r/ReverseEngineering • u/Early-Toe646 • 4d ago
[Release] First-Ever Open Source QEMU Machine Model & Hardware Definitions for Realtek RTD2841 Smart TV SoCs
https://github.com/rubenthampy890-del/qemu-rtd2841-11
u/Early-Toe646 4d ago
GitHub: https://github.com/rubenthampy890-del/qemu-rtd2841
Realtek RTD2841 (RTK284x) SoCs power millions of Smart TVs (TCL RT41 chassis, Xiaomi, Hisense), but upstream QEMU had zero support for this silicon family. Physical hardware permanently fuses JTAG, making firmware research, custom kernels, and security audits risky without physical board teardowns.
I've published the first bare-metal QEMU machine model (`-M rtd2841-tv030`):
- Quad-core ARM Cortex-A53 in AArch32 mode with PSCI SMC conduit
- Realtek TC0–TC7 27 MHz decrement timer engine & hardware watchdog
- GIC-400 interrupt distributor (256 lines mapped)
- 16550A UART0 console with 4-byte stride at 0x18062300
- Hardware SDHCI eMMC controller mapped at 0x18010800
- Bundled position-independent bare-metal validation payload passing live MMIO & timer tests
Repo includes complete QEMU patches, DTBs, and a one-command runner script.
14
u/igor_sk 4d ago
Hyperbole much?
Sure, maybe QEMU didn’t emulate some details of this SoC, but “zero support”, really? Did you write all of the A53 support from scratch?
-17
u/Early-Toe646 4d ago edited 4d ago
Fair callout — definitely didn’t write an A53 TCG emulator from scratch! QEMU already has Cortex-A53 core emulation. and by "zero support", I meant the SoC platform layer: vanilla QEMU had no machine model (`-M`), memory map, or peripheral definitions for the RTD2841 chassis. This project adds the board wiring, custom 27MHz TC0–TC7 timers, GIC SPI routing, and UART stride to make code bootable on it.
18
3
18
u/cp8h 4d ago
Lots of reverse engineering is a “first ever”. You really don’t need to highlight it as something special.
“First ever iPhone secure element dump” that would be worth hyping about but not this.