Skip to content

Firmware m1401

mefistotelis edited this page Jul 30, 2021 · 6 revisions

Table of Contents

Target
Purpose
Versions
Structure
Boot process
OS and Libraries
Flashing
Interfaces

Target

The firmware programs NXP LPC1549 micro-controller on GL300c RC Main board. Earlier GL300 models had NXP LPC1765 instead, which has separate m1400 firmware.

Purpose

TODO

Versions

There are multiple versions, always unencrypted.

Marking Packages Timestamp Overview
01.00.1050 MG1SRC_FW_V01.00.00.01 2016-12-05
04.09.0795 C1_FW_V01.05.0070 2015-11-24
04.09.0800 C1_FW_v01.05.0071 2016-02-01
04.09.0805 C1_FW_V01.05.0080 2016-03-15
04.10.0006 C1_FW_V01.06.0000 C1_FW_v01.06.0001 C1_FW_v01.07.0000 C1_FW_v01.07.0002 C1_FW_v01.07.0030 C1_FW_v01.07.0040 C1_FW_v01.08.0000 C1_FW_v01.09.0000 2016-03-24
05.01.1286 C1_FW_v00.00.0001 2016-08-29

Structure

All the published versions are without encryption.

The unencrypted firmware is a memory image of ARM binary. During startup, it is being loaded into memory at address 0x0a000 (unverified) and executed by a loader. Such memory images are usually prepared by first linking the file with all libraries, and then using objcopy -O binary to get the final file without ELF header. The ELF header can be re-created if the address and boundaries of sections are known.

Boot process

No analysis of the booting procedure were performed.

OS and Libraries

The image is based on FreeRTOS.

No signatures of common libraries were found in the code.

Flashing

TODO

Interfaces

TODO

Clone this wiki locally