Exploitee.rs

Posted: **Sat Sep 03, 2011 7:56 am**

Hi,
i found out, that the pic24 communicates with maybe the cpu over uart.
Some more information you find here and also the pinout i found out.

Pin1
Pin2 - D7 LED(green) see (*1)
Pin3
Pin4
Pin5
Pin6 - GND
Pin7 - VDDCORE
Pin8
Pin9
Pin10

Pin11
Pin12
Pin13
Pin14
Pin15 - paaring switch see (*1)
Pin16 - GND
Pin17 - VCC
Pin18 - !MCLR available on J3
Pin19 - PGD available on J3
Pin20 - PFC available on J3

Pin21
Pin22
Pin23
Pin24 - UART (setting 9600 baud)
Pin25
Pin26
Pin27
Pin28 - VDD
Pin29 - GND
Pin30

Pin31 - OSCO (8 MHz)
Pin32 - OSCI (8 MHz)
Pin33
Pin34
Pin35
Pin36
Pin37 - IR-leds see (*1)
Pin38 - D8 LED(green) see (*1)
Pin39 - GND
Pin40 - VDD

Pin41 - IR-reciever see (*1)
Pin42
Pin43
Pin44 -

(*1) look at post http://forum.gtvhacker.com/revue/topic132.html

When sniffing Pin24, you get an output like this:

Code: Select all

....3.0..3.0.0.0031.22.0.:..):..).

as hex it is this:

Code: Select all

EB D2 D2 00 33 2E 30 2E 0F 33 2E 30 2E 30 2E 30
30 33 31 2E 32 32 00 30
30 3A 9D 10 29 3A 9D 10 29 FA FA FA FA D2 D2 D2 D2 D2 D2 D2 D2 D2 D2 D2 D2

You get EB when pressing button and when pressing longer then you get few ms later D2.
This is the output

Code: Select all

0F 33 2E 30 2E 30 2E 30
30 33 31 2E 32 32 00 30

when you restart and the rest is during getting logitech animation film.

Posted: **Mon Sep 12, 2011 4:31 am**

Which PIC chip is this? There is a PIC on board that I was able to dump a full hex data from it using my PIC Kit Dev kit but we couldnt do much with it. I think it was just a chip to control power.

Posted: **Mon Sep 12, 2011 7:36 am**

think that is the same chip i meant

it has a few things more to do than just control power up ...

Posted: **Wed Sep 14, 2011 4:57 am**

If you want the hex dump of the file I think I still have it. I couldnt decipher it and we just guessed it was just a power management chip and nothing else

Posted: **Wed Sep 14, 2011 5:44 am**

yes, please upload it

saw the assembler stuff in the wiki pages, but no binary and hexdump isn't right format for IDA ...
i think it is the same as the pic24.hex which is in the rootfile system

after my opinion the pic is updateable by a bootloader over uart.

Posted: **Sun Oct 23, 2011 10:58 am**

Sorry for the horrible late reply. I have been out of town for work for the past few weeks.

Here is a dump of the PIC chip

http://dl.dropbox.com/u/217678/Bootload ... %20PIC.TXT

Ignore the name of the file, Its just what i named it when I first got it

Exploitee.rs

PIC24 pinout

PIC24 pinout

Re: PIC24 pinout

Re: PIC24 pinout

Re: PIC24 pinout

Re: PIC24 pinout

Re: PIC24 pinout