Do we have a NUON bios extracted anywhere? Presumably theres a version of it (or something very much like it) in the N501 firmware upgrade? But I can't make head nor tail of that.
On which note, can we reverse engineer the BIOS enough to extract the NUON.VLM elements from the rest of it?
Hmmm. Wonder if Riff knows anything about this?
Cheers
Chris
the bizzarre ratings of an ignorant, deluded old fool
The Samsung firmware upgrade is just a Nuon program with the BIOS code in the data section. Its quite obvious from the disassembly of the program that the unit uses AMD flash memory command sequences. The commands are sent via communication packets to ID $45 which is the miscellaneous I/O interface.
As always, the nuon.run file contains an authentication header and then a little further down you will find the COFF file. The magic number for Nuon executable COFF files is 0x01 0x20. Similarly the magic number for relocatable object COFF files is 0x01 0x21. You will be able to tell if the 0x120 is the start of the COFF file because the ASCII readout will show the section headers nearby. Look for 'text', 'data', 'rodata' and 'PATCH' similar words. Text is always the first section, so follow your way up from there (only 32-64 bytes) and the first 0x01 0x20 is probably going to be the start of the COFF file. Extract everything starting from and including the 0x120 and beyond and save it as a binary file.
Once you have the COFF file extracted, you can use the coffdump utility to obtain section addresses. Use the vmdisasm utility to obtain disassemblies of the various sections. If I recall correctly, they put the firmware code in its own section, so if you use vmdisasm to disassemble code starting from that section, you should obtain a disassembly of the BIOS. You will have to make multiple disassemblies, of course, because many of the routines are spaced or use code memory for storing data, so vmdisasm will reach portions where it cant continue.
Once you have a disassembly, you should see two big jump tables at the start. The first series of 64-bit jmp instructions is the BIOS jump table that gets copied to $8000000 when BiosInit is called. The second set is considerably larger and that is the all-important DVD jumptable. That won't get you anything useful by itself, but if you use the vmar utility to extract the object files from the SDK libpe.a library file and then use coffdump to dump the symbols, you will obtain the symbolic name for each of the entries. At that point its easy to correlate sections of the disassembly with the various presentation engine functions.
In particular, you will notice in the dvdJumptable symbols that one of the routines is called API_LoadVLMEffect (or something similar). I don't need to explain why you would be interesting in checking that out. Similarly there are routines API_EnterVLM and API_ExitVLM. If the standard VLM code used an embedded VLM file, I would suspect that it would be loaded some time after calling API_EnterVLM. I would start with a disassembly of the API_EnterVLM routine and follow it through its course, looking for any load instructions or memory copies and memory access patterns that look like it might correspond to a VLM file. For figuring out the format of the VLM file itself, look at the LoadVLMEffect disassembly. It will still be insanely difficult without an example and without documentation but you might be able to gain some information from it.
Also, just to point out the obvious, the entire VMLabs BIOS code is contained within the firmware. The BIOS code is copied to RAM as part of the ROM entry code. If you look out for magic numbers $80000000 and $80760000 and code that looks like its copying a block from $F000xxxx to $8000000, you can find the code easily and see how it goes about setting up things for execution from RAM. Note that a few BIOS jump table entries contain jumps to ROM routines. The LoadPE, SecureForPE, BiosExit and one other function are always executed from ROM.
Lester M Fong wrote:doesn't Yak periodically say that he wants to get rid of his nuon dev stuff (like here and here)?
I'm no expert, but I'm guessing that if he developed VLM2 on those boxen, then there might be some kind of clues on them...
Heh, I have images of people poring over Yak's old HDDs with hex editors going "aha! this looks like a bit of Nuon code, so does this... oh no, that's just yet another picture of a sheep"
It'd be like Time Team, only with more sheep and less walls and ditches
