[019] IT9919 Hacking - part 4 - Diving into the boot-ROM

In this series I will be hacking around with the IT9919 media processor that powers the Lenkeng LKV373 HDMI Extender Device and the EZCAP 283S which were reviewed in previous videos.
In this video I investigate the booting mechanism to try and uncover the mystery of the SMAZ compressions scheme and checksum.
Show Notes: opentechlab.org.uk/videos:019...
Twitter: @OpenTechLabChan
Mastadon: @[e-mail]
SubscribeStar: www.subscribestar.com/opentec...
PayPal: www.paypal.me/opentechlab
Bitcoin: 18CU9LxwRuiLHy9HsuMj2vzobbW4J3QVC2

[@mph8759]

Extremely well for forensic reverse engineering. I’m tech savvy but not a programmer or electrical engineer, but this is very interesting and educational. Thank you for putting in the time to create this content!!!

[@userPrehistoricman]

I love rabbit hole digging like this. Do you know of any other channels that do similar videos? I've spent quite a long time REing the instruction set of an old DSP and I wanted to publish something like this - a multi-part series explaining my steps and progress. The motivation has so far evaded me, but seeing similar videos gives me hope.

[@UpcycleElectronics]

Thanks Joel. I can't believe you've documented for months without publishing it. That is some serious commitment. I keep encountering these circumstances where I realize I need to suck it up and learn to code right, and with python. Thanks for giving me the clarity and direction to see where I want to develop my skills, and thanks to everyone that can and chooses to support Joel. Seriously, this series has given me a lot to think about. Supporting Joel means enabling people like me, a dude that is disabled from a car hitting me on a bicycle commute to work in 2014. Joel's content has more value to me right now than anything else I've seen on KZbin in a long time, and I have close to 1k subscriptions. So, seriously, thanks to anyone who can and does choose to support this channel. I would throw in a few bucks if I could get the judge to hurry up and get me on disability already. Thanks again, seriously. -Jake

[@OpenTechLab]

What a comment! It's such a privilege to have an audience like this. Most of the time engineering is quite a thankless task, working away in obscurity where nobody can see the details of what you're doing. It's a great encouragement to me to be able to share these projects. As for donations: It's only for a small group of people: people who have all the needs of them and their loved ones met, and are well supplied with gear for their own projects, who feel like they want to chip in to help the production. And you shouldn't worry - I already have a solid day job, and I'd still make videos even if there was no donations or ads whatsoever. Why? Because it's fun, and it's a great way to memorialize and share the projects I enjoy doing.

[@tedvanmatje]

With you, Alistair and velociraptor on it's case, I think that smaz's cloak and dagger days are now finite. This series has hit the nail square on the head Joel! Thankyou for this totally inspiring and motivating series mate....you are a legend :)

[@razorr1920]

Loved it man....absolutely amazing and downright finding a needle in a haystack

[@avramitra]

I was eagerly waiting for an update! Thanks for sharing your adventure with us. I'm feeling so thrilled as this is the first time I'm witnessing a reverse engineering/hacking journey in (not so) real time. Can't wait fot the day when you (or, we?) become successful uncovering the mystery of this bad boy..

[@Graham_Wideman]

Great detective story! I'm hanging on for the bit where you decide to add the Blue Pill to your 3D printed board frame! :-)

[@IljaSara]

"Detective story". The exact words I also describe this series of videos.

[@edgeeffect]

This series was one of the best things I've ever seen on KZbin.... I hope you o some more one day.

[@LightningTheGod]

You are doing a great job. You deserve much more views!

[@im0b]

very good job! exited to see this unfold, especially in the community but in the future as well, this might pave the way for hdmi stuff in the make community :D

[@bumelant]

I'm a simple man, I see new OpenTechLab video, I click thumb up :)

[@joopterwijn]

Before viewing the video! (I assume), same here!

[@programorprogrammed]

Fantastic, each video gets more exciting

[@jekader]

Suddenly stumbled upon this channel and it's an amazing reverse-engineering project! It's especially interesting to follow the github issue with all the collaboration happening leading to great results. Subscribed and pretty sure the next episode will connect all remaining dots.

[@pabloabraham7284]

Amazing work!!! Please keep doing these videos!!!

[@AndriusJankauskasJankiz]

Just watched through the series and Wow! You gained a new subscriber!! Absolutely fascinating process. I'm more of a hardware design guy but dabble in software, mostly unsuccessfully. The tools used in these videos make absolute sense but I would have no idea on where to even start with them. Congratulations on your progress and I am eagerly waiting for the next installment. Any introductory information on where to get started would be greatly appreciated (baby steps, possibly a completely known processor architecture application disassembled and analyzed from HEX to logical functions would be an amazing resource)

[@Grazfather]

Great work on this! Well explained. With all the tooling you've written, I'm surprised you haven't written a processor module for IDA or a lifter for Binary Ninja.

