{"id":3149,"date":"2012-01-13T19:19:01","date_gmt":"2012-01-14T00:19:01","guid":{"rendered":"https:\/\/example.com\/?postname=chinese-wonder-pun"},"modified":"2012-01-13T19:19:01","modified_gmt":"2012-01-14T00:19:01","slug":"chinese-wonder-pun","status":"publish","type":"post","link":"http:\/\/atomsofttech.com\/blog\/uncategorized\/chinese-wonder-pun\/","title":{"rendered":"Chinese Wonder* (pun)"},"content":{"rendered":"

\"\"<\/a><\/p>\n

Ok i have one of those tiny 7 inch laptops which has a ARM and WinCE\/Android running on it..<\/p>\n

While this is pretty cool to have i have no use for it. Unless i start learning how to program for android. Which i will not even get into. The cool thing i like about this laptop is the 7in LCD and the fact it has a mouse and keyboard built in. I would love to be able to use this for something other than what it has.<\/p>\n

This so called PC uses a WM8505 Processor which in it self is quite hard to find good info on..<\/p>\n

\"\"<\/a><\/p>\n

Here are some specs on my model:<\/p>\n

Max Resolution:<\/strong> 800 x 480 px
\n OS Language:<\/strong> English
\n Operating System:<\/strong> Windows CE 6.0 or Android
\n CPU:<\/strong> ARM-WM8505 or VIA VT8505( ARM926EJ-S)
\n Chipset:<\/strong> WM8505
\n Memory:<\/strong> 128 MB
\n Flash Disk:<\/strong> 2GB Built-in
\n External Memory:<\/strong> SD\/MMC card (16GB Max.)
\n LAN:<\/strong> RJ45, 10\/100Mbps
\n WLAN:<\/strong> 802.11b\/g Wifi \/ Wireless LAN
\n Speaker:<\/strong> Internal Speaker x 2
\n Touchpad:<\/strong> Yes
\n Keyboard:<\/strong> 80-key keyboard
\n Ports:<\/strong>
\n2 * USB External
\n1 * USB Internal
\n1 * RJ45 LAN
\n1 * 3.5mm Microphone
\n1 * 3.5mm Headphone
\n1 * SD\/MMC card slot<\/p>\n

Now for the GOOD the BAD and the UGLY!<\/p>\n

The Good… The main board has a UART port on it and i am able to get valuable information from it. I can even access a terminal on it.<\/p>\n

