MN-100 Flash Reverse Engineering

Flash Memory map:

Area Start Address Size Link
Boot 0x00000000   BOOT initial boot kick start
Boot - 2 0x00008000   BOOT second part of the boot code
Code Image 0x00040000 768k ? CODE
end of ROM 0x00200000 Total-2M end of ROM

Booting Sequence

Normal boot sequence may be interrupted by key press:


Click here to see a boot sequence

BootLoader decoding 

Need to be included
Code section is an exact copy of the firmware file. Firmware file use unknown *.dlf extension and unknown format. Addiditonal investigation required.

*.DLF file structure
Offset Description Value from MN*.dlf
0 TF - Type of file 2
4 DL - Data Length
(FileLength-80)		 0x000b1e6e
8 DC - Data CheckSum (byte)
for(i=80; i<=fileLen-1;i++)
  DC+ = (byte)file[i]; 		0x05e2bb5c
0x0c..
12...		 Text Signature "msfox_wired"
0x4c
76		 HC - header checksum:
for(i=0;i<0x4b;i++)
  HC+ = (byte)header[i];
 0x000030ae
0x50...
80...		 data file - unknown compression  

$Id: flash_mem.html,v 1.5 2004/03/02 22:51:10 bcabral Exp $