Hacking Jobo device

I blogged earlier about buying the Linux-based Jobo Giga Vu Pro Evolution. On 2007-04-14 I asked about the source code, and on 2007-04-23 I received a reply pointing at this URL. I see now that the file can also be downloaded (much faster) from Jobo directly.

For the record:

2c64bf3ed589566eb20fe8fe173717f2b9eb058e  Open Source Packages.zip

The package contain no instructions, and just a collection of random tarballs.

jas@mocca:~/jobo/Open Source Packages$ ls */*
Blackbox/blackbox-0.62.1.tar.gz        Libexif/libexif_xsilo.patch
Blackbox/blackbox_xsilo.patch          Libjpeg/jpegsrc.v6b.tar.gz
Busybox/busybox-0.60.4.tar.gz          Libtiff/tiff-v3.6.1.tar.gz
Dhcpcd/dhcpcd-1.3.22-pl4.tar.gz        Linux/linux.tar.gz
Dosfstools/dosfstools-2.10.src.tar.gz  Pcmcia CS/pcmcia-cs-3.2.4.tar.gz
Dosfstools/dosfstools_xsilo.patch      X Windows/X430src-1.tgz
Glibc/glibc-2.2.3.tar.gz               X Windows/X430src-2.tgz
Glib/glib-1.2.10.tar.gz                X Windows/X430src-3.tgz
Gtk+/gtk+-1.2.10.tar.gz                X Windows/X430_xsilo.patch
ID3lib/id3lib-3.8.3.tar.gz             Zlib/zlib.tar.gz
Libexif/libexif-0.6.9.tar.gz
jas@mocca:~/jobo/Open Source Packages$ 

I was somewhat disappointed.

Today I thought of looking at the official firmware images. I downloaded the 1.0.2.1, 1.0.3 and 2.0.4 versions from Jobo.

For the record, the SHA-1 of the firmware ZIP files were:

f2382f2a723324a5de510bdc24a87de65e631775  Firmware_1_0_2_1.zip
c0e1667e406ce471da47e071fb476f9dd1964131  Firmware_1_0_3.zip
3a793eadf7c4300c0efc8b6eff25d5ac3d508848  Firmware_2_04.zip

The package contains of two sub-directories, Part1/ and Part2/. I looked at some of the files, and they are in the B000FF format that appears to be a WinCE format (?). I tried to decode these files for a while, but didn’t get far.

Then I had the idea to compare the images between firmware versions to identify which files are worthy of attention.

Here is the output:

79c4222c874f56a0ac217e42f981b9487c2938c0  Firmware_1_0_2_1/Part 1/upgrade.bin
79c4222c874f56a0ac217e42f981b9487c2938c0  Firmware_1_0_2_1/Part 2/upgrade.bin
79c4222c874f56a0ac217e42f981b9487c2938c0  Firmware_1_0_3/Part 1/upgrade.bin
79c4222c874f56a0ac217e42f981b9487c2938c0  Firmware_1_0_3/Part 2/upgrade.bin
79c4222c874f56a0ac217e42f981b9487c2938c0  Firmware_2_04/Part1/upgrade.bin
79c4222c874f56a0ac217e42f981b9487c2938c0  Firmware_2_04/Part2/upgrade.bin

Clearly that is uninteresting code (at least for now), since it didn’t change. Possibly it is the firmware flash code or similar.

4b0f73278a30f131062cee2030f1e1de72ccb1a1  Firmware_1_0_2_1/Part 1/upgrade4.dat
1714fc04ba57f8555b0c84e166edbf7509b3e643  Firmware_1_0_2_1/Part 2/upgrade1.dat
e15632238f431aeb4d4be01b44cfe237d688834c  Firmware_1_0_2_1/Part 2/upgrade2.dat
0fbab96aeae91bf959baaa14fa336b4a0b76e12c  Firmware_1_0_2_1/Part 2/upgrade3.dat
4b0f73278a30f131062cee2030f1e1de72ccb1a1  Firmware_1_0_2_1/Part 2/upgrade4.dat
8c5939e1d5d91fe84a0c5db04a884c34f11424a4  Firmware_1_0_2_1/Part 2/upgrade5.dat
3770888bfe4de1122062c191665fb0d7bc8e7fe1  Firmware_1_0_2_1/Part 2/upgrade6.dat
4b0f73278a30f131062cee2030f1e1de72ccb1a1  Firmware_1_0_3/Part 1/upgrade4.dat
1714fc04ba57f8555b0c84e166edbf7509b3e643  Firmware_1_0_3/Part 2/upgrade1.dat
df998f8c67894f9b4eb6e76b33a736606563bdb7  Firmware_1_0_3/Part 2/upgrade2.dat
0fbab96aeae91bf959baaa14fa336b4a0b76e12c  Firmware_1_0_3/Part 2/upgrade3.dat
4b0f73278a30f131062cee2030f1e1de72ccb1a1  Firmware_1_0_3/Part 2/upgrade4.dat
8c5939e1d5d91fe84a0c5db04a884c34f11424a4  Firmware_1_0_3/Part 2/upgrade5.dat
3770888bfe4de1122062c191665fb0d7bc8e7fe1  Firmware_1_0_3/Part 2/upgrade6.dat
4b0f73278a30f131062cee2030f1e1de72ccb1a1  Firmware_2_04/Part1/upgrade4.dat
1714fc04ba57f8555b0c84e166edbf7509b3e643  Firmware_2_04/Part2/upgrade1.dat
46fc13bc42819b32f08019418ba40d2e0483fca7  Firmware_2_04/Part2/upgrade2.dat
0fbab96aeae91bf959baaa14fa336b4a0b76e12c  Firmware_2_04/Part2/upgrade3.dat
4b0f73278a30f131062cee2030f1e1de72ccb1a1  Firmware_2_04/Part2/upgrade4.dat
8c5939e1d5d91fe84a0c5db04a884c34f11424a4  Firmware_2_04/Part2/upgrade5.dat
3770888bfe4de1122062c191665fb0d7bc8e7fe1  Firmware_2_04/Part2/upgrade6.dat

