Ipod patcher to backup firmware what am I doing wrong

[psxpetey]

I downloaded ipod patcher and this is the prompt: Enter i to install the Rockbox bootloader, u to uninstall
 or c to cancel and do nothing (i/u/c) :

If I enter anything other than iuc it disappears. How do I use it to extract firmware from the ipod.

[saratoga]

You need to run ipodpatcher from the command line. See here for instructions:  https://www.rockbox.org/wiki/IpodPatcher

However, ipodpatcher can only dump the partitions visible on the storage, it can't access the raw NAND nor can it access the external ROM chip containing the bootloader. 

[psxpetey]

You need to run ipodpatcher from the command line. See here for instructions:  https://www.rockbox.org/wiki/IpodPatcher

However, ipodpatcher can only dump the partitions visible on the storage, it can't access the raw NAND nor can it access the external ROM chip containing the bootloader.

do you know of any tools that can? For decrypting AUPD I found a link on freemyipod, the link is dead but I went on wayback machine and found a description on ipod linux. However link is dead. Any idea how I can get kingstones C++ aupd decrypter or a tool to pull the raw nand? The rc4 encryption of the nano 1g I could get the key myself but im not sure how to use the key to decrypt/ view raw nand maybe if I got a rt809h and used the key maybe that could get me the raw nand?

[bluebrother]

What are you actually trying to achieve? For the Ipods the firmware files from Apple are linked in the wiki: https://www.rockbox.org/wiki/IpodManualRestore If you simply want a backup for possible restore after swapping disks you can use those files (I've restored my Ipod disk a couple of times that way -- mini2g that is)

[saratoga]

You can save the ROM contents to disk in rockbox:

https://www.rockbox.org/wiki/IpodFlash

[psxpetey]

What are you actually trying to achieve? For the Ipods the firmware files from Apple are linked in the wiki: https://www.rockbox.org/wiki/IpodManualRestore If you simply want a backup for possible restore after swapping disks you can use those files (I've restored my Ipod disk a couple of times that way -- mini2g that is)

I am trying to replace/upgrade a ipod nano 1st gen 48pin tsop storage as I outine in this thread: https://forums.rockbox.org/index.php/topic,53678.0.html. Trouble is apple seems to have married them to each individual board. I just today swapped a nand daughter board with the exact same chips in the same configuration to another ipod 1st gen and it will boot and say: ipod needs restore in itunes but it will say : Ipod busy cannot flash when it trys to flash, So clearly apple has a way off marrying them to the board like they do with iphones https://youtu.be/rHP-OPXK2ig?t=1484

So im thinking if I dump and decrypt all firmware ad scour it in ida pro, I can find what it is I need to flash to a 48pin tsop to make it work in a different ipod and then possibly upgrade the storage:)

[saratoga]

If you're comfortable disassembling ARMv4, you can dump the ROM file in Rockbox and look at the initialization code to see what it expects from the NAND.  This could be pretty difficult though.  I'm not sure if anyone has studied the ROM very closely, that might be worth searching through google and our wiki to see.

Another option would be to use a NAND programmer to copy the contents of the working NAND to the new NAND and see if that works.  This might fail if the ROM is looking for specific models of NAND, or if it expects different chips to be configured in different ways. 

[psxpetey]

If you're comfortable disassembling ARMv4, you can dump the ROM file in Rockbox and look at the initialization code to see what it expects from the NAND.  This could be pretty difficult though.  I'm not sure if anyone has studied the ROM very closely, that might be worth searching through google and our wiki to see.

Another option would be to use a NAND programmer to copy the contents of the working NAND to the new NAND and see if that works.  This might fail if the ROM is looking for specific models of NAND, or if it expects different chips to be configured in different ways.

I wouldn't say confident but I am working on it, I dumped the rom via Rockbox (pretty badass you guys including that) and am trying to find options in IDA pro that disassemble it. Not sure if  the rom has VFP instructions or  not but the default is none for armv4, The loading address might help. if anyone happens upon this which I doubt and wants to help out here is the rom file for disassembly: https://app.box.com/s/t3k2qk67d82whwasub3fuzg2qbfibytx.

Ill have to do some more googling to see if anyone has studied the rom, I took a spin around the wiki to see if I could find anyone who has studied it. Any idea who implemented the rom dump function in to rockbox? I assume they would probably know something about the rom.

[saratoga]

The arm7tdmi support regular ARMv4. No floating point at all.

[psxpetey]

good that seemed to help alot more of the bin file is reporting as a rom now pretty much the whole thing. seems to be a big gap at the end. What can you tell me about kernel options

[saratoga]

I don't know what kernel options are. 

[psxpetey]

I don't know what kernel options are.

actually to switch gears rockbox has a nand table right ? coul I just add a different one to that table do you think that would work?

[saratoga]

What would you  be adding?  FWIW, on the Nano 1G the storage is exposed as a normal ATA interface. On the 2G it shows up as a raw NAND device and the drivers handle the flash translation layer in software. 

[psxpetey]

someone said this was a nand identification table, but apparently not, and if I cant access the nand than I cant install rockbox so I have to fix/ figure out the apple identifier anyway. The easiest method is looking like me buying a nand programmer. Still working with the rom file. Its in assembly but getting it to a point to where I can look at the initialization code is rather difficult. I spose I could try a jtag to view what's going on when initializing.

[saratoga]

You mean a table of allowed NAND chip IDs in the bootloader?  The bootloader is stored on the ROM chip, which I believe can be updated from inside rockbox (or at least it shouldn't be too hard to), although I'm not sure how hard it is to sign the image so that the apple firmware will accept the updated ROM.