Hi,
I was wondering how the bit positions in voice frames were found (I am talking of voice_frame.py in rp-celp repo) I can not find the info in PAS 0001-7: Version 1.0.3 (so much for a specification...) I am trying to decode Q & ph for each subframe in order to feed the excitation signal in the filters, but there seems to be some incoherency either with my own received frames (that I was not able to test) or with the voice_tones sample from the transmit repo.
Regards, Xilokar
I think that they were reverse engineered by JS, who was generating sine waves and sum of two sine waves of different frequencies and amplitudes and somewhat guessed it. So of course there may be mistakes.
On 23.12.2016 11:58, Xilokar wrote:
Hi,
I was wondering how the bit positions in voice frames were found (I am talking of voice_frame.py in rp-celp repo) I can not find the info in PAS 0001-7: Version 1.0.3 (so much for a specification...) I am trying to decode Q & ph for each subframe in order to feed the excitation signal in the filters, but there seems to be some incoherency either with my own received frames (that I was not able to test) or with the voice_tones sample from the transmit repo.
Regards, Xilokar
Tetrapol-kit mailing list Tetrapol-kit@brmlab.cz https://brmlab.cz/cgi-bin/mailman/listinfo/tetrapol-kit
There are at least 2 but I suppose 3 or more bits in voice frame which are not properly assigned. Also the constants in filters are just wild guess.
JS
On Fri, 23 Dec 2016 16:42:54 +0100 Jan Hrach jenda@yakumo.hrach.eu wrote:
I think that they were reverse engineered by JS, who was generating sine waves and sum of two sine waves of different frequencies and amplitudes and somewhat guessed it. So of course there may be mistakes.
On 23.12.2016 11:58, Xilokar wrote:
Hi,
I was wondering how the bit positions in voice frames were found (I am talking of voice_frame.py in rp-celp repo) I can not find the info in PAS 0001-7: Version 1.0.3 (so much for a specification...) I am trying to decode Q & ph for each subframe in order to feed the excitation signal in the filters, but there seems to be some incoherency either with my own received frames (that I was not able to test) or with the voice_tones sample from the transmit repo.
Regards, Xilokar
Tetrapol-kit mailing list Tetrapol-kit@brmlab.cz https://brmlab.cz/cgi-bin/mailman/listinfo/tetrapol-kit
Ok, so no hidden doc ;)
As I have no compatible device, I cannot do it this way. Did you guys managed to dump the firmware of one phone ?
Xilokar
Le 23/12/2016 à 17:11, JS a écrit :
There are at least 2 but I suppose 3 or more bits in voice frame which are not properly assigned. Also the constants in filters are just wild guess.
JS
On Fri, 23 Dec 2016 16:42:54 +0100 Jan Hrach jenda@yakumo.hrach.eu wrote:
I think that they were reverse engineered by JS, who was generating sine waves and sum of two sine waves of different frequencies and amplitudes and somewhat guessed it. So of course there may be mistakes.
On 23.12.2016 11:58, Xilokar wrote:
Hi,
I was wondering how the bit positions in voice frames were found (I am talking of voice_frame.py in rp-celp repo) I can not find the info in PAS 0001-7: Version 1.0.3 (so much for a specification...) I am trying to decode Q & ph for each subframe in order to feed the excitation signal in the filters, but there seems to be some incoherency either with my own received frames (that I was not able to test) or with the voice_tones sample from the transmit repo.
Regards, Xilokar
Tetrapol-kit mailing list Tetrapol-kit@brmlab.cz https://brmlab.cz/cgi-bin/mailman/listinfo/tetrapol-kit
We have managed several dumps and found few interesting thinks, but the firmware is mostly x86 code with user interface routines.
There is no clue for audio decoding. We heve discovered only some "hashing" algorithm for key derivation or somethink like this, nothigh else for encryption. All encryption and audio should be implemented in hardware or in attached DSP chip. We did not managed dump firmware for DSP chip.
We are able to deccap all the chips present and make photos of die. But we does not have enough hardware in order to try delayering etc.
We should probably publish more of our findings, I will try to do so, but no promise.
With best regards, JS
On Fri, 23 Dec 2016 18:53:37 +0100 Xilokar xilokar@xilokar.info wrote:
Ok, so no hidden doc ;)
As I have no compatible device, I cannot do it this way. Did you guys managed to dump the firmware of one phone ?
Xilokar
Le 23/12/2016 à 17:11, JS a écrit :
There are at least 2 but I suppose 3 or more bits in voice frame which are not properly assigned. Also the constants in filters are just wild guess.
JS
On Fri, 23 Dec 2016 16:42:54 +0100 Jan Hrach jenda@yakumo.hrach.eu wrote:
I think that they were reverse engineered by JS, who was generating sine waves and sum of two sine waves of different frequencies and amplitudes and somewhat guessed it. So of course there may be mistakes.
On 23.12.2016 11:58, Xilokar wrote:
Hi,
I was wondering how the bit positions in voice frames were found (I am talking of voice_frame.py in rp-celp repo) I can not find the info in PAS 0001-7: Version 1.0.3 (so much for a specification...) I am trying to decode Q & ph for each subframe in order to feed the excitation signal in the filters, but there seems to be some incoherency either with my own received frames (that I was not able to test) or with the voice_tones sample from the transmit repo.
Regards, Xilokar
Tetrapol-kit mailing list Tetrapol-kit@brmlab.cz https://brmlab.cz/cgi-bin/mailman/listinfo/tetrapol-kit
Digging out an old mail...
Did you happen to publish somewhere more of your findings on the mc9620 ? I've finally managed to get my hand on an used one (that unfortunately seems to need reprogramming)
Best Xilokar
Le 23/12/2016 à 19:22, JS a écrit :
We have managed several dumps and found few interesting thinks, but the firmware is mostly x86 code with user interface routines.
There is no clue for audio decoding. We heve discovered only some "hashing" algorithm for key derivation or somethink like this, nothigh else for encryption. All encryption and audio should be implemented in hardware or in attached DSP chip. We did not managed dump firmware for DSP chip.
We are able to deccap all the chips present and make photos of die. But we does not have enough hardware in order to try delayering etc.
We should probably publish more of our findings, I will try to do so, but no promise.
With best regards, JS
On Fri, 23 Dec 2016 18:53:37 +0100 Xilokar xilokar@xilokar.info wrote:
Ok, so no hidden doc ;)
As I have no compatible device, I cannot do it this way. Did you guys managed to dump the firmware of one phone ?
Xilokar
Le 23/12/2016 à 17:11, JS a écrit :
There are at least 2 but I suppose 3 or more bits in voice frame which are not properly assigned. Also the constants in filters are just wild guess.
JS
On Fri, 23 Dec 2016 16:42:54 +0100 Jan Hrach jenda@yakumo.hrach.eu wrote:
I think that they were reverse engineered by JS, who was generating sine waves and sum of two sine waves of different frequencies and amplitudes and somewhat guessed it. So of course there may be mistakes.
On 23.12.2016 11:58, Xilokar wrote:
Hi,
I was wondering how the bit positions in voice frames were found (I am talking of voice_frame.py in rp-celp repo) I can not find the info in PAS 0001-7: Version 1.0.3 (so much for a specification...) I am trying to decode Q & ph for each subframe in order to feed the excitation signal in the filters, but there seems to be some incoherency either with my own received frames (that I was not able to test) or with the voice_tones sample from the transmit repo.
Regards, Xilokar
Tetrapol-kit mailing list Tetrapol-kit@brmlab.cz https://brmlab.cz/cgi-bin/mailman/listinfo/tetrapol-kit
We have not got over to it, no time, sorry, but I still have the board sitting in the cabinet and we plan to dive into it. (no idea when, some of us were changing jobs, then we were moving our hackerspace, I am finishing school etc., so we are pretty busy with other things too)
On 8.1.2018 11:17, Xilokar wrote:
Digging out an old mail...
Did you happen to publish somewhere more of your findings on the mc9620 ? I've finally managed to get my hand on an used one (that unfortunately seems to need reprogramming)
Best Xilokar
Le 23/12/2016 à 19:22, JS a écrit :
We have managed several dumps and found few interesting thinks, but the firmware is mostly x86 code with user interface routines.
