RJMENDEZ

RJMENDEZ

Semi-professional trial and error coder, crafter of artisanal fuck-ups.

ViaSat rm4100 Memory Dump

16 minute read

Published:

This is part of a series on reversing the ViaSat rm4100 satellite modem.

Hardware

Dumping Contents

Flash

Flash in programmer

vm dumping memory

We will dump this a few times to make sure we aren’t getting a different image

rjmendez@MrPink:~/viasat_rm4100$ sha256sum rm4100_mx29gl256flt2i-90q_*.bin
307930781d32c3c5575bcc477c416f7d2d83d073d29172dd050aec1ff519fca7  rm4100_mx29gl256flt2i-90q_0.bin
307930781d32c3c5575bcc477c416f7d2d83d073d29172dd050aec1ff519fca7  rm4100_mx29gl256flt2i-90q_1.bin
307930781d32c3c5575bcc477c416f7d2d83d073d29172dd050aec1ff519fca7  rm4100_mx29gl256flt2i-90q_2.bin
307930781d32c3c5575bcc477c416f7d2d83d073d29172dd050aec1ff519fca7  rm4100_mx29gl256flt2i-90q_3.bin

Lets see what we have with strings:

rjmendez@MrPink:~/viasat_rm4100$ strings -n 40 rm4100_mx29gl256flt2i-90q_0.bin | head
## #REOR R## #lPaeesR SETEt ehb aodr# ##
PI Dabkcrpseuserw roakornu devirifde ,otko%  dolpo
PI Dabkcrpseuserw roakornu dAFLIDEv reifacitno .dAujtso tcoe_npi_dpbe_anlb(e )of rhtsic ih!p
PI Dabkcrpseuserw roakornu dAFLIDE .dAujtso tcoe_npi_dpbe_anlb(e )of rhtsic ih!p
CPeI :lAgiingnT PLc uotnre sO(TUP_C_UOTN%=)d
AFAT:LE rrroi initlazini grfeem mero yilts
REOR:RU anlb eota llcota eemomyrf roh ae.p.. .1(
REOR:RU anlb eota llcota eobtooldarer sereev demomyr( dard :x0x% ,isez :x0x%.)
AWNRNI:GN  oeresvrdem mero yof rmiga eoldani.g
REOR:RU anlb eota llcota eilun xeresvrdem mero ya(dd:r0 %x,xs zi:e0 %x)x

That isn’t quite right, it looks like our data is out of order. We can use dd (The DISK DESTROYER) to swap these around.

rjmendez@MrPink:~/viasat_rm4100$ dd conv=swab if=rm4100_mx29gl256flt2i-90q_0.bin of=rm4100_mx29gl256flt2i-90q_0.bin.swapbytes
65536+0 records in
65536+0 records out
33554432 bytes (34 MB, 32 MiB) copied, 0.185042 s, 181 MB/s
rjmendez@MrPink:~/viasat_rm4100$ strings -n 40 rm4100_mx29gl256flt2i-90q_0.bin.swapbytes | head
### ERROR ### Please RESET the board ###
IPD backpressure workaround verified, took %d loops
IPD backpressure workaround FAILED verfication. Adjust octeon_ipd_bp_enable() for this chip!
IPD backpressure workaround FAILED. Adjust octeon_ipd_bp_enable() for this chip!
PCIe: Aligning TLP counters (OUT_P_COUNT=%d)
FATAL: Error initializing free memory list
ERROR: Unable to allocate memory for heap.... (1)
ERROR: Unable to allocate bootloader reserved memory (addr: 0x%x, size: 0x%x).
WARNING: No reserved memory for image loading.
ERROR: Unable to allocate linux reserved memory (addr: 0x%x, size: 0x%x).

Much better! Now we can start looking at what we have besides strings from what looks like uboot.

