THEA500 Mini Hacking Development

This is what I've found out about the A500 so far, in semi-random order - updated as I go:

• Hardware:
  • H6 SoC (SUN50IW6P1)
  • 512MB of DDR3 memory (instead of LPDDR3 that most SBC's seem to use)
  • 256MB (2Gb) NAND - no eMMC unfortunately
    NAND ID is 98 da 90 15 76 16 08 00
• The UART serial port is the one with the filled-in pads behind the right-most USB port (looking at the PCB to the USB/HDMI/power ports)
• FEL mode can be achieved by:
•     Keeping '2' pressed in an UART sessionwhen powering on
•     Keeping the UBoot button pressed when powering on
•     The OTG/FEL port is the first USB A port, next to the HDMI connector

• U-Boot:
•     Can be interrupted by holding the 'S' key in an UART session
•     Supports bootm, boota but not bootz
•     Can read but not write from USB
• UART communication is a bit weird, the last character typed is ignored until another character is input - not sure if this is just with my A500 and serial2USB converter
• Kernel:

•     Linux version 3.10.65 (chris@puck) (gcc version 4.9.3 20150113 (prerelease) (Linaro GCC 4.9-2015.01-3) ) #32 SMP PREEMPT Fri Nov 12 10:48:03 GMT 2021
•     64-bit aarch64
•     The initrd ramdisk init has been modified to ignore console settings and ignore the ramfs parameter, so no easy way to get into the initrd shell by adding ramfs to to the kernel bootargs or dropping into a login     shell by providing a non-existent rootfs parameter
  
  #!/bin/sh

mount -t proc proc /proc
mount -t sysfs sysfs /sys
mount -t devtmpfs none /dev

exec < /dev/console > /dev/console 2>&1

for parm in $(cat /proc/cmdline); do
case $parm in
ramfs)
RAMFS_MODE=1
;;
root=*)
ROOT_DEVICE=`echo $parm | awk -F\= '{print $2}'`
;;
# console=*)
# CONSOLE_DEVICE=`echo $parm | awk -F\= '{print $2}' | awk -F\, '{print $1}'`
# ;;
gpt=*)
GPT_SUPPORT=`echo $parm | awk -F\= '{print $2}'`
;;
esac
done

if [ "x$ROOT_DEVICE" = "x" ]; then
ROOT_DEVICE=autoconfig
fi

#echo [$0]: "getty is $CONSOLE_DEVICE"
#echo [$0]: RootDevice is \"$ROOT_DEVICE\" , GPT_SUPPORT=$GPT_SUPPORT

#set the default device for autoconfig
if [ "x$GPT_SUPPORT" = "x1" ]; then
NAND_DEF_DEVICE=nand0p5
SDMMC_DEF_DEVICE=mmcblk0p5
else
NAND_DEF_DEVICE=nandb
SDMMC_DEF_DEVICE=mmcblk0p7
fi

# $1: the name of block device
wait_for_ready()
{
CNT=10
while true; do
if [ -b $1 ]; then
return 0
fi

echo [$0]: Wait $1 ready ...

CNT=`expr $CNT - 1`
if [ $CNT -eq 0 ]; then
echo [$0]: $1 is not available!
return 1
fi
sleep 1
done
}

# $1: The block device
do_mount()
{
# e2fsck -y $1
#mount -o rw,noatime,nodiratime,norelatime,noauto_da_alloc,barrier=0,data=ordered -t ext4 $1 /mnt
mount -o ro,noatime,nodiratime,norelatime,noauto_da_alloc,barrier=0,data=ordered -t ext4 $1 /mnt
if [ $? -ne 0 ]; then
echo [$0]: Failed to mount $1!
fi
}

load_nand()
{
# echo [$0]: Try to load Nand ...

