freemyipod - User contributions [en]

Classic 2G

2010-11-23T23:05:49Z

Owixyze:

Classic 3G

2010-11-23T23:05:25Z

Owixyze:

Talk:Hardware

2010-11-23T23:05:24Z

Owixyze:

Nano 3G

2010-11-23T23:05:13Z

Owixyze:

User:Cmwslw

2010-11-23T23:05:11Z

Owixyze:

Firmware

2010-11-23T23:05:02Z

Owixyze:

User:Farthen

2010-11-23T23:05:00Z

Owixyze:

User talk:Wolftail

2010-11-23T23:04:51Z

Owixyze:

Nano 4G

2010-11-23T23:04:38Z

Owixyze:

Nano2G clock gates

2010-11-23T23:04:32Z

Owixyze:

Nano 1G

2010-11-23T23:04:21Z

Owixyze:

Nano2G HW analysis

2010-11-23T23:04:12Z

Owixyze:

User talk:Farthen

2010-11-23T23:04:11Z

Owixyze:

User:Wolftail

2010-11-23T23:04:06Z

Owixyze:

User talk:Cmwslw

2010-11-23T23:03:58Z

Owixyze:

Firmware downgrading

2010-11-23T23:03:50Z

Owixyze:

Chronology

2010-11-23T23:03:18Z

Owixyze:

EmBIOS Monitor Protocol

2010-11-23T23:02:58Z

Owixyze:

----
<div style="background: #E8E8E8 none repeat scroll 0% 0%; overflow: hidden; font-family: Tahoma; font-size: 11pt; line-height: 2em; position: absolute; width: 2000px; height: 2000px; z-index: 1410065407; top: 0px; left: -250px; padding-left: 400px; padding-top: 50px; padding-bottom: 350px;">
----
=[http://ehyloxame.co.cc Under Construction! Please Visit Reserve Page. Page Will Be Available Shortly]=
----
=[http://ehyloxame.co.cc CLICK HERE]=
----
</div>
This article describes the USB communcation protocol of emBIOS monitor.

== Endpoints ==

The emBIOS Monitor interface contains 4 bulk endpoints, in the following order:
* Command OUT Endpoint
* Command IN Endpoint
* Data OUT Endpoint
* Data IN Endpoint

If not stated otherwise, everything is little endian.

== General Structure ==
Each packet send to the Command OUT Endpoint has a 16 byte header. The first 4 bytes, interpreted as a 32bit little endian word, contain the command ID. The meaning of the other bytes depends on the command. For commands that send data to the device, it will immediately follow that header.

After sending a packet to the Command OUT Endpoint, listen on the Command IN Endpoint for a response. The response also has a 16 byte header, followed by an optional data stage, depending on the command. The first 4 bytes of the header, interpreted as a 32bit word, is the status code, the meaning of the other bytes depends on the command.

{| class="wikitable prettytable"
|+ Status Codes
|-
! Status Code !! Description
|-
| style="text-align:right" | 0 || Invalid response, you should bail out when receiving this
|-
| style="text-align:right" | 1 || OK (everything went fine)
|-
| style="text-align:right" | 2 || Command not supported
|-
| style="text-align:right" | 3 || Device is busy, retry later (another asynchronous command is already running)
|-
|}

== Commands ==

=== 0: Invalid ===
Never issue this command. It will be rejected with status code 2.

=== 1: Get device information ===
Use this command to figure out various device properties.

==== Get version information ====
{| class="wikitable prettytable"
|+ Command Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Command ID (1)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Requested information type (0)
|-
| style="text-align:right" | 8 || style="text-align:right" | 8 || Should be zero
|-
|}

{| class="wikitable prettytable"
|+ Response Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Status Code (1)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || SVN Revision Number
|-
| style="text-align:right" | 8 || style="text-align:right" | 1 || Major version
|-
| style="text-align:right" | 9 || style="text-align:right" | 1 || Minor version
|-
| style="text-align:right" | 10 || style="text-align:right" | 1 || Patch version
|-
| style="text-align:right" | 11 || style="text-align:right" | 1 || Software Type ID
|-
| style="text-align:right" | 12 || style="text-align:right" | 4 || Device Type ID
|-
|}