Extracting Data

Binwalk does a pretty great job, it does have some “trouble” sometimes, its always a good idea to verify what its telling you with a hex editor.

rjmendez@MrPink:~/viasat_rm4100$ binwalk -E rm4100_mx29gl256flt2i-90q_0.bin.swapbytes

DECIMAL       HEXADECIMAL     ENTROPY
--------------------------------------------------------------------------------
0             0x0             Falling entropy edge (0.668093)
524288        0x80000         Rising entropy edge (0.994561)
14368768      0xDB4000        Falling entropy edge (0.810862)
14417920      0xDC0000        Rising entropy edge (0.997903)
14811136      0xE20000        Falling entropy edge (0.606425)
15073280      0xE60000        Rising entropy edge (0.997149)
15089664      0xE64000        Falling entropy edge (0.103024)
15204352      0xE80000        Rising entropy edge (0.994314)
29081600      0x1BBC000       Falling entropy edge (0.795012)
29097984      0x1BC0000       Rising entropy edge (0.997356)
29786112      0x1C68000       Falling entropy edge (0.634911)
30031872      0x1CA4000       Falling entropy edge (0.752746)
30146560      0x1CC0000       Rising entropy edge (0.980162)
30162944      0x1CC4000       Falling entropy edge (0.815836)
30310400      0x1CE8000       Rising entropy edge (0.984965)
30326784      0x1CEC000       Falling entropy edge (0.801491)
30408704      0x1D00000       Rising entropy edge (0.993756)
30539776      0x1D20000       Falling entropy edge (0.001377)
30670848      0x1D40000       Rising entropy edge (0.994107)
30801920      0x1D60000       Falling entropy edge (0.001377)
30932992      0x1D80000       Rising entropy edge (0.994297)
31195136      0x1DC0000       Falling entropy edge (0.001377)
31326208      0x1DE0000       Rising entropy edge (0.993585)
31883264      0x1E68000       Rising entropy edge (0.993771)
31981568      0x1E80000       Falling entropy edge (0.001377)
32112640      0x1EA0000       Rising entropy edge (0.979396)
32145408      0x1EA8000       Rising entropy edge (0.977967)
32227328      0x1EBC000       Falling entropy edge (0.790373)
32571392      0x1F10000       Falling entropy edge (0.819581)
33030144      0x1F80000       Rising entropy edge (0.995752)
33046528      0x1F84000       Falling entropy edge (0.825947)
33161216      0x1FA0000       Falling entropy edge (0.001377)
33292288      0x1FC0000       Rising entropy edge (0.970452)
33308672      0x1FC4000       Falling entropy edge (0.802592)
33374208      0x1FD4000       Rising entropy edge (0.983023)
33390592      0x1FD8000       Falling entropy edge (0.845397)
33406976      0x1FDC000       Rising entropy edge (0.971143)
33423360      0x1FE0000       Falling entropy edge (0.000000)

Binwalk entropy graph

rjmendez@MrPink:~/viasat_rm4100$ binwalk rm4100_mx29gl256flt2i-90q_0.bin.swapbytes

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
207598        0x32AEE         U-Boot version string, "U-Boot 1.1.1)"
236424        0x39B88         CRC32 polynomial table, big endian
524308        0x80014         gzip compressed data, from Unix, last modified: 1970-01-01 00:00:00 (null date)
2923835       0x2C9D3B        HPACK archive data
15073280      0xE60000        gzip compressed data, from Unix, last modified: 2016-04-22 21:22:24
15204372      0xE80014        gzip compressed data, from Unix, last modified: 1970-01-01 00:00:00 (null date)
29884416      0x1C80000       POSIX tar archive (GNU)

That kind of makes sense, the entropy still looks a little weird for a tar file though.

01c6a100  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
*
01c80000  63 65 72 74 73 2f 00 00  00 00 00 00 00 00 00 00  |certs/..........|
01c80010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
01c80060  00 00 00 00 30 30 30 30  37 35 35 00 30 30 30 30  |....0000755.0000|
01c80070  30 30 30 00 30 30 30 30  30 30 30 00 30 30 30 30  |000.0000000.0000|
01c80080  30 30 30 30 30 30 30 00  31 31 33 31 37 32 33 35  |0000000.11317235|
01c80090  34 33 32 00 30 31 30 36  37 35 00 20 35 00 00 00  |432.010675. 5...|
01c800a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
01c80100  00 75 73 74 61 72 20 20  00 72 6f 6f 74 00 00 00  |.ustar  .root...|
01c80110  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
01c80120  00 00 00 00 00 00 00 00  00 72 6f 6f 74 00 00 00  |.........root...|
01c80130  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

Seems okay.

