LCD screen for your dockstar (cheap! <$5)

> and I can't find anything in /tmp

Aha - couple of issues...

> #!/bin/sh -e

Your /etc/rc.local uses sh rather than bash. I must have changed mine at somepoint.

> /usr/bin/startx < /dev/null > /dev/null 2>&1 &
> /usr/bin/startx < /dev/null > /tmp/startx_output.txt 2>&1 &
> ...
> and I can't find anything in /tmp

You cant have startx in there twice.

Try the following for /etc/rc.local... (backup your old one)...

#!/bin/bash
rdate ptbtime1.ptb.de >/dev/null &
echo 2 > /proc/cpu/alignment
echo default-on > /sys/class/leds/dockstar\:orange\:health/trigger
echo none > /sys/class/leds/dockstar\:orange\:misc/trigger
mount -a
/usr/local/bin/camstart &
/usr/bin/startx < /dev/null > /tmp/startx_output.txt 2>&1 &
/root/lcd4linux-0.11.0-SVN/lcd4linux -f /root/lcd4linux-0.11.0-SVN/lcd4linux.conf
exit 0

If LCD4Linux doesn't start double check that the picframe device is still the /dev/sdX thats in lcd4linux.conf. It may change at bootup depending on whats plugged in.

Then post your /tmp/startx_output.txt and /var/log/Xorg.0.log

- PG



Edited 1 time(s). Last edit at 11/21/2010 07:16PM by petergunn.

petergunn, when i

/st2205tool/hack/m_my_new_hack#  hexdump fwimage-seg0.bin | head -10 i get

i get

0000000 ffff ffff ffff ffff ffff ffff ffff ffff
*
0001400 ffff ffff ffff ffff ffff ffff ffff 6108
0001410 2421 2421 2421 2421 2421 2421 4429 2421
0001420 2421 2421 2421 2421 2421 2421 2421 2421
0001430 2429 2429 2429 2429 2429 2429 2429 2429
0001440 2429 2429 2429 2429 2429 2429 2429 0421
0001450 a210 bef7 ffff ffff ffff ffff ffff ffff
0001460 ffff ffff ffff ffff ffff ffff ffff ffff
*

don't look the same..

oh, i uninstalled the deb'ed cc65 and downloaded then compiled the source, but its still doing the same problem..

it is the same device, doing the "./hackfw.sh /dev/sd(e for this one)" does give "baks r ok" on the screen.
i don't know, i always break something in CLI :(

That looks strange... try running strings on the first firmware segment.

This is what I get...

# strings -a -8 fwimage-seg0.bin | grep SITRONIX 
SITRONIX CORP.
SITRONIXMULTIMEDIA      0.09

-PG

nope, nothing there, i took "| grep SITRONIX" off just to see the section you aiming at and i get:

a!$!$!$!$!$!$)D!$!$!$!$!$!$!$!$!$)$)$)$)$)$)$)$)$)$)$)$)$)$)$)$!
JiJIJIJIJIJiJIJIJIJIJIJIJIJIJIJIJIJIJIJIJIJIJIJIJiJIJIJIB
T9L9T9T9T
3w+73w+7
JIB(B(JIB(JIB(B(B(B(B(B(B(B(B(B(B(B(B(B(B(B(B(JIB(B(B(JIB
B(J()$)e
)$)$)$)$)$)$)$)$!
)$)D)$)$)$)$)$)$!
)$)$)$)$)$)$)D!

i really think something is broked :\

Peter
I still get nothing in /tmp directory.

I did get the other log, and I think I did a "bad" thing, I attempted to post it here and I see it crashed the room. It was big log file. :)

Is there a part of the x.org.0. log that you want me to post, the whole thing is big! ;)

Peter you can start both monitor and 5 dollar LCD from your dockstar, could you post what you have in your file.

here is what I get when I startx on my own and then turn it off. don't know if it gives you any info.
root@debian:~# startx


