We have managed several dumps and found few interesting thinks, but the firmware is mostly x86 code with user interface routines.
There is no clue for audio decoding. We heve discovered only some "hashing" algorithm for key derivation or somethink like this, nothigh else for encryption. All encryption and audio should be implemented in hardware or in attached DSP chip. We did not managed dump firmware for DSP chip.
We are able to deccap all the chips present and make photos of die. But we does not have enough hardware in order to try delayering etc.
We should probably publish more of our findings, I will try to do so, but no promise.
With best regards, JS
On Fri, 23 Dec 2016 18:53:37 +0100 Xilokar xilokar@xilokar.info wrote:
Ok, so no hidden doc ;)
As I have no compatible device, I cannot do it this way. Did you guys managed to dump the firmware of one phone ?
Xilokar
Le 23/12/2016 à 17:11, JS a écrit :
There are at least 2 but I suppose 3 or more bits in voice frame which are not properly assigned. Also the constants in filters are just wild guess.
JS
On Fri, 23 Dec 2016 16:42:54 +0100 Jan Hrach jenda@yakumo.hrach.eu wrote:
I think that they were reverse engineered by JS, who was generating sine waves and sum of two sine waves of different frequencies and amplitudes and somewhat guessed it. So of course there may be mistakes.
On 23.12.2016 11:58, Xilokar wrote:
Hi,
I was wondering how the bit positions in voice frames were found (I am talking of voice_frame.py in rp-celp repo) I can not find the info in PAS 0001-7: Version 1.0.3 (so much for a specification...) I am trying to decode Q & ph for each subframe in order to feed the excitation signal in the filters, but there seems to be some incoherency either with my own received frames (that I was not able to test) or with the voice_tones sample from the transmit repo.
Regards, Xilokar
Tetrapol-kit mailing list Tetrapol-kit@brmlab.cz https://brmlab.cz/cgi-bin/mailman/listinfo/tetrapol-kit