\"\"<\/a><\/p>\n

Here is what i get on boot:<\/p>\n\n\n\n
\n
WonderMedia Technologies, Inc. W-Load Version : 0.17.00.00 ethaddr............found U-Boot 1.1.4 (Apr\u00a0 1 2010 - 16:26:54) WonderMedia Technologies, Inc. WMT U-Boot Version : 0.12.01.00.14 U-Boot code: 03F80000 -> 03FB9294\u00a0 BSS: -> 040076AC RAM Configuration: Bank #0: 00000000 128 MB boot from spi flash. flash: \u00a0\u00a0\u00a0\u00a0 Bank1: FFF80000 -- FFFFFFFF \u00a0\u00a0\u00a0\u00a0 Bank2: FF780000 -- FFF7FFFF Flash:\u00a0 8.5 MB In:\u00a0\u00a0\u00a0 serial Out:\u00a0\u00a0 serial Err:\u00a0\u00a0 serial ### main_loop entered: bootdelay=1 bootcmd=\"nand read 3c00000 12f00000 100000;logo show;run text1\" CE0: NAND FLASH ID: 0xECD514B6 CE0: NAND FLASH Name: SAMSUNG_K9XXG08UXM (2048 MB) block4095 tag=74624230\u00a0 version =1 block4094 tag=62743142\u00a0 version =1 g_nfinfo[0].id = 0xE, g_nfinfo[1].id = 0xFFFF Read finsih show logo ..... LCD param (setting): 1,30000,8,800,480,48,40,40,3,29,13 PWM param (setting): 0,4,599,599 LCD FrameBuffer = 0x07900000, BMP Address = 0x03C00000 Loading BMP ..... ok no string .... PWM0 input freq = 47916666 Hz, output freq = 19998 Hz PWM0 register setting: scalar = 3, period = 598, duty = 598 \"V1.5.2\" Execute register operation: \u00a0 reg op: 0xD8110064 | 0xC \u00a0 reg op: 0xD811008C | 0xC \u00a0 reg op: 0xD81100B4 & 0xFFFFFFFB \u00a0 reg op: 0xD81100B4 | 0x8 \u00a0 reg op: 0xD8130054 | 0x1 ### main_loop: bootcmd=\"nand read 0 0 300000;bootm 0\" Hit any key to stop autoboot:\u00a0 0 WMT # <\/strong><\/pre>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
When I type help this is what i get:<\/p>\n\n\n\n
\n
WMT # help<\/strong>\n?\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 - alias for 'help'<\/strong>\nautoscr - run script from memory<\/strong>\nbase\u00a0\u00a0\u00a0 - print or set address offset<\/strong>\nbdinfo\u00a0 - print Board Info structure<\/strong>\nboot\u00a0\u00a0\u00a0 - boot default, i.e., run 'bootcmd'<\/strong>\nbootd\u00a0\u00a0 - boot default, i.e., run 'bootcmd'<\/strong>\nbootm\u00a0\u00a0 - boot application image from memory<\/strong>\nbootp\u00a0\u00a0 - boot image via network using BootP\/TFTP protocol<\/strong>\ncleanlcd - clean LCD screen<\/strong>\ncmp\u00a0\u00a0\u00a0\u00a0 - memory compare<\/strong>\nconinfo - print console devices and information<\/strong>\ncp\u00a0\u00a0\u00a0\u00a0\u00a0 - memory copy<\/strong>\ncrc32\u00a0\u00a0 - checksum calculation<\/strong>\ndhcp\u00a0\u00a0\u00a0 - invoke DHCP client to obtain IP\/boot params<\/strong>\ndiskboot- boot from IDE device<\/strong>\ndmacp\u00a0\u00a0\u00a0\u00a0 - dma memory copy<\/strong>\necho\u00a0\u00a0\u00a0 - echo args to console<\/strong>\nerase\u00a0\u00a0 - erase FLASH memory<\/strong>\nfatinfo - print information about filesystem<\/strong>\nfatload - load binary file from a dos filesystem<\/strong>\nfatls\u00a0\u00a0 - list files in a directory (default \/)<\/strong>\nfatstore - store binary file to a dos filesystem<\/strong>\nflinfo\u00a0 - print FLASH memory information<\/strong>\ngo\u00a0\u00a0\u00a0\u00a0\u00a0 - start application at address 'addr'<\/strong>\nhelp\u00a0\u00a0\u00a0 - print online help<\/strong>\nide\u00a0\u00a0\u00a0\u00a0 - IDE sub-system<\/strong>\niminfo\u00a0 - print header information for application image<\/strong>\nimls\u00a0\u00a0\u00a0 - list all images found in flash<\/strong>\nitest\u00a0\u00a0 - return true\/false on integer compare<\/strong>\nlcdinit - initialize LCD<\/strong>\nloadb\u00a0\u00a0 - load binary file over serial line (kermit mode)<\/strong>\nloads\u00a0\u00a0 - load S-Record file over serial line<\/strong>\nshow\u00a0\u00a0\u00a0 -<\/strong>\nloop\u00a0\u00a0\u00a0 - infinite loop on address range<\/strong>\nmd\u00a0\u00a0\u00a0\u00a0\u00a0 - memory display<\/strong>\nmii\u00a0\u00a0\u00a0\u00a0 - MII utility commands<\/strong>\nmm\u00a0\u00a0\u00a0\u00a0\u00a0 - memory modify (auto-incrementing)<\/strong>\nmmcinit - init mmc card<\/strong>\nmtest\u00a0\u00a0 - simple RAM