1

Device: i was able to recover bricked Chinese IOT a Sous Vide cooker. Replaced damaged capacitor. it works.

it has

  • ARM soc/mcu/processor
  • WI-FI (broadcom)
  • LCD touch screen + 16bit STM mcu.
  • EEPROM 4Kbyte on i2c bus
  • 1 Giga bit NAND flash memory.
  • 125 M byte of RAM
  • I2C bus on the motherboard.

Lacks features: i would like to start the timer only after the device reach the target temperature: with meats, it is ok to add food to the water as it heats. Not for Poached eggs!

I downloaded the firmware update payload motorola srecord SREC format concatenated with a big blob of data like BMP & i18n files. i used ghidra to look inside the code SREC : ARM 32bit/16bit big endian.

Qemu emulation with unicorn framework: i traced mcr instructions. it seems the firmware is configuring the MPU this way:

MPU's layout base address

Recon Then i was able to id "Boot_console_put(char *)" function and a memory address where the firmware write char by char all the boot message related strings: 0x3402f404

0x3402f404 used to place boot console char

Console Output Then the emulated firmware update payload seems to be stuck on a loop when trying to acces and I2C slave (could be the eeprom) printing this:

[boot] entering HW_MCASIC_init
[boot NVM] I2C: SDA seems stuck low!
[boot NVM] I2C: SDA seems stuck low!
[boot NVM] I2C: SDA seems stuck low!

the code dealing with I2C seem a bit too much convoluted for a rapid understanding

The question : i would like to guess What are all the others address the firmware is referencing in the code. Searching google and github for similar constant/base address & offsets didn't help... google search result returning off topic commercial links.

Improve this question
2
  • The best thing would be obtaining extact model of this ARM chip. This way you could browse the internet for the datasheet with memory map, and thanks to it see which addresses are used to interface with the GPIOs and other peripherals
    – morsisko
    May 22, 2020 at 17:30
  • Package marking on the chip are custom . didnt find on the internet. i found dead code: a function not used anywhere that referencing an array of strings and use the index of coprocesor CP15 returned id of the chip. the arrays is "946","Cortex-R4", "Cortex-A9", "Marvell PJ4", "1176", "Cortex-A7","Not Listed"
    – pabx06
    May 22, 2020 at 19:35

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy