Home

Welcome to the kyletd_modem wiki!

The Packaged Modem in Samsung SC8810 firmware is just a combined image with the same offsets as their load addresses, for easy loading by S-Boot https://github.com/fxsheep/sprd-u-boot-kyletd/blob/5ce26cc34381f886dce234d66410dbeee0e3ed9d/property/normal_mode.h#L67

DSP Image Format

The SC8810 DSP image is actually a combination of two DSP images, the GSM DSP (for GSM network) and the TD DSP (for CMCC 3G network),
both of which are flat images(i.e. no headers)
DSP image offset:
0x0-0x7F Header:(but who parses it?)
0x80-0x1E0000 GSM DSP
0x1E0000-0x2DFFFF TD DSP

DSP Info

The SC8810 uses ARM Cortex-A5 as the MCU, CEVA-X1622 as the DSP. There's an internal shared memory between AP and DSP.
Both AP and DSP can access External Memory Controller, so both share the DDR as well.
The DDR base address is 0x0 in ARM, 0xC0000000 in DSP.

The modem image controls the DSP (start, stop, program start address, etc.)

There's a ROM dedicated to ARM, documented as IROM. There's also a ROM dedicated to DSP, documented as L2ROM.
The ARM boots from IROM, but the DSP doesn't seem to, as there's a register called DSP boot vector. But who knows?

The DSP architecture is not known publicly. Public information indicates that it uses CEVA-X 16bit architecture.
The assembler is called cevax16asm, being part of CEVA's IDE for the DSP, called SmartNcode (TM) SDT for CEVA-X16xx (TM) 9.2 .

However, while the details of CEVA-X1622 ISA is completely under the cover of NDA, the debugging tools here provide a
built-in disassembler for various processors, including this DSP. Moreover, a demo version of the software can be downloaded free of
charge, which still has the disassembler fully-functional. This opens up many possibilities, e.g. bruteforcing every possible combination of
machine code and have them disassembled in it, then make a rainbow-table based assembler for the DSP. From there it's possible to determine the
instuctions and their encodings, without any access to confidential documentation/software. Then, with instruction mnemonics and corresponding
encodings, combining block diagram of the DSP in public advertisements, it's possible to guess the meaning of them and have it checked by actually
running them on our own sc8810 devices. In the end, we may be able to (even) have some fun with these cores in our phones!

We bought our phones AND their particular pieces of silicon inside, and we have right to run whatever we want to on them :)

The fun starts here