Hacking Jobo device

I blogged earlier about buying the Linux-based Jobo Giga Vu Pro Evolution. On 2007-04-14 I asked about the source code, and on 2007-04-23 I received a reply pointing at this URL. I see now that the file can also be downloaded (much faster) from Jobo directly.

For the record:

2c64bf3ed589566eb20fe8fe173717f2b9eb058e  Open Source Packages.zip

The package contain no instructions, and just a collection of random tarballs.

jas@mocca:~/jobo/Open Source Packages$ ls */*
Blackbox/blackbox-0.62.1.tar.gz        Libexif/libexif_xsilo.patch
Blackbox/blackbox_xsilo.patch          Libjpeg/jpegsrc.v6b.tar.gz
Busybox/busybox-0.60.4.tar.gz          Libtiff/tiff-v3.6.1.tar.gz
Dhcpcd/dhcpcd-1.3.22-pl4.tar.gz        Linux/linux.tar.gz
Dosfstools/dosfstools-2.10.src.tar.gz  Pcmcia CS/pcmcia-cs-3.2.4.tar.gz
Dosfstools/dosfstools_xsilo.patch      X Windows/X430src-1.tgz
Glibc/glibc-2.2.3.tar.gz               X Windows/X430src-2.tgz
Glib/glib-1.2.10.tar.gz                X Windows/X430src-3.tgz
Gtk+/gtk+-1.2.10.tar.gz                X Windows/X430_xsilo.patch
ID3lib/id3lib-3.8.3.tar.gz             Zlib/zlib.tar.gz
Libexif/libexif-0.6.9.tar.gz
jas@mocca:~/jobo/Open Source Packages$ 

I was somewhat disappointed.

Today I thought of looking at the official firmware images. I downloaded the 1.0.2.1, 1.0.3 and 2.0.4 versions from Jobo.

For the record, the SHA-1 of the firmware ZIP files were:

f2382f2a723324a5de510bdc24a87de65e631775  Firmware_1_0_2_1.zip
c0e1667e406ce471da47e071fb476f9dd1964131  Firmware_1_0_3.zip
3a793eadf7c4300c0efc8b6eff25d5ac3d508848  Firmware_2_04.zip

The package contains of two sub-directories, Part1/ and Part2/. I looked at some of the files, and they are in the B000FF format that appears to be a WinCE format (?). I tried to decode these files for a while, but didn’t get far.

Then I had the idea to compare the images between firmware versions to identify which files are worthy of attention.

Here is the output:

79c4222c874f56a0ac217e42f981b9487c2938c0  Firmware_1_0_2_1/Part 1/upgrade.bin
79c4222c874f56a0ac217e42f981b9487c2938c0  Firmware_1_0_2_1/Part 2/upgrade.bin
79c4222c874f56a0ac217e42f981b9487c2938c0  Firmware_1_0_3/Part 1/upgrade.bin
79c4222c874f56a0ac217e42f981b9487c2938c0  Firmware_1_0_3/Part 2/upgrade.bin
79c4222c874f56a0ac217e42f981b9487c2938c0  Firmware_2_04/Part1/upgrade.bin
79c4222c874f56a0ac217e42f981b9487c2938c0  Firmware_2_04/Part2/upgrade.bin

Clearly that is uninteresting code (at least for now), since it didn’t change. Possibly it is the firmware flash code or similar.