01c823e0  52 54 49 46 49 43 41 54  45 2d 2d 2d 2d 2d 0d 0a  |RTIFICATE-----..|
01c823f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
01c82800  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
*
01ca0000  19 85 20 03 00 00 00 0c  f0 60 dc 98 19 85 e0 01  |.. ......`......|
01ca0010  00 00 00 2b 3e 42 24 27  00 00 00 01 00 00 00 00  |...+>B$'........|
01ca0020  00 00 00 02 4b 3d 3b 27  03 04 00 00 1b b9 c8 52  |....K=;'.......R|
01ca0030  72 73 02 ec 63 61 6c ff  19 85 e0 02 00 00 00 44  |rs..cal........D|

This looks like JFFS2 magic bytes.

rjmendez@MrPink:~/viasat_rm4100$ dd skip=30015488 count=3538944 bs=1 if=rm4100_mx29gl256flt2i-90q_0.bin.swapbytes of=rm4100_mx29gl256flt2i-90q_0.bin.swapbytes.0x000001ca0000-0x000002000000
3538944+0 records in
3538944+0 records out
3538944 bytes (3.5 MB, 3.4 MiB) copied, 6.12366 s, 578 kB/s
rjmendez@MrPink:~/viasat_rm4100$ hd rm4100_mx29gl256flt2i-90q_0.bin.swapbytes.0x000001ca0000-0x000002000000 | head
00000000  19 85 20 03 00 00 00 0c  f0 60 dc 98 19 85 e0 01  |.. ......`......|
00000010  00 00 00 2b 3e 42 24 27  00 00 00 01 00 00 00 00  |...+>B$'........|
00000020  00 00 00 02 4b 3d 3b 27  03 04 00 00 1b b9 c8 52  |....K=;'.......R|
00000030  72 73 02 ec 63 61 6c ff  19 85 e0 02 00 00 00 44  |rs..cal........D|
00000040  a4 ef 22 3e 00 00 00 02  00 00 00 01 00 00 41 ed  |..">..........A.|
00000050  00 00 00 00 00 00 00 00  4b 3d 3b 27 4b 3d 3b 27  |........K=;'K=;'|
00000060  4b 3d 3b 27 00 00 00 00  00 00 00 00 00 00 00 00  |K=;'............|
00000070  00 00 00 00 00 00 00 00  2e 11 1b 8a 19 85 e0 01  |................|
00000080  00 00 00 2e 4e 28 d0 a8  00 00 00 01 00 00 00 01  |....N(..........|
00000090  00 00 00 03 4b 3d 3b 27  06 04 00 00 73 11 ea c1  |....K=;'....s...|
rjmendez@MrPink:~/viasat_rm4100$ hd rm4100_mx29gl256flt2i-90q_0.bin.swapbytes.0x000001ca0000-0x000002000000 | tail
0035ebe0  69 6d 61 67 65 3d 31 00  73 77 31 5f 73 69 7a 65  |image=1.sw1_size|
0035ebf0  3d 64 33 65 63 36 31 00  00 6d 61 67 65 3d 30 00  |=d3ec61..mage=0.|
0035ec00  73 77 30 5f 73 69 7a 65  3d 64 32 36 37 33 36 00  |sw0_size=d26736.|
0035ec10  00 30 00 73 77 30 5f 73  69 7a 65 3d 64 32 36 37  |.0.sw0_size=d267|
0035ec20  33 36 00 00 61 67 65 3d  30 00 73 77 30 5f 73 69  |36..age=0.sw0_si|
0035ec30  7a 65 3d 64 32 36 37 33  36 00 00 73 77 30 5f 73  |ze=d26736..sw0_s|
0035ec40  69 7a 65 3d 64 32 36 37  33 36 00 00 00 00 00 00  |ize=d26736......|
0035ec50  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00360000

