dogtopus

Besta RTOS reversing notes

Some random notes about Besta RTOS. Will probably ended up on a wiki somewhere after Project Muteki become mostly usable.

Windows CE?

NOPE. Not even close.

Then why there's Windows CE stuff all over?

dogtopus

Moonoon Color Technical Specs

Hardware

Basic specs

CPU: AppoTech AX208 AXC51 (8051-compatible with 16-bit extended instruction set) microcontrolle @ ~~100MHz~~ 96MHz?

RAM: 15KB (12K IRAM + 1K Data RAM + 2K PRAM)

dogtopus

#!/usr/bin/python3
# This tool exploits a weakness in RGSSAD file format in order to recover
# non-standard magic key (other than the default 0xdeadcafe key) used in some
# RGSSAD archives.
#
# RGSSAD uses a LCG (Linear Congruential Generator) (Xn+1 = aXn+c mod m) to
# generate xor pads in order to encrypt files and their metadata. However,
# the LCG implementation returns the seed (X0) instead of the result of a single
# iteration of the algorithm (X1) on its first iteration. The seed is then being
# used as the xor pad for the file name length (a 32-bit value) of the first

dogtopus

import hashlib

def secret(start: int, size: int) -> bytes:
    result = bytearray()
    add = start + size
    for i in range(size):
        result.append(start & 0xff)
        next = start + add
        add = start
        start = next

dogtopus

#!/usr/bin/env python3

from __future__ import annotations

'''
Convert sigrok JSON trace containing UART HCI traffic to HCI PCAP file.

The JSON trace files are typically acquired with:

sigrok-cli -i some-sigrok-session.sr -P uart:baudrate=<hci-baud> -A uart=tx-data:rx-data --protocol-decoder-jsontrace > some-json-trace-file.json

dogtopus

Jedi/Banana Info

Identification

FCCID

• AK8CUHZCT1: JDM-001, JDM-020(?, uses similar BT module)
• AK8CUHZCT1F1: JDM-011(D2?)
• AK8CUHZCT1A: JDM-030
• AK8CUHZCT2: JDM-040

dogtopus

#!/usr/bin/env python3

from Cryptodome.PublicKey import RSA
from Cryptodome.Signature import pss
from Cryptodome.Hash import SHA256
from Cryptodome.Math.Numbers import Integer

import io
import shutil
import sys

dogtopus

#!/usr/bin/env python3

import hid

import contextlib
import ctypes
import enum
import hashlib
import os
import sys

dogtopus

# Invokes [thefuck](https://github.com/nvbn/thefuck) when typing
# 'im a girl btw' in the shell.
#
# Inspired by Beluga's discord series. https://www.youtube.com/c/Beluga1
#
# Installation: add to anywhere in .bashrc.
#
# Effect:
#
# $ pacman -Syu

dogtopus

SEGA Grand Pianist

SD Card

SD card slot is on its own separate PCB connected via a 8-pin JST PH (?) jumper cable.

Tested with 2GB SD card formatted with FAT16. Cards smaller than 2GB might also work but are untested (since the smallest cards I got are 2GB).

(Official spec stated that it supports 128MB-2GB SD cards formatted with FAT16.)