[Rooted the PMP][job's done 20060219 0045]
I don't know if I am the first in the world or in the forum to have done that but I have rooted my PMP
preriquist : - serial port hack by shamrockman + linux box
- linux knowlegde
- hexadecimal editor
- genromfs tool
- the source of the 2.03
method :
=========
The source of the 2.03 is on the net.
In this package, there are two interesting files :
- linux.rr : the linux kernel which is run by the pmp
- fs.img.rr : the base filesystem with binaries and init script
big steps :
1) copy the fs.img.rr to fs.img.rr.work
2) edit fs.img.rr.work with hexa editor and remove the rrload header (3 lines)
3) mount the fs.img.rr.work locally (fs type : romfs)
4) copy all the files mounted to an other directory
5) modify the file /etc/inittab and remove the # on the first line
5) use genromfs to generate a new filesystem image
6) add the headers cut in step 2 to this file
7) verify the size of the new generated filesystem image is equal to the
original fs.img.rr
boot your pmp and get into the rrload menu
9) serial load linux.rr
10) serial load fs.img.rr
11) boot them
12) enjoy the root on the serial terminal of your PMP
==================== ===================
PROOF OF CONCEPT
==================== ===================
war_target login: root
Jan 3 06:51:39 login[133]: root login on `ttyS0'
BusyBox v0.60.3 (2004.09.06-05:39+0000) Built-in shell (msh)
Enter 'help' for a list of built-in commands.
# cd /proc
# cat cpuinfo
Processor : ARM/VLSI ARM 7 TDMI rev 0 (v3l)
BogoMIPS : 23.39
Hardware : TMS320DM270 Development Module
Revision : 0000
Serial : 0000000000000000
# cat interrupts
0: 329634 timer
2: 3293660 dispbuf
11: 0 dsp_intr
12: 4196 serial
20: 0 col0
21: ` 0 col1
22: 154 col2
23: 0 power
24: 0 pmu
25: 0 usbdevice
26: 13 1161-OHCI-HC
29: 18204 ide0
33: 0 tv
34: 0 lcd
Err: 0
#
==================== ===