Seems we got some bonus uboot env settings at the tail as well. :D Time to see what binwalk can extract! We will start with the following.

rjmendez@MrPink:~/viasat_rm4100$ binwalk -Me rm4100_mx29gl256flt2i-90q_0.bin.swapbytes

And

rjmendez@MrPink:~/viasat_rm4100$ binwalk -Me rm4100_mx29gl256flt2i-90q_0.bin.swapbytes.0x000001ca0000-0x000002000000

Here’s what we got out.

rjmendez@MrPink:~/viasat_rm4100$ ls _rm4100_mx29gl256flt2i-90q_0.bin.swapbytes.0x000001ca0000-0x000002000000.extracted/jffs2-root -Rlat
_rm4100_mx29gl256flt2i-90q_0.bin.swapbytes.0x000001ca0000-0x000002000000.extracted/jffs2-root:
total 76
drwxr-xr-x 19 rjmendez rjmendez 69632 Sep  4 01:24 ..
drwxr-xr-x  3 rjmendez rjmendez  4096 Sep  4 01:24 .
drwxr-xr-x  5 rjmendez rjmendez  4096 Sep  4 01:24 fs_1

_rm4100_mx29gl256flt2i-90q_0.bin.swapbytes.0x000001ca0000-0x000002000000.extracted/jffs2-root/fs_1:
total 44
drwxr-xr-x 5 rjmendez rjmendez 4096 Sep  4 01:24 .
drwxr-xr-x 3 rjmendez rjmendez 4096 Sep  4 01:24 ..
-rw-r--r-- 1 rjmendez rjmendez    3 Sep  4 01:24 .boot-count
drwxr-xr-x 2 rjmendez rjmendez 4096 Sep  4 01:24 cal
drwxr-xr-x 2 rjmendez rjmendez 4096 Sep  4 01:24 config
-rw-rw-rw- 1 rjmendez rjmendez   86 Sep  4 01:24 .fileParserHash
-rw-r--r-- 1 rjmendez rjmendez   14 Sep  4 01:24 .flash_stats
-rw-rw-rw- 1 rjmendez rjmendez   11 Sep  4 01:24 .installed_date
drwxr-xr-x 2 rjmendez rjmendez 4096 Sep  4 01:24 logs
-rw-r--r-- 1 rjmendez rjmendez   46 Sep  4 01:24 .odometer
-rw-r--r-- 1 rjmendez rjmendez  108 Sep  4 01:24 vwa_memdb_perf.txt

_rm4100_mx29gl256flt2i-90q_0.bin.swapbytes.0x000001ca0000-0x000002000000.extracted/jffs2-root/fs_1/cal:
total 16
drwxr-xr-x 2 rjmendez rjmendez 4096 Sep  4 01:24 .
drwxr-xr-x 5 rjmendez rjmendez 4096 Sep  4 01:24 ..
-rw-r--r-- 1 rjmendez rjmendez 1000 Sep  4 01:24 ad9743_aux
-rw-r--r-- 1 rjmendez rjmendez  382 Sep  4 01:24 TXPower.txt

_rm4100_mx29gl256flt2i-90q_0.bin.swapbytes.0x000001ca0000-0x000002000000.extracted/jffs2-root/fs_1/config:
total 156
drwxr-xr-x 2 rjmendez rjmendez  4096 Sep  4 01:24 .
drwxr-xr-x 5 rjmendez rjmendez  4096 Sep  4 01:24 ..
-rw-r--r-- 1 rjmendez rjmendez  8192 Sep  4 01:24 .boot.env
-rw-r--r-- 1 rjmendez rjmendez  1401 Sep  4 01:24 dailystats
-rw-r--r-- 1 rjmendez rjmendez     2 Sep  4 01:24 .HW_ID
-rw-rw-rw- 1 rjmendez rjmendez  1086 Sep  4 01:24 lkg-fwd.conf
-rw-rw-rw- 1 rjmendez rjmendez  5579 Sep  4 01:24 lkg-ret.conf
-rw-r--r-- 1 rjmendez rjmendez    18 Sep  4 01:24 .MAC_addr
-rw-rw-rw- 1 rjmendez rjmendez 48415 Sep  4 01:24 outage_hist
-rw-r--r-- 1 rjmendez rjmendez    11 Sep  4 01:24 .part_number
-rwxr-xr-x 1 rjmendez rjmendez 57875 Sep  4 01:24 sat-info
-rw-r--r-- 1 rjmendez rjmendez    13 Sep  4 01:24 .serial_number

