Reverse engineering (HW/SW) of HP printers - DeskJet f2180 - Page 1
Forum section: electronics / general

author: ronenk
author_rank: Newbie
timestamp: June 13, 2014, 10:02:06 pm
content: Hello everybody,Over the years I have amassed a large collection of HP printer main boards from small to large and always wanted to see what kind of hardware they use and maybe even re-purpose themas a network attached machine or maybe even as a DEV board.So I've dug around and found a board from this printer HP DESKJET f2180 which is an All-in-one old printer vintage ~2006.The problem with every HP product is the markings on almost all of the chips are HP proprietary numbers.For example the main SoC is a Marvell one but the codes on it are2CR6-0001 1825-0126which off-course are not the SoCs real numbers.The SPI flash on the board was an OKI part with the same weird numbers, but I've figured it out and dumped it, it's just a8Mbit SPI flash.Luckily the board has a UART connection as well but not much info came from it(just stuck a serial cable on the ports and watched what happens)So here is my progress,SOC - Have no Idea, MFG Marvell - ARM?MIPS?POWERPC? don't know.FLASH - SPI 8Mbit OKI.TI Part - A micro ? for USB handling ?I2C - 24c32an 4KB eeprom for what ?RAM - 32MbitAnd other probably useless to me stuff.What do I have:I have the raw firmware dump from the SPI chip, it has some strings in it (the bootloader is unencrypted and unpacked) but the most of it is packed.BINWALK tells me nothing about it at all.Attached is the firmware file.And here is the UART outputIt shows some useful stuff like where is the bootloader ending and code beginningBut I've tried OnlineDissasamble, IDA, HEX editor and I only get trash from those can't figure out the architecture how to decode the bootloader, how to uncompress the data.And this is where I need some help/guidance, any body knows how to read the bootloader? what architecture is the SoC ?any info, suggestions will be helpful.PS. typing 'uart' in the console shows empty table, tried typing other stuff, does nothing.Thank you.

author: amyk
author_rank: Super Contributor
timestamp: June 14, 2014, 02:57:53 pm
content: - I see the version ID (05090701) at the beginning of the file, and at 2228 is D C21CAB8, followed by the table of firmware parts:Code:dc269328 00c578b8 00000028dc2691c0 00c578e0 00000168...So that tells us the processor is big-endian.Next, note that near the beginning there is a regular pattern of every 4 bytes' high nybble being E, this is almost certainly ARM code since that is the encoding of the "always" predicate present on most instructions. Indeed the first 2 instructions (reset vectors?) disassemble toCode:LDR PC, =0xC0001CLDR PC, =0xC00014suggesting that the flash image is mapped into memory at C00000 (there's a few other ARM SoCs out there that have a similar mapping - search around.) Now you can start disassembling from there - it switches into thumb mode not long after doing something with the MMU, and then...Code:ROM:00C005FA LDR R6, =a0123456789abcdROM:00C005FC LDR R1, [SP,#0x18]ROM:00C005FE LSR R3, R1, #0x1CROM:00C00600 LDRB R0, [R6,R3]ROM:00C00602 BL sub_0_C010A6ROM:00C00606 LDR R1, [SP,#0x18]ROM:00C00608 LSL R1, R1, #4ROM:00C0060A STR R1, [SP,#0x18]ROM:00C0060C LDR R1, ROM:00C0060E ADD R1, #1ROM:00C00610 STR R1, ROM:00C00612 CMP R1, #8ROM:00C00614 BLT loc_0_C005FAROM:00C00616 ADR R7, asc_0_C00694 ; "\n\r"ROM:00C00618 ADD R0, R7, #0ROM:00C0061A BL sub_0_C010B8ROM:00C0061E ADR R0, aBootBootId ; " Boot ID: "ROM:00C00620 BL sub_0_C010B8ROM:00C00624 BL sub_0_C003C4ROM:00C00628 ADD R0, #0xCROM:00C0062A BL sub_0_C010B8ROM:00C0062E ADD R0, R7, #0ROM:00C00630 BL sub_0_C010B8ROM:00C00634 BL sub_0_C0099CROM:00C00638 STR R0, [SP,#4]ROM:00C0063A ADD R5, R0, #0ROM:00C0063C ADD R4, R0, #0ROM:00C0063E ADR R0, aBootNvmCode0x ; " NVM Code: 0x"I'll let you trace the rest... also you may notice interesting strings at 5d560, suggesting that the compression is LZ with indicator bytes and that this an ARM9.It also identifies the "OS" it uses.Good luck!

