**** BEGIN LOGGING AT Sat Mar 23 02:59:59 2013 Mar 23 07:32:31 Hi people, I have a Nokia N9 and would like to know how can helpin the project Mar 23 07:33:13 knowledge of Lynux packaging Mar 23 07:33:26 *Linux packaging Mar 23 07:35:16 xavinux: maybe ask in #harmattan? Rzr on that channel maintains a repo in which he does quite a lot of packaging from Debain's armel repos for the N9 Mar 23 07:38:09 ok thanks for your answer thedead Mar 23 07:38:16 np Mar 23 16:16:19 DocScrutinizer05: seriously, why didn't you guys ban "$a:Estel" too? Mar 23 16:16:43 kerio: eh? Mar 23 16:17:24 oh nvm Mar 23 16:17:34 i misread Mar 23 16:19:07 on a sidenote: what do you think how many fingerprints a skilled chanop can still gather about a user and his IRC client, even when said user tries to hide his identity Mar 23 16:21:55 DocScrutinizer05: irrelevant - how many fingerprints can a skilled freenode ircop gather about a user who repeatedly ban-evades on an "official" channel? Mar 23 16:22:23 ;-P Mar 23 16:23:00 at some point, you just report and wait for the k-line Mar 23 16:23:12 not that I'd care too much about such silly games as answering to self Mar 23 16:24:12 wouldn't k-line be kind of useless, unless you wanted to ban the whole ISP? Mar 23 16:24:12 after all it sheds some light on psyche of the individula that does such weird games Mar 23 16:24:47 individual even Mar 23 16:57:52 wow, WinSCP and N900 are hating on me today Mar 23 16:57:59 constantly disconnecting *sigh* Mar 23 18:09:30 wl1251 firmware is a piece of cake (raw ARM image), but I've found out it mostly uses Thumb Mar 23 18:10:12 which is the reason I wasn't seeing too much ARM code in cmt-mcusw - they are using Thumb there, too Mar 23 18:10:57 I figured out part of the mcusw header, it's a u8 type; u8 length; u8 content[length]; kind of deal Mar 23 18:38:01 you probably can "reuse" lots of general info found out for other BB5 phones' firmwares Mar 23 18:41:03 after all NOLO is just forwarding/sending a rather standard (kermit? zmodem?) BB% firmware image to cmt, since cmt is using same format for flashing new firmware, no matter which interface it comes in Mar 23 18:42:42 so cmt-mcusw is probably largely identical to the firmware image phoenix would flash directly to cmt via the testpoints under battery, and also mostly identical to other firmwares phonix would flash to other BB5 based phones via F-Bus Mar 23 18:43:50 or USB Mar 23 18:44:49 but honestly it's a mostly useless futile effort, since cmt firmware is signed Mar 23 18:45:09 so you can't patch a single byte of it Mar 23 18:45:55 best you can hope for is to find easter-eggs Mar 23 18:46:33 or gain a better understanding of how ISI works Mar 23 18:49:37 DocScrutinizer05: best we can hope for is a way to exec() something else Mar 23 18:51:07 yeah, that's what I thought Mar 23 18:51:20 remote execution exploits Mar 23 18:51:44 so the sections make a bit more sense now: https://gist.github.com/eddyb/127da89b6daa631b7b21/raw/a7f34a843af2fc6ba67a978bcf0d363b0bb2b540/mcusw-sections Mar 23 18:52:09 first number is offset in file, a weird offset follows, then actual length Mar 23 18:54:54 no way to execute something in cmt Mar 23 18:55:11 you can send data and receive from it, right? Mar 23 18:55:16 that data has to be parsed Mar 23 18:55:45 one small buffer overflow bug that never showed up in production because the same guys wrote both communicating ends Mar 23 18:56:01 and then? Mar 23 18:56:27 and then you have remote code execution Mar 23 18:56:37 no you don't Mar 23 18:56:53 you can do at least ROPs Mar 23 18:57:01 s/s// Mar 23 18:57:03 eddyb meant: you can do at leat ROPs Mar 23 18:57:13 lol Mar 23 18:57:15 afaik code on modem gets executed directly from NAND, you don't have any executable RAM