_rm4100_mx29gl256flt2i-90q_0.bin.swapbytes.0x000001ca0000-0x000002000000.extracted/jffs2-root/fs_1/logs:
total 1124
drwxr-xr-x 2 rjmendez rjmendez    4096 Sep  4 01:24 .
drwxr-xr-x 5 rjmendez rjmendez    4096 Sep  4 01:24 ..
-rw-r--r-- 1 rjmendez rjmendez 1139188 Sep  4 01:24 ut_X_2016-07-22T134139_<SNIP>.tar.gz

And

rjmendez@MrPink:~/viasat_rm4100$ ls -laht _rm4100_mx29gl256flt2i-90q_0.bin.swapbytes.extracted/
total 55M
drwxr-xr-x 3 rjmendez rjmendez 4.0K Sep  4 01:34 _E80014.extracted
drwxr-xr-x 3 rjmendez rjmendez 4.0K Sep  4 01:33 _80014.extracted
drwxr-xr-x 5 rjmendez rjmendez 4.0K Sep  4 01:33 .
-rw-r--r-- 1 rjmendez rjmendez 3.5M Sep  4 01:33 1C80000.tar
-rw-r--r-- 1 rjmendez rjmendez  17M Sep  4 01:33 E80014
-rw-r--r-- 1 rjmendez rjmendez  18M Sep  4 01:33 E60000.gz
-rw-r--r-- 1 rjmendez rjmendez  17M Sep  4 01:33 80014
drwxr-xr-x 6 rjmendez rjmendez 4.0K Sep  4 01:33 ..
drwxr-xr-x 2 rjmendez rjmendez 4.0K Dec 31  2009 certs
rjmendez@MrPink:~/viasat_rm4100$ ls -laht _rm4100_mx29gl256flt2i-90q_0.bin.swapbytes.extracted/certs/
total 24K
drwxr-xr-x 5 rjmendez rjmendez 4.0K Sep  4 01:33 ..
-rwxr-xr-x 1 rjmendez rjmendez  902 Nov 29  2014 Client_privKey.pem
-rwxr-xr-x 1 rjmendez rjmendez 2.5K Oct  7  2014 Client_Cert.pem
-rwxr-xr-x 1 rjmendez rjmendez 1.4K Oct  7  2014 TrustList.pem
-rwxr-xr-x 1 rjmendez rjmendez 1.4K Jun 18  2010 NAP_Cert.pem
drwxr-xr-x 2 rjmendez rjmendez 4.0K Dec 31  2009 .
rjmendez@MrPink:~/viasat_rm4100$ ls -laht _rm4100_mx29gl256flt2i-90q_0.bin.swapbytes.extracted/_E80014.extracted/
total 28M
drwxr-xr-x 3 rjmendez rjmendez 4.0K Sep  4 01:34 _65E318.extracted
drwxr-xr-x 3 rjmendez rjmendez 4.0K Sep  4 01:34 .
-rw-r--r-- 1 rjmendez rjmendez  28M Sep  4 01:33 65E318
-rw-r--r-- 1 rjmendez rjmendez  55K Sep  4 01:33 4485B8
drwxr-xr-x 5 rjmendez rjmendez 4.0K Sep  4 01:33 ..
rjmendez@MrPink:~/viasat_rm4100$ ls -laht _rm4100_mx29gl256flt2i-90q_0.bin.swapbytes.extracted/_E80014.extracted/_65E318.extracted/
total 28M
drwxr-xr-x 17 rjmendez rjmendez 4.0K Sep  4 01:34 cpio-root
drwxr-xr-x  3 rjmendez rjmendez 4.0K Sep  4 01:34 .
-rw-r--r--  1 rjmendez rjmendez  28M Sep  4 01:34 0.cpio
drwxr-xr-x  3 rjmendez rjmendez 4.0K Sep  4 01:34 ..
rjmendez@MrPink:~/viasat_rm4100$ ls -laht _rm4100_mx29gl256flt2i-90q_0.bin.swapbytes.extracted/_E80014.extracted/_65E318.extracted/cpio-root/
total 2.1M
drwxr-xr-x  9 rjmendez rjmendez 4.0K Sep  4 01:34 etc
drwxr-xr-x  3 rjmendez rjmendez 4.0K Sep  4 01:34 lib32