test<\/strong>\nmw\u00a0\u00a0\u00a0\u00a0\u00a0 - memory write (fill)<\/strong>\nnand\u00a0\u00a0\u00a0 - NAND sub-system<\/strong>\nnfs\u00a0\u00a0\u00a0\u00a0 - boot image via network using NFS protocol<\/strong>\nnm\u00a0\u00a0\u00a0\u00a0\u00a0 - memory modify (constant address)<\/strong>\nping\u00a0\u00a0\u00a0 - send ICMP ECHO_REQUEST to network host<\/strong>\nprintenv- print environment variables<\/strong>\nprotect - enable or disable FLASH write protection<\/strong>\nrandmac - generate a random MAC address and save to \"ethaddr\" environment variable<\/strong>\nrarpboot- boot image via network using RARP\/TFTP protocol<\/strong>\nreset\u00a0\u00a0 - Perform RESET of the CPU<\/strong>\nrun\u00a0 \u00a0\u00a0\u00a0- run commands in an environment variable<\/strong>\nsaveenv - save environment variables to persistent storage<\/strong>\nsdwaitins - wait sd card inserted or removed<\/strong>\nsdwaitins 0 -- waiting removed<\/strong>\nsdwaitins 1 -- waiting inserted<\/strong>\nsetenv\u00a0 - set environment variables<\/strong>\nsleep\u00a0\u00a0 - delay execution for some time<\/strong>\ntextout - show text to the screen<\/strong>\ntextout x y \"str\" color<\/strong>\ncolor is 24bit Hex, R[23:16], G[15:8], B[7:0]<\/strong>\nfor example: textout 0 0 \"hello world\" FFFFFF<\/strong>\ntftpboot- boot image via network using TFTP protocol<\/strong>\ntmpt\u00a0\u00a0\u00a0\u00a0 - execute Mass Production Tool<\/strong>\nuploadfile- Transfer the spi flash image to the server.<\/strong>\nversion - print monitor version<\/strong><\/pre>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
While this maybe cool and usefull it will suck if i can not create my own code.<\/p>\n
The BAD…. Since im mostly interested in the LCD and keyboard and could care less about the processor or anything else i am stuck.
\nAs you might expect there is no datasheet for either and manually reverse engineering both is beyond me since i dont have the necessary tools.<\/p>\n
The Ugly… Now what i am trying to figure out is how do i get into a U-Boot.bin file to get all the source. This is beyond me as well. The U-Boot.bin file has the bootloader and from what i can see some LCD init stuff and a ton more. To find out what can be expected in the file i used my Linux OS (debian) to search for strings in the file…<\/p>\n
(this is from Cygwin tho easier to copy\/paste)<\/p>\n\n\n\n
\n
Jason@Jason-PC ~\/ARM8505\/script<\/strong>\n$ strings u-boot.bin<\/strong>\n...<\/strong>\nU-Boot 1.1.4 (Apr\u00a0 1 2010 - 16:26:54)<\/strong>\nBbt01tbB@x}<\/strong>\nFont 12x22<\/strong>\n...<\/strong>\nLCD_ENABLE<\/strong>\nCxScreen<\/strong>\nCyScreen<\/strong>\nLCD_ID<\/strong>\nLCD panel ID????<\/strong>\nUn-Support LCD panel ID ( %d )<\/strong>\nX_LTEXT<\/strong>\nY_LTEXT<\/strong>\nLCDC_FB<\/strong>\nBMP_ADR<\/strong>\nLCD FrameBuffer = 0x%08X, BMP Address = 0x%08X<\/strong>\n....<\/strong>\nlcdparam<\/strong>\nLCD param (default): 1,25000,8,800,480,48,40,40,3,29,13<\/strong>\nLCD param (setting): %s<\/strong>\nLCD param Error: expected version 1, but get %d<\/strong>\nLCD param Error: need %d arg count, but get %d<\/strong>\nSo use default LCD param: 1,25000,8,800,480,48,40,40,3,29,13<\/strong>\nLCD param Error: the string length of extra register opreation length = %d, it is too long, it should be less than %d<\/strong>\nNot excute extra register operation for LCD<\/strong>\n.....<\/strong>\nLCD already initialized<\/strong>\nLoading BMP .....<\/strong>\n....<\/strong>\nLCDC_FB2<\/strong>\nfailed<\/strong>\nLOGO_STRING<\/strong>\nno string ....<\/strong>\nExecute register operation for LCD:<\/strong><\/pre>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
Obviously there is more but i clipped out what wasnt relevant to save scroll space…<\/p>\n
I know know there are quite a few things related to the LCD in there which is something i will need. I ran across a program called binwalk and tried it on the uboot bin file and got:<\/p>\n\n\n\n
\n
Scan Time:\u00a0\u00a0\u00a0 Jan 10, 2012 @ 22:04:41<\/strong>\nMagic File:\u00a0\u00a0 \/usr\/local\/etc\/binwalk\/magic.binwalk<\/strong>\nSignatures:\u00a0\u00a0 75<\/strong>\nTarget File:\u00a0 u-boot.bin<\/strong>\nMD5 Checksum: d2c6f4e628ee5594caaccedb95fda7a6<\/strong>\n\u00a0<\/strong>\nDECIMAL\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0 HEX\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0 DESCRIPTION<\/strong>\n-------------------------------------------------------------------------------------------------------<\/strong>\n184350\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0 0x2D01E\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0 LZMA compressed data, properties: 0x01, dictionary size: 8388608 bytes, uncompressed size: 128 bytes<\/strong>\n185224\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0 0x2D388\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0 LZMA compressed data, properties: 0x03, dictionary size: 8388608 bytes, uncompressed size: 64 bytes<\/strong>\n186634\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0 0x2D90A\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0 LZMA compressed data, properties: 0x01, dictionary size: 8388608 bytes, uncompressed size: 4194432 bytes<\/strong>\n231695\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0 0x3890F\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0 LZMA compressed data, properties: 0xD8, dictionary size: 65011712 bytes, uncompressed size: 1 bytes<\/strong>\n\u00a0<\/strong><\/pre>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
This leads me to believe that there is something i can extract and decompress … Look at address 186634 (0x2D90A) the uncompressed size is 4,194,432 bytes.<\/p>\n
That is just about 4MB big… Also since there are strings easily readable in there it also leads me to think that there are most likely normal files i can open. (i hope)<\/p>\n
 <\/p>\n
The Only BIG problem im having is… getting the data out of the u-boot.bin which is the main goal. I made a simple program to extract data from a file at a specific offset for a specifiv length and output it to a file. All in binary. While it does the job it doesnt work . I think its because i dont know when the archive ends? Or when it starts really.<\/p>\n
While the above binwalk gives me a address i doubt its to the actual compressed file. LZMA compressed file have a magic number which usually is something like :<\/p>\n
0x5D, 0x00,0x00,0x08 or something similar. I know the 0x5D is correct. But the above binwalk points to the Properties of said location… like 186634 offset is a 0x01 and not a 0x5D…<\/p>\n
So if anyone knows how to extract this stuff please help me out.<\/p>\n","protected":false},"excerpt":{"rendered":"
Ok i have one of those tiny 7 inch laptops which has a ARM and WinCE\/Android running on it.. While this is pretty cool to have i have no use for it. Unless i start learning how to program for android. Which i will not even get into. The cool thing i like about this […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-3149","post","type-post","status-publish","format-standard","hentry"],"jetpack_featured_media_url":"","_links":{"self":[{"href":"http:\/\/atomsofttech.com\/blog\/wp-json\/wp\/v2\/posts\/3149","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/atomsofttech.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/atomsofttech.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/atomsofttech.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/atomsofttech.com\/blog\/wp-json\/wp\/v2\/comments?post=3149"}],"version-history":[{"count":0,"href":"http:\/\/atomsofttech.com\/blog\/wp-json\/wp\/v2\/posts\/3149\/revisions"}],"wp:attachment":[{"href":"http:\/\/atomsofttech.com\/blog\/wp-json\/wp\/v2\/media?parent=3149"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/atomsofttech.com\/blog\/wp-json\/wp\/v2\/categories?post=3149"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/atomsofttech.com\/blog\/wp-json\/wp\/v2\/tags?post=3149"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}