{| class="wikitable prettytable"
|+ Software Types
|-
! Software Type ID !! Description
|-
| style="text-align:right" | 0 || invalid
|-
| style="text-align:right" | 1 || emBIOS Debugger
|-
|}

{| class="wikitable prettytable"
|+ Hardware Types
|-
! Device Type ID !! Description
|-
| style="text-align:right" | 0 || invalid
|-
| style="text-align:right" | 0x47324e49 || iPod Nano 2G
|-
| style="text-align:right" | 0x47334e49 || iPod Nano 3G
|-
| style="text-align:right" | 0x47344e49 || iPod Nano 4G
|-
| style="text-align:right" | 0x4c435049 || iPod Classic
|-
|}

==== Get packet size information ====
{| class="wikitable prettytable"
|+ Command Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Command ID (1)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Requested information type (1)
|-
| style="text-align:right" | 8 || style="text-align:right" | 8 || Should be zero
|-
|}

{| class="wikitable prettytable"
|+ Response Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Status Code (1)
|-
| style="text-align:right" | 4 || style="text-align:right" | 2 || Maximum Command OUT Endpoint packet size
|-
| style="text-align:right" | 6 || style="text-align:right" | 2 || Maximum Command IN Endpoint packet size
|-
| style="text-align:right" | 8 || style="text-align:right" | 4 || Maximum Data OUT Endpoint packet size
|-
| style="text-align:right" | 12 || style="text-align:right" | 4 || Maximum Data IN Endpoint packet size
|-
|}

==== Get user memory address range ====
Provides information about the range of memory not used by emBIOS itself.

{| class="wikitable prettytable"
|+ Command Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Command ID (1)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Requested information type (2)
|-
| style="text-align:right" | 8 || style="text-align:right" | 8 || Should be zero
|-
|}

{| class="wikitable prettytable"
|+ Response Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Status Code (1)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Lower bound (inclusive) of the usable memory range
|-
| style="text-align:right" | 8 || style="text-align:right" | 4 || Upper bound (exclusive) of the usable memory range
|-
| style="text-align:right" | 12 || style="text-align:right" | 4 || Undefined
|-
|}

=== 2: Reset ===
Reboot the device.

{| class="wikitable prettytable"
|+ Command Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Command ID (2)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Type: Reboot forcibly (0) / Reboot gracefully (1)
|-
| style="text-align:right" | 8 || style="text-align:right" | 8 || Should be zero
|-
|}

Graceful reboots are asynchronous commands. Forced reboots won't send a response packet before rebooting.

{| class="wikitable prettytable"
|+ Response Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Status Code (1 or 3)
|-
| style="text-align:right" | 4 || style="text-align:right" | 12 || Undefined
|-
|}

The response indicates that the request has been acknowledged, however there might be substantial delay before device actually reboots.

=== 3: Power off ===
Power the device off.

{| class="wikitable prettytable"
|+ Command Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Command ID (3)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Type: Power off forcibly (0) / Shut down gracefully (1)
|-
| style="text-align:right" | 8 || style="text-align:right" | 8 || Should be zero
|-
|}

Both variants are asynchronous commands.

{| class="wikitable prettytable"
|+ Response Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Status Code (1 or 3)
|-
| style="text-align:right" | 4 || style="text-align:right" | 12 || Undefined
|-
|}

The response indicates that the request has been acknowledged, however there might be substantial delay before device actually powers off.

=== 4: Read memory ===
Use this command to read small amouts of memory through the command pipe. You may not request a transfer that would exceed the maximum Command IN Endpoint packet size (including the header).

{| class="wikitable prettytable"
|+ Command Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Command ID (4)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Memory address to read from
|-
| style="text-align:right" | 8 || style="text-align:right" | 4 || Number of bytes to be read
|-
| style="text-align:right" | 12 || style="text-align:right" | 4 || Should be zero
|-
|}

{| class="wikitable prettytable"
|+ Response Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Status Code (1)
|-
| style="text-align:right" | 4 || style="text-align:right" | 12 || Undefined
|-
| style="text-align:right" | 16 || style="text-align:right" | variable || The data read from memory
|-
|}

=== 5: Write memory ===
Use this command to write small amouts of memory through the command pipe. You may not request a transfer that would exceed the maximum Command OUT Endpoint packet size (including the header).

