電子辞書のアイデンティティを消す方法

第54回 情報科学若手の会 #wakate2022

Transcript

1. 54 #wakate 2022 @puhitaku
2. 2 Takumi Sueda @puhitaku HOMMA 
 Inc. 
 3 D 20 1 4 2 018 2020 Linux 
 20 2 1 TEPRA Lite BLE 

5. SHARP Brain 5
6. 2020 Linux 6
7. Twitter #wakate 202 2 7
8. SHARP Brain
9. SHARP Brain SHARP Brain PW-SH 1 SHARP 2008 Windows CE 2020 CE exe Brain 2ch Brain Windows CE Wikipedia matplotlib 
 9
10. SHARP Brain 10 DRAM: LPDDR 128 MB eMMC: 8 GB SD Raspberry Pi LCD CPU: NXP i.MX 2 83 ARM 926 EJ-S, armv 5 tej 4 54 MHz LCD: 8 00 x 48 0 SD: SDXC :
11. SHARP Brain Linux 2020 Linux "Brain Hackers" 
 Brain Debian Linux Brainux OS SD Brain Linux 11 Brainux / Brain Hackers
12. SHARP Brain 1 Windows Linux 12
13. SHARP Brain SD eMMC 13 SD Linux eMMC SD: SDXC eMMC: 8 GB SD ❌
14. SHARP Brain SD eMMC SD SD SD SDIO Wi-Fi Linux mainline SDIO Wi-Fi GPIO eMMC Linux 14
15. SHARP Brain SD eMMC Brain Linux 
 Linux Good-bye, Windows Good-bye, 15
16. eMMC Linux
17. eMMC Linux 17
18. eMMC Linux 18 Brain 
 Windows CE
19. eMMC Linux 19 Windows CE 
 ?
20. eMMC Linux SoC 
 eMMC 20
21. Boot ROM
22. Boot ROM Arm SoC 22
23. Boot ROM A. Boot ROM 23
24. Boot ROM A. Boot ROM 
 (i.MX 28 On-chip ROM ) 24
25. Boot ROM CPU 25 eMMC DRAM I 2 C SPI ARM 9 2 6 EJ-S 
 Core
26. Boot ROM On-chip ROM On-chip RAM On-chip RAM On-chip ROM 26 On-chip ROM 
 (Boot ROM) On-chip RAM 
 (SRAM) ARM 9 2 6 EJ-S 
 Core
27. ARM 9 2 6 EJ-S 
 Core Boot ROM CPU Boot ROM 27 On-chip ROM On-chip RAM 
 (SRAM) 🤔 ARM USB recovery I 2 C SPI SSP (eMMC / SD) GPMI (NAND) JTAG
28. ARM 9 2 6 EJ-S 
 Core Boot ROM Boot ROM "One-Time Programmable ROM" "Boot Mode" 28 On-chip ROM On-chip RAM 
 (SRAM) 🤔 OTP 
 One-Time Programmable ROM
29. Boot ROM "OTP ROM" "OTP" SoC ROM CPU 
 OTP One-Time Programmable (OTP) ROM 29 OTP 

