Julian Uy uyjulian

Android Stagefright/libstagefright OpenMAX IL library usage

Information based on commit 103f9d584ba053bce9bf9726de63f8469c5a74e2 from https://android.googlesource.com/platform/frameworks/av before removal

aacdec: https://github.com/mstorsjo/fdk-aac
aacenc: https://github.com/mstorsjo/fdk-aac
amrnb: https://android.googlesource.com/platform/frameworks/av/+/refs/heads/main/media/module/codecs/amrnb/
amrwbenc: https://android.googlesource.com/platform/frameworks/av/+/refs/heads/main/media/module/codecs/amrwb/
avcdec (H.264, MPEG-4 Part 10): https://github.com/ittiam-systems/libavc
avcenc (H.264, MPEG-4 Part 10): https://github.com/ittiam-systems/libavc

DivX Ultra related info

Keywords

DivX Media Format (DMF)
DivX 6
DivX Ultra
DivX Ultra Certified
DX50
XSUB

Making XOSD 2.11 (PSX2) work in more cases

PSX2 DVRP firmware allows ATA access above 28bit limit, and XOSD from 2.11 uses this to access the filesystem.
The atad module stores the 28-bit and 48-bit sizes from the ATA IDENTIFY data separately, and the apa/hdd module uses this information to determine where bhdd0: should start searching for __extend and __xcontents partitions.
The 28-bit offset can also be retrieved using HDIOC_GETMAXLBA48 / (0x683B) devctl on dvr_hdd0:.

If the __xcontents partition cannot be found, the system will remain on a black screen, bootloop (the HDD access LED will blink periodically), and the following will be output over EE debug:

The HDD could not be started.
I have not added support for auto-formatting the HDD yet.

Notes on OpenMAX Development Layer

(aka OMX DL)

omxACMP3 - N/A
omxACAAC - N/A
omxIPBM - N/A
omxIPPP - N/A
omxIPCS - VLC, mediastreamer2
omxICJP - libjpeg-kinoma-openmax

DVRP DVR-SPEED workaround for HDD authentication

Usually, DVR-SPEED does not allow DMA commands (e.g. DMA read/write) until the 0x8e command is received.
However, the ATA state machine in DVR-SPEED does not reset or take into account primary/secondary device selection when receiving results after setting ATA command register.
The following is done:

Set 0xe8 command to primary (write buffer)
Write wanted ID (or null bytes) to device
Set 0xe4 command to primary (read buffer)
Set 0x8e command to secondary (sce auth)

FC1307A pin description

Numbers and names from https://archive.org/download/sd2ide_fc1307a_fw/FC1307_TFx2_TO_CF_V1.0_schematic.pdf.zip
Descriptions from https://www.alldatasheet.com/datasheet-pdf/download/1132338/ETC2/FC1306T.html

Pin	IC	PCB	Description
1	GND	GND
2	RESET	RESET	Chip Reset. (Schmidt)

FC1307A notes for SCE security

The firmware, stored in the SPI flash connected to FC1307A, is 8051 architecture.
It is unencrypted and unsigned, with checksums.

When loading the firmware in Ghidra as a raw 8051 binary, truncate the flash to 0x10000 bytes.

In firmware 3.72 of the FC1307A, the ATA command dispatch table is at 0x9482, laid out as the following:

	#!/usr/bin/env python3
	# SPDX-License-Identifier: MIT

	# This program does the following equivalents on offline IOP memory dumps:
	# thmon thlist
	# dsidb mlist, memlist

	import sys

	a = None


	★Project Manager/Leader
	沢谷琢
	田中民也
	村山直樹
	丸岡一寿
	杉山治
	太田浩

	★EE/GS


	NOTE: will remain unfinished

	XHA-001

	40 pin ide opposite /// x pin to top lid