For people interested in the technology behind the great sound - use the attached script on a .KUF file.

Read those:

http://documentation.renesas.com/doc/pr ... sh7705.pdf
http://documentation.renesas.com/doc/pr ... sh_3sm.pdf

The bootloader (KBTL) gets loaded by a smaller bootloader (which I call BOOT0) to address 0xCD00000 and executed there.

BOOT0 and KBTL are located in 512 KBytes of NOR-Flash, but only BOOT0 is XIP.
The application and objects are stored in a bigger NAND-Flash.

If you want debug messages, you need to solder a UART onto your mainboard. The correct part is a SC16C550. And of you need a level shifter (or just use a USB<->Serial adapter with 3.3V levels).

Have fun!

kufextract.py:

#!/usr/bin/python

import sys, struct


def LZ77readEncValue(data):
  result = 0
  rpos = 0
  
  while True:
    value = ord(data[rpos])
    rpos += 1;
    result <<= 7
    result |= value & 0x7F

    if not value & 0x80:
      break;    
  
  return (rpos, result)


def LZ77unpack(data):
  marker = data[0]
  dout = ""
  rpos = 1

  print "Marker Byte: 0x%02X" % (ord(marker))

  while rpos < len(data):
    if data[rpos] == marker:
      startpos = rpos
      rpos += 1
      (rcount, count) = LZ77readEncValue(data[rpos:])
      rpos += rcount
      
      if count == 0:
        dout+=marker
        continue

      (rcount, back) = LZ77readEncValue(data[rpos:])
      rpos += rcount

      assert back <= len(dout)
      
      startpos = len(dout) - back

      dout += dout[startpos:startpos+count]

    else:
      dout+=data[rpos]
      rpos += 1
      
  return dout


offsets = ((0x58, 0x78), (0x78, 0x98), (0x98, 0xB8), (0xB8, 0xD8), (0xD8, 0xF8))

for file in sys.argv[1:]:
  data = open(file, 'r').read()
  print file
  for offset in offsets:
    (fourcc, pc3k, major, minor, nullA, offset, nullB, nullC) =  struct.unpack('>4s4sLLLLLL', data[offset[0]:offset[1]])
    
    if pc3k == "PC3K":
      print "%s:%s V%i.%02i 0x%08X" % (pc3k, fourcc, major, minor, offset)
      
      blockfmt = '>4sLLLLLLLLLL'
      blocksz = struct.calcsize(blockfmt)
      (fourccX, nullA, sizeX, nullB, nullC, nullD, nullE, nullF, nullG, nullH, nullI) = struct.unpack(blockfmt, data[offset:offset+blocksz])
      
      print "     %s %i %i %i %i %i %i" % (fourccX, nullA, sizeX, nullB, nullC, nullD, nullE)
      print "     NewOffset: 0x%08X" % (offset + blocksz + sizeX)  

      offset += blocksz

      (fourccY, nullA, sizeY, nullB, nullC, nullD, nullE, nullF, nullG, nullH, nullI) = struct.unpack(blockfmt, data[offset:offset+blocksz])
           
      print "     %s %i %i %i %i %i %i" % (fourccY, nullA, sizeY, nullB, nullC, nullD, nullE)
      print "     NewOffset: 0x%08X" % (offset + blocksz + sizeY) 

      offset += blocksz 

      print "     Data: ", ' '.join(["%02X" % (ord(byte)) for byte in data[offset:offset+16]])

      f = open(file + "." + fourccX + "." + fourccY, 'w')
      f.write(data[offset:offset+sizeY])
      f.close()
      
      if fourccY == "LZ77":
        unpacked = LZ77unpack(data[offset:offset+sizeY])

        f = open(file + "." + fourccX, 'w')
        f.write(unpacked)
        f.close()