X.Org X Server 1.7.7
Release Date: 2010-05-04
X Protocol Version 11, Revision 0
Build Operating System: Linux 2.6.32 armv5tel Debian
Current Operating System: Linux debian 2.6.35.7-dockstar #5 PREEMPT Mon Oct 18 12:22:45 CEST 2010 armv5tel
Kernel command line: console=ttyS0,115200 root=/dev/sdb1 rootdelay=10 rootfstype=ext2 mtdparts=orion_nand:1M(u-boot),4M(uImage),32M(rootfs),-(data)
Build Date: 10 October 2010 12:07:24PM
xorg-server 2:1.7.7-8 (Cyril Brulebois <kibi@debian.org>)
Current version of pixman: 0.16.4
Before reporting problems, check http://wiki.x.org
to make sure that you have the latest version.
Markers: (--) probed, (**) from config file, (==) default setting,
(++) from command line, (!!) notice, (II) informational,
(WW) warning, (EE) error, (NI) not implemented, (??) unknown.
(==) Log file: "/var/log/Xorg.0.log", Time: Mon Nov 22 03:59:35 2010
(==) Using config file: "/etc/X11/xorg.conf"
(==) Using system config directory "/usr/share/X11/xorg.conf.d"
SELinux: Disabled on system, not enabling in X server
(EE) AIGLX error: dlopen of /usr/lib/dri/swrast_dri.so failed (/usr/lib/dri/swrast_dri.so: cannot open shared object file: No such file or directory)
(EE) GLX: could not load software renderer
Error: must specify one of: -solid, -mod, -gradient

^C
waiting for X server to shut down XIO: fatal IO error 104 (Connection reset by peer) on X server ":0.0"
after 6804 requests (6795 known processed) with 0 events remaining.


xinit: unexpected signal 2.

..............................................................................

I'm afraid to post too much now after crashing this room, sorry everybody, I'm not doing it on purpose. ok?

It seems that my webhost (Dreamhost) has implemented some sort of malware pattern matching that's choking on some of the pastes here. I've had to delete the offending posts just to get this tread back on the air.

Until I can get things fixed , please 'preview' your post before submitting it. If it previews okay, you should be safe to post it.

For dumps of more than 10-20 lines, please consider using something like pastebin.com out of courtesy for the other forum readers.

-- Jeff

Jeff
I can't remember if it crashed in preview or not, I think it is just linux code that is crashing it, right?

I see others put stuff in the boxes , cut and paste stuff, are they using "pastebin.com" program or something else.

I'm sorry everybody for crashing this room, I was trying to get feedback on why my program wouldn't start on start up and pasted some of the code from x.org. log into my post.

Can you guys tell me what program you use for entering code that would not crash Jeff's site.
I am looking into "pastebin.com" , right now, and looked at their wiki. Is that what you guys are using?

The post before your post, Jeff , is what crashed the room too, did you take out something from post to make it not crash?
I had posted 2x's the one before my last, was much larger with xorg.log and now I realize not to post too much , and I thought that post above your last would have been ok, but I guess not.



Edited 1 time(s). Last edit at 11/22/2010 06:08AM by rgtaa.

Maxii, post the output from...

ls -al /dev/disk/by-id/

-PG

If I want to buy one now, what key words should I use to have a better chance of getting a "hackable" one?

funtoy1001 Wrote:
-------------------------------------------------------
> If I want to buy one now, what key words should I
> use to have a better chance of getting a
> "hackable" one?

Try to find ones that look like the ones on the Picframe list

Ask seller or look in buyer comments to see if it comes with a software CD (you want one that does). The new ones act like a CDROM so they work with netbooks - they are not currently hackable.

Look for devices that are priced as old stock.

Do a Internet search and see if anyone mentions if it has a USB ID like "1403:0001".

Post info here if you find a new one that is hackable.

-PG

Peter still no luck with start up stuff yet, I'm afraid to post linux script here, since I'm doing it wrong and crashing the system.
What program are you using to put your linux sutff inside the boxes. I'll try that.

You mentioned that my local.rc is using a different way to do stuff then the one you are using.

Could you share what you are using and I'll do apt-get to try that.

I'm not having success with startup stuff on another program either.

I have squeezeslave which is client for squeezeserver which I have on dockstar, but I can't get it either to do startup.

I did use linuxplug in the past and you could add program names in "daemon" and that would do startup of those programs. What are you using, because I'll copy what you are doing that works.

rgtaa, I'm not using anything special - my /etc/rc.local is a #!/bin/bash script which is different from #!/bin/sh which is really a link to dash rather than bash, but it probably doesn't matter.

