How to dump the entire firmware

[JayFoxRox]

I have now got concordance running (with #31) and did -b -f, -b -s and -b -c, but it raised some more questions:

• What is safemode? How do I reboot the remote into it?
• Why is the config so much larger than the firmware?
• Is there a documentation of the memory layout, other than the source code? (also related to #30)

But also:

• Is there any easy way to dump the entire flash? I'd like to have all the storage dumped that can be dumped via software
• Is there any portion of the flash that can't be dumped via software?

[jaymzh]

We didn't write the firmware, you'd have to ask Logitech. :)

We treat the firmware and the config as black boxes - the goal is to be able to get them and safely write them to do the device.

We reverse engineered the protocol by watching the USB traffic (see consnoop), and figured out the available commands to read/write various parts of the firmware.

IIRC, safemode is what the device will boot into if you hose the main firmware badly enough....

The devel list is a good resource for a lot of this stuff. At this point, this project doesn't get a ton of attention as the newer remotes are all configured over the internet, not through direct connections, and adding new remotes was the majority of the ongoing work that was required.

[JayFoxRox]

We didn't write the firmware, you'd have to ask Logitech. :)

I'm aware. I don't think there's any good chance that Logitech would be willing to help.

We treat the firmware and the config as black boxes - the goal is to be able to get them and safely write them to do the device.

concordance does already contain some hardware and memory layout information, so I think this is the right place to ask for more information.

We reverse engineered the protocol by watching the USB traffic (see consnoop), and figured out the available commands to read/write various parts of the firmware.

Am aware. Doesn't hurt to extend knowledge about these remotes (other than USB protocol) though?

IIRC, safemode is what the device will boot into if you hose the main firmware badly enough....

Yes, I suspected this, but was wondering if there was a hotkey or command to reboot into it. I was curious how it looks and if there might be a simplified firmware that I could have tried to emulate and understand first. I also found mentions of it where people claim their device keeps booting into safemode, but I'm not sure how it looks or how to achieve it (without bricking the device).

The devel list is a good resource for a lot of this stuff.

I'm not interested in using a mailing-list in 2021.

At this point, this project doesn't get a ton of attention as the newer remotes are all configured over the internet, not through direct connections, and adding new remotes was the majority of the ongoing work that was required.

Yes, I assumed so, but was hoping someone might be in the same situation as me: I have access to an old Harmony One that was recently fixed with a new battery. However, the tilt sensor is still in bad shape and I passionately hate the UI and slowness of the remote.

So I simply want to improve the firmware (improving visual effects, adding features, fixing slowness, optionally disabling tilt sensor, potentially making a USB <> IR bridge to turn the remote into an IR hub) while also extending the lifetime by getting rid of the server communication (.. injecting learned IR into the Update.EZHex). I'm not the owner of the remote and I don't care too much about it; this is merely a project I'd dedicate 1 or 2 weekends to. Given my findings so far it doesn't look like it's worth the effort though (https://github.com/jaymzh/concordance/issues/30#issuecomment-803577932).

[swt2c]

I'm not interested in using a mailing-list in 2021.

Tough. If it isn't in the code, the mailing list archives are really your only source. No one remembers low level details like this in their head.

[jaymzh]

What you're saying is "I don't want to go read about it, please go review all your old emails and spoon feed it to me."

There's a bunch of information we found, it's in the archives. As Scott noted, none of us remember the specifics off hand.

[JayFoxRox]

Tough. If it isn't in the code, the mailing list archives are really your only source.

Let me be more specific: I'm fine with reading the mailing-list, but I won't actively engage on it.

With the mailing-list (this one, but also other mailing-lists in the past) I had a hard time finding content, even if it existed. There's almost no structure on mailing-list which makes them a bad permanent resource. I did look at messages like https://sourceforge.net/p/concordance/mailman/message/18513295/ or https://sourceforge.net/p/concordance/mailman/message/19463322/. But the information is very incomplete and links are broken.

So I also don't plan to read through the entire decade-old mailing-list; searching on the list also feels hopeless without knowing important authors or keywords to look for. Without any guidance, my time is better spent re-analyzing it on my own, rather than wasting time searching the mailing-list.

What you're saying is "I don't want to go read about it, please go review all your old emails and spoon feed it to me."

This is absolutely not what I'm saying.

I'm merely asking for guidance and pointers in a field that I've never looked into before. If there was a more organized / structured central resource, that's what I'd be looking at, rather than asking for help.

No one remembers low level details like this in their head. There's a bunch of information we found, it's in the archives. As Scott noted, none of us remember the specifics off hand.

I don't expect that.

But someone hopefully remembers who looked into it, or where it was documented / roughly how much was done in a topic.

I was hoping someone can give me pointers ("XY did this, and documented it at XY") OR that someone is willing to discuss these things further (primarily in #30). In this issue in particular, I was only interested in better documentation of the existing features - if the safemode can be dumped, then that is probably documented somewhere. I was expecting maintainers to know these things.

[guyman624]

I did look at messages like https://sourceforge.net/p/concordance/mailman/message/18513295/ or https://sourceforge.net/p/concordance/mailman/message/19463322/.

for anyone lurking, this seems to be the message being referred to from this thread in that dead link.