|
Top-level
 3. The buffer in the HTML file had to be written without using a zero byte, and someone wrote a ARM assembler loop that would just write data to memory. We had a rough idea what SoC was in there, so we knew a little of what to try. 4. Eventually, one day, that operation made the LCD backlight blink! The LCD controller was found in memory. (..) 6 comments
7. The initial bootloader to load Rockbox was then just such a crafted HTML file that would load the correct firmware, and since it still worked after reboots it was a pretty neat hack. 8. Eventually the encryption key for the bootloader was found in the SRAM of the running device, and we could encrypt and create custom "real" bootloaders for the devices. 9. Rockbox would then boot and run natively on ipods. The rest is history.    @bagder I loved Rockbox. I had an iPod Mini (found discarded in a house move) and put Rockbox on it in preference to entering the iTunes ecosystem. I configured the clickwheel so a long press Up would toggle "shuffle all". I could navigate to any album/track by doing this, hitting Next until I reached the right album, turning off shuffle and then Next/Back to get to the start of the album or the desired track. All with one hand and keeping my eyes and attention on the road. Not possible with touchscreen UIs!  |
Gregory's Server
5. Now the exploit was rewritten to read memory, and *blink* out the contents using the LCD backlight. A LEGO construction was built and a webcam would register the binary stream of a few megabytes of memory contents. Slooooow.
6. Using this method, the USB controller memory mapped registers were found and it was similar to another device Rockbox did USB on. The memory-dump code was rewritten to instead dump the entire memory over USB.
(...)