There is no clue for audio decoding. We heve discovered only some "hashing" algorithm for key derivation or somethink like this, nothigh else for encryption. All encryption and audio should be implemented in hardware or in attached DSP chip. We did not managed dump firmware for DSP chip.
We are able to deccap all the chips present and make photos of die. But we does not have enough hardware in order to try delayering etc.
We should probably publish more of our findings, I will try to do so, but no promise.
With best regards, JS
On Fri, 23 Dec 2016 18:53:37 +0100 Xilokar xilokar@xilokar.info wrote:
Ok, so no hidden doc ;)
As I have no compatible device, I cannot do it this way. Did you guys managed to dump the firmware of one phone ?
Xilokar
Le 23/12/2016 à 17:11, JS a écrit :
There are at least 2 but I suppose 3 or more bits in voice frame which are not properly assigned. Also the constants in filters are just wild guess.
JS
On Fri, 23 Dec 2016 16:42:54 +0100 Jan Hrach jenda@yakumo.hrach.eu wrote:
I think that they were reverse engineered by JS, who was generating sine waves and sum of two sine waves of different frequencies and amplitudes and somewhat guessed it. So of course there may be mistakes.
On 23.12.2016 11:58, Xilokar wrote:
Hi,
I was wondering how the bit positions in voice frames were found (I am talking of voice_frame.py in rp-celp repo) I can not find the info in PAS 0001-7: Version 1.0.3 (so much for a specification...) I am trying to decode Q & ph for each subframe in order to feed the excitation signal in the filters, but there seems to be some incoherency either with my own received frames (that I was not able to test) or with the voice_tones sample from the transmit repo.
Regards, Xilokar
Tetrapol-kit mailing list Tetrapol-kit@brmlab.cz https://brmlab.cz/cgi-bin/mailman/listinfo/tetrapol-kit
I understand, same here.
I'd just like to know if you managed to find where if there are any jtag bus on the 24 pins (8+8+6) "connector" sitting next to the atmel chip ?
I've search for uart/jtag on the 6 pin connector but without success so far.
btw, does any one owns a programming cable/software for this phone ? I didn't find any picture of one.
Le 08/01/2018 à 11:33, Jan Hrach a écrit :
We have not got over to it, no time, sorry, but I still have the board sitting in the cabinet and we plan to dive into it. (no idea when, some of us were changing jobs, then we were moving our hackerspace, I am finishing school etc., so we are pretty busy with other things too)
On 8.1.2018 11:17, Xilokar wrote:
Digging out an old mail...
Did you happen to publish somewhere more of your findings on the mc9620 ? I've finally managed to get my hand on an used one (that unfortunately seems to need reprogramming)
Best Xilokar
Le 23/12/2016 à 19:22, JS a écrit :
We have managed several dumps and found few interesting thinks, but the firmware is mostly x86 code with user interface routines.
There is no clue for audio decoding. We heve discovered only some "hashing" algorithm for key derivation or somethink like this, nothigh else for encryption. All encryption and audio should be implemented in hardware or in attached DSP chip. We did not managed dump firmware for DSP chip.
We are able to deccap all the chips present and make photos of die. But we does not have enough hardware in order to try delayering etc.
We should probably publish more of our findings, I will try to do so, but no promise.
With best regards, JS
On Fri, 23 Dec 2016 18:53:37 +0100 Xilokar xilokar@xilokar.info wrote:
Ok, so no hidden doc ;)
As I have no compatible device, I cannot do it this way. Did you guys managed to dump the firmware of one phone ?
Xilokar
Le 23/12/2016 à 17:11, JS a écrit :
There are at least 2 but I suppose 3 or more bits in voice frame which are not properly assigned. Also the constants in filters are just wild guess.
JS
On Fri, 23 Dec 2016 16:42:54 +0100 Jan Hrach jenda@yakumo.hrach.eu wrote:
I think that they were reverse engineered by JS, who was generating sine waves and sum of two sine waves of different frequencies and amplitudes and somewhat guessed it. So of course there may be mistakes.
