Information/MIPSelBootLoader - Revision history

220.253.85.152 at 15:14, 15 February 2007

220.253.85.152 — Thu, 15 Feb 2007 15:14:28 GMT

← Older revision		Revision as of 15:14, 15 February 2007
Line 18:		Line 18:
	\|style="background:#CCCCCC; color:green"\| '''description'''		\|style="background:#CCCCCC; color:green"\| '''description'''
	\|-		\|-
-	\| 0 \|\| 4 \|\|\| Product ID (value=6)	+	\| 0x00 \|\| 0x04 \|\|\| Product ID (value=6)
	\|-		\|-
-	\| 4 \|\| 0x10 \|\|\| Header key	+	\| 0x04 \|\| 0x10 \|\|\| Header key
	\|-		\|-
	\| 0x14 \|\| 0x58 \|\|\| Crypted header		\| 0x14 \|\| 0x58 \|\|\| Crypted header
Line 26:		Line 26:
	\| 0x14 \|\| 0x20 \|\|\| Label ("HD-HLAN(IENOBU)")		\| 0x14 \|\| 0x20 \|\|\| Label ("HD-HLAN(IENOBU)")
	\|-		\|-
-	\| 0x34 \|\| 2 \|\|\| ~~release major~~ (value=2)	+	\| 0x34 \|\| 0x01 \|\|\| Firmware version (value=2)
	\|-		\|-
-	\| ~~0x36~~ \|\| 2 \|\|\| release ~~minor (value=2 or 3)~~	+	\| 0x35 \|\| 0x01 \|\|\| Firmware release major
	\|-		\|-
-	\| ~~0x38~~ \|\| ~~0x10~~ \|\|\| ~~flash label ("FLASH 1.0" or "FLASH 1.1")~~	+	\| 0x36 \|\| 0x01 \|\|\| Firmware release minor
	\|-		\|-
-	\| ~~0x48~~ \|\| ~~0x08~~ \|\|\| ??	+	\| 0x37 \|\| 0x01 \|\|\| Reserved
	\|-		\|-
-	\| ~~0x50~~ \|\| ~~0x04~~ \|\|\| ~~compressed length~~	+	\| 0x38 \|\| 0x10 \|\|\| Flash label ("FLASH 1.0" or "FLASH 1.1")
	\|-		\|-
-	\| ~~0x54~~ \|\| ~~0x04~~ \|\|\| ~~compressed offset (0x70)~~	+	\| 0x48 \|\| 0x02 \|\|\| Build year
	\|-		\|-
-	\| ~~0x58~~ \|\| ~~0x04~~ \|\|\| ~~compressed part checksum~~	+	\| 0x4a \|\| 0x01 \|\|\| Build month
	\|-		\|-
-	\| ~~0x5c~~ \|\| ~~0x10~~ \|\|\| ~~compressed part key~~	+	\| 0x4b \|\| 0x01 \|\|\| Build day
	\|-		\|-
-	\| ~~0x6c~~ \|\| ~~0x04~~ \|\|\| ~~unencrypted null~~	+	\| 0x4c \|\| 0x01 \|\|\| Reserved
	\|-		\|-
-	\| 0x70 \|\| var \|\|\| ~~crypted~~/BZiped kernel~~+ramdisk~~	+	\| 0x4d \|\| 0x01 \|\|\| Build hour
		+	\|-
		+	\| 0x4e \|\| 0x01 \|\|\| Build minute
		+	\|-
		+	\| 0x4f \|\| 0x01 \|\|\| Build second
		+	\|-
		+	\| 0x50 \|\| 0x04 \|\|\| Compressed length
		+	\|-
		+	\| 0x54 \|\| 0x04 \|\|\| Compressed offset (0x70)
		+	\|-
		+	\| 0x58 \|\| 0x04 \|\|\| Compressed part checksum
		+	\|-
		+	\| 0x5c \|\| 0x10 \|\|\| Compressed part key
		+	\|-
		+	\| 0x6c \|\| 0x04 \|\|\| Unencrypted null
		+	\|-
		+	\| 0x70 \|\| var \|\|\| Crypted/BZiped kernel
	\|}		\|}

