warehack.ing/skywalker-1
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Reorder firmware versions: custom first, then newest-to-oldest stock

Browse Source
This commit is contained in:
Ryan Malloy 2026-02-13 02:46:54 -07:00
parent 2bf6515cbb
commit 7b27c93219
1 changed files with 86 additions and 86 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

172
site/src/content/docs/firmware/version-comparison.mdx
View File

@ -11,12 +11,12 @@ Five firmware versions have been analyzed through Ghidra reverse engineering and
| Firmware | Version ID | Build Date | Target PID | Functions | Binary Size | Stack Pointer |
|----------|-----------|------------|------------|-----------|-------------|---------------|
| v2.06.04 | `0x020604` | 2007-07-13 | `0x0203` | 61 | 9,472 bytes | `0x72` |
| Rev.2 v2.10.04 | `0x020A04` | 2010-03-12 | `0x0202` | 107 | 8,843 bytes | `0x4F` |
| Custom v3.01.0 | `0x030100` | 2026-02-12 | `0x0203` | N/A | ~3 KB (RAM) | N/A |
| v2.13.01 (FW1) | `0x020D01` | 2010-03-12 | `0x0203` | 82-88 | 9,322 bytes | `0x50` |
| v2.13.02 (FW2) | `0x020D01` | 2010-03-12 | `0x0203` | 83 | 9,377 bytes | `0x50` |
| v2.13.03 (FW3) | `0x020D01` | 2010-03-12 | `0x0203` | 83 | 9,369 bytes | `0x52` |
| Custom v3.01.0 | `0x030100` | 2026-02-12 | `0x0203` | N/A | ~3 KB (RAM) | N/A |
| Rev.2 v2.10.04 | `0x020A04` | 2010-03-12 | `0x0202` | 107 | 8,843 bytes | `0x4F` |
| v2.06.04 | `0x020604` | 2007-07-13 | `0x0203` | 61 | 9,472 bytes | `0x72` |
<Aside type="note">
Rev.2 v2.10 targets PID `0x0202` (a different product line). All other versions target `0x0203` (SkyWalker-1). The custom v3.01.0 is compiled with SDCC + fx2lib and loaded into FX2 RAM, not flashed to EEPROM.
@ -25,64 +25,31 @@ Rev.2 v2.10 targets PID `0x0202` (a different product line). All other versions
## Version-by-Version Details
<Tabs>
<TabItem label="v2.06">
<TabItem label="Custom v3.01">
### v2.06.04 <Badge text="Stock" variant="note" />
### Custom v3.01.0 <Badge text="Custom" variant="success" />
The original SkyWalker-1 firmware extracted from the device's onboard EEPROM.
Open-source replacement firmware built with SDCC + fx2lib. RAM-loaded for testing.
| Property | Value |
|----------|-------|
| Version ID | `0x020604` |
| Build date | 2007-07-13 |
| Functions | 61 |
| Binary size | 9,472 bytes |
| Stack pointer | `0x72` |
| Config byte IRAM | `0x6D` |
| Descriptor base | `0x1200` |
| Init table address | `CODE:0B46` |
| Vendor commands | 30 (`0x80`--`0x9D`) |
| DiSEqC data pin | P0.7 |
| Version ID | `0x030100` |
| Build date | 2026-02-12 |
| Toolchain | SDCC + fx2lib |
| Source | `firmware/skywalker1.c` (1351 lines) |
| Binary size | ~3 KB |
| Load method | RAM upload via `tools/fw_load.py` |
| DiSEqC data pin | P0.7 (v2.06 assignment) |
**Characteristics:**
- Simplest firmware with the fewest functions
- INT0 handler performs USB re-enumeration (CPUCS pulse)
- No demodulator probe at boot
- No retry loops or integrity verification
- BCM4500 status polling reads 3 registers (0xA2, 0xA8, 0xA4) up to 6 times
- Commands 0x99, 0x9A, 0x9C route to STALL
- Command 0x9D reads descriptor byte and sets mode flag based on hardware revision (4, 5, or 6)
</TabItem>
**Additions over stock:**
- Seven new diagnostic commands (`0xB0`--`0xB6`)
- Incremental debug boot modes (wValue `0x80`--`0x85` for BOOT_8PSK)
- I2C timeout protection (6000-iteration countdown vs. infinite spin)
- I2C bus scan for device discovery
- Spectrum sweep and blind scan capabilities
- Raw BCM4500 register access
<TabItem label="Rev.2 v2.10">
### Rev.2 v2.10.04 <Badge text="Transitional" variant="caution" />
Firmware for the Rev.2 hardware variant (PID `0x0202`). Architecturally sits between v2.06 and v2.13.
| Property | Value |
|----------|-------|
| Version ID | `0x020A04` |
| Build date | 2010-03-12 |
| Functions | 107 (most of any version) |
| Binary size | 8,843 bytes (smallest) |
| Stack pointer | `0x4F` |
| Config byte IRAM | `0x4E` |
| Descriptor base | `0x0E00` |
| Init table address | `CODE:0B48` |
| Vendor commands | 27 (`0x80`--`0x9A`) |
| DiSEqC data pin | P0.4 |
**Characteristics:**
- Highest function count due to granular decomposition (10-30 byte helper functions)
- Smallest binary despite having the most functions
- Retained v2.06's INT0 USB re-enumeration behavior
- Already adopted v2.13's descriptor base (`0x0E00`) and similar stack pointer
- Contains `FUN_CODE_0800`: a massive 874-byte configuration dispatcher with embedded main loop
- Lacks v2.13's demodulator polling, retry loops, and additional vendor commands (0x9B--0x9D out of range)
- 0x99/0x9A present as prototype implementations
See the [Rev.2 Analysis](/firmware/rev2-analysis/) page for the complete 107-function inventory.
See the [Custom v3.01](/firmware/custom-v301/) page for full details.
</TabItem>
<TabItem label="v2.13 FW1">
@ -117,50 +84,83 @@ The most feature-complete stock firmware, targeting the original I2C-connected S
See the [FW2.13 Variants](/firmware/fw213-variants/) page for sub-variant comparison.
</TabItem>
<TabItem label="Custom v3.01">
<TabItem label="Rev.2 v2.10">
### Custom v3.01.0 <Badge text="Custom" variant="success" />
### Rev.2 v2.10.04 <Badge text="Transitional" variant="caution" />
Open-source replacement firmware built with SDCC + fx2lib. RAM-loaded for testing.
Firmware for the Rev.2 hardware variant (PID `0x0202`). Architecturally sits between v2.06 and v2.13.
| Property | Value |
|----------|-------|
| Version ID | `0x030100` |
| Build date | 2026-02-12 |
| Toolchain | SDCC + fx2lib |
| Source | `firmware/skywalker1.c` (1351 lines) |
| Binary size | ~3 KB |
| Load method | RAM upload via `tools/fw_load.py` |
| DiSEqC data pin | P0.7 (v2.06 assignment) |
| Version ID | `0x020A04` |
| Build date | 2010-03-12 |
| Functions | 107 (most of any version) |
| Binary size | 8,843 bytes (smallest) |
| Stack pointer | `0x4F` |
| Config byte IRAM | `0x4E` |
| Descriptor base | `0x0E00` |
| Init table address | `CODE:0B48` |
| Vendor commands | 27 (`0x80`--`0x9A`) |
| DiSEqC data pin | P0.4 |
**Additions over stock:**
- Seven new diagnostic commands (`0xB0`--`0xB6`)
- Incremental debug boot modes (wValue `0x80`--`0x85` for BOOT_8PSK)
- I2C timeout protection (6000-iteration countdown vs. infinite spin)
- I2C bus scan for device discovery
- Spectrum sweep and blind scan capabilities
- Raw BCM4500 register access
**Characteristics:**
- Highest function count due to granular decomposition (10-30 byte helper functions)
- Smallest binary despite having the most functions
- Retained v2.06's INT0 USB re-enumeration behavior
- Already adopted v2.13's descriptor base (`0x0E00`) and similar stack pointer
- Contains `FUN_CODE_0800`: a massive 874-byte configuration dispatcher with embedded main loop
- Lacks v2.13's demodulator polling, retry loops, and additional vendor commands (0x9B--0x9D out of range)
- 0x99/0x9A present as prototype implementations
See the [Custom v3.01](/firmware/custom-v301/) page for full details.
See the [Rev.2 Analysis](/firmware/rev2-analysis/) page for the complete 107-function inventory.
</TabItem>
<TabItem label="v2.06">
### v2.06.04 <Badge text="Stock" variant="note" />
The original SkyWalker-1 firmware extracted from the device's onboard EEPROM.
| Property | Value |
|----------|-------|
| Version ID | `0x020604` |
| Build date | 2007-07-13 |
| Functions | 61 |
| Binary size | 9,472 bytes |
| Stack pointer | `0x72` |
| Config byte IRAM | `0x6D` |
| Descriptor base | `0x1200` |
| Init table address | `CODE:0B46` |
| Vendor commands | 30 (`0x80`--`0x9D`) |
| DiSEqC data pin | P0.7 |
**Characteristics:**
- Simplest firmware with the fewest functions
- INT0 handler performs USB re-enumeration (CPUCS pulse)
- No demodulator probe at boot
- No retry loops or integrity verification
- BCM4500 status polling reads 3 registers (0xA2, 0xA8, 0xA4) up to 6 times
- Commands 0x99, 0x9A, 0x9C route to STALL
- Command 0x9D reads descriptor byte and sets mode flag based on hardware revision (4, 5, or 6)
</TabItem>
</Tabs>
## Architectural Differences
| Feature | v2.06 | Rev.2 v2.10 | v2.13 | Custom v3.01 |
|---------|-------|-------------|-------|--------------|
| Vendor commands | 30 | 27 | 30 | 30 stock + 7 custom |
| INT0 handler | USB re-enum | USB re-enum | Demod polling | N/A (fx2lib ISR) |
| Demod probe at boot | No | No | Yes (40 attempts) | Yes (with timeout) |
| Retry loops | No | No | Yes (20-attempt) | Yes (with timeout) |
| HW revision detect | No | Yes (descriptor walker) | Yes (flag `_1_3`) | No |
| DiSEqC data pin | P0.7 | P0.4 | P0.0 | P0.7 |
| Config byte IRAM addr | `0x6D` | `0x4E` | `0x4F` | C variable |
| BCM4500 status poll | 3 registers | 3 registers | 1 register | 1 register |
| I2C timeout | None | None | None | 6000-count |
| Anti-tampering | No | No | Yes | No |
| New commands | -- | 0x99/0x9A proto | 0x99, 0x9A, 0x9C | 0xB0--0xB6 |
| 0x9D behavior | HW revision mode | N/A (out of range) | Conditional demod reset | N/A |
| Feature | Custom v3.01 | v2.13 | Rev.2 v2.10 | v2.06 |
|---------|--------------|-------|-------------|-------|
| Vendor commands | 30 stock + 7 custom | 30 | 27 | 30 |
| INT0 handler | N/A (fx2lib ISR) | Demod polling | USB re-enum | USB re-enum |
| Demod probe at boot | Yes (with timeout) | Yes (40 attempts) | No | No |
| Retry loops | Yes (with timeout) | Yes (20-attempt) | No | No |
| HW revision detect | No | Yes (flag `_1_3`) | Yes (descriptor walker) | No |
| DiSEqC data pin | P0.7 | P0.0 | P0.4 | P0.7 |
| Config byte IRAM addr | C variable | `0x4F` | `0x4E` | `0x6D` |
| BCM4500 status poll | 1 register | 1 register | 3 registers | 3 registers |
| I2C timeout | 6000-count | None | None | None |
| Anti-tampering | No | Yes | No | No |
| New commands | 0xB0--0xB6 | 0x99, 0x9A, 0x9C | 0x99/0x9A proto | -- |
| 0x9D behavior | N/A | Conditional demod reset | N/A (out of range) | HW revision mode |
## Kernel Version Constants