On 23.12.2016 11:58, Xilokar wrote: > Hi, > > I was wondering how the bit positions in voice frames were found > (I am talking of voice_frame.py in rp-celp repo) > I can not find the info in PAS 0001-7: Version 1.0.3 (so much for > a specification...) > I am trying to decode Q & ph for each subframe in order to feed > the excitation signal in the filters, but there seems to be some > incoherency either with my own received frames (that I was not > able to test) or with the voice_tones sample from the transmit > repo. > > Regards, > Xilokar > > > _______________________________________________ > Tetrapol-kit mailing list > Tetrapol-kit@brmlab.cz > https://brmlab.cz/cgi-bin/mailman/listinfo/tetrapol-kit >
The programmation interface look like this
WaaX Interface
Code name : TPS1
Le 08/01/2018 à 11:49, Xilokar a écrit :
I understand, same here.
I'd just like to know if you managed to find where if there are any jtag bus on the 24 pins (8+8+6) "connector" sitting next to the atmel chip ?
I've search for uart/jtag on the 6 pin connector but without success so far.
btw, does any one owns a programming cable/software for this phone ? I didn't find any picture of one.
Le 08/01/2018 à 11:33, Jan Hrach a écrit :
We have not got over to it, no time, sorry, but I still have the board sitting in the cabinet and we plan to dive into it. (no idea when, some of us were changing jobs, then we were moving our hackerspace, I am finishing school etc., so we are pretty busy with other things too)
On 8.1.2018 11:17, Xilokar wrote:
Digging out an old mail...
Did you happen to publish somewhere more of your findings on the mc9620 ? I've finally managed to get my hand on an used one (that unfortunately seems to need reprogramming)
Best Xilokar
Le 23/12/2016 à 19:22, JS a écrit :
We have managed several dumps and found few interesting thinks, but the firmware is mostly x86 code with user interface routines.
There is no clue for audio decoding. We heve discovered only some "hashing" algorithm for key derivation or somethink like this, nothigh else for encryption. All encryption and audio should be implemented in hardware or in attached DSP chip. We did not managed dump firmware for DSP chip.
We are able to deccap all the chips present and make photos of die. But we does not have enough hardware in order to try delayering etc.
We should probably publish more of our findings, I will try to do so, but no promise.
With best regards, JS
On Fri, 23 Dec 2016 18:53:37 +0100 Xilokar xilokar@xilokar.info wrote:
Ok, so no hidden doc ;)
As I have no compatible device, I cannot do it this way. Did you guys managed to dump the firmware of one phone ?
Xilokar
Le 23/12/2016 à 17:11, JS a écrit :
There are at least 2 but I suppose 3 or more bits in voice frame which are not properly assigned. Also the constants in filters are just wild guess.
JS
On Fri, 23 Dec 2016 16:42:54 +0100 Jan Hrach jenda@yakumo.hrach.eu wrote: > I think that they were reverse engineered by JS, who was generating > sine waves and sum of two sine waves of different frequencies and > amplitudes and somewhat guessed it. So of course there may be > mistakes. > > On 23.12.2016 11:58, Xilokar wrote: >> Hi, >> >> I was wondering how the bit positions in voice frames were found >> (I am talking of voice_frame.py in rp-celp repo) >> I can not find the info in PAS 0001-7: Version 1.0.3 (so much for >> a specification...) >> I am trying to decode Q & ph for each subframe in order to feed >> the excitation signal in the filters, but there seems to be some >> incoherency either with my own received frames (that I was not >> able to test) or with the voice_tones sample from the transmit >> repo. >> >> Regards, >> Xilokar >> >> >> _______________________________________________ >> Tetrapol-kit mailing list >> Tetrapol-kit@brmlab.cz >> https://brmlab.cz/cgi-bin/mailman/listinfo/tetrapol-kit
Tetrapol-kit mailing list Tetrapol-kit@brmlab.cz https://brmlab.cz/cgi-bin/mailman/listinfo/tetrapol-kit
-
Jan Hrach -
JS -
WaaX -
Xilokar