
cookie.info  remote.info  vudu