If you want to attach a large amount of data either use pastebin.com and use a link in your post or tar/gzip it as a file and attach it to you post.

If you are not seeing any /tmp/startx_output.txt file in /tmp then the startx command is not being run from /etc /rc.local and you probably have a general issue (wrong file name, not executable, typo or bad char somewhere).

This is diverging a bit from the original topic of hacking Photo Frames. Might be a good time to create a new topic or investigate the 'correct' way to start things after boot (/etc/inet.d scripts).

-PG

petergunn Wrote:
-------------------------------------------------------
> Maxii, post the output from...
>
> ls -al /dev/disk/by-id/
>
> -PG


heres the output:

http://pastebin.com/Jbb9CLGh

You have a *lot* of devices plugged in :-) but the picframe is definitely /dev/sde

Is the picframe plugged directly into the dockstar or into a USB hub?

I'm thinking the firmware dump might actually be data from another device.

-PG

it is on another device (this laptop, not external hub, probably internal at most) thought it be easier to get it running on this 1st to test it out (and see what else i could hack it for, eg: my server)

i wouldn't of thought a different system would change results for it..

Peter
I made the mistake of not removing all the old stuff from the file I edited.

Once I just put what you gave me, it worked PERFECT.

Thanks a lot for your help.

It's gonna be cool playing with the stuff you create on the little screen.

Not sure if ROOT access would be possible , but it would be cool to log into debian from the tinny screen. :)

Maxii, seem like a logical approach. I don't really have any ideas why you fwimage.bin looks strange.

Can you try dumping it again?

cd st2205tool
./phack -df fwimage.bin /dev/sde
strings -a -8 fwimage.bin

-PG

petergunn Wrote:
-------------------------------------------------------
> Maxii, seem like a logical approach. I don't
> really have any ideas why you fwimage.bin looks
> strange.
>
> Can you try dumping it again?
>
> cd st2205tool
> ./phack -df fwimage.bin /dev/sde
> strings -a -8 fwimage.bin
>
>
> -PG

still jumbled mess of raw data/ascii/code :/
http://pastebin.com/7N0vWSta

i was thinking, i'll try this from scratch, see if it does any different, or on another system..

Maxi, I suspect it may not work. I stumbled a post with an attachment that has a similar bad firmware dump to yours.

You might recognize this pattern:

# strings -a -8 attachment/modified-phack-firmware-dump/fwimage.bin | head -59 | tail -18
8 0((0 8
@ 8(00(8 @
H @(8008(@ H
P H(@0880@(H P
X P(H0@88@0H(P X
` X(P0H8@@8H0P(X `
h `(X0P8H@@H8P0X(` h
p h(`0X8P@HH@P8X0`(h p
x p(h0`8X@PHHP@X8`0h(p x
 x(p0h8`@XHPPHX@`8h0p(x 
(x0p8h@`HXPPXH`@h8p0x(
0x8p@hH`PXXP`Hh@p8x0
8x@pHhP`XX`PhHp@x8 
@xHpPhX``XhPpHx@(
HxPpXh``hXpPxH0
PxXp`hh`pXxP8
Xx`phhp`xX@
`xhpphx`H

Looking at the phack code I see:

    } else if (mode==M_FDMP) {
        //Use a trick to get the 64K of firmware: if we request the data starting
        //at (2M-64K), the data gets read from a mirror of the flash, position 0.

This suggests than that your device has a different memory layout - it may have less or more ram than the original Sitronix design. If this is the case phack is probably just dumping the 64k of memory at the 2Mb-64k address rather than the firmware mirror.

You can probably dump the entire 2Mb contents which likely includes the firmware with cat /dev/sde > dump.bin then use strings command to check, but unless you want to find the address of the real firmware mirror and re-code phack so it can be reflashed I think you may be are out of luck. :-(

-PG

may pick this one up.
http://cgi.ebay.com/Coby-Digital-Photo-Viewer-ClipHanger-/260696689398?pt=LH_DefaultDomain_0&hash=item3cb2bbcaf6

Looks identical to the ones I bought. Can't tell if its hackable just from the picture though.

You might want to ask the seller if it the back of the package says "ACCESSORIES INCLUDED: CD With File Transfer Software for Windows and Macintosh". If it does there is a good chance its hackable.

