what malac0da13 said is quite interessting:
you find the sourcecode of 2nd-init here http://and-developers.com/2ndinit

does anyone did something similiar to this approach?
during recovery mode it should be possible or?


Maybe http://xvilka.github.com/2ndboot-ng/ is also useful!

[Question:]
Is it ...

This is a update for everyone who want to dump the NAND extern.

I did the first dump with dd, but that isn't very clever and good.
There exists a package mtd-utils which has nanddump included:

Usage: nanddump [OPTIONS] MTD-device
Dumps the contents of a nand mtd partition.

--help Display this ...

yes, please upload it
saw the assembler stuff in the wiki pages, but no binary and hexdump isn't right format for IDA ...
i think it is the same as the pic24.hex which is in the rootfile system

after my opinion the pic is updateable by a bootloader over uart.

think that is the same chip i meant

it has a few things more to do than just control power up ...

we do not know what is enabled and what not!
We have to digg deeper into cefdk but this is time intensive and my take some time ...

feel free to help


Update:
0B B0 AD DE 0F 00 01 A9 this is also used by the MBR file which Intel delivers.
Also the mentioned header is the same as the demo cefdk ...

So new version for splitting dump:
#!/bin/bash
# copyright: pcgeil
# (c) 2011 progged for GTV revue

echo "progged for gtv revue by pcgeil (c) 2011"
echo "revision 0.1"
echo ""

dumpFile="nand.dump"

outputDir="dump"
outputName=${outputDir}"/test"

# bash check if directory exists
if [ -d ...

ok, few hours of sleep I found something quite interessting:
the following lines are the start of the cefdk version:
06 00 00 00 A1 00 00 00 00 00 01 00 01 00 00 00
86 80 00 00 30 03 10 20 41 3F 00 00 40 00 00 00
40 00 00 00 01 00 00 00 80 05 00 00 80 04 00 00
if you take kernel.img or recovery ...

Hi,
i found out, that the pic24 communicates with maybe the cpu over uart.
Some more information you find here and also the pinout i found out.


Pin1
Pin2 - D7 LED(green) see (*1)
Pin3
Pin4
Pin5
Pin6 - GND
Pin7 - VDDCORE
Pin8
Pin9
Pin10

Pin11
Pin12
Pin13
Pin14
Pin15 - paaring switch see (*1)
Pin16 ...

from 0x20800 to 0x2F7FF also non-zeros, no strings at the end

from 0x30000 to 0x0x3069b also non zeros

from 0x30d00 to 0x3120e non-zeros

from 0x31400 to 0x31D1F non-zeros

from 0x32000 to 0x3217C non-zeros

and so on ...

from 0x34800 to 0x34994:

Intel Lincroft SCH Microcode Version 000.064d ...

This thread should be about the cefdk out of the following archive:
439c26f6af05.mp-signed-ota_update-b39389.zip

the link can be found in the wiki.
This cefdk is not encrypted as the honeycomb one and you can see strings in the hexeditor.
So anyone who has tried to dissasemble it, please share your ...