john Profile picture
5 Jul 20, 18 tweets, 6 min read
As promised, here’s my little thread about my experience of repairing 1st-gen KongSWD (all-white)
Although that’s most likely not your case if you got such a cable, but I did manage to break firmware on mine completely. So let’s start with restoring it
Both generations of Kong make use of NXP LPC1768 MCU (Cortex-M3) (along with Xilinx Spartan 6 FPGA, by the way), that can be reflashed over SWD Image
My guess was that both SWDIO and SWDCLK can be accessed via certain testpoints on the MLB. But there’re plenty of them, and the MCU is a BGA chip, so no continuity testing without desoldering ImageImage
Luckily, @1nsane_dev sent me a dead 2nd-gen Kong motherboard for free. I desoldered everything from it and located SWD test points (LPC1768 BGA100 pinout is available in the official datasheet). Here they are: Image
Although 1st-gen and 2nd-gen boards are a little bit different, SWD test points are located at the same places. But be careful, the TPs are very fragile - I destroyed one recently when I tried to solder them again for making better photos for this thread!
Then I soldered wires to them and connected to Waveshare’s STLink V2 clone. Although it’s intended to be used with STM32s only, it happily works with this NXP MCU as well Image
Default OpenOCD’s config for LPC1xxx sets 10 kHz tckrate, which leads to weird bugs whenever you try to access any fair amount of memory - e.g. you can read 16 bytes of memory just fine, but not 1024. And of course flashing worked neither
I did set it to 4 MHz and then it started to work flawlessly. The cable booted in disk mode - reflashing with astrisctl and it can now be recognized by Astris itself: Image
Now let’s examine common problems

The first one is damaged motherboard. There’re 2 broken tracks (one per side) that come from USB power of both cords. Something wasn’t powered up at all?
Here they are already fixed with little pieces of copper wires, but you can recognize their locations anyway: ImageImage
Another problem is connector:

1) It’s weirdly ringed (continuity testing) with multimeter
2) Its bottom side’s pin pad (which is meant to be connected with the port) looks recessed. Not sure you can see that on the photo below, but it is. This, I believe, makes connection between it and the female port very unstable or just not working at all Image
So, it is to be replaced. As I mentioned in my Lightning write-up, Kong’s connector doesn’t have any logic inside, as it’s handled by MCU and FPGA inside the enclosure. The pinout is written with silk on the MLB. I replaced the connector with jumper wires and a breakout board Image
Now, the last problem - Kong doesn’t seem to like modern HOSTIDs (again, look at my Lightning write-up in case you don't know what this means): Image
But that can be fixed easily by setting disableIdCheck environmental variable:

astrisctl setenv disableIdCheck 1

(Only available in newer firmwares such as 0.52 or 0.49)
Credits/thanks to:

@iRazGAr
@chiptunext
@1nsane_dev
By the way - I'm looking for a manufacturer that can produce a little batch (100-150 pcs) of custom Lightning-connectors with short cords (10-15 cm) with a style of Kong's and/or Kanzi's ones. No need for any HiFive logic - I just need an access to all of the 8 pins ImageImage

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with john

john Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @nyan_satan

5 Feb 20
Here is my little thread about bugs I’ve found in Image3 parsers of various SecureROMs (well, A4 and A6)

None of them are exploitable, but all of them can cause a crash and/or denial-of-service

Why am I posting this? Just for lulz and from hopelessness

Image
1) memsetting the whole address space

That’s only for A4 (and maybe lower)

Back in February 2019, someone told me about “SHSH tag length underflow”, that allows “arbitrary memset”. The person failed to tell me which ROM it’s for
But for A4 ROM I found something similar. Look at this line of code:

github.com/NyanSatan/Imag… Image
Read 23 tweets
8 Oct 19
@chronic 1/ there’s no such bootloader as BSS, there’s iBSS (iBoot Single Stage) instead

2/ LLB cannot enter recovery mode, it enters DFU-like mode

3/ boot-command upgrade makes it boot new iBEC, not iBSS

4/ SecureROM versions do NOT match iBoot version at the time of device release
@chronic 5/ there’s console on production iBoot too, although very limited

6/ there’re more iBoot flags than he shows

7/ demotion to 01 is enough to get JTAG (I’d even say SWD). Demotion of Security status isn’t even possible according to @s1guza

@chronic @s1guza 8/8 limera1n isn’t the only bootrom exploit of the past times. There also were Pwnage 1/2, steaks4uce, 24kpwn, SHAtter and alloc8

That was just brief view, by the way
Read 4 tweets
17 Aug 19
Here is my little thread about Power NVRAM — another persistent key-value storage, located right on PMU chip. Only talking about iBoot context
Modifying certain key there allows to enable debug UART on any boot loader (including DFU ones) very early and without touching normal NVRAM

Both keys and values are unsigned 8-bit integers

Now let’s talk about known keys and values for them:
Read 17 tweets
27 Jul 19
Here is my little thread about Lightning video adapters – also known as Haywire – which are actually computers that feature Apple Secure Boot and run Darwin kernel
There’re 2 kinds of Haywire:

1. Lightning Digital AV Adapter (b137ap/iAccy1,1) – Lightning to HDMI adapter, supports both video and audio
2. Lightning to VGA Adapter (b165ap/iAccy1,2) – doesn’t support audio output for obvious reason
Read 20 tweets
31 Jan 19
I was planning to keep this knowledge private, but damn it. This is a thread about Apple SWD cables, some things they can do and how to use them
For now I only have got KongSWD, so everything below applies to this type of cable first of all
f you’re reading this thread, you’ve most likely seen many photos with these weird Apple internal cables posted here, on Twitter, — Gorilla, Kong, Kanzi, Chimp, Flamingo, etc.

Read 29 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!

Follow Us on Twitter!