Klightspeed at 03:52, 14 February 2007

Klightspeed — Wed, 14 Feb 2007 03:52:14 GMT

← Older revision		Revision as of 03:52, 14 February 2007
Line 18:		Line 18:
	\|style="background:#CCCCCC; color:green"\| '''description'''		\|style="background:#CCCCCC; color:green"\| '''description'''
	\|-		\|-
-	\| 0 \|\| 4 \|\|\| ~~Don't know~~ (value=6)	+	\| 0 \|\| 4 \|\|\| Product ID (value=6)
	\|-		\|-
	\| 4 \|\| 0x10 \|\|\| Header key		\| 4 \|\| 0x10 \|\|\| Header key
	\|-		\|-
-	\| 0x14 \|\| ~~0x5c~~ \|\|\| Crypted header	+	\| 0x14 \|\| 0x58 \|\|\| Crypted header
	\|-		\|-
	\| 0x14 \|\| 0x20 \|\|\| Label ("HD-HLAN(IENOBU)")		\| 0x14 \|\| 0x20 \|\|\| Label ("HD-HLAN(IENOBU)")
Line 42:		Line 42:
	\| 0x5c \|\| 0x10 \|\|\| compressed part key		\| 0x5c \|\| 0x10 \|\|\| compressed part key
	\|-		\|-
-	\| 0x6c \|\| 0x04 \|\|\| ??	+	\| 0x6c \|\| 0x04 \|\|\| unencrypted null
	\|-		\|-
	\| 0x70 \|\| var \|\|\| crypted/BZiped kernel+ramdisk		\| 0x70 \|\| var \|\|\| crypted/BZiped kernel+ramdisk

Klightspeed at 15:27, 13 February 2007

Klightspeed — Tue, 13 Feb 2007 15:27:44 GMT

← Older revision		Revision as of 15:27, 13 February 2007
Line 1:		Line 1:
	{{Template:Articles}}		{{Template:Articles}}
	''<font color=red><small>		''<font color=red><small>
-	This article	+	This article
-	Last edited by frontalot.	+	Last edited by klightspeed.
		+	Previously edited by frontalot.
	Originally by Nenik.		Originally by Nenik.
	at Linkstationwiki.org		at Linkstationwiki.org
Line 25:		Line 26:
	\| 0x14 \|\| 0x20 \|\|\| Label ("HD-HLAN(IENOBU)")		\| 0x14 \|\| 0x20 \|\|\| Label ("HD-HLAN(IENOBU)")
	\|-		\|-
-	\| 0x34 \|\| 2 \|\|\| release major? (value=2)	+	\| 0x34 \|\| 2 \|\|\| release major (value=2)
	\|-		\|-
-	\| 0x36 \|\| 2 \|\|\| release minor? (value=2)	+	\| 0x36 \|\| 2 \|\|\| release minor (value=2 or 3)
	\|-		\|-
-	\| 0x38 \|\| 0x10 \|\|\| flash label ("FLASH 1.0")	+	\| 0x38 \|\| 0x10 \|\|\| flash label ("FLASH 1.0" or "FLASH 1.1")
	\|-		\|-
	\| 0x48 \|\| 0x08 \|\|\| ??		\| 0x48 \|\| 0x08 \|\|\| ??
Line 53:		Line 54:
	of the encrypted content, byte by byte.		of the encrypted content, byte by byte.

-	I have managed to get to the state of having decrypted both the header and the kernel	+	'''frontalot:''' I have managed to get to the state of having decrypted both the header and the kernel
	image, which is really BZipped! I have also uncompressed the image, but so far I have failed to open the initial ramdisk, which is appended to the image.		image, which is really BZipped! I have also uncompressed the image, but so far I have failed to open the initial ramdisk, which is appended to the image.

		+	'''klightspeed:''' I suspected that the decrypted mtd1 would be kept in memory, so I created an init script that dumped the memory contents to disk. Upon inspecting the memory dump (searching for "HD-HLAN"), I found that the boot loader loads and decrypts mtd1 to virtual address 0x81A00000. The kernel image is indeed a bzimage, which is just a BZipped ELF image.
		+	There is no initrd appended to the image. Instead, the gzipped ramdisk is part of the ELF image. It is present at offset 0x001D6000 in my image (virtual address 0x802D6000).
		+	The ramdisk image is a standard EXT2 filesystem. It has a cut-down version of the linkstation root filesystem, so that if it can't mount the root filesystem, it can still be flashed over the network.

