[Xperia Arc General] scholbert:
Hi,

in the meantime i was able to identify some of the OTP registers used on MSM8255(T), a.k.a. fuse registers.

There's another interesting factory register which identifies the type of CPU.

Though it seems that of "old" and "new" security chip could not directly identified using these registers, it is a nice journey to the internals.

We need a tool to dump these values from userland.

Check out viewmem:

http://blog.maurus.be/index.php/2011/01/samsung-i9000-irom-dump/

Grab the viewmem tool from http://blog.maurus.be/wp-content/uploads/viewmem

Copy to /data/local on your device and execute the tool as root.

HW_REVISION_NUMBER

I started some investigation again and made some dumps using this tool.

./viewmem 0xabc00270 0x4 | hexdump -C

As an example given my device got this ID:

HW_REVISION_NUMBER 0xabc00270 = 0x205720e1

This equals to the JTAG Core ID of the Qualcomm chip.

The other one used for JTAG is the TAP ID = 0x27B360E1

I found these Core ID values of derivates in the web:

CPU: Qualcomm MSM8255

Core ID: 0x205700E1

and

Core ID: 0x205720E1

There's this one as well:

CPU: Qualcomm MSM8255T

Core ID: 0x2057A0E1

If someone likes to contribute, please run the viewmem command given above and post it here.

This way we might get an idea which chip revisions are floating around.

MSM_TCSR_CONF_FUSE

I stumbled over the MSM_TCSR register set by looking into bootloaders and disassembled parts of s1_boot as well.

These gave the same offset in some code snippets.

So here we go...

MSM_TCSR_PHYS 0xab600000

TCSR_CONF_FUSE_0 0xab60005c // TCSR_CONF_FUSE_0 register (base security setup)
TCSR_CONF_FUSE_1 0xab600060 // TCSR_CONF_FUSE_1 register (enhanced debug)
TCSR_CONF_FUSE_2 0xab600064 // TCSR_CONF_FUSE_2 register (feature setup)
TCSR_CONF_FUSE_3 0xab600068 // TCSR_CONF_FUSE_3 register (unique serial#)
TCSR_CONF_FUSE_4 0xab60006c // TCSR_CONF_FUSE_4 register (L1&L2 clocking)
TCSR_CONF_FUSE_5 0xab600070 // TCSR_CONF_FUSE_5 register (not used)

These are the values i dumped from my device:

0xab60005c = 0x00716d4b
0xab600060 = 0xc8041447
0xab600064 = 0x28040815
0xab600068 = 0x695888c0 (unique serial number of CPU)
0xab60006c = 0x200001b0
0xab600070 = 0x00000000

MSM8255 based:

Xperia pro (MK16)

FUSE(0-5): 00716d4b c8041447 28040815 695888c0 200001b0 00000000

Which looks very similar to these (found on the web over various forums):

MSM8255 based:

Xperia arc (LT15)

FUSE(0-5): 00716d4b c8041447 28040815 fe53ed80 200001b0 00000000

MSM8255 based (according to GSM forum this is a new security device):

Sony Walkman (WT19i)

FUSE(0-5): 00714b6d c8041447 28040815 14b248a0 200001b0 00000000

MSM8255 based (security unknown):

Xperia neo V (MT11)

FUSE(0-5): 00714b6d c8041447 28040815 13789bc0 200001b0 00000000

MSM8255T based (security unknown):

Xperia arc S (LT18)

FUSE(0-5): 00714b6d e8041447 28040815 e99f59a0 200001b0 00000000

MSM8255T based (new security):

Xperia arc S (LT18)

FUSE(0-5): 00714b6d c8041447 28040815 c25cf0a0 200001b0 00000000

MSM8655 based (security unknown):

Xperia acro (IS11S)

FUSE(0-5): 00714b6d 08041447 28000816 5244e280 200001b0 00000000

We need to confirm if this is true...

Copy viewmem to /data/local on your device and execute the tool as root.

Read out the value of TCSR_CONF_FUSE_0:

./viewmem 0xab60005c 0x4 | hexdump -C

result: 4b 6d 71 00

which is LSB first so please rearrange to get MSB first...

result: 00 71 6d 4b

This is one of the things that still need some clarification:

value = 0x00716d4b old and newsecurity

value = 0x00714b6d definitely new security

This is not proven and maybe it's not the correct register to look at.

Anyway this will be mostly guessing because i'm missing documents.

It's still unknown at which position the trusted boot bit is located and if it play a role for "old" vs "new" security setup.

I will need some more dumps of these registers. So i really would appreciate any help here...

At least dumping that register of:

one device successfully unlocked with s1tool

and

one from a device giving that packet error.

EDIT:

There's no difference here... as far as we got it right now.

How to participate?

First i need information about your device:

- model

- manufacturing date form the sticker under the battery

Second you need root, busyboy installed (with hexdump feature) viewmem tool (see 2nd post) and Android terminal or working adb.

- grab viewmem from the link in 2nd post

- put the viewmem binary on your device in /data/local

- type:

cd /data/local

chmod 0755 ./viewmem

- post the output of your Hardware ID, type:

./viewmem 0xabc00270 0x4 | hexdump -C

- post the output of your TCSR_CONF_FUSE_0..5

./viewmem 0xab60005c 0x14 | hexdump -C

Additionally you might give some details if you already tried to unlock with s1tool and if you got the paket error.

Thanks for all the fish :laugh: !!

MARM_ANY_MODE_DEBUG_DISABLE

Apart from the location of the trusted boot bit this is another very interesting fuse bit.

More to come on this topic soon!

Any help would be appreciated to shed some light on this!

Please join in :victory:

To get a better idea of all this stuff you might have a brief look into the application note attached to this post.

To the admins:

I know that some confidential data could be found all over in this forum, but please tell me if you see conflicts with the forum rules.

Geek stuff link collection:

If you like engineer stuff, check out this comprehensive thread:

http://xdaforums.com/showthread.php?t=1856327

This as well:

http://www.anyclub.org/2012/05/qpst-emergency-download-support.html

EDIT:

This document will give you a good idea what happens on bootup and how parts interact with each other:

http://dl.dropbox.com/u/69550833/Android_Board_Bringup - 80-VM984-1-B.pdf

Hugh thanks to Antagonist42 for this beautiful document collection!!

I may add some referals to the parts used on the Xperia 2011 series... ;)

I will clean up here from time to time and write down conclusions in the first post.

TBC

Regards,

scholbert