Author |
Message |
Сергей
Joined: 26 Aug 2005 Posts: 7876 Location: Soft-Center
|
Posted: Thu Oct 23, 2008 15:58 Post subject: Example_4 - Mix Editor
|
|
Open dumps
To open many dumps together give them names:
01_01.dump
01_02.dump
cc_bb.dump, где:
cc - chip number
bb - bank number
Open any of them:
|
|
|
Сергей
Joined: 26 Aug 2005 Posts: 7876 Location: Soft-Center
|
Posted: Thu Oct 23, 2008 16:03 Post subject:
|
|
FAT Search
List down (PageDown)
You will see 3 sectors with zeros.
And sector with "02":
|
|
|
Сергей
Joined: 26 Aug 2005 Posts: 7876 Location: Soft-Center
|
Posted: Thu Oct 23, 2008 16:06 Post subject:
|
|
Skipped sectors
List down and look on second column of numbers.
02:
03:
04:
05:
Skipped:
06
07
08
09
0a:
0b:
0c:
0d:
Skipped:
0e
0f
10
11
12:
...
|
|
|
Сергей
Joined: 26 Aug 2005 Posts: 7876 Location: Soft-Center
|
Posted: Thu Oct 23, 2008 16:08 Post subject:
|
|
Search for skipped sectors
First look at well known places
Start from соседнего дампа
Blue rect show dump opened at editor "L":
This is dump_1.
Click one dump_2 with left mouse button (1 раз).
He will be opened at editor "L":
|
|
|
Сергей
Joined: 26 Aug 2005 Posts: 7876 Location: Soft-Center
|
Posted: Thu Oct 23, 2008 16:20 Post subject:
|
|
Exemine found FAT fragments
00:
01:
Пропущены:
02
03
04
05
06:
07:
08:
09:
Skipped:
0a
0b
0c
0d
0e:
0f:
10:
11:
...
|
|
|
Сергей
Joined: 26 Aug 2005 Posts: 7876 Location: Soft-Center
|
Posted: Thu Oct 23, 2008 16:23 Post subject:
|
|
Analysis
Mix consist of 2 parts.
Every part is 4 sectors long:
Code: | dump_2 00 01
dump_1 02 03 04 05
dump_2 06 07 08 09
dump_1 0a 0b 0c 0d
dump_2 0e 0f 10 11 |
To remove mix, we join dumps by 4 sectors.
|
|
|
Сергей
Joined: 26 Aug 2005 Posts: 7876 Location: Soft-Center
|
Posted: Thu Oct 23, 2008 16:26 Post subject:
|
|
Join by Page
Right click on lest step number (0)
Choose Steps -> Join by Page:
Right click on grey squares, choose order
Right click on new step number (1)
Choose Properties
Set Page = 2112 = 528 * 4
|
|
|
Сергей
Joined: 26 Aug 2005 Posts: 7876 Location: Soft-Center
|
Posted: Thu Oct 23, 2008 16:29 Post subject:
|
|
Verify
Right click on blue square.
Join result will appear at editor "L".
But we join dumps by 4 sector, this mean FAT moved twice forward.
Find it again:
List down.
Verify sectors order.
|
|
|
|