	[[Category:LS2]]		[[Category:LS2]]

Ramuk at 20:47, 6 September 2006

Ramuk — Wed, 06 Sep 2006 20:47:21 GMT

← Older revision		Revision as of 20:47, 6 September 2006
Line 12:		Line 12:

	<center>mtd1 layout:</center>		<center>mtd1 layout:</center>
-	{\| style="width:75%; background:#~~E0FFFF" border="1~~" align=center	+	{\| style="width:75%; background:#DDDDDD;" align=center
-	\| offset \|\| len \|\|\| description	+	\|style="background:#CCCCCC; color:green"\| '''offset'''
		+	\|style="background:#CCCCCC; color:green"\| '''len '''
		+	\|style="background:#CCCCCC; color:green"\| '''description'''
	\|-		\|-
	\| 0 \|\| 4 \|\|\| Don't know (value=6)		\| 0 \|\| 4 \|\|\| Don't know (value=6)

Ramuk at 01:21, 21 July 2006

Ramuk — Fri, 21 Jul 2006 01:21:33 GMT

← Older revision		Revision as of 01:21, 21 July 2006
Line 1:		Line 1:
		+	{{Template:Articles}}
	''<font color=red><small>		''<font color=red><small>
	This article		This article

Ramuk at 20:49, 30 June 2006

Ramuk — Fri, 30 Jun 2006 20:49:04 GMT

← Older revision		Revision as of 20:49, 30 June 2006
Line 1:		Line 1:
		+	''<font color=red><small>
		+	This article
		+	Last edited by frontalot.
		+	Originally by Nenik.
		+	at Linkstationwiki.org
		+	</small></font>''<br>
	mipsel-hdhlan boot loader seems like customized IDTboot with added "encryption."		mipsel-hdhlan boot loader seems like customized IDTboot with added "encryption."

Ramuk at 00:50, 26 June 2006

Ramuk — Mon, 26 Jun 2006 00:50:27 GMT

← Older revision		Revision as of 00:50, 26 June 2006
Line 46:		Line 46:
	I have managed to get to the state of having decrypted both the header and the kernel		I have managed to get to the state of having decrypted both the header and the kernel
	image, which is really BZipped! I have also uncompressed the image, but so far I have failed to open the initial ramdisk, which is appended to the image.		image, which is really BZipped! I have also uncompressed the image, but so far I have failed to open the initial ramdisk, which is appended to the image.
		+
		+
		+	[[Category:LS2]]

Bauldrick at 22:24, 16 June 2006

Bauldrick — Fri, 16 Jun 2006 22:24:54 GMT

New page

mipsel-hdhlan boot loader seems like customized IDTboot with added "encryption."

The bootloader itself is inside mtd0 and during boot, it is mapped at virtual address
0xBFC00000. It copies the mtd1 into ram, decrypts it, decompresses and starts the kernel.

<center>mtd1 layout:</center>
{| style="width:75%; background:#E0FFFF" border="1" align=center
| offset || len ||| description
|-
| 0 || 4 ||| Don't know (value=6)
|-
| 4 || 0x10 ||| Header key
|-
| 0x14 || 0x5c ||| Crypted header
|-
| 0x14 || 0x20 ||| Label ("HD-HLAN(IENOBU)")
|-
| 0x34 || 2 ||| release major? (value=2)
|-
| 0x36 || 2 ||| release minor? (value=2)
|-
| 0x38 || 0x10 ||| flash label ("FLASH 1.0")
|-
| 0x48 || 0x08 ||| ??
|-
| 0x50 || 0x04 ||| compressed length
|-
| 0x54 || 0x04 ||| compressed offset (0x70)
|-
| 0x58 || 0x04 ||| compressed part checksum
|-
| 0x5c || 0x10 ||| compressed part key
|-
| 0x6c || 0x04 ||| ??
|-
| 0x70 || var ||| crypted/BZiped kernel+ramdisk
|}

Now to the encryption:
The bootloader contains a pseudo-random number generator (statically seeded inside
the bootloader, so in fact completely predictable). The output of the generator
is used to select a byte from the key for decryption (read: "xor") of a byte
of the encrypted content, byte by byte.

I have managed to get to the state of having decrypted both the header and the kernel
image, which is really BZipped! I have also uncompressed the image, but so far I have failed to open the initial ramdisk, which is appended to the image.