posts
- Debloating Android 2.3 on the HTC Desire Z: use pm disable
51 CyanogenMod 7 system APKs came off an HTC Desire Z and only one was load-bearing. pm disable was the better tool, and I had already used it.
- FiiO X1 NAND dump: 128 MB over USB, one block at a time
A bare-metal SD dumper for the FiiO X1 that never ran, and the hwstub shell loop that copied all 128 MB of its NAND flash overnight with zero read errors.
- HTC Desire Z bought for parts: S-OFF, SuperCID and 4202 mV
A 2010 HTC Desire Z bought for parts came back S-OFF, SuperCID, ENG HBOOT and CyanogenMod 7, its battery at 4202 mV: the start of a pocket mesh node.
- FiiO X1 factory.x1: unsigned code execution from the SD card
The FiiO X1's X-Boot loader jumps into any factory.x1 on the SD card on its recovery path: XOR-scrambled with a public prime key, never signed.
- FiiO X1 IPL decompiled: 8 KB of JZ4760B DDR init code
Decompiling the FiiO X1's 8 KB IPL in Ghidra: warm resume, a UART log nobody reads, 64-step DQS calibration and the real DDR timings.
- FiiO X1 NAND dump: hwstub, fee1:dead and a 64-bit compiler
Dumping the FiiO X1's IPL from NAND after every ingenic-boot route failed: Rockbox hwstub cross-built for the JZ4760B, shimmed for Lua 5.4.
- FiiO X1 DDR deadlock: reading RAM config from live registers
A warm reboot into the FiiO X1's USB boot mode left its JZ4760B DDR controller configured: its live registers gave up the config, clocks and DQS value.
- FiiO X1 boot ROM: running code on a JZ4760B with no RAM
Reverse engineering the FiiO X1's Ingenic JZ4760B boot ROM: USB boot protocol, boot modes, IPL format, and running code from I-cache with no DDR.