IT9919 Hacking - part 4 - Diving into the boot ROM

Summary

Aug 25, 2019

In this series I will be hacking around with the IT9919 media processor that powers the Lenkeng LKV373 HDMI Extender Device and the EZCAP 283S which were reviewed in previous videos.

In this video I investigate the booting mechanism to try and uncover the mystery of the SMAZ compressions scheme and checksum.

Project Git Repository
- Work-in-progress SMEDIA/SMAZ decoder
- Discussion: Towards SMAZ decompression

Danman's Original Blog Post
v3l0c1r4pt0r: Reverse Engineering the LKV373A
lkv-wiki
- Instruction Set Architecture
Leaked IT9910 Data Sheet
Daniel Kucera's Repository (includes upgrade files, and other captured information).
ith_defs.h

Backups of the original content of the flash chips: 20181226-lkv-373a-backups.zip

Internal Bootloader ROM: 20190318-rom.zip

Call Graph

Functions are labelled with: address, number of instructions, presence of SMED(IA02) and SMAZ comparisons, and register accesses.

Flash Loader Function

Annotated disassembly: 20190520-ssi-loader.txt

20190830-corpus.tar.bz2

IT9919 Hacking - part 4 - Diving into the boot ROM

Summary

Tools

Source Information

Firmware Backups

Boot Rom

Call Graph

Flash Loader Function

SMAZ Decoding