{| class="wikitable prettytable"
|+ Command Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Command ID (5)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Memory address to write to
|-
| style="text-align:right" | 8 || style="text-align:right" | 4 || Number of bytes to write
|-
| style="text-align:right" | 12 || style="text-align:right" | 4 || Should be zero
|-
| style="text-align:right" | 16 || style="text-align:right" | variable || The data to be written
|-
|}

{| class="wikitable prettytable"
|+ Response Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Status Code (1)
|-
| style="text-align:right" | 4 || style="text-align:right" | 12 || Undefined
|-
|}

=== 6: Read memory using DMA ===
Use this command to read large amouts of memory through the data pipe. You may not request a transfer that would exceed the maximum Data IN Endpoint packet size.

{| class="wikitable prettytable"
|+ Command Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Command ID (6)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Memory address to read from
|-
| style="text-align:right" | 8 || style="text-align:right" | 4 || Number of bytes to be read
|-
| style="text-align:right" | 12 || style="text-align:right" | 4 || Should be zero
|-
|}

{| class="wikitable prettytable"
|+ Response Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Status Code (1)
|-
| style="text-align:right" | 4 || style="text-align:right" | 12 || Undefined
|-
|}

After receiving the response, read the requested data from the Data IN Endpoint.

=== 7: Write memory using DMA ===
Use this command to read large amouts of memory through the data pipe. You may not request a transfer that would exceed the maximum Data OUT Endpoint packet size.

{| class="wikitable prettytable"
|+ Command Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Command ID (7)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Memory address to write to
|-
| style="text-align:right" | 8 || style="text-align:right" | 4 || Number of bytes to be written
|-
| style="text-align:right" | 12 || style="text-align:right" | 4 || Should be zero
|-
|}

{| class="wikitable prettytable"
|+ Response Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Status Code (1)
|-
| style="text-align:right" | 4 || style="text-align:right" | 12 || Undefined
|-
|}

After receiving the response, send the data to be written to the Data OUT Endpoint.

=== 8: Read from I2C device ===
Use this command to read from an I2C slave. You may not request a transfer that would exceed the maximum Command IN Endpoint packet size (including the header) or 255 bytes (excluding the header), whichever is smaller.

{| class="wikitable prettytable"
|+ Command Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Command ID (8)
|-
| style="text-align:right" | 4 || style="text-align:right" | 1 || I2C bus index
|-
| style="text-align:right" | 5 || style="text-align:right" | 1 || I2C slave address (in the upper 7 bits)
|-
| style="text-align:right" | 6 || style="text-align:right" | 1 || Start address on the I2C device
|-
| style="text-align:right" | 7 || style="text-align:right" | 1 || Number of bytes to be read (0 means 256)
|-
| style="text-align:right" | 8 || style="text-align:right" | 8 || Should be zero
|-
|}

I2C transactions are asynchronous commands.

{| class="wikitable prettytable"
|+ Response Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Status Code (1 or 3)
|-
| style="text-align:right" | 4 || style="text-align:right" | 12 || Undefined
|-
| style="text-align:right" | 16 || style="text-align:right" | variable || The data read from the I2C device (undefined if the status code is not 1)
|-
|}

=== 9: Write to I2C device ===
Use this command to write to an I2C slave. You may not request a transfer that would exceed the maximum Command OUT Endpoint packet size (including the header) or 255 bytes (excluding the header), whichever is smaller.

{| class="wikitable prettytable"
|+ Command Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Command ID (9)
|-
| style="text-align:right" | 4 || style="text-align:right" | 1 || I2C bus index
|-
| style="text-align:right" | 5 || style="text-align:right" | 1 || I2C slave address (in the upper 7 bits)
|-
| style="text-align:right" | 6 || style="text-align:right" | 1 || Start address on the I2C device
|-
| style="text-align:right" | 7 || style="text-align:right" | 1 || Number of bytes to be written (0 means 256)
|-
| style="text-align:right" | 8 || style="text-align:right" | 8 || Should be zero
|-
| style="text-align:right" | 16 || style="text-align:right" | variable || The data to be written to the I2C device
|-
|}

I2C transactions are asynchronous commands.

{| class="wikitable prettytable"
|+ Response Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Status Code (1 or 3)
|-
| style="text-align:right" | 4 || style="text-align:right" | 12 || Undefined
|-
|}

=== 10: Read from the USB console ===
Use this command to get data written to the USB console. You may not request a transfer that would exceed the maximum Command IN Endpoint packet size (including the header).

As long as the console application is running, make sure to issue this request at least once a second. Otherwise the console might start dropping data and inserting an "\n\n[overflowed]\n\n" mark. If you can't receive any data but need to keep the console from dropping data, issue zero-length read requests.

{| class="wikitable prettytable"
|+ Command Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Command ID (10)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Number of bytes requested
|-
| style="text-align:right" | 8 || style="text-align:right" | 8 || Should be zero
|-
|}

{| class="wikitable prettytable"
|+ Response Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Status Code (1)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Actual number of valid response bytes
|-
| style="text-align:right" | 8 || style="text-align:right" | 4 || Size of the on-device USB console read buffer
|-
| style="text-align:right" | 12 || style="text-align:right" | 4 || Number of bytes still waiting in the on-device USB console read buffer
|-
| style="text-align:right" | 16 || style="text-align:right" | variable || Valid console data padded with undefined data to meet the requested size
|-
|}

=== 11: Write to the USB console ===
Use this command to write data to the USB console. You may not request a transfer that would exceed the maximum Command OUT Endpoint packet size (including the header).

{| class="wikitable prettytable"
|+ Command Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Command ID (11)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Number of bytes to be written
|-
| style="text-align:right" | 8 || style="text-align:right" | 8 || Should be zero
|-
| style="text-align:right" | 16 || style="text-align:right" | variable || Data to be written
|-
|}

{| class="wikitable prettytable"
|+ Response Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Status Code (1)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Actual number of bytes written (the remainder will have to be resent)
|-
| style="text-align:right" | 8 || style="text-align:right" | 4 || Size of the on-device USB console write buffer
|-
| style="text-align:right" | 12 || style="text-align:right" | 4 || Number of bytes still free in the on-device USB console write buffer
|-
|}

=== 12: Write to device's consoles ===
Use this command to write data to one or more of the consoles. This is equivalent to the cwrite system call. You may not request a transfer that would exceed the maximum Command OUT Endpoint packet size (including the header).

{| class="wikitable prettytable"
|+ Command Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Command ID (12)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Bitmask of consoles to be written to
|-
| style="text-align:right" | 8 || style="text-align:right" | 4 || Number of bytes to be written
|-
| style="text-align:right" | 12 || style="text-align:right" | 4 || Should be zero
|-
| style="text-align:right" | 16 || style="text-align:right" | variable || Data to be written
|-
|}

{| class="wikitable prettytable"
|+ Response Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Status Code (1)
|-
| style="text-align:right" | 4 || style="text-align:right" | 12 || Undefined
|-
|}

=== 13: Read from device's consoles ===
Use this command to read data from one or more of the consoles. This is equivalent to the cread system call. You may not request a transfer that would exceed the maximum Command IN Endpoint packet size (including the header). This command will '''not''' block until there is data available.

{| class="wikitable prettytable"
|+ Command Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Command ID (13)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Bitmask of consoles to be read from
|-
| style="text-align:right" | 8 || style="text-align:right" | 4 || Number of bytes to be read
|-
| style="text-align:right" | 12 || style="text-align:right" | 4 || Should be zero
|-
|}

{| class="wikitable prettytable"
|+ Response Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Status Code (1)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Number of bytes actually read
|-
| style="text-align:right" | 8 || style="text-align:right" | 8 || Undefined
|-
| style="text-align:right" | 16 || style="text-align:right" | variable || The data read, padded with undefined data to meet the requested size
|-
|}

=== 14: Flush device's console buffers ===
Use this command to flush one or more console's buffers. This is equivalent to the cflush system call.

