RE Journal
Notes from reverse-engineering the RED ONE MX firmware and hardware.
-
The emulated camera had been sleeping at the same line for weeks — a driver waiting on a chip that isn't there. Three flipped bits along its own bringup path woke it, and for a few hundred milliseconds it did everything a camera does at dawn, right up until it reached for a picture that no longer exists.
-
For weeks the emulated camera complained about its HDMI transmitter three times a second. The failure was a race measured in microseconds that don't exist — and when it was finally fixed, the cure looked exactly like a hang.
-
If you want to see what the camera is drawing, hook the function that draws it. The hook is correct, the address is correct — and it never fires. The OSD doesn't exist until the video pipeline does.
-
The firmware is not the whole story. The IO-FPGA bitstream contains 25,170 frames of configuration data — hiding four blocks of high-entropy content that are almost certainly color pipeline coefficients.
-
The camera has booted. The display drivers initialized. The FPGA is scanning a framebuffer at 0x840000. But the pixels are noise — and the OSD render buffer is somewhere we can't reach.
-
Boot stalls at 'Initializing status display.' One I²C transaction never completes. Five interdependent device-model bugs, all on the same path. Fix one, find another.
-
The firmware runs. VxWorks immediately hangs in a DTLB-miss livelock. Is this a firmware bug? No — it's a bug in QEMU's own PPC405 MMU emulation, hiding as firmware behavior.
-
software.bin links for base address 0x10000. QEMU was loading it at 0x0. One 65,536-byte error was the root cause of every wrong theory, every garbage value, every false fix — for two weeks.
-
An ISP1562 USB stub. A hand-seeded allocator. A patched dispatcher. Every fix revealed another problem. None of them were real problems.
-
Enumerate the tasks. Decode the relocation. Find where the firmware actually lives in memory. All from the outside, through a JTAG cable, without touching a byte.
-
The emulator is stuck. But there's a real camera on a JTAG cable, running real firmware in real time. Getting a host machine to listen — carefully, read-only, without wrecking anything.
-
QEMU loads the firmware and immediately jumps into a string. The first crash is at address 0xD7E680 — and what's there is not code.
-
Before you can understand a binary, you need to rebuild it. Tracking down the exact compiler that made the RED ONE MX firmware — and proving it, byte for byte.