> Has anyone experimented with "Parrot" on the ppc platform to perform a
> memory dump and copy data to CF/SD?
I've not done it with an iPaq, but with a Pocket PC Phone Edition.
For this we used a 'feature' in this specific bootloader that
allows code on an SD card to be executed while booting in bootloader
mode. This code then allows a copy of RAM to be written to SD.
> I am attempted to determine if a file on the ppc platform is deleted it is
> in fact recoverable. Paraben's PDA Seizure does
> not retreive deleted files on PPC on Palm OS. Any comments would be much
> appreciated.
I've not done research in how far deleted files are still accessible.
Actually I've not even looked very deeply if it is easy to map the file
system based on this RAM image. I did manage to wipe the bit that sais
the PIN code is active thereby allowing you temporary access to the device
even if it is protected by the pin/pass mechanism (you can also turn it
on again without knowing the pin/pass).
The only 'but' is that this was specific for this bootloader. Although
it is similar to earlier iPaq loaders, I'm not sure if the code execution
from SD feature is present in iPaqs.
Of course you could write a program that does the bootloader memory reads
by giving the bootloader commands over serial and then parsing the results,
but it sounds like a long wait :-)
Some details can be found at http://www.itsx.com/pocketpc/ under the
'insecure bootloader' heading.
Regards,
Job
-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com
> Has anyone experimented with "Parrot" on the ppc platform to perform a
> memory dump and copy data to CF/SD?
I've not done it with an iPaq, but with a Pocket PC Phone Edition.
For this we used a 'feature' in this specific bootloader that
allows code on an SD card to be executed while booting in bootloader
mode. This code then allows a copy of RAM to be written to SD.
> I am attempted to determine if a file on the ppc platform is deleted it is
> in fact recoverable. Paraben's PDA Seizure does
> not retreive deleted files on PPC on Palm OS. Any comments would be much
> appreciated.
I've not done research in how far deleted files are still accessible.
Actually I've not even looked very deeply if it is easy to map the file
system based on this RAM image. I did manage to wipe the bit that sais
the PIN code is active thereby allowing you temporary access to the device
even if it is protected by the pin/pass mechanism (you can also turn it
on again without knowing the pin/pass).
The only 'but' is that this was specific for this bootloader. Although
it is similar to earlier iPaq loaders, I'm not sure if the code execution
from SD feature is present in iPaqs.
Of course you could write a program that does the bootloader memory reads
by giving the bootloader commands over serial and then parsing the results,
but it sounds like a long wait :-)
Some details can be found at http://www.itsx.com/pocketpc/ under the
'insecure bootloader' heading.
Regards,
Job
-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com
[ reply ]