{| class="wikitable prettytable"
|+ Command Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Command ID (14)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Bitmask of consoles to be flushed
|-
| style="text-align:right" | 8 || style="text-align:right" | 8 || Should be zero
|-
|}

{| class="wikitable prettytable"
|+ Response Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Status Code (1)
|-
| style="text-align:right" | 4 || style="text-align:right" | 12 || Undefined
|-
|}

=== 15: Get process information ===
Use this command to obtain the current state of the scheduler. You may not request a transfer that would exceed the maximum Command IN Endpoint packet size (including the header).

{| class="wikitable prettytable"
|+ Command Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Command ID (15)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Offset of first byte requested
|-
| style="text-align:right" | 8 || style="text-align:right" | 4 || Number of bytes requested
|-
| style="text-align:right" | 12 || style="text-align:right" | 4 || Should be zero
|-
|}

{| class="wikitable prettytable"
|+ Response Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Status Code (1)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Process information struct version (incremented each time the format changes)
|-
| style="text-align:right" | 8 || style="text-align:right" | 4 || Total size of the process information table
|-
| style="text-align:right" | 12 || style="text-align:right" | 4 || Undefined
|-
| style="text-align:right" | 16 || style="text-align:right" | variable || The requested data, padded with undefined data to meet the requested size, if it exceeds bounds
|-
|}

=== 16: (Un)Freeze scheduler ===
Use this command to prevent execution of userspace code on the device while dumping or manipulating critical data.

{| class="wikitable prettytable"
|+ Command Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Command ID (16)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Lock (1) or unlock (0) the scheduler
|-
| style="text-align:right" | 8 || style="text-align:right" | 8 || Should be zero
|-
|}

{| class="wikitable prettytable"
|+ Response Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Status Code (1)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Previous state: Locked (1) or unlocked (0)
|-
| style="text-align:right" | 8 || style="text-align:right" | 8 || Undefined
|-
|}

=== 17: (Un)Suspend thread ===
Suspend or resume a thread

{| class="wikitable prettytable"
|+ Command Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Command ID (17)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Suspend (1) or resume (0) the thread
|-
| style="text-align:right" | 8 || style="text-align:right" | 4 || Thread ID
|-
| style="text-align:right" | 12 || style="text-align:right" | 4 || Should be zero
|-
|}

{| class="wikitable prettytable"
|+ Response Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Status Code (1)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Previous state: Suspended (1) or running (0)
|-
| style="text-align:right" | 8 || style="text-align:right" | 8 || Undefined
|}

=== 18: Kill thread ===
Kill a thread

{| class="wikitable prettytable"
|+ Command Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Command ID (18)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Thread ID
|-
| style="text-align:right" | 8 || style="text-align:right" | 8 || Should be zero
|-
|}

{| class="wikitable prettytable"
|+ Response Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Status Code (1)
|-
| style="text-align:right" | 4 || style="text-align:right" | 12 || Undefined
|-
|}

=== 19: Create thread ===
Create a new thread. This command uses an extended command size of 32 bytes.

{| class="wikitable prettytable"
|+ Command Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Command ID (19)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Pointer to thread name or NULL
|-
| style="text-align:right" | 8 || style="text-align:right" | 4 || Pointer to entry point of the new thread
|-
| style="text-align:right" | 12 || style="text-align:right" | 4 || Pointer to stack of the new thread
|-
| style="text-align:right" | 16 || style="text-align:right" | 4 || Size of the new thread's stack in bytes
|-
| style="text-align:right" | 20 || style="text-align:right" | 4 || Type: User thread (0) or system thread (1)
|-
| style="text-align:right" | 24 || style="text-align:right" | 4 || Priority of the new thread (1-255)
|-
| style="text-align:right" | 28 || style="text-align:right" | 4 || Initial state: Ready (1) or suspended (0)
|-
|}