[@laneboysrc]

This would sure be a great talk at the next Chaos Computer Congress end of the year!

[@samthornley]

Amazing work!

[@cjxordi]

Smart ass. I love it. Keep it up. I wish have a time to do such a project.

[@leozendo3500]

Amazing. This may become like the rtl-SDR chip.

[@cooker5000]

great content! keep up the great work.

[@pipsqueak2009]

Fascinating- please keep going , and sharing your progress. Thank you!

[@Thebloggermustdie]

great work man, your videos are like my own personal soap opera. I cant wait for the next one to learn more. could you do tutorial on hardware hacking and use something generic(cheap) like a router so we can all follow along. Thanks

[@OpenTechLab]

If you want to get a LKV373A, they're selling for ~$35

[@philippelhaus]

Quality Video

[@pixelflow]

I've been tinkering with some STM32 binaries lately, radare2 has a global graph with the command 'agC' just like yours! it can export dot and gml. Gephi has some nice graph layouts for visualizing more complex connected graphs!

[@danielegger6460]

The addresses and terminology used in the memory map descriptions look very ARMish.

[@OpenTechLab]

Yes - it uses the AHB bus, which is an ARM thing.

[@DaveHojo]

Just saw the ADC/DAC video from 2018 and you mentioned being in CO but having to move. Where are you presently?

[@daviddouard9294]

Hi, have you considered using radare2 for your disassembling process? That would require adding support for this cpu/arch, but it might have made your work easier.

[@SimonCoates]

I wonder if the techs at ITE are watching, willing you to progress and crack it, or are just pissed off?

[@user-zo6nn2ih2f]

they're watching studying how to protect their IP in future products

[@SimonCoates]

@@user-zo6nn2ih2f - I was thinking the same 👍

[@OpenTechLab]

Or studying how to better hide the fact that they used patented or tradmarked technology without paying royalties?

[@nicholasroos3627]

​@@OpenTechLab more likely!

[@ghwizz]

@@OpenTechLab agreed - but the whole patent / IP system is broken - at least in the sense that the way it works isn't what's written on the tin! The fundamentals are that having IP gives you a few years headstart - after that it becomes shared. If it's useful enough ways will be found to deploy it widely.

[@danielegger6460]

Co-operative mode could be bitstream via SPI/UART which would be useful if this chip is used as a companion in a slightly more powerful setup, e.g. a settop-box.

[@OpenTechLab]

Reading the data-sheet, it appears that the SPI port has direct access to the entire memory space including all the peripherals. In other words, it's possible to completely configure the processor without involving the CPU. Perhaps co-operative means - downloading the firmware through SPI at boot, OR running the chip without any firmware at all.

[@giacomo.delazzari]

@@OpenTechLab I thought co-operative mode had something to do with the other IC reflashing the FW if the checksum doesn't match. Have you found where's the code that communicates with the other processor and reads back the "right" firmware? I know it's really not important, but just out of curiosity

[@OpenTechLab]

Certainly I think it has something to do with it. Though I haven't dug into that part yet. There is one SPI bus between the two processors, but it's not used to transfer firmware just to poll some registers

[@bxhome]

Amazing skill! it is like breaking enigma code. Good luck!

[@metaforest]

You are going to need to buy some replacement SPI FLASH chips soon. They aren't designed to get hammered on with 1000's of writes like you are doing. One thing you might look at is building a FLASH emulator. The BluePill could act as your SPI slave emulation. The bluepill maintains a list of patches in RAM and applies them on the fly as the target requests data from the FLASH. FLASHBluePill Target This would speed things up as well. No need to rewrite the Flash image for every test. You would have one Flash image fixture and just change the dynamic patch for every test.

[@OpenTechLab]

I'm actually not reflashing the flash chips, just modifying the flash burner routines built into the upgrade package - which gets loaded into RAM through the device web server, so that it runs the test code that I patch into an unused area of the upgrade package. Otherwise, yes I probably would build something like what you're suggesting

[@sdjhgfkshfswdfhskljh3360]

If you have ability to dump uncompressed firmware, then you can start analyzing it even without complete knowledge of compression algorithm. Maybe inteleaving the uncompressed data with literal control codes and patching of CRC check is enough to make it work. Or am I wrong?

[@goosenp]

Which version of the LKV373A do you have? (I see an version 3 of the device on eBay already) Oh, you mentioned that you managed a 0.2S latency on this device, how were you able to achieve that?

[@scooserver]

Any progress with this?i love this device it would be great to have custom firmwares :) thanks for your efforts :)

[@Rooey129]

Love it!

[@MickeyD2012]

You should get it to run Pong and Doom.