author: ronenk
author_rank: Newbie
timestamp: June 19, 2014, 10:03:13 pm
content: amyk,Thanks for the explanation and the help! I appreciate it.I'm trying to find where is the switch to THUMB occurs,Code:; Processor : ARMBROM:00C00000 ; Target assembler: Generic assembler for ARMROM:00C00000 ; Byte sex : Big endianROM:00C00000ROM:00C00000 ; ===========================================================================ROM:00C00000ROM:00C00000 ; Segment type: Pure codeROM:00C00000 AREA ROM, CODE, READWRITE, ALIGN=0ROM:00C00000 ; ORG 0xC00000ROM:00C00000 CODE32ROM:00C00000 LDR PC, =loc_C0001CROM:00C00004 ; ---------------------------------------------------------------------------ROM:00C00004 LDR PC, =loc_C00014ROM:00C00004 ; ---------------------------------------------------------------------------ROM:00C00008 DCD 0x5090701ROM:00C0000C DCB 0x63, 0x75, 0x72, 0x6C, 0x79, 0, 0, 0ROM:00C00014 ; ---------------------------------------------------------------------------ROM:00C00014ROM:00C00014 loc_C00014 ; CODE XREF: ROM:00C00004jROM:00C00014 ; DATA XREF: ROM:00C00004o ...ROM:00C00014 MOV SP, #1ROM:00C00018 B loc_C00208ROM:00C0001C ; ---------------------------------------------------------------------------ROM:00C0001CROM:00C0001C loc_C0001C ; CODE XREF: ROM:00C00000jROM:00C0001C ; DATA XREF: ROM:00C00000o ...ROM:00C0001C MOV SP, #0ROM:00C00020 MOV R1, #0xD3ROM:00C00024 MSR CPSR_cxsf, R1ROM:00C00028 MRC p15, 0, R0,c1,c0ROM:00C0002C MOV R1, #0x80ROM:00C00030 ORR R0, R1, R0ROM:00C00034 MCR p15, 0, R0,c1,c0ROM:00C00038 MOV R0, R1ROM:00C0003C MOV R1, R0ROM:00C00040 LDR R2, =0x20813500ROM:00C00044 MOV R0, #0ROM:00C00048 STRH R0, [R2,#0xA]ROM:00C0004C MOV R0, 0x212CROM:00C00054 STRH R0, [R2,#6]ROM:00C00058 MOV R0, 0x5060ROM:00C00060 STRH R0, ROM:00C00064 MOV R0, 0xCDAROM:00C0006C STRH R0, [R2,#2]ROM:00C00070 MOV R0, 0x4E1ROM:00C00078 STRH R0, [R2,#4]ROM:00C0007C MOV R0, #3ROM:00C00080 STRH R0, [R2,#8]ROM:00C00084 MOV R0, #1ROM:00C00088 STRH R0, [R2,#0xC]ROM:00C0008C NOPROM:00C00090 NOPROM:00C00094 NOPROM:00C00098 NOPROM:00C0009C NOPROM:00C000A0 NOPROM:00C000A4 NOPROM:00C000A8 NOPROM:00C000AC MOV R3, #1ROM:00C000B0ROM:00C000B0 loc_C000B0 ; CODE XREF: ROM:00C000B8jROM:00C000B0 LDRH R0, [R2,#0xC]ROM:00C000B4 ANDS R0, R0, R3ROM:00C000B8 BNE loc_C000B0ROM:00C000BC MOV R0, #8ROM:00C000C0 STRH R0, [R2,#0xA]ROM:00C000C4 MOV R3, #3ROM:00C000C8ROM:00C000C8 loc_C000C8 ; CODE XREF: ROM:00C000D4jROM:00C000C8 ; ROM:00C000E4j ...ROM:00C000C8 LDRH R0, [R2,#0xE]ROM:00C000CC ANDS R0, R0, R3ROM:00C000D0 CMP R3, R0ROM:00C000D4 BNE