Question for Motorola linux phones users about sbf and other firmware files

[zolookas]

Hi, I have some questions for you. I want to add linux phone firmware support to my program and i need some info about sbf firmware files:
1. What is the maximum number of codegroup? I've seen CG43 in fullflash, is there any codecgroups with higher number?
2. Also there is RDL3 codegroup in Kaleidoscope 0.01a fullflash (0xA0DE0000-0xA13FFFFF). I suppose this is ram downloader. Right? If yes, why it's named RDL3?
3. What programs do you use to compile/decompile sbf files for linux phones?
4. Do you use any other format than .sbf for firmwares?
5. Where i can find what each CG means, for example what is CG34.

[sjj]

hi zolookas, long time no see....

Try this website for more information: https://opensource.motorola.com/sf/sfmain/do/home

[zjole]

hi zolookas,hope you'll the following information useful.
1.There's cg52 in z6/v8 firmwares.
2.I'm not sure.RDL 3 should be the ram downloader.But the odd thing is there's RDL(03fc8000-03fe7ff7) too.
3.SBF Codec
4..shx format
5.check this wiki out.

edit:I've just figured out that RDL 3 is ram downloader for ap while RDL is for bp.

[zolookas]

Can you give me link to .shx format linux motorola firmware? Seems that everything I download is in sbf format.
Also i've noticed that sbf file format are completely different from one for p2k phones.

[zjole]

e680 firmware and e2 bp part of firmware are in .shx format.

can you pm me your email address?I can send you sample .shx files via email.My connetion is so bad these days that I

cannot upload anything to online sharing sites.

[Exploited]

http://www.e2mod.com/content/view/89/26/ - this one have all .shx stock files

[zolookas]

Exploited, thanks

Is there any opensorce tools to extract linux sbf (i need to take look at the source)? I think I understand header and start of description area, but there are unknown areas. I've tried unsbf, but it doesn't extract it.

This is what i know:
All information here is hypothetical and untested!

Header format:
0-14: text "Multi-Interface"
15-255: filled with zero bytes ("00")
256-259: "3.50"
260-287: filled with zero bytes ("00")
288-291: "2.00"
292-319: filled with zero bytes ("00")
320-(approx.350, size can vary because of month string): date (format: "Sat September 15 18:14:34 2007")
(approx.350)-447: filled with zero bytes ("00")
448-477: "Multi-Interface Super File CSF"
478-770: filled with zero bytes ("00")

Description area:
Description area size depends on how many codegroups are in .sbf
CG data is stored in raw format (as is, no half bytes like in shx)
771: defines type of first CG, if it's "FF", then it's ramdownloader, if number like "02" then it will mean there is codegroup, ex. CG2
772: ramldownloader "number" (seems like ramldownloaders have numbers like codegroups), if it's CG, not ramldownloader, it needs to be "FF"
773: unknown, seems to be always "23"
774-777: start address written in backwards. Ex.: "0000DEA0" should be "A0DE0000"
778-781: end address written in backwards. Ex.: "FFFF3FA1" should be "A13FFFFF"
782-789: filed with "FF" bytes
----format after this unknown------

Before CG there are some bytes of information about it:
8 bytes: "0000000000030201"
4 bytes: CG size in hex
4 bytes: start address (not in backwards!)

[zjole]

hey,zolookas.
try the attached sbftools(source code).