実機からのROM DUMP

HowTo

必要なファイル

http://nah6.com/~itsme/itsutilsbin-20080313.zip

下準備

下記のレジストリを使用して、S11HTのアプリケーションロックを解除しておく。

※今手元に資料がないので後で書く

itsutilsbinを適当なフォルダに解凍する。
例としてD:\Work\Toolsに解凍。

下記のようなバッチファイルをD:\Workに作って実行→コマンドプロンプトが開く。

subst M: .
PATH=%PATH%;M:\Tools
M:
cmd

メモリアドレスの取得

M:\>pdocread -l
210.25M (0xd240000) FLASHDR
|           3.12M (0x31f000) Part00
|           3.63M (0x3a0000) Part01
|          68.50M (0x4480000) Part02
|         135.00M (0x8700000) Part03
  1.89G (0x79280000) DSK1:
|           1.89G (0x79260e00) Part00
STRG handles: 
handle 65bfeb8a  1.89G (0x79260e00)
handle e7474ce6135.00M (0x8700000)
handle 674841ae 68.50M (0x4480000)
handle e74aff72  3.63M (0x3a0000)
handle 074aff96  3.12M (0x31f000)
disk 65bfeb8a
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk e7474ce6
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 674841ae
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk e74aff72
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 074aff96
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

ROMの抽出

M:\>pdocread -w -d FLASHDR -b 0x800 -p Part00 0 0x31f000 Part00.raw
CopyTFFSToFile(0x0, 0x31f000, Part00.raw)

M:\>pdocread -w -d FLASHDR -b 0x800 -p Part01 0 0x3a0000 Part00.raw
CopyTFFSToFile(0x0, 0x3a0000, Part01.raw)

M:\>pdocread -w -d FLASHDR -b 0x800 -p Part02 0 0x4480000 Part02.raw
CopyTFFSToFile(0x0, 0x4480000, Part02.raw)

M:\>pdocread -w -d FLASHDR -b 0x800 -p Part03 0 0x8700000 Part03.raw
CopyTFFSToFile(0x0, 0x8700000, Part03.raw)

下記の4つのファイルができていたらとりあえず成功。

  • Part00.raw(3,272,704バイト)
  • Part01.raw(3,801,088バイト)
  • Part02.raw(71,827,456バイト)
  • Part03.raw(141,557,760バイト)

S11HT

ROM抽出

とりあえずROMの抽出を試みる。

210.25M (0xd240000) FLASHDR


    

               3.12M (0x31f000) Part00
    

    

               3.63M (0x3a0000) Part01
    

    

              68.50M (0x4480000) Part02
    

    

             135.00M (0x8700000) Part03
    


STRG handles: 
handle c7483c82135.00M (0x8700000)
handle 8749318e 68.50M (0x4480000)
handle 674aff52  3.63M (0x3a0000)
handle 874aff76  3.12M (0x31f000)
disk c7483c82
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 8749318e
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 674aff52
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 874aff76
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

ROMのDUMP

DUMP成功。先人に感謝。
XIPも同じく抽出、DUMPに成功。