Hacker News new | ask | show | jobs
by voltagex_ 3947 days ago
Why has no one reverse engineered the boot blob on either Pi?
4 comments

People are working on it. The biggest challenge is that it isn't "let's reverse engineer this ARM blob"--they have to reverse engineer the entire (VC4) architecture, and write an assembler for it. Most people think of the rPi as an ARM board; it's more helpful to think of it as a VideoCore IV board with an ARM co-processor tacked on. The stock "boot blob" isn't just a boot blob--it's actually an entire OS (ThreadX, I believe) that's running on the VC4 GPU, in parallel with whatever OS you load on the ARM CPU. Of course, you wouldn't need to re-implement all of the OS, but it does make reverse-engineering harder.

The people working on this like to hang out at #raspberrypi-internals on Freenode.

(Disclaimer: the last I looked into this was in January, before the Raspberry Pi 2 came out)

It's not VC4 GPU, which is fully documented and fairly open. The bootloader runs on VPU, for which the reverse engineering is the only option, because there were no resources for doing anything sane with the official internal docs, when I checked last time. And Broadcom does not even own a compiler for this ISA. So, people had been officially encouraged to reverse engineer it.
I'm sure people have (tried to), but the problem is that, possible legal issues aside, the RPi is not a relatively standard and widespread system like the PC and Broadcom have not released much in the way of documentation. There's so much undocumented, and not enough people willing to go and analyse it all (unlike with the PC).

Although PCs are becoming more closed and blobby with each new generation, the legacy of backwards-compatibility means that a lot of things still work like they used to - in the days when documentation was far more open. IBM released the PC with full schematics and source code for the BIOS. The RPi was released with nothing more than its software and a few very incomplete datasheets.

> IBM released the PC with ... source code for the BIOS.

Um, no they didn't. The BIOS was very much a blob. Compaq spent a significant amount of resources reverse-engineering the BIOS, which made the IBM-PC-compatible market possible.

You're right that Compaq went to a lot of reverse engineering effort, userbinator is also right about IBM releasing the source code for their BIOS. They did it to prevent reverse engineering by tainting anyone exposed to the code. https://en.m.wikipedia.org/wiki/Phoenix_Technologies
Huh, I didn't know that. Thanks!
How long is a piece of string?
Twice the distance from the middle to one end...
I'm unfamiliar with that rebuttal, but it sounds like it has significance. Could someone explain it to me?
It signifies an unknown quantity, a string could be any length. I really don't like that saying at all.
Also, it doesn't really make sense in the context of the question anyway...