Zotty
26th February 2008, 22:36
After playing around with the xbox360 HD DVD drive I thought it would be fun to play with a standalone player. So I've managed to get my hands on a cheap Toshiba HD-EP30 and started gathering information on it's hard- and firmware. However I quickly came to the conclusion these require a different approach than the xbox addon.
Hardware is much better protected, since the flash chips have black glue blobs on their pins. Also part of the address/databus is protected the same way.
So far I've identified some of the chips and their purpose. It has multiple processing units, even inside single chips. These's little or no information available and the important ones are MIPS based, which doesn't make it any easier.
As for the firmware, the flash is locked onto the main PCB with pins protected, so not a change of getting the code out by reading the flash. So I started looking at the firmware downloadable from the net (the iso images). These contain a header with section and offset info and a SHA-1 hash. For the moment I'm assuming each section serves a specific controller and/or core.
The actuall firmware appears to be encrypted. From what I've seen this is true for all recent Toshiba players, not just the EP30. No idea what was used for encrypting this, but I'd very much like to decrypt it. Once decrypted it could yields a lot more information about how these things work and possibly allow us to modify it.
As with earlier models this one appears to run on Linux (documentation mentions the Linux kernel, busybox, glibc, openssl and freetype).
So basicly is anyone else willing to help out and get into these standalones? I've placed the things I've found so far online: hardware (http://www.decrypthd.org/wiki/Toshiba_EP30_hardware) and firmware (http://www.decrypthd.org/wiki/Toshiba_EP30).
Hardware is much better protected, since the flash chips have black glue blobs on their pins. Also part of the address/databus is protected the same way.
So far I've identified some of the chips and their purpose. It has multiple processing units, even inside single chips. These's little or no information available and the important ones are MIPS based, which doesn't make it any easier.
As for the firmware, the flash is locked onto the main PCB with pins protected, so not a change of getting the code out by reading the flash. So I started looking at the firmware downloadable from the net (the iso images). These contain a header with section and offset info and a SHA-1 hash. For the moment I'm assuming each section serves a specific controller and/or core.
The actuall firmware appears to be encrypted. From what I've seen this is true for all recent Toshiba players, not just the EP30. No idea what was used for encrypting this, but I'd very much like to decrypt it. Once decrypted it could yields a lot more information about how these things work and possibly allow us to modify it.
As with earlier models this one appears to run on Linux (documentation mentions the Linux kernel, busybox, glibc, openssl and freetype).
So basicly is anyone else willing to help out and get into these standalones? I've placed the things I've found so far online: hardware (http://www.decrypthd.org/wiki/Toshiba_EP30_hardware) and firmware (http://www.decrypthd.org/wiki/Toshiba_EP30).