drwxr-xr-x  2 rjmendez rjmendez 4.0K Sep  4 01:34 sbin
drwxr-xr-x  6 rjmendez rjmendez 4.0K Sep  4 01:34 opt
drwx------  5 rjmendez rjmendez 4.0K Sep  4 01:34 root
drwxr-xr-x  7 rjmendez rjmendez 4.0K Sep  4 01:34 var
drwxr-xr-x 17 rjmendez rjmendez 4.0K Sep  4 01:34 .
-rwx---r--  1 rjmendez rjmendez 7.2K Sep  4 01:34 WMM2010.COF
drwxr-xr-x  2 rjmendez rjmendez 4.0K Sep  4 01:34 bin
-rwxr-xr-x  1 rjmendez rjmendez 664K Sep  4 01:34 fpga_p3.rbf
-rwxr-xr-x  1 rjmendez rjmendez 105K Sep  4 01:34 ODU_app_etria.bin
-rwxr-xr-x  1 rjmendez rjmendez  56K Sep  4 01:34 ODU_app_kacst.bin
-rwxr-xr-x  1 rjmendez rjmendez  59K Sep  4 01:34 ODU_app_tria.bin
-rwxr-xr-x  1 rjmendez rjmendez  91K Sep  4 01:34 sat-info
-rwxr-xr-x  1 rjmendez rjmendez 2.4K Sep  4 01:34 cert_load.sh
-rwxr-xr-x  1 rjmendez rjmendez   35 Sep  4 01:34 get
lrwxrwxrwx  1 rjmendez rjmendez   12 Sep  4 01:34 hw -> /root/ut_mac
-rwxr-xr-x  1 rjmendez rjmendez 876K Sep  4 01:34 il_ram.bin
drwxr-xr-x  4 rjmendez rjmendez 4.0K Sep  4 01:34 lib
-rwxr-xr-x  1 rjmendez rjmendez   64 Sep  4 01:34 load
lrwxrwxrwx  1 rjmendez rjmendez   12 Sep  4 01:34 oct-linux-csr -> /root/ut_mac
-rwxr-xr-x  1 rjmendez rjmendez   35 Sep  4 01:34 put
lrwxrwxrwx  1 rjmendez rjmendez   12 Sep  4 01:34 TxBurst -> /root/ut_mac
-rwxr-xr-x  1 rjmendez rjmendez 1.1K Sep  4 01:34 bram_1.bin
-rwxr-xr-x  1 rjmendez rjmendez  768 Sep  4 01:34 bram_2.bin
-rwxr-xr-x  1 rjmendez rjmendez  128 Sep  4 01:34 Demod_Cfg_Reg.bin
-rwxr-xr-x  1 rjmendez rjmendez 1.0K Sep  4 01:34 Demod_Control_LUT.bin
drwxr-xr-x  2 rjmendez rjmendez 4.0K Sep  4 01:34 dev
lrwxrwxrwx  1 rjmendez rjmendez   10 Sep  4 01:34 init -> /sbin/init
-rwxr-xr-x  1 rjmendez rjmendez  34K Sep  4 01:34 LDPC_Address_LUT.bin
lrwxrwxrwx  1 rjmendez rjmendez   12 Sep  4 01:34 linuxrc -> /bin/busybox
-rwxr-xr-x  1 rjmendez rjmendez  16K Sep  4 01:34 LLR_LUT_16PSK.bin
-rwxr-xr-x  1 rjmendez rjmendez  16K Sep  4 01:34 LLR_LUT_8PSK.bin
lrwxrwxrwx  1 rjmendez rjmendez   12 Sep  4 01:34 rl_fpga -> /sbin/rlfpga
-rwxr-xr-x  1 rjmendez rjmendez 102K Sep  4 01:34 skyphy
drwxr-xr-x  2 rjmendez rjmendez 4.0K Sep  4 01:34 lib64
drwxr-xr-x  7 rjmendez rjmendez 4.0K Sep  4 01:34 mnt
drwxr-xr-x  2 rjmendez rjmendez 4.0K Sep  4 01:34 proc
drwxr-xr-x  2 rjmendez rjmendez 4.0K Sep  4 01:34 sys
drwxrwxrwt  2 rjmendez rjmendez 4.0K Sep  4 01:34 tmp
drwxr-xr-x  8 rjmendez rjmendez 4.0K Sep  4 01:34 usr
drwxr-xr-x  3 rjmendez rjmendez 4.0K Sep  4 01:34 ..

It looks like there is an alternate boot filesystem in case of a failed over the air upgrade, pretty good idea if you ask anyone deploying stuff like these, double the space used but probably not looking at bricking with a bad firmware update.

rjmendez@MrPink:~/viasat_rm4100/_rm4100_mx29gl256flt2i-90q_0.bin.swapbytes.0x000001ca0000-0x000002000000.extracted/jffs2-root/fs_1/config$ strings .boot.env 
^baudrate=115200
download_baudrate=115200
bootloader_flash_update=protect off ${uboot_flash_addr} +${uboot_flash_size};erase ${uboot_flash_addr} +${uboot_flash_size};cp.b ${fileaddr} ${uboot_flash_addr} ${uboot_flash_size}
burn_app=erase ${flash_unused_addr} +${filesize};cp.b ${fileaddr} ${flash_unused_addr} ${filesize}
bf=bootoct ${flash_unused_addr} forceboot numcores=${numcores}
nuke_env=protect off ${env_sector_addr} +${env_sector_size}; erase ${env_sector_addr} +${env_sector_size}
autoload=n
netretry=no
coremask=3
max_sw_size=1C00000
sw_hdr_len=14
sw0_flash_offset=80000
sw1_flash_offset=e80000
sw0_indicator=0
sw1_indicator=1
calc_sw_size_long=setexpr sw_copy_len_long ${sw_copy_len} / 4; setexpr len_mod ${sw_copy_len} % 4; if test ${len_mod} != 0; then setexpr sw_copy_len_long ${sw_copy_len_long} + 1; fi
calc_sw_vars=setenv sw_start_addr ${sw_addr}; setenv sw_copy_len ${sw_size}; run calc_sw_size_long
clear_sw_vars=setenv sw_addr; setenv sw_start_addr; setenv sw_copy_len; setenv sw_copy_len_long
wr_image_setup=setexpr sw_addr ${flash_base_addr} + ${sw0_flash_offset}; sw_size=${filesize}
wr_image_finish=erase ${sw_addr} +${sw0_size}; cp.l ${fileaddr} ${sw_start_addr} ${sw_copy_len_long}; setenv current_sw_image ${sw0_indicator}; setenv sw0_size ${sw_size}; run clear_sw_vars; saveenv
wr_image=run wr_image_setup; run calc_sw_vars; run wr_image_finish
get_boot_args=if test ${cli_enable} = 0; then cli_arg=console=NULL; if test ${bootdelay} > 0; then setenv bootdelay 0; saveenv; fi; fi; setenv boot_args coremask=${coremask} ${cli_arg} mem=${sdram_size_dec}
boot_ram=run get_boot_args; bootoctlinux ${loadaddr} ${boot_args}
load_sw_from_flash=run calc_sw_vars; cp.l ${sw_start_addr} ${loadaddr} ${sw_copy_len_long}; run clear_sw_vars
boot_flash=run load_sw_from_flash; run boot_ram
boot_sw0=echo Booting Software Image 0; setenv booting_sw_image 0; setexpr sw_addr ${flash_base_addr} + ${sw0_flash_offset}; sw_size=${sw0_size}; run boot_flash; echo Failed to boot SW Image 0; setenv current_sw_image 1; saveenv
boot_sw1=echo Booting Software Image 1; setenv booting_sw_image 1; setexpr sw_addr ${flash_base_addr} + ${sw1_flash_offset}; sw_size=${sw1_size}; run boot_flash; echo Failed to boot SW Image 1; setenv current_sw_image 0; saveenv
boot_sw=vsat_mtest; if test ${current_sw_image} = ${sw0_indicator}; then run boot_sw0; run boot_sw1; else run boot_sw1; run boot_sw0; fi
bootcmd=run boot_sw

You May Also Enjoy

Wildflower Seeds

2 minute read

Published:

We moved to PA in 2023 and our property has a rather large and very plain looking power line easement. Previous owners had been mowing it every few months and as a result the plant biodiversity is pretty low consisting of mostly Timothy Grass with a few blackberry bushes spreading out of the woods.

Inspiration

I like to look at wildflowers damn it. Going outside and collecting seed heads from wild plants on the roadside while effective still means I need to spread them on the easement somehow. I figured why not make something airborne? Enter the seed drone!

Hardware

The drone is a pretty common custom made 5 inch prop FPV drone, its running a betaflight firmware (4.5.1). The seed deployment mechanism consists of a 9g servo and a rubber band. The servo proved to be the most frustrating part of this build. The drone flight controller is a SpeedyBee F7 V3 with the servo signal line going to motor pad 5 (M5) with the ground and +5v to their pads. Drone Electronics The motor controller outputs more than enough power for a 9g servo, that servo rotates the control horn releasing the rubber band and flinging seeds. Depending on the type of seeds they can be wind dispersed or scattered by gravity alone, below is an example of wind dispersed Joe Pye weed and wild lettuces.

Wild Lettuce Wind Dispersed Seeds Joe Pye Weed Joe Pye Weed

Other seeds like to be in a soil seed bank and they can be packed into “seed balls” made of clay and compost. Seed Balls

Still others are perfect for dropping loose but packed for flight using “natural materials” found around the forest. Seed Packet

Demonstration of the loose seed deployer in action.

Drone Dropper

Software

By default Motor 5 is mapped to output B07, since I’m not using motor 5 for a flight motor we can redefine Servo 1 to use that output.

# resources
resource MOTOR 5 NONE
resource SERVO 1 B07

Next we need to make sure that CHANNEL_FORWARDING is enabled in betaflight, I’m using channel AUX 1 for the seed deployer Servo 1 with that mapped to a pushbutton on the radio transmitter. By default the channel_forwarding_start param maps AUX 1 to Servo 1

References:

https://betaflight.com/docs/wiki/guides/current/servos-and-servo_tilt-for-3-1

https://youtu.be/L-6r2iX1p6s?t=804

Drone Servo

MycoMIDI - Mushrooms as musical instruments

1 minute read

Published:

Every so often when I’m dealing with a lot of stress I end up making strange projects. I had a dream where I had synesthesia, movements of muscles and joints had distinct sounds and actions like walking or running played different melodies. As a result I ended up learning about human nerve action potentials and their electrical spikes.

Inspiration

My goal was to turn bioelectrical signals into “music” of a sort, attaching electrodes to myself would be quite uncomfortable long term but I was already growing Oyster and Lions Mane mushrooms for food.

Plantwave - https://plantwave.com/

BioAmp-EXG-Pill - https://github.com/upsidedownlabs/BioAmp-EXG-Pill

Hardware

On a whim I pulled a retired mycelium block from the compost and hooked some electrodes to it. The signals were barely noticable on an oscilloscope so an amplifier was needed, enter the BioAmp-EXG-Pill!

oscope

With the amplification sorted out the signal needed to be converted into a MIDI signal, a Raspberry pi and ADS1256 ADC was pulled from the parts bin with each channel assigned to an amp.

Signal Amp

Bio Amp

All wired up

Proof of concept

Fruiting mushroom block

Mushroom Blocks

When the blocks are done fruiting they get retired to the great outdoors and then composted

Retired mushroom blocks

Software

https://github.com/rjmendez/MycoMIDI/blob/main/mycomidi.py