loc_C000C8ROM:00C000D8 LDRH R0, [R2,#0xE]ROM:00C000DC AND R0, R0, R3ROM:00C000E0 CMP R3, R0ROM:00C000E4 BNE loc_C000C8ROM:00C000E8 LDRH R0, [R2,#0xE]ROM:00C000EC AND R0, R0, R3ROM:00C000F0 CMP R3, R0ROM:00C000F4 BNE loc_C000C8ROM:00C000F8 NOPROM:00C000FC NOPROM:00C00100 NOPROM:00C00104 NOPROM:00C00108 MOV R0, #0xAROM:00C0010C STRH R0, [R2,#0xA]ROM:00C00110 MOV R7, 0x20814400ROM:00C00118 LDRH R1, [R7,#4]ROM:00C0011C ORR R1, R1, #1ROM:00C00120 STRH R1, [R7,#4]ROM:00C00124 MOV R1, 0x404ROM:00C0012C STRH R1, ROM:00C00130 MOV R1, #0x15ROM:00C00134 STRH R1, [R7,#2]ROM:00C00138 MOV R1, 0x827ROM:00C00140 STRH R1, [R7,#6]ROM:00C00144 MOV R1, 0x311ROM:00C0014C STRH R1, [R7,#8]ROM:00C00150 MOV R1, #5ROM:00C00154 STRH R1, [R7,#0xA]ROM:00C00158 MOV R1, #0x66ROM:00C0015C STRH R1, [R7,#0xC]ROM:00C00160 MOV R1, 0x3FFROM:00C00168 STRH R1, [R7,#0xE]ROM:00C0016C MOV R1, #0x14ROM:00C00170 STRH R1, [R7,#0x12]ROM:00C00174 MOV R1, #0x60ROM:00C00178 STRH R1, [R7,#0x1E]ROM:00C0017C MOV R1, #0xFROM:00C00180 STRH R1, [R7,#0x1C]ROM:00C00184 ADD R6, R7, #0x32ROM:00C00188 ADD R5, R7, #0x14ROM:00C0018C MOV R4, #8ROM:00C00190 BLX loc_C00314ROM:00C00194 ADD R5, R7, #0x1AROM:00C00198 MOV R4, #2ROM:00C0019C BLX loc_C00314ROM:00C001A0 ADD R5, R7, #0x16ROM:00C001A4 MOV R4, #1ROM:00C001A8 BLX loc_C00314ROM:00C001AC LDR R6, =0x2081FE00ROM:00C001B0 MOV R1, #0x30ROM:00C001B4 STRH R1, [R6,#0x1E]ROM:00C001B8 MOV R0, #0xC8ROM:00C001BC BLX loc_C0034CROM:00C001C0 MOV R1, #0ROM:00C001C4 STRH R1, [R7,#0x22]ROM:00C001C8 MOV R0, #1ROM:00C001CC BLX loc_C0034CROM:00C001D0 MOV R1, 0x4002ROM:00C001D8 STRH R1, [R7,#0x10]ROM:00C001DC MOV R0, #1ROM:00C001E0 BLX loc_C0034CROM:00C001E4 MOV R1, 0x121ROM:00C001EC STRH R1, [R7,#0x10]ROM:00C001F0 MOV R0, #4ROM:00C001F4 BLX loc_C0034CROM:00C001F8 MOV R1, #0x21ROM:00C001FC STRH R1, [R7,#0x10]ROM:00C00200 MOV R0, #0x2DROM:00C00204 BLX loc_C0034CROM:00C00208ROM:00C00208 loc_C00208 ; CODE XREF: ROM:00C00018jROM:00C00208 MRC p15, 0, R0,c1,c0ROM:00C0020C MOV R1, 0x1005ROM:00C00214 BIC R0, R0, R1ROM:00C00218 MCR p15, 0, R0,c1,c0ROM:00C0021C MOV R1, #0x3FROM:00C00220 MCR p15, 0, R1,c6,c0ROM:00C00224 MOV R1, #0x33ROM:00C00228 MCR p15, 0, R1,c6,c1ROM:00C0022C MOV R1, 0xDC000031ROM:00C00234 MCR p15, 0, R1,c6,c2ROM:00C00238 MOV R1, 0xFC000031ROM:00C00240 MCR p15, 0, R1,c6,c3ROM:00C00244 MOV R1, 0xFE000031ROM:00C0024C MCR p15, 0, R1,c6,c4ROM:00C00250 LDR R1, =0x2081001FROM:00C00254 MCR p15, 0, R1,c6,c5ROM:00C00258 MOV R1, 0x20000023ROM:00C00260 MCR p15, 0, R1,c6,c6ROM:00C00264 MOV R1, #0x40000037ROM:00C00268 MCR p15, 0, R1,c6,c7ROM:00C0026C