4b0f73278a30f131062cee2030f1e1de72ccb1a1  Firmware_1_0_2_1/Part 1/upgrade4.dat
1714fc04ba57f8555b0c84e166edbf7509b3e643  Firmware_1_0_2_1/Part 2/upgrade1.dat
e15632238f431aeb4d4be01b44cfe237d688834c  Firmware_1_0_2_1/Part 2/upgrade2.dat
0fbab96aeae91bf959baaa14fa336b4a0b76e12c  Firmware_1_0_2_1/Part 2/upgrade3.dat
4b0f73278a30f131062cee2030f1e1de72ccb1a1  Firmware_1_0_2_1/Part 2/upgrade4.dat
8c5939e1d5d91fe84a0c5db04a884c34f11424a4  Firmware_1_0_2_1/Part 2/upgrade5.dat
3770888bfe4de1122062c191665fb0d7bc8e7fe1  Firmware_1_0_2_1/Part 2/upgrade6.dat
4b0f73278a30f131062cee2030f1e1de72ccb1a1  Firmware_1_0_3/Part 1/upgrade4.dat
1714fc04ba57f8555b0c84e166edbf7509b3e643  Firmware_1_0_3/Part 2/upgrade1.dat
df998f8c67894f9b4eb6e76b33a736606563bdb7  Firmware_1_0_3/Part 2/upgrade2.dat
0fbab96aeae91bf959baaa14fa336b4a0b76e12c  Firmware_1_0_3/Part 2/upgrade3.dat
4b0f73278a30f131062cee2030f1e1de72ccb1a1  Firmware_1_0_3/Part 2/upgrade4.dat
8c5939e1d5d91fe84a0c5db04a884c34f11424a4  Firmware_1_0_3/Part 2/upgrade5.dat
3770888bfe4de1122062c191665fb0d7bc8e7fe1  Firmware_1_0_3/Part 2/upgrade6.dat
4b0f73278a30f131062cee2030f1e1de72ccb1a1  Firmware_2_04/Part1/upgrade4.dat
1714fc04ba57f8555b0c84e166edbf7509b3e643  Firmware_2_04/Part2/upgrade1.dat
46fc13bc42819b32f08019418ba40d2e0483fca7  Firmware_2_04/Part2/upgrade2.dat
0fbab96aeae91bf959baaa14fa336b4a0b76e12c  Firmware_2_04/Part2/upgrade3.dat
4b0f73278a30f131062cee2030f1e1de72ccb1a1  Firmware_2_04/Part2/upgrade4.dat
8c5939e1d5d91fe84a0c5db04a884c34f11424a4  Firmware_2_04/Part2/upgrade5.dat
3770888bfe4de1122062c191665fb0d7bc8e7fe1  Firmware_2_04/Part2/upgrade6.dat

From this I see that only Part2/upgrade2.dat changed between firmware versions. Ok, throw it at ‘file’.

jas@mocca:~/jobo$ file Firmware_2_04/Part2/upgrade2.dat
Firmware_2_04/Part2/upgrade2.dat: Linux Compressed ROM File System data, little endian size 65536 CRC 0x9c4061e, edition -2091585525, 2002560618 blocks, -1917785711 files
jas@mocca:~/jobo$ 

Bingo! Just mount it, and I can view their root filesystem.

mocca:/home/jas/jobo/Firmware_2_04/Part2# losetup /dev/loop0 upgrade2.dat
mocca:/home/jas/jobo/Firmware_2_04/Part2# mount /dev/loop0 /mnt

Neat. Looking around, I find a lot of apparently GPL’d code. Many of them were NOT included in the source package I received from Jobo. Hey, even a GPL’d project that I work on is on the system!

mocca:/mnt# ls -l usr/lib/libgnutls-extra.so.11.1.16 
-rw-r--r-- 1 root root 89676 1970-01-01 01:00 usr/lib/libgnutls-extra.so.11.1.16
mocca:/mnt# file usr/lib/libgnutls-extra.so.11.1.16 
usr/lib/libgnutls-extra.so.11.1.16: ELF 32-bit LSB shared object, MIPS, MIPS-I version 1 (SYSV), stripped
mocca:/mnt# 

I doubt that they have modified much of the GPL’d software, although I believe they still must ship source for it. Bad Jobo!

So, let’s have a look around. The system seems to be built from scratch, I don’t recognize any typical signs of a debian, openembedded etc installation, but I may be mistaken.

Curious about the rc.sysinit? Let’s take a look.