areas Mar 23 18:57:27 DocScrutinizer05: ROP doesn't need executable RAM Mar 23 18:58:04 you craft a function-call-by-return that "happens" when the function exploited returns Mar 23 18:58:28 *function being exploited Mar 23 18:58:29 so what? Mar 23 18:58:39 execute what then? Mar 23 18:59:02 I'm not really sure, but it's close to being turing-complete Mar 23 18:59:09 you can start poking around Mar 23 18:59:32 nfc what you're talking about Mar 23 18:59:46 but you can't execute code that doesn't already exist on cmt Mar 23 18:59:50 for all I know Mar 23 19:01:19 not to mention you also got a physical separation of secure and non-secure hardware all over whole ARM SoC which BB5 actually is Mar 23 19:02:03 I don't know if BB5 firmware is using secure world of ARM Mar 23 19:04:31 you might be able to find a way to edit the cmt's filesystem, which is basically an area where config data gets stored. So you could unlock SIMlocked devices *maybe*, or ruin the TX or audio calibration. But that's it, really Mar 23 19:07:27 afaik even IMEI is hardcoded and not in filesystem Mar 23 19:12:08 anyway, good luck Mar 23 19:13:56 * DocScrutinizer05 idly wonders *what* code was worth getting executed on cmt, *if* there was a way to inject arbitrary code Mar 23 19:14:53 except for changing IMEI and unlocking SIMlocked devices I can't figure a single useful hack Mar 23 19:15:41 RF scramblers can get built more easily and cheaper Mar 23 19:16:59 and for eavesdropping other GSM devices near to you, you better use a modem with all of sourcecode available and easily tweakable, since for such usecase quite massive tweaks are needed Mar 23 19:20:15 afaik the wizards at osmocom-bb managed to turn a calypso-cmt based cellphone into a single-user BTS basically. Wouldn't even start to ponder if that's even possible for BB5-cmt Mar 23 19:20:36 woah, that's neat Mar 23 19:20:39 and... illegal? Mar 23 19:20:46 sure - LOL Mar 23 19:20:59 highly illegal... to operate such device Mar 23 19:21:07 OTA Mar 23 19:21:18 it's legal to do so in a private place with your own equipment, i hope Mar 23 19:22:17 as long as you work with a dummy-load instead of an antenna Mar 23 19:22:33 i'll swear i'll use a really tiny antenna! Mar 23 19:22:45 s/'ll// Mar 23 19:22:46 kerio meant: i swear i'll use a really tiny antenna! Mar 23 19:23:37 s/.//g Mar 23 19:26:15 fun with regexps Mar 23 19:26:31 she can't do regex Mar 23 19:26:58 darn. was about to try a backref to see if it would work :p Mar 23 19:27:10 s/.*can.*/noway/ Mar 23 19:27:26 s/can.t/noway/ Mar 23 19:27:32 s/can't/noway/ Mar 23 19:27:34 DocScrutinizer05 meant: she noway do regex Mar 23 19:27:37 eccerr0r: backticks to eval are also fun, with perl Mar 23 19:28:24 s/e/E/g Mar 23 19:28:25 DocScrutinizer05 meant: shE can't do rEgEx Mar 23 19:28:36 that chan would be always alive :) Mar 23 19:30:29 s/x/x. All she knows is /g. And she has a timeout for the buffer of last regular post - after some minutes it gets discarded/ Mar 23 19:30:37 next is whether it's closer to perlre or sed regexps... Mar 23 19:30:56 (or other flavor...) Mar 23 19:31:18 s./g.\/g/ Mar 23 19:31:24 s./g.\/g. Mar 23 19:31:46 it's no regex Mar 23 19:32:40 http://www.youtube.com/watch?v=z9pD_UK6vGU Mar 23 19:32:42 it a simple string-substitute, with an extension to get /g working. And it won't accept *any* special chars, or any other delimiters than / Mar 23 19:32:57 that's no fun. Mar 23 19:34:39 which btw is really strange since iirc she's written in perl Mar 23 19:35:36 probably not a good idea to eval it anyway. it's tainted. Mar 23 19:43:46 oh really Mar 23 19:43:56 it's "probably" a good idea to not eval remote input? Mar 23 19:45:48 str.replace(new RegExp(regex, flags), replace_with) Mar 23 19:46:40 if you don't care about \/ inside a replace pattern, then you can just split('/') and use the three parts Mar 23 19:46:59 eval for regexp sounds like waaay more trouble than it's worth Mar 23 19:55:55 Pali: ping Mar 23 19:56:14 hi Mar 23 19:57:11 I'm preparing a new rescueos release and want to include the Wifi firmware now. I think you once send me a link regarding that, do you remember? Mar 23 19:59:20 nevermind, finally found it in the logs Mar 23 20:01:05 yay Mar 23 20:02:14 ok seems the licence in that tarball https://api.pub.meego.com/public/source/CE:Adaptation:N900/ti-wl1251-firmware/ti-wl1251-firmware_0.4.tar.bz2 does not say you will be nuked if you use it somewhere Mar 23 20:02:36 and since nitroid has been shipping it for a while I guess there shouldn't be any problems.... Mar 23 20:02:53 is it the same firmware, down to hashsum? Mar 23 20:02:59 I'll check Mar 23 20:06:38 yes it is Mar 23 20:12:07 I have completely recompiled everything to use uclibc Mar 23 20:12:21 saves tons of space etc. Mar 23 20:12:39 -Os and thumb? Mar 23 20:13:22 -Os is a bad idea ;) Mar 23 20:13:56 it saves some bytes, but performance-wise it is awful Mar 23 20:14:23 -O2 or -O3 then? Mar 23 20:14:27 -O2 Mar 23 20:14:57 I have used buildroot for that, tbh wasn't smart enough to check the options, should be rather irrelevant anyway for rescueOS... Mar 23 20:15:06 -O3 enables -ftree-vectorize if -mfpu=neon is given Mar 23 20:15:16 I've seen -O3 turn a recursive fibonacci into a hundred or so instructions Mar 23 20:15:32 but was -Os Mar 23 20:15:39 NIN101, I have modified rescueos to work on 3.5/3.8 kernels Mar 23 20:15:42 and gcc auto-vectorizer sucks on ARM IMO Mar 23 20:15:48 maybe you can include some patches Mar 23 20:16:07 like, it converts the recursive form into a loop of some sort, then it unrolls the loop Mar 23 20:16:20 freemangordon: you should use 4.8 then :) Mar 23 20:16:43 eddyb: hehe. I'll wait zeq to build it for scratchbox first :) Mar 23 20:16:51 Pali: hmm, I don't think a new kernel changes much for rescueOS, but what did you change? Mar 23 20:17:02 some in init scripts Mar 23 20:17:26 /etc/init.d/rcS Mar 23 20:17:30 Pali: I'll create a git repo with all configs and scripts. Mar 23 20:17:41 Pali: hi. I have a problem which might be related to your patches to audio policy. Mar 23 20:17:43 you can make a pull request then, is this ok? Mar 23 20:17:55 NIN101, ok Mar 23 20:18:14 freemangordon, where is problem? Mar 23 20:18:17 in prolog? Mar 23 20:18:34 Pali: volume is set to zero, with fmtx enabled and BT HF attached, after I end a phone call Mar 23 20:19:06 Pali: But I am not sure if it is not HF itself, I lost my old one, this one is new. Mar 23 20:19:21 Pali: I installed everything from cssu-devel :) Mar 23 20:19:39 Pali: which package I should downgrade to verify where is the problem? Mar 23 20:19:52 freemangordon, try to downgrade policy-settings-rx51 Mar 23 20:19:59 Pali: ok, I will Mar 23 20:20:26 this contains prolog file and alsaped config which was changed Mar 23 20:22:29 NIN101, my changes: add my userspace watchdog kicker (usefull for kernel with nowayout=1), handle power button (to turn off device), fix brightness sysfs (in 3.9 kernel it has same names as in maemo 2.6.28) Mar 23 20:23:57 Pali: hmm, why CSSU-T and cssu-devel contain one and the same version? didn't you push a newer in -devel? Mar 23 20:24:32 freemangordon: as I remember it's one time (quiet old) fix Mar 23 20:24:47 oh oh, 0bytes free in my phone Mar 23 20:25:03 freemangordon, policy-settings-rx51 was compiled by cssuT by merlin1991 Mar 23 20:25:25 downgrade to nokia version Mar 23 20:25:39 Pali: but then it couldn't be policy-settings-rx51 at fault Mar 23 20:25:51 if it is in cssu-t since forever Mar 23 20:26:10 no wonder winscp was showing errors Mar 23 20:26:55 freemangordon, only that package was changed for audio policy Mar 23 20:27:42 hmm, we had a bug then :( Mar 23 20:27:53 however, I'll test with stock Mar 23 20:30:40 freemangordon: fell free to create new bug (but first take a look in old bugs - I remember there is one with BT + jack) Mar 23 20:30:58 Pali: cool. Will most likely include some of it in 1.1 (doing 1.0 now, and want to release it first) Mar 23 20:31:51 luf: it was working fine with my old HF. just downgraded, will test for a while to see if it makes any difference Mar 23 20:33:56 luf: it is the same :( Mar 23 20:34:52 though i should find a wait to reliably reproduce it Mar 23 20:35:43 NIN101: please consider that some users might want to modprobe somecruft.ko of injured system on rescueOS Mar 23 20:36:48 for example if /home was on $leete-new-fs.ko Mar 23 20:37:57 absolutely no stringent rationale why for a rescueOS you'd need bleeding-edge kernel Mar 23 20:40:03 so you mean it should run on maemo's 2.6.28? Mar 23 20:40:51 luf: hmm, that bug might be a PEBKAC :D Mar 23 20:41:13 ~PEBKAC Mar 23 20:41:13 PEBKAC: Problem Exists Between Keyboard And Chair. Mar 23 20:41:50 freemangordon: I'm curious which "that" bug :D Mar 23 20:41:57 luf: it seems I have accidentaly set volume in mplayer to zero Mar 23 20:42:08 freemangordon: good for you ... Mar 23 20:42:33 will test for a while to see if that was the problem :) Mar 23 20:42:52 freemangordon: two days ago I reported problem in one repository while I wrongly excluded packages using *something* :D Mar 23 20:43:10 in any case, I simply can't be bothered to make it fly with 2.6.28 now. Whoever uses somecruft.ko can go into mass storage mode and mount his stuff on his computer. Mar 23 20:43:53 luf: but hey, now you know what PEBKAC is :D Mar 23 20:45:02 freemangordon: I know such kind of "bugs" for very long time ;) But not in english ... Mar 23 20:51:13 ok, wtf Mar 23 20:51:27 this is UTF-16 or UCS-2 or wchar_t Mar 23 20:51:37 but it doesn't make any sense Mar 23 20:51:52 it's definitely not english Mar 23 20:52:25 for the sake of the logs, the madness starts at 0x00049010 in mcusw Mar 23 20:59:47 eddyb: IDA? Mar 23 21:00:07 nope Mar 23 21:00:10 radare2 Mar 23 21:00:28 the DSP code is not ARM nor Thumb, so I won't bother Mar 23 21:00:45 DSP? Mar 23 21:01:02 someone just told me IDA has some support for DSPs. but I won't try now Mar 23 21:02:11 hmm, seems I am missing something, but what DSP has to do with cmt FW? Mar 23 21:02:42 or it is not THAT DSP :) Mar 23 21:02:50 C64x Mar 23 21:03:41 freemangordon: about a third of the firmware is code for some internal DSP Mar 23 21:04:03 aah, ok, not THAT dsp then :D Mar 23 21:06:16 * kerio would be hard pressed to find a fs driver for linux that's not in mainline Mar 23 21:06:22 and FUSE doesn't count Mar 23 21:15:31 freemangordon: cmt DSP Mar 23 21:16:09 or probably rather "the radio stack" Mar 23 21:17:20 DocScrutinizer05: yeah, got it. It is just that when I read DSP in the context of n900 I always think about C64x Mar 23 21:18:39 freemangordon: eddybthinks since RE of cmt firmware is particularly difficult and particularly cumbersome, it must be particularly useful ;-D Mar 23 21:19:47 I still haven't heard what purpose a RE'ed cmt firmware would serve Mar 23 21:21:00 DocScrutinizer05: hmm. do you think a RE'd wl1251 firmware would serve any purpose? Mar 23 21:48:38 kerio, reiser4? Mar 23 21:49:35 eddyb, wl1251 FW does not have AP mode support Mar 23 21:49:49 but wl1251 HW has some AP support... Mar 23 21:53:23 Pali: oh come on, nobody uses reiser4 Mar 23 21:53:30 :D Mar 23 21:53:43 kerio, or spadfs Mar 23 21:55:25 anyway, reiser4 isn't supported by kernel-power anyway Mar 23 21:55:40 and neither is spadfs Mar 23 21:56:26 