ArcaneNibble

WCH QingKe RISC-V XW extension opcode encoding

This has been reverse engineered from the toolchain only and has not been tested on hardware.

The c.lbu, c.lhu, c.sb, and c.sh opcodes replace some standard opcodes (that the QingKe cores do not implement, as the replaced opcodes require the D extension), and they also appear to be compatible with "Huawei" extensions mentioned here.

The c.lbusp, c.lhusp, c.sbsp, and c.shsp opcodes exist in a "reserved" opcode block.

001 uimm[0] uimm[4:3] rs1` uimm[2:1] rd`  00			c.lbu		(replacing c.fld)

ArcaneNibble

#include <stdint.h>
#include <string.h>

#include "CH579SFR.h"

void write_str(const char *s) {
	for (uint32_t i = 0; i < strlen(s); i++) {
		while (!(R8_UART1_LSR & RB_LSR_TX_FIFO_EMP)) {}
		R8_UART1_THR = s[i];
	}

ArcaneNibble

GATT

service 0xFFF0 characteristic 0xFFF2 --> commands service 0xFFF0 characteristic 0xFFF1 --> responses

packet format (both commands and responses)

0xB4 0x4B len type <payload> csum len -> number of bytes in payload csum -> add all of the previous bytes in the packet and truncate to 1 byte

fragmented bulk data (within payloads)

ArcaneNibble

import sys


def parse_cnf(infn):
    with open(infn, 'r') as f:
        inp = f.readlines()

    while inp:
        l = inp[0]
        inp = inp[1:]

ArcaneNibble

import sys


def parse_cnf(infn):
    with open(infn, 'r') as f:
        inp = f.readlines()

    # print(inp)
    while inp:
        l = inp[0]

ArcaneNibble

import struct
import time
import usb

dev = usb.core.find(idVendor=0x32f8, idProduct=0x424c)
# print(dev)

dev.set_configuration()

serno = usb.util.get_string(dev, dev.iSerialNumber)

ArcaneNibble

OUTDATED PLEASE GO TO https://github.com/rqou/linux/tree/atc-m1max






if instance == 0
	AUSPLL_CORE_AUSPLL_CFG_DCO_EFUSE_SPARE.RODCO_ENCAP_EFUSE		= efuse 0xa10 >> 25
	AUSPLL_CORE_AUSPLL_CFG_DCO_EFUSE_SPARE.RODCO_BIASADJ_EFUSE		= efuse 0xa10 >> 22

ArcaneNibble

OUTDATED PLEASE GO TO https://github.com/rqou/m1n1/tree/jpeg

ArcaneNibble

Set up reMarkable for easy UI hacking

The reMarkable UI is primarily built using QML, but all of the files are embedded inside the binary as compiled Qt resources. For ease of hacking, it is possible to extract the files onto the filesystem and patch the binary to load the extracted files.

--> ONLY FOR FIRMWARE VERSION 2.11.0.442 on rM2 <--

Resource extraction

ArcaneNibble

#!/usr/bin/env python3

import sys
from PIL import Image

infn = sys.argv[1]
outfn = sys.argv[2]

with open(infn, 'rb') as f:
    indata = f.read()