by kalide » Wed Jan 02, 2008 2:15 am
I've been doing some preliminary research into reverse engineering EOS 4.7. This would be challenging to say the least since there are custom chips in there.
However, there are some fairly reasonable Coldfire processor development tools including some seemingly ok emulators, embedded micro linux variants and lots of libraries for general purpose processing, and some good papers on FIIR filters using the coldfire native multiply-add- instruction features in some of the variants.
The challenge is understanding if this can be fixed is:
1. Being able to get a clean build/compile/re-assemble of the code to a binary bit for bit compatible load file for flash download from floppy.
2. Understanding if the RFX issue is hardware or software related. If its hardware, its probably in FPGA type code and we are ^&()ed. If its software, its determining the exact behaviour of the OS and DSP management code. This is likely to be very complex but not impossible.
3. Alternative: throw out EOS and code from scratch using uLinux as a kernel from which to build on a hardware management and processing set of tasks. Very complex requiring complete reverse engineering of hardware platform - very tedious but not impossible, but would be multi man year effort.
I've reverse engineered code in the past and its possible, and not so hard if the tools are good for disassembly and re-building a binary, but I would imageine the EOS build is a few hundred thousand lines of C and coldfire, possibly DPS assembly code.
It would be a massive help if we could determine if compilers were used, what development environment, what memory maps exist, and what data is available on the IC's beyond the obvious coldfire support family.
Anyone attempted an research into this ? I know there is extensive debugging at least from a behaviour perspective of the RFX/Emu OS, but not at a bus/logic or otherwise level.
Lastly, not sure how many read/write cycles the Emu Flash could take - would be handy if there was a dev platform handy on ebay or some kind of debug eprom chipset......any former emu guys out there with a garage full of gear ? :-)
Mark
's'allbollocksinnit.