-PG

ah, i see, so i got one of them cheap clones..

so, how do i tell it to dump the whole flash? or do i need to mod the make.c file for it? (then make'n'install it)
and there will be no issue for the program to read though the whole image/bin/data?

oh, hey, thanks for the help too! and putting up with me

try:

cat /dev/sde > whole-memory.bin
strings -a -8 whole-memory.bin | grep SITRONIX

-PG

root@ubuntu:/home/digit/st2205tool# strings -a -8 whole-memory.bin | grep SITRONIX
SITRONIX CORP.
SITRONIXMULTIMEDIA      0.09
SITRONIX CORP.
     ...
rSITRONIX CORP.
SITRONIXMULTIMEDIA      0.09
rSITRONIX CORP.
SITRONIXMULTIMEDIA      0.09
root@ubuntu:/home/digit/st2205tool#

so the firmware is there, somewhere.. (poetic much?)

How big is whole-memory.bin? Also, what offsets are the 'SITRONIX CORP' message at?

ls -al whole-memory.bin
perl -e 'undef $/; $_=<>; $o=0; while(/SITRONIX CORP/) { $o+=length($`); printf "offset=$o (0x%04x)\n",$o; $o+=length($&); $_=$'\'' }' whole-memory.bin

-PG



Edited 1 time(s). Last edit at 11/23/2010 06:13AM by petergunn.

petergunn Wrote:
-------------------------------------------------------
> How big is whole-memory.bin? Also, what offsets
> are the 'SITRONIX CORP' message at?
>
> ls -al whole-memory.bin
> perl -e 'undef $/; $_=<>; $o=0; while(/SITRONIX
> CORP/) { $o+=length($`); printf "offset=$o
> (0x%04x)\n",$o; $o+=length($&); $_=$'\'' }'
> whole-memory.bin
>
> -PG

its about 2MB..
here you go,full info
http://pastebin.com/zcHZ8yde



Edited 1 time(s). Last edit at 11/23/2010 08:19AM by Maxi.

I just noticed that the 'correct' way to dump the memory is:

./phack -d whole-memory.bin
ls -al whole-memory.bin /dev/sde
perl -e 'undef $/; $_=<>; $o=0; while(/SITRONIX CORP/) { $o+=length($`); printf "offset=$o (0x%04x)\n",$o; $o+=length($&); $_=$'\'' }' whole-memory.bin

I only get one match when I do this.

# ls -al whole-memory.bin 
-rw-r--r-- 1 root root 2031616 Nov 23 20:21 whole-memory.bin
# perl -e 'undef $/; $_=<>; $o=0; while(/SITRONIX CORP/) { $o+=length($`); printf "offset=$o (0x%04x)\n",$o; $o+=length($&); $_=$'\'' }' whole-memory.bin
offset=995426 (0xf3062)

-PG

I just hacked another Coby DP152. So far I haven't heard of one that can't be hacked.

If anyone buys one from a well known merchant (such as Adorama or Amazon) please post your results.

Most picframes need to be put into 'Update' mode before they can be used as a USB display. When they boot up you have to manually press a button when the menu asks which is less than ideal if your picframe wont hold a charge or you reboot after a power outage. However, the DP152 doesn't require this step so its a better candidate for hacking than some other frames.

-PG

Did a bit of research on the state of models that were still known to be completely hackable (before you posted your luck with a newer Coby version) and noticed that there was one model of keychain that had a completely plain front, usb port on the bottom of the keychain (though not quite as centered as the Coby) but has the wider part of the keyed plug front ways...

Meaning it can just be sat on the Mini USB plug on the dockstar without any need to mod the plug orientation or fix the screen rotation.

It's the Shift3 keychain. Example here: http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&item=400164549890

The Picframe wiki says it's now hackable with an updated file. One caveat is that the battery icon indicator will overlay but I figured it was a fair enough tradeoff for something that had a higher chance of working. (Nothing electrical tape can't fix) I'll let everyone know (with pics) how it turns out. They tend to show up on eBay for $10 new.

The AX20X picframes, though unhackable from libst2205's perspective, are visible in Linux through the gphoto2 camlib so it might be possible to hack a lcdproc client in your favorite shell script/programming language to drive gphoto2's CLI client and push the images out to the picframe.