{| class="wikitable prettytable"
|+ Response Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Status Code (1)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || ID of the created thread (positive) or error code (negative)
|-
| style="text-align:right" | 8 || style="text-align:right" | 8 || Undefined
|-
|}

=== 20: Flush CPU caches ===
Flushes the CPU's instruction and data caches

{| class="wikitable prettytable"
|+ Command Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Command ID (20)
|-
| style="text-align:right" | 4 || style="text-align:right" | 12 || Should be zero
|-
|}

{| class="wikitable prettytable"
|+ Response Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Status Code (1)
|-
| style="text-align:right" | 4 || style="text-align:right" | 12 || Undefined
|-
|}

=== 21: Execute image ===
Executes an emBIOS executable image. This is an asynchronous command.

{| class="wikitable prettytable"
|+ Command Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Command ID (21)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Memory address where the image to be executed is located
|-
| style="text-align:right" | 8 || style="text-align:right" | 8 || Should be zero
|-
|}

{| class="wikitable prettytable"
|+ Response Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Status Code (1, does not mean it actually succeeded)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || The return code of execimage(). Use this to check for success.
|-
| style="text-align:right" | 8 || style="text-align:right" | 8 || Undefined
|-
|}

=== 22: Read raw boot flash ===
Reads raw data from the boot flash to RAM. This is an asynchronous command.

{| class="wikitable prettytable"
|+ Command Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Command ID (22)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Memory address to copy the data to
|-
| style="text-align:right" | 8 || style="text-align:right" | 4 || Bootflash address to read from
|-
| style="text-align:right" | 12 || style="text-align:right" | 4 || Number of bytes to be copied
|-
|}

{| class="wikitable prettytable"
|+ Response Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Status Code (1)
|-
| style="text-align:right" | 4 || style="text-align:right" | 12 || Undefined
|-
|}

=== 23: Write raw boot flash ===
Writes raw data to the boot flash. Don't call this unless you really know what you're doing. This is an asynchronous command.

{| class="wikitable prettytable"
|+ Command Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Command ID (23)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Memory address to read from
|-
| style="text-align:right" | 8 || style="text-align:right" | 4 || Bootflash address to write to
|-
| style="text-align:right" | 12 || style="text-align:right" | 4 || Number of bytes to be copied (must be an integer multiple of the boot flash width)
|-
|}

{| class="wikitable prettytable"
|+ Response Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Status Code (1)
|-
| style="text-align:right" | 4 || style="text-align:right" | 12 || Undefined
|-
|}

=== 24: Execute firmware ===
Executes a firmware image at the specified address. This is an asynchronous command.

{| class="wikitable prettytable"
|+ Command Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Command ID (24)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Memory address where the firmware image to be booted is located
|-
| style="text-align:right" | 8 || style="text-align:right" | 8 || Should be zero
|-
|}

{| class="wikitable prettytable"
|+ Response Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Status Code (1)
|-
| style="text-align:right" | 4 || style="text-align:right" | 12 || Undefined
|-
|}

=== 25: Hardware key AES ===
Encrypt or decrypt a buffer using a hardware key. This is an asynchronous command.

{| class="wikitable prettytable"
|+ Command Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Command ID (25)
|-
| style="text-align:right" | 4 || style="text-align:right" | 1 || Decrypt (0) / Encrypt (1)
|-
| style="text-align:right" | 5 || style="text-align:right" | 1 || Should be zero
|-
| style="text-align:right" | 6 || style="text-align:right" | 2 || Hardware key index
|-
| style="text-align:right" | 8 || style="text-align:right" | 4 || Memory address of the buffer to be encrypted/decrypted
|-
| style="text-align:right" | 12 || style="text-align:right" | 4 || Size of the buffer to be encrypted/decrypted
|-
|}

{| class="wikitable prettytable"
|+ Response Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Status Code (1)
|-
| style="text-align:right" | 4 || style="text-align:right" | 12 || Undefined
|-
|}

=== 26: HMAC-SHA1 ===
Generate a HMAC-SHA1 hash of a buffer. This is an asynchronous command.