NAND_MODULE=/lib/modules/$(uname -r)/nand.ko
if [ ! -f $NAND_MODULE ]; then
echo [$0]: $NAND_MODULE does not exist!
# return 1
fi

insmod $NAND_MODULE
if [ $? -ne 0 ]; then
echo [$0]: $NAND_MODULE is invalid!
# return 2
fi
wait_for_ready /dev/nandb
if [ $? -eq 0 ]; then
do_mount /dev/nandb
fi
}

load_emmc()
{
echo [$0]: Try to load EMMC ...

wait_for_ready $1
if [ $? -eq 0 ]; then
do_mount $1
fi
}

case $ROOT_DEVICE in
/dev/nand*|/dev/system)
load_nand $ROOT_DEVICE
;;
/dev/mmc*)
load_emmc $ROOT_DEVICE
;;
autoconfig*)
sleep 1;
echo [$0]: default device $SDMMC_DEF_DEVICE $NAND_DEF_DEVICE
if cat /proc/partitions|grep "$SDMMC_DEF_DEVICE" >/dev/null;then
magic_num=$(hexdump -s 1292 -n 2 -x /dev/$SDMMC_DEF_DEVICE|head -1|awk '{print $2 }')
echo $magic_num|grep "f30a" >/dev/null
if [ $? -eq 0 ]; then
echo [$0]: "magic_num[f30a] match!!!"
else
load_emmc /dev/$SDMMC_DEF_DEVICE
fi
else
load_nand /dev/$NAND_DEF_DEVICE
fi
;;
*)
echo [$0]: "Use default type"
;;
esac

[ -x /mnt/init ] && exec switch_root /mnt /init
/sbin/getty -L $CONSOLE_DEVICE 115200 vt100 -n -l /bin/ash
  
  
• Commandline:
  console=ttyS0,115200 root=/dev/nandb init=/init loglevel=3 partitions=boot@nanda:rootfs@nandb:UDISK@nandc mem=512M quiet androidboot.serialno=8c0001421d58206f20d1 boot_type=0 androidboot.hardware=sun50iw6p1

[/li][li]Userspace is 32-bit - so all binaries are armhf[/li][li]After booting there's a login prompt on the UART
___     _              ___                     _   _      _
| _ \___| |_ _ _ ___   / __|__ _ _ __  ___ ___ | | | |_ __| |
|   / -_)  _| '_/ _ \ | (_ / _` | '  \/ -_|_-< | |_|  _/ _` |
|_|_\___|\__|_| \___/  \___\__,_|_|_|_\___/__/ |____\__\__,_|

RedquarkSix - THEA500 Mini

redquarksix login:
[/li][li]Root password

• I've tried some obvious ones (e.g. jayminer) but haven't guessed the root password
• The root password line in /etc/shadow is:
  root:$5$OxjDiEcDpA3Oar7$0HjDfJJuRuxhEXyysJ5raIb8wVE/9k0yCrPg55nXBtB:::::::
  

[/li][/ul]

• At startup, the binary 'skyline' is started which apparently then starts the Carousel 'manhattan'
• The Amiga emulator is amiberry
• All built-in games and their Carousel pictures seem to be in one 46MB file, resources.bod. Upon game selection the selected game and amiberry config file etc is extracted into /tmp and run with amiberry from there. The games are .uss savestates.

• June 4th, 2022: RGL have released a similar way of getting nanda and editing it in their github for THEA500.
• There are easier ways to copy nanda and nandb via the Workbench if you are still on firmware v1.0.0 - see bullet 'Running Linux commands from the Workbench'
• No /dev/mem
• No /proc/zconfig - but can be extracted from the kernel Image
• Kernel modules - preventing (or making it more difficult) to load new modules
  • No Modules.symvers 
  • No forced module loading
• Reduced command set in /bin, /sbin, /usr/bin, /usr/sbin:
  # ls /bin /sbin /usr/bin /usr/sbin
/bin:
ash        df         hostname   mkdir      ps         sh         umount
busybox    dmesg      kill       mknod      pwd        sleep      uname
cat        echo       ln         more       resume     stty       usleep
cp         false      login      mount      rm         sync       vi
date       getopt     ls         mv         rmdir      touch
dd         grep       minips     pidof      setserial  true

/sbin:
blkid              insmod             pivot_root         runlevel
devmem             losetup            poweroff           start-stop-daemon
getty              lsmod              reboot             sulogin
halt               makedevs           rmmod              switch_root
init               modprobe           run-init           udevd

/usr/bin:
[          clear      ipcrm      manhattan  reset      tty
[[         dc         ipcs       mesg       resize     udevadm
amiberry   du         killall    mkpasswd   skyline    unlink
bc         env        less       nohup      test       vlock
chrt       id         lsusb      printf     tr         wc