MOV R1, #0x1EROM:00C00270 MCR p15, 0, R1,c2,c0, 1ROM:00C00274 MOV R1, #0xEROM:00C00278 MCR p15, 0, R1,c2,c0ROM:00C0027C MOV R1, #0xFCROM:00C00280 MCR p15, 0, R1,c3,c0ROM:00C00284 MOV R1, 0xFFFFROM:00C0028C MCR p15, 0, R1,c5,c0, 1ROM:00C00290 MCR p15, 0, R1,c5,c0ROM:00C00294 MRC p15, 0, R0,c1,c0ROM:00C00298 MOV R1, 0x1005ROM:00C002A0 ORR R0, R1, R0ROM:00C002A4 MCR p15, 0, R0,c1,c0ROM:00C002A8 MOV R0, #8ROM:00C002AC LDR R0, ROM:00C002B0 MOV R1, SPROM:00C002B4 MRC p15, 0, R2,c1,c0ROM:00C002B8 ORR R2, R2, #0x40000ROM:00C002BC MCR p15, 0, R2,c1,c0ROM:00C002C0 LDR SP, =0xFC0009D0ROM:00C002C4 LDR PC, =(loc_C005B8+1)all seems like native ARM, including the jump to C005B8but after that it looks all scrambled.Code:LDRLTB R11, [R0,#0x87]!ROM:00C005BC ANDLS R9, R6, R5,LSL#2ROM:00C005C0 MRRCMI p9, 5, R4,R10,c11ROM:00C005C4 SMLABBLS R3, R12, R2, R4ROM:00C005C8 ANDLE R12, R5, #0x700ROM:00C005CC LDRNVB PC, [PC,R4,ROR#29]!ROM:00C005D0 STMLSDA R3, {R2,R7,R9,LR}ROM:00C005D4 MOVLES R4, 0xFFFFEA3FROM:00C005D8 LDMMIDB R7, {R2,R8,R12,PC}^ROM:00C005DC ADDMI SP, SP, #0x50000000ROM:00C005E0 STCGT p7, c15, [R7,#-0x3FC]ROM:00C005E4 CDP2 p8, 0xE, c9,c5,c4ROM:00C005E8 ADDMI SP, R5, #0xE4000003ROM:00C005EC ANDNV PC, R0, R1,LSL#27ROM:00C005F0 SUBGES PC, R2, R0ROM:00C005F4 STC2L p2, c2, !ROM:00C005F8 ANDLS R4, R0, #0x550ROM:00C005FC STMLSDB R6, {R0,R1,R3,R8-R11}ROM:00C00600 LDCPLL p0, c15, ROM:00C00604 LDC2L p9, c9, [R0,#-0x18]ROM:00C00608 TSTEQ R9, R6,LSL#2which makes me believe it happens after the jump.Is my assumption correct.Still trying to pinpoint what type of Marvell SoC this is, most of the ones I've found are the modern ones.88F5182 looks close, but seems unlikely that it's used (too overpowered for this application)

author: amyk
author_rank: Super Contributor
timestamp: June 20, 2014, 12:10:56 pm
content: Yes, the code after that is Thumb (and there's the occasionalNotice the target of that jump at c002c4 - it's putting c005b9into r15 but ARM instructions must be aligned to multiples of 4 (and Thumb, multiples of 2). Fromthis:Quote

author: ronenk
author_rank: Newbie
timestamp: June 20, 2014, 03:03:43 pm
content: Small update,Just used IDA and put xScale processor and all the bootloader decompiled just fine.So not it's just sifting trough the code.and find JTAG maybe.So it's xScale processor maybe pxa260 or pxa270.

author: amyk
author_rank: Super Contributor
timestamp: June 21, 2014, 12:54:16 pm
content: It's definitely not a PXA2xx, but a custom chip Marvell designed for HP. There may be similarities, however.