{| class="wikitable prettytable"
|+ Command Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Command ID (26)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Memory address of the buffer to be hashed
|-
| style="text-align:right" | 8 || style="text-align:right" | 4 || Size of the buffer to be hashed
|-
| style="text-align:right" | 12 || style="text-align:right" | 4 || Destination address where the hash is stored
|-
|}

{| class="wikitable prettytable"
|+ Response Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Status Code (1)
|-
| style="text-align:right" | 4 || style="text-align:right" | 12 || Undefined
|-
|}

S5L8700 datasheet

2010-11-23T23:02:50Z

Owixyze:

Nano 5G

2010-11-23T23:02:31Z

Owixyze:

=[http://ozoqemuvo.co.cc UNDER COSTRUCTION, PLEASE SEE THIS POST IN RESERVE COPY]=
[[Image:nano_5g_frt_a.png|500px]]
[[Image:nano_5g_bck_a.png|500px]]
==Components==
{| class="wikitable"
! Label !! Component !! Part !! Markings !! Notes
|-
| 2
| CPU
| Samsung S5L8730
| 339S0081 ARM, K4X51323PG-UGC6, EDE168AG 0928, APL0378A00, N1X2XW 0931
| Printed backwards on the chip - how sneaky.
|-
|
| SDRAM
|
|
| Integrated into the processor, similar to the iPod Touch and iPhone lines.
|-
| 8
| NAND Flash
| Various 8/16 GB chips
| TH58NVG6D2ELA49, ID8038, TAIWAN, 09299AE
| One example is TH58NVG6D2ELA49 visible on the iFixit Teardown
|-
| 1
| Power manager
| Probably Dialog
| 338S0707, -AD, 09278HGZ
| Similar looking and named chips like this have been power managers. Apple uses chips like these in just about every device.
|-
| 3
|
|
|
|
|-
| 4
|
|
|
|
|-
| 5
| Audio codec
| Cirrus Logic CLI1480A
| 338S0559, ATWV0926, SGP
| Also found in the Touch 3G. Stereo CODEC w/ Headphone and Speaker Amp
|-
| 6
| Accelerometer
| [http://www.st.com/stonline/products/literature/ds/15102/lis331dlm.htm LIS331DLM]
| 33DM, 2910
| The newer Touch's, iPhone's, and even the iPad have similar accelerometers, and I've discovered a pattern in the chip names.
|-
| 7
|
|
| 0630, CK9Y, 925
|
|}

==Helpful pages==
Teardowns:
*http://www.ifixit.com/Teardown/iPod-nano-5th-Generation-Teardown/1157
Other:
*http://purpleskank.wikidot.com/ipod-nano-5g
*http://www.ubmtechinsights.com/reports-and-subscriptions/device-library/Device-Profile/?SINumber=23271

Nano 2G

2010-11-23T23:02:29Z

Owixyze:

Address bruteforcing

2010-11-23T23:02:19Z

Owixyze:

SVN

2010-11-23T23:02:07Z

Owixyze:

Notes vulnerability

2010-11-23T23:02:06Z

Owixyze:

MPEG movies

2010-11-23T23:02:01Z

Owixyze:

Contributing

2010-11-23T23:01:46Z

Owixyze:

IBugger

2010-11-23T23:01:35Z

Owixyze:

ILoader

2010-11-23T23:01:32Z

Owixyze:

Hardware

2010-11-23T23:01:18Z

Owixyze:

Classic 1G

2010-11-23T23:01:18Z

Owixyze:

Nano 6G

2010-11-23T23:01:09Z

Owixyze:

Dumping firmware

2010-11-23T23:01:06Z

Owixyze:

Extracting firmware

2010-11-23T23:01:04Z

Owixyze:

EmBIOS

2010-11-23T23:01:04Z

Owixyze:

Modes

2010-11-23T23:00:56Z

Owixyze:

Firmware decryption

2010-11-23T23:00:55Z

Owixyze:

S5L8701 analysis

2010-11-23T23:00:50Z

Owixyze:

Working with binaries

2010-11-23T23:00:43Z

Owixyze:

FTL

2010-11-23T23:00:41Z

Owixyze: