On Mon, 5 Mar 2007, Ward Vandewege wrote:
On Mon, Mar 05, 2007 at 05:53:52PM +0100, Carl-Daniel Hailfinger wrote:
A counter with 6 bits per byte and one unknown byte. Note how no value is >=0x40 and a wraparound of the second value increases the third value by 1? Could be a timer, e.g. boot time or something like that. Try to correlate boot time intervals with the differences in the counter.
Hypothesis: boot or shutdown time in UTC and date (Ward's local time seems to be -0500 from UTC, translation to decimal below):
-0000fd90 0f 00 24 00 12 00 00 02 03 07 00 00 40 00 00 00
The baseline was last Friday, i.e 2007-03-02: 02 03 07
2007-03-05 10:17 +0000fd90 0a 00 00 00 0f 00 00 05 03 07 00 00 40 00 00 00
ss mm hh DD MM YY 10 00 15 05 05 07
2007-03-05 10:29 +0000fd90 16 00 1c 00 0f 00 00 05 03 07 00 00 40 00 00 00
22 28 15
2007-03-05 10:38 +0000fd90 14 00 25 00 0f 00 00 05 03 07 00 00 40 00 00 00
20 37 15
2007-03-05 10:40 +0000fd90 14 00 27 00 0f 00 00 05 03 07 00 00 40 00 00 00
20 39 15
2007-03-05 10:42 +0000fd90 08 00 29 00 0f 00 00 05 03 07 00 00 40 00 00 00
08 41 15
2007-03-05 10:43 +0000fd90 39 00 2a 00 0f 00 00 05 03 07 00 00 40 00 00 00
57 42 15
2007-03-05 10:48 +0000fd90 2e 00 2c 00 0f 00 00 05 03 07 00 00 40 00 00 00
46 44 15
2007-03-05 10:50 +0000fd90 16 00 31 00 0f 00 00 05 03 07 00 00 40 00 00 00
22 49 15
2007-03-05 10:52 +0000fd90 0b 00 33 00 0f 00 00 05 03 07 00 00 40 00 00 00
11 51 15
2007-03-05 10:53 +0000fd90 00 00 35 00 0f 00 00 05 03 07 00 00 40 00 00 00
00 53 15
2007-03-05 10:55 +0000fd90 32 00 36 00 0f 00 00 05 03 07 00 00 40 00 00 00
50 54 15
2007-03-05 10:57 +0000fd90 28 00 38 00 0f 00 00 05 03 07 00 00 40 00 00 00
40 56 15
2007-03-05 11:00 +0000fd90 0e 00 3b 00 0f 00 00 05 03 07 00 00 40 00 00 00
14 59 15
2007-03-05 11:02 +0000fd90 05 00 01 00 10 00 00 05 03 07 00 00 40 00 00 00
05 01 16
2007-03-05 11:03 +0000fd90 36 00 02 00 10 00 00 05 03 07 00 00 40 00 00 00
54 02 16
2007-03-05 11:05 +0000fd90 2c 00 04 00 10 00 00 05 03 07 00 00 40 00 00 00
44 04 16
2007-03-05 13:01 +0000fd90 22 00 3b 00 11 00 00 05 03 07 00 00 40 00 00 00
34 59 17
These timestamps are the ones of the rom files; the actual boot time would be 30-60 seconds earlier.
The boot at 2007-03-05 10:17 was a cold boot.
The boot at 2007-03-05 11:00 was a cold boot.
The boot at 2007-03-05 13:01 was a *really* cold boot: I unplugged power, waited 10 seconds, and then replugged and started the machine.
Was the down time (from shutdown to power on) like a few seconds/minutes or longer? I try to distinguish between last *shutdown* time and last *boot* time.
For the boot 2007-03-05 10:17, there is a 16 minute difference, if we interpret the numbers in the image as time in UTC, for 2007-03-05 10:48 a 4 minute difference, while for the others more like within one minute. This suggest that it could be correlated with last shutdown time.
A possible experiment to distinguish between shutdown and boot time could be to do dumps after a 10 minute shutdown and a 1 minute shutdown. If the interpreted time in the image differs by approximately 10 minutes in the first case, I believe we have shown it to be the shutdown time.
/ulf