From this I see that only Part2/upgrade2.dat changed between firmware versions. Ok, throw it at ‘file’.

jas@mocca:~/jobo$ file Firmware_2_04/Part2/upgrade2.dat
Firmware_2_04/Part2/upgrade2.dat: Linux Compressed ROM File System data, little endian size 65536 CRC 0x9c4061e, edition -2091585525, 2002560618 blocks, -1917785711 files
jas@mocca:~/jobo$ 

Bingo! Just mount it, and I can view their root filesystem.

mocca:/home/jas/jobo/Firmware_2_04/Part2# losetup /dev/loop0 upgrade2.dat
mocca:/home/jas/jobo/Firmware_2_04/Part2# mount /dev/loop0 /mnt

Neat. Looking around, I find a lot of apparently GPL’d code. Many of them were NOT included in the source package I received from Jobo. Hey, even a GPL’d project that I work on is on the system!

mocca:/mnt# ls -l usr/lib/libgnutls-extra.so.11.1.16 
-rw-r--r-- 1 root root 89676 1970-01-01 01:00 usr/lib/libgnutls-extra.so.11.1.16
mocca:/mnt# file usr/lib/libgnutls-extra.so.11.1.16 
usr/lib/libgnutls-extra.so.11.1.16: ELF 32-bit LSB shared object, MIPS, MIPS-I version 1 (SYSV), stripped
mocca:/mnt# 

I doubt that they have modified much of the GPL’d software, although I believe they still must ship source for it. Bad Jobo!

So, let’s have a look around. The system seems to be built from scratch, I don’t recognize any typical signs of a debian, openembedded etc installation, but I may be mistaken.

Curious about the rc.sysinit? Let’s take a look.

#!/bin/sh

PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/X11R6/bin
export PATH
export TERM="linux"

# mount all filesystems
mount -t jffs2 -o rw /dev/mtdblock4 /root
mount -t proc none /proc
mount -t ramfs none /ram
mount -t ramfs none /root/var/run

# Switch to video buffer '3', and display the GVPe logo
/bin/fblogo

# start Xserver
Xfbdev -mouse null -noreset -br -s 0 &

mount -t vfat -o sync,noatime,umask=000,shortname=mixed /dev/hda1 /mnt/harddisk

export DISPLAY=":0.0"

ifconfig lo 127.0.0.1 up

portmap

# start
sleep 2
echo "XServer should be up"
blackbox &
sleep 2
echo "Blackbox should be up"

# start cardmgr
cardmgr


# delayed scripts
/etc/init.d/rc.delayedinit &

# start application
echo "starting app"
while :
do
photocontainer
done

/bin/echo "Sysinit done"

I suspect ‘photocontainer’ is the main GUI for the entire Jobo application.

mocca:/mnt# file bin/photocontainer 
bin/photocontainer: ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), for GNU/Linux 2.4.0, dynamically linked (uses shared libs), for GNU/Linux 2.4.0, not stripped

Debugging symbols are still there, nice… Let’s see what kind of libraries they use.

mocca:/mnt/bin# nm photocontainer >/tmp/f
mocca:/mnt/bin# grep ' U ' /tmp/f>/tmp/g

(Ok, ok, I wanted to use a pipe there, but I don’t know how to type a pipe character on my powerbook!)

Looking at the external symbols, I can tell that they are using lcms, libexif, gtk, libiptcdata, libjpeg, libtiff, libid3, libxml. None of them are GPL’d.

I noticed that some custom stuff is in /usr/local. For example, in /usr/local/lib there is:

mocca:/mnt/usr/local# ls -la lib/ samba/ sbin/
lib/:
total 394
lrwxrwxrwx 1 root staff     17 1970-01-01 01:00 libexif.so -> libexif.so.10.0.0
lrwxrwxrwx 1 root staff     17 1970-01-01 01:00 libexif.so.10 -> libexif.so.10.0.0
-rwxr-xr-x 1 root staff 145047 1970-01-01 01:00 libexif.so.10.0.0
lrwxrwxrwx 1 root root      20 1970-01-01 01:00 libiptcdata.so -> libiptcdata.so.0.3.0
lrwxrwxrwx 1 root root      20 1970-01-01 01:00 libiptcdata.so.0 -> libiptcdata.so.0.3.0
-rwxr-xr-x 1 root root  108255 1970-01-01 01:00 libiptcdata.so.0.3.0
lrwxrwxrwx 1 root root      23 1970-01-01 01:00 liblirc_client.so -> liblirc_client.so.0.0.0
lrwxrwxrwx 1 root root      23 1970-01-01 01:00 liblirc_client.so.0 -> liblirc_client.so.0.0.0
-rwxr-xr-x 1 root root   35575 1970-01-01 01:00 liblirc_client.so.0.0.0
lrwxrwxrwx 1 root root      15 1970-01-01 01:00 libmad.so -> libmad.so.0.2.1
lrwxrwxrwx 1 root root      15 1970-01-01 01:00 libmad.so.0 -> libmad.so.0.2.1
-rwxr-xr-x 1 root root  108809 1970-01-01 01:00 libmad.so.0.2.1

samba/:
total 5546
-rwxr-xr-x 1 root root 1430332 1970-01-01 01:00 nmbd
-rwxr-xr-x 1 root root 4247904 1970-01-01 01:00 smbd

Here, lirc and libmad are licensed under the GPL. Samba is too. No source code for them were provided.

Ok, that’s it for tonight. More updates later on.