[@giacomo.delazzari]

By what you saw, what do you think the DPU could also be used for besides decompression and (presumably) CRC (or the checksum thing, whatever it is)? Seems like it could be an interesting peripheral for when we'll be able to write our own code here. Maybe it's even a bit programmable?

[@OpenTechLab]

When we finally unlock the SMAZ compression, we'll be able to see a complete view of the way that all the different IT9910-based products use the registers in their firmwares. Perhaps we'll see more applications for the DPU - or not; perhaps it's just used for booting. Hard to tell

[@giacomo.delazzari]

@@OpenTechLab right. Thank you very much for all the work you've been doing and the great videos BTW! It's really great content

[@birgermonsen]

@@OpenTechLab Since the compression used doesn't seem to be any "logical" choice, could they be reusing algorithms in the DPU that are later used for decompressing the HDMI data streams?

[@lo2740]

Do you have the complete document for ITE9856-9910-9800-9917寄存器定义? it is over 14 pages long..

[@edgeeffect]

I seem to have missed something here.... I thought that only a couple of opcodes for the RISC processor had been worked out, but here you seem to be disassembling the entire boot ROM. Where did I miss "us" finding out what all the opcodes are??????

[@OpenTechLab]

In part 3 at 10:19: kzbin.info/www/bejne/iYOaqpt8ntSKrck . After I published it, based on the instructions I'd found someone commented that this appears that this is OpenRISC or1k

[@edgeeffect]

@@OpenTechLab Riiight! I've missed a whole episode (I've been in hospital :/ ). Not keeping my nose glued to my "subscriptions" box on KZbin. Thanks for the quick response. This has been a fascinating journey so far.

[@jaro6985]

@@edgeeffect Go to your subscriptions feed page, grid view is preferred, scroll to the bottom, once you've watched or don't want to watch a video click the "Hide" button. Then move on to the next oldest video.

[@matisec3413]

Excellent piece of reverse engineering! can't wait for the next episode.

[@Graham_Wideman]

19:20 Makes viewers aware they've been using Intel processors too long when it's so hard to read 4-byte quantities written in "normal" MSB first order! Hahahaha

[@leisergeist]

Brilliant work as always. Is your intelligence open source too? I need some of that, lol. Wish I had the smarts to help with this kind of stuff.

[@DAVIDGREGORYKERR]

Could it be RLE (Run Length Encoding)

[@goosenp]

Wow, more amazing progress! I hope someone in the community figures out the rest. What software do you use for editing videos on Linux?

[@OpenTechLab]

I've been using kdenlive for every video so far. It does the job, but it's a bit glitchy in places. I'm thinking of trying out the NLE in Blender, now that they've done so much to improve the UI.

[@nxxxxzn]

is there an offline FLOSS alternative to binvis.io?

[@OpenTechLab]

I don't know of one that matches binvis, but I would be very happy if there was. It seems to me that it would be possible to take the binviz concept and extend it in many ways. Would be a nice little project for someone, I think

[@userPrehistoricman]

It's probably all client-sided so you could just save the page and make a couple of mods to make it fully offline.

[@Asdayasman]

@@OpenTechLab Have you seen that one that xoreaxeaxeax made but never released? That seems like an amazing blueprint to work from.

[@srlorch406]

So you found out how to pass the checksum with the all ones trick(minute 20) but you havent actually tryed it? You just tryed to understand how the checksum is made. did i understand that correctly?

[@havresylt]

In several videos, you've referred to your Rigol Ds1054z as a "200 MHz oscilloscope". Why is that? I know that one can "hack" them to increase their capabilities, but AFAIK that only increases the bandwidth to 100 mhz, no?

[@franciscolameira950]

You're right. No DS1054Z can do 200MHz.

[@superBert1983]

I love such content, and really am very interested in being able to do such things. Can anybody tell me where I should start to learn this? It is a combination of both electronics and writing code. I have no background in IT or engineering, I only know how to sail with a ship :(

[@ghwizz]

I would say find a simple thing you want to have - to scratch your itch - and research how to make your project. esp32 plus sensor of your choice. Go start making!

[@Goldenkrew3000]

Heyyyyyyyy 15th like lol And third comment

[@ryanavery7980]

what is the IT9919? I've googled it but no info really. at least nothing that I can understand. Its some sort of chip?

[@Tangobaldy]

92 likes 0 dislikes, amazing stats

[@user-zo6nn2ih2f]

looks like someone disliked it after reading your comment xD

[@skipper1st216]

I found a thread about SMAZ stackoverflow.com/questions/33331552/how-smaz-compression-library-works

[@OlivierLatignies]

Very nice reverse engineering.

[@nancyzhang6447]

We have a 3d printer that we want to promote, are you interested?