/usr/sbin:
fbset     killall5  nologin

So it will probably be easier to replace the kernel with some/all of the disabled features disabled

• To run RGL's version of Amiberry directly from the UART commandline:
  
  EXTERNAL_FILES_DIR=/usr/share/amiberry amiberry

  
• Running Linux commands from the Workbench:
  1. Download the host-run program and put it somewhere in the Workbench, e.g. in the C directory
  
  2. Enable host-run by editing the xxx_ol.uaa or the xxx.uae Amiberry config file you use to run the Workbench. Add a line

[/code]
3. Start the Workbench. Now from a CLI shell you can run Linux commands, e.g.:
host-run "mount -o remount,rw /

host run "cp /dev/nand* /mnt"[/ul]

I have changed the password on the A500 Mini and overmounted it with the password from PCUAE Network Mode, so I can login to it via Putty,I had to copy to its int.d folder a start-up script like Autoboot, it uses the USB wait code so it can wait for the USB Stick to show before it run the code to overmount the password from the USB Stick, the Password file is on the USB Stick so if you need to can remove it easily and if you want to add other code to it to get it to do other things without running it in the firmware.

Thanks, but that is ignored as the init script from the initrd mounts the nandb rootfs to /mnt and has /mnt/init hardcoded.

That's a kernel option. Unless they've modified the kernel to hardcode an init, it's irrelevant what the init in userspace does or does not do since it won't be executed. Looks like initrd runs before init if it's present, so I guess you will need an alternate initrd to get this to work.

These are my initial guesses about resources.bod:


First 625 bytes is 25 bytes of data per game. No idea what it means.
Then 42872 (?) bytes of text for the UI etc in various languages
Then 53695 (? could be 25*2148=53700 bytes) bytes of unknown data
Then 25 times data for a game:
3 PNG's of various length
An amiberry config file
a gzipped xxxx.uss savestate file

44614984 The Manhattan copyright and a shader file
Then from 44615594 onwards various stuff
44615594 Google Roboto Regular Font
48553945 onwards a number of software license texts
48829468 onwards more stuff to be analysed...

Hey guys do u have news about?
Is possible to enable the fel without opening the hardware?

Here's some quick unpacking code for the files in resources.bod. The data between the file table and the file data appear to be a string table of some sort, although the decoding function is a bit of a slog to go through, so maybe some other time.

[/ul][/quote]Set your terminal program to use two stop bits and it will work just fine, i.e. "8N2".[/quote]... or at least it did for me once. It appears to be more complicated than that.

Updated my 'this is what I've found out post', adding a way to run Linux commands from the Workbench.

I assume you have the following in your .config:

CONFIG_MODVERSIONS=y
CONFIG_MODULE_SRCVERSION_ALL=y
However this will still not help as to compile modules with the same symbol version info as the A500's actual kernel you need the actual Modules.symvers from the A500. But as RGL have not included this in the /lib/modules/3.10.65 directory this is not possible. So you need to find some way to get the symbol version(s) from the running kernel.

Can this help? github.com/glandium/extract-symvers/blob/master/extract-symvers.py

Source and reason for its existence is here: glandium.org/blog/?p=2664

Glad to see progress being made, hopefully by the time I get mine (or a way to run the fw on the OrangePi 3 LTS that's slowly coming from China) all will be already figured out by you guys ;-)

Hmm, there's something not quite right about the Module.symvers extracted from the kernel.

For example, for symbol module_layout the version in the extracted Module.symvers is: 0xb67737d2. However the version in the modules in /lib/modules/3.10.65 is 0xafa30df0:

00051B78   F0 0D A3 AF  00 00 00 00  6D 6F 64 75  6C 65 5F 6C  61 79 6F 75  74 00 00 00  00 00 00 00  ........module_layout.......
You can change this in Module.symvers or hexedit the .ko file but for pl2303.ko I then get many other symbol version errors (usb_....).

Ahh sorry about that, I forgot to say that I didn't yet get a chance to test it. I suspect that extract-symvers needs to be updated to support newer kernels -- the tool is ten years old, and I already found one issue [*], and there's probably more to it.

[1] The pointer to the CRC table is an unsigned long pointer, but it was advancing by 4 bytes instead of 8 bytes, so every other value would be zero. But I probably missed some other detail while making this change.