30. OTP
31. SHARP OTP SHARP Brain PW-SH 1 SHARP 2008 Windows CE 2020 CE exe Brain 2ch Brain Windows CE Wikipedia matplotlib 
 31
32. SHARP OTP Brain Scalpel Windows CE 32
33. SHARP OTP 33 0x 80 02 C 1 A 0 32bit MSB 8bit BOOT_MODE Scalpel 0x 80 02 C 1 A 0 BOOT_MODE 0x 01 ( 0 b 00 0000 01 )
34. SHARP OTP BOOT_MODE 0 bXXX 0 0 001 I²C 3 . 3 V 34
35. ARM 9 2 6 EJ-S 
 Core SHARP OTP CPU I²C EEPROM 35 On-chip ROM On-chip RAM 
 (SRAM) 😊 ARM USB slave (recovery) SSP (eMMC / SD) SPI I 2 C GPMI (NAND) JTAG I²C
36. EEPROM
37. SHARP EEPROM Q. Brain EEPROM 37
38. SHARP EEPROM 38
39. SHARP EEPROM I²C 100kHz 400kHz EEPROM Digi-key SON 2 mm x 3 mm ON Semi Rohm 0.5mm Rohm VSON EEPROM IC 4G 3 BR 2 4 G 3 2 = 4 KB EEPROM 39
40. SHARP EEPROM 0.2mm 40
41. SHARP EEPROM "Boot Stream" (SB) SB Boot ROM Rockbox sbtoelf 
 Ghidra disassemble EEPROM 41 SB Header Encryption keys Section 0 Cmd: LOAD @ 0xE440 Cmd: FILL @ 0xE6A0 ~ +0x114 Cmd: LOAD @ 0xE400 Cmd: CALL @ 0xE400 Cmd: MODE to 0x09 Rockbox: Boot ROM (U-Boot)
42. SHARP EEPROM SB SRAM 42 IVT Header Entry point: 
 0xE61C Instructions (armv5tej) Zero-filled area 
 (.bss) 0xE400 0xE440 0xE6A0 0xE7B4 0xE61C CALL command Jump Return
43. SHARP EEPROM eMMC eMMC eMMC EEPROM eMMC SB EEPROM Boot ROM 43 Cmd: LOAD @ 0xE440 Cmd: FILL @ 0xE6A0 Cmd: LOAD @ 0xE400 Cmd: CALL @ 0xE400 Cmd: MODE to 0x09 eMMC eMMC
44. ARM 9 2 6 EJ-S 
 Core SHARP EEPROM CPU I²C EEPROM eMMC eMMC 44 On-chip ROM On-chip RAM 
 (SRAM) 😊 ARM USB slave (recovery) SSP (eMMC / SD) SPI I 2 C GPMI (NAND) JTAG I²C EEPROM eMMC eMMC 

45. eMMC
46. SHARP eMMC Linux SD dd /dev/mmcblk 0 
 Master Boot Record i.MX 2 8 partition type 0 x 5 3 SB eMMC 46
47. SHARP eMMC eMMC 47 MBR Entry 0: FAT32 Entry 1: SB Entry 2: ? SB FAT32 Sector 0 256 2304 Read MBR Read & run SB Run EBOOT ? 198912
48. ARM 9 2 6 EJ-S 
 Core SHARP eMMC CPU eMMC EBOOT Windows CE 48 On-chip ROM On-chip RAM 
 (SRAM) 😊 ARM USB slave (recovery) SSP (eMMC / SD) SPI I 2 C GPMI (NAND) JTAG eMMC
49. SHARP eMMC EBOOT NK image Windows 
 eMMC DRAM Windows CE 49 EBOOT SSP (eMMC / SD) MBR Boot Stream NK image NK image On-chip ROM On-chip RAM DRAM NK image EBOOT EBOOT
50. SHARP eMMC 50 On-chip ROM I²C EEPROM eMMC Windows CE
52. I²C EEPROM SB OS eMMC SB Windows CE EBOOT eMMC Linux 52 On-chip ROM I²C EEPROM eMMC OS OS
53. : USB boot eMMC boot Windows
54. 54 "USB boot mode" PC SB EEPROM eMMC SB PC Windows CE EEPROM OS eMMC ❌ I²C EEPROM USB Boot 💻 USB SB U-Boot mkimage
55. eMMC USB USB boot mode 55
56. : EEPROM eMMC 56 On-chip ROM I²C EEPROM eMMC SB
57. eMMC
58. eMMC Linux U-Boot (Das U- Boot) SD Linux kernel U-Boot eMMC SD OS SB U-Boot eMMC OS 58
59. eMMC eMMC OS 59 MBR Entry 0: FAT32 Entry 1: SB Entry 2: Ext4 FAT32 Ext4 Sector 0 2048 20800 Read MBR Read & run SB Run U-Boot SB 24800
60. eMMC
61. eMMC Linux SD eMMC dd 
 USB boot + (UART) eMMC 61
62. eMMC UART 62
63. eMMC 63 /dev/mmcblk0 = eMMC
64. eMMC SHARP Brain Linux 64
66. 66 On-chip ROM I²C EEPROM eMMC SoC