kerio: tux3 Mar 23 21:59:14 I WAS EXAGGERATING TO EXPLAIN MY POINT I WASN'T FACTUAL Mar 23 22:02:18 aaaha Mar 23 22:02:51 so after removed the 0 byte after each char in that weird part of the DSP code, I got things like this Mar 23 22:02:53 rEor:r Mar 23 22:03:02 can you guess what is wrong with this picture? Mar 23 22:03:19 endianness? Mar 23 22:03:47 except... why would endianness affect strings? Mar 23 22:04:21 it affects the order of bytes in words Mar 23 22:04:28 each pair of chars are swapped Mar 23 22:04:40 Flyser: who would load two chars in one word? Mar 23 22:04:48 UTF16? Mar 23 22:04:52 no Mar 23 22:04:54 embedded be wack, yo Mar 23 22:05:01 that's one char in one half-word Mar 23 22:05:20 and it doesn't matter if it's little or big endian, as long as it's latin-1 Mar 23 22:05:29 you just remove the extra zeroes in between Mar 23 22:05:57 sounds a lot like utf16 to me Mar 23 22:06:02 yeah Mar 23 22:06:16 but UTF16 doesn't swap every two chars Mar 23 22:06:25 that's the weird thing here Mar 23 22:07:16 yeah .. endianess Mar 23 22:07:21 dude Mar 23 22:07:28 even if you load two chars at once, when you put them anywhere else, they will still be out of order Mar 23 22:08:01 one char is two bytes. four byte endianness is meaningless to the string Mar 23 22:09:28 I think you mix things up a but. Just because one char is two bytes, it does not mean it is not affected by endianess Mar 23 22:10:13 Flyser: no I don't Mar 23 22:10:45 eddyb: how the ~fixribbon go? Mar 23 22:10:54 sixwheeledbeast: great, thanks! :D Mar 23 22:10:59 sixwheeledbeast: it's alive again :) Mar 23 22:11:32 Flyser: as long as you don't explicitly swap the order of the bytes/half-words yourself, they will remain that way Mar 23 22:11:46 gd gd, did you have issues with the screws? Mar 23 22:12:36 sixwheeledbeast: once my uncle came around I found a good screwdriver that worked even for the screws that didn't look too good Mar 23 22:12:53 did you source new screws? Mar 23 22:12:58 nope Mar 23 22:13:40 ok, I haven't managed to remove my damaged screw the stud is still poking out. Mar 23 22:13:52 thing is... Mar 23 22:13:55 I lost one screw Mar 23 22:14:01 it was the worse looking one Mar 23 22:14:31 It's in there solid I doubt I can get it out. Mar 23 22:14:33 but it felt pretty tight even with 5 screws Mar 23 22:14:50 one screw missing will be ok, 5 left Mar 23 22:15:18 wouldn't be that good if it was the opposite Mar 23 22:16:53 eh, 1 out of 6 screws? wouldn't happen. need a minimum of 2 screws or the slider would fail Mar 23 22:17:47 soooo Mar 23 22:19:20 mcusw contains NOLO, DSP0 and MCUSW Mar 23 22:27:53 http://206.253.166.96/N900/rescueOS/ released... Mar 23 23:34:16 anybody alive over here? :) Mar 23 23:39:59 wait, now rescueOS is 1.0? Mar 23 23:40:02 hahahahahahahahahahaha Mar 23 23:40:45 kerio Mar 23 23:47:42 hi Mar 23 23:48:02 what packages are required to install rescueos? Mar 23 23:57:37 amospalla: it's not something to install Mar 23 23:58:07 kerio: yes, I mean, any installable package it depends on, like something related to multiboot Mar 23 23:58:34 I have bootmenu installed Mar 23 23:58:57 but I'm afraid to install anything new Mar 23 23:59:38 can someone help me with a problem that I have Mar 23 23:59:49 although, it's harmattan related though Mar 24 00:00:00 (guys at #harmattan are asleep I gues) Mar 24 00:00:48 http://talk.maemo.org/showthread.php?p=1331232#post1331232 Mar 24 00:04:38 amospalla: it's not something you install on a n900 Mar 24 00:04:51 at least, it's not intended to be as such Mar 24 00:05:20 kerio: yeah, right, but, can I put it on my n900 without any multiboot thing? that is what I mean Mar 24 00:06:58 like kernel-power-bootimg or multiboot package **** ENDING LOGGING AT Sun Mar 24 02:59:58 2013