#!/bin/sh

PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/X11R6/bin
export PATH
export TERM="linux"

# mount all filesystems
mount -t jffs2 -o rw /dev/mtdblock4 /root
mount -t proc none /proc
mount -t ramfs none /ram
mount -t ramfs none /root/var/run

# Switch to video buffer '3', and display the GVPe logo
/bin/fblogo

# start Xserver
Xfbdev -mouse null -noreset -br -s 0 &

mount -t vfat -o sync,noatime,umask=000,shortname=mixed /dev/hda1 /mnt/harddisk

export DISPLAY=":0.0"

ifconfig lo 127.0.0.1 up

portmap

# start
sleep 2
echo "XServer should be up"
blackbox &
sleep 2
echo "Blackbox should be up"

# start cardmgr
cardmgr


# delayed scripts
/etc/init.d/rc.delayedinit &

# start application
echo "starting app"
while :
do
photocontainer
done

/bin/echo "Sysinit done"

I suspect ‘photocontainer’ is the main GUI for the entire Jobo application.

mocca:/mnt# file bin/photocontainer 
bin/photocontainer: ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), for GNU/Linux 2.4.0, dynamically linked (uses shared libs), for GNU/Linux 2.4.0, not stripped

Debugging symbols are still there, nice… Let’s see what kind of libraries they use.

mocca:/mnt/bin# nm photocontainer >/tmp/f
mocca:/mnt/bin# grep ' U ' /tmp/f>/tmp/g

(Ok, ok, I wanted to use a pipe there, but I don’t know how to type a pipe character on my powerbook!)

Looking at the external symbols, I can tell that they are using lcms, libexif, gtk, libiptcdata, libjpeg, libtiff, libid3, libxml. None of them are GPL’d.

I noticed that some custom stuff is in /usr/local. For example, in /usr/local/lib there is:

mocca:/mnt/usr/local# ls -la lib/ samba/ sbin/
lib/:
total 394
lrwxrwxrwx 1 root staff     17 1970-01-01 01:00 libexif.so -> libexif.so.10.0.0
lrwxrwxrwx 1 root staff     17 1970-01-01 01:00 libexif.so.10 -> libexif.so.10.0.0
-rwxr-xr-x 1 root staff 145047 1970-01-01 01:00 libexif.so.10.0.0
lrwxrwxrwx 1 root root      20 1970-01-01 01:00 libiptcdata.so -> libiptcdata.so.0.3.0
lrwxrwxrwx 1 root root      20 1970-01-01 01:00 libiptcdata.so.0 -> libiptcdata.so.0.3.0
-rwxr-xr-x 1 root root  108255 1970-01-01 01:00 libiptcdata.so.0.3.0
lrwxrwxrwx 1 root root      23 1970-01-01 01:00 liblirc_client.so -> liblirc_client.so.0.0.0
lrwxrwxrwx 1 root root      23 1970-01-01 01:00 liblirc_client.so.0 -> liblirc_client.so.0.0.0
-rwxr-xr-x 1 root root   35575 1970-01-01 01:00 liblirc_client.so.0.0.0
lrwxrwxrwx 1 root root      15 1970-01-01 01:00 libmad.so -> libmad.so.0.2.1
lrwxrwxrwx 1 root root      15 1970-01-01 01:00 libmad.so.0 -> libmad.so.0.2.1
-rwxr-xr-x 1 root root  108809 1970-01-01 01:00 libmad.so.0.2.1

samba/:
total 5546
-rwxr-xr-x 1 root root 1430332 1970-01-01 01:00 nmbd
-rwxr-xr-x 1 root root 4247904 1970-01-01 01:00 smbd

Here, lirc and libmad are licensed under the GPL. Samba is too. No source code for them were provided.

Ok, that’s it for tonight. More updates later on.

3 Replies to “Hacking Jobo device”

  1. Wow! I wish I could understand that better. My question: do you see any way of using a wireless “g” card instead of the old “b” one?
    Is there a way to add the linux “g” driver to the existing firmware?
    Thanks.

  2. It would take quite some work, but seems possible. Replacing user-space stuff, and just re-packaging the CROMFS image would be simple. However, you may need a new kernel too to get 802.11g to work, and compiling a new kernel for the device may be trickier. I’m not sure Jobo Inc. distribute the .config file that is necessary to reproduce the kernel they use.

    Alas, I haven’t had any time to continue exploring this device. 🙁

  3. Thank you Simon.
    It is unfortunate that Jobo chose the wireless “b” route initially, since “g” was available at the development stage of the Evolution. Oh well, the device is still a very good storage and viewing unit.

    Best wishes!
    -Ron