WDTV Forum - WDTV Media Player

WDTV LIVE Groups => WDTV LIVE Homebrew / Custom Firmware => Topic started by: godissexy on January 28, 2010, 12:28:02 PM

Title: WDTV LIVE FW 1.01.17 Unpack-Pack-Flash success
Post by: godissexy on January 28, 2010, 12:28:02 PM
Hi there fellas !
I successfully unpacked, packed & flashed official 1.01.17 firmware using b33rm4t pibos instructions.
So, what i used:

patched cramfs-1.1
Code: [Select]
diff -urN cramfs-1.1.orig/cramfsck.c cramfs-1.1/cramfsck.c
--- cramfs-1.1.orig/cramfsck.c  2002-02-23 03:00:42.000000000 +0300
+++ cramfs-1.1/cramfsck.c       2010-01-28 09:11:16.000000000 +0300
@@ -65,7 +65,7 @@
 #define FSCK_LIBRARY     128   /* Shared library error */

 #define PAD_SIZE 512
-#define PAGE_CACHE_SIZE (4096)
+#define PAGE_CACHE_SIZE (4096 * 4)

 static const char *progname = "cramfsck";

@@ -85,7 +85,7 @@
 static unsigned long end_data = 0;     /* end of the data */

 /* Guarantee access to at least 8kB at a time */
-#define ROMBUFFER_BITS 13
+#define ROMBUFFER_BITS 14
 #define ROMBUFFERSIZE  (1 << ROMBUFFER_BITS)
 #define ROMBUFFERMASK  (ROMBUFFERSIZE-1)
 static char read_buffer[ROMBUFFERSIZE * 2];
diff -urN cramfs-1.1.orig/mkcramfs.c cramfs-1.1/mkcramfs.c
--- cramfs-1.1.orig/mkcramfs.c  2002-02-20 11:03:32.000000000 +0300
+++ cramfs-1.1/mkcramfs.c       2010-01-28 09:10:54.000000000 +0300
@@ -45,7 +45,7 @@
 #define PAD_SIZE 512

 /* The kernel assumes PAGE_CACHE_SIZE as block size. */
-#define PAGE_CACHE_SIZE (4096)
+#define PAGE_CACHE_SIZE (4096 * 4)

 /*
  * The longest filename component to allow for in the input directory tree.


Some handy script
Code: [Select]
#! /bin/sh
CRAMFS_TOOLS=/opt/wdtv/bin

do_unpack () {
rm -rf ./unpacked tmp.cramfs
dd if=wdtvlive.bin of=tmp.cramfs bs=32 skip=1
$CRAMFS_TOOLS/cramfsck -x unpacked tmp.cramfs
}

do_pack () {
rm wdtvlive.cramfs wdtvlive.md5 wdtvlive.new.bin
$CRAMFS_TOOLS/mkcramfs -v unpacked wdtvlive.cramfs
md5sum wdtvlive.cramfs | dd bs=32 count=1 > wdtvlive.md5
cat wdtvlive.md5 wdtvlive.cramfs > wdtvlive.new.bin
}

do_clean () {
rm -rf wdtvlive.cramfs wdtvlive.md5 wdtvlive.new.bin ./unpacked tmp.cramfs
}


case "$1" in
  pack)
        do_pack
        ;;
  unpack)
        do_unpack
        ;;
  clean)
        do_clean
        ;;
  *)
        echo "Usage: $0 [pack|unpack|clean]" >&2
        exit 3
        ;;
esac

:

So i flashed repacked wdtvlive.bin from flash drive, and it boot correctly.
Hope it helps.
Title: Re: WDTV LIVE FW 1.01.17 Unpack-Pack-Flash success
Post by: pibos on January 29, 2010, 01:06:02 AM
Congrats, but your source of info is a bit wrong.
check here for the author
http://wdtvforum.com/main/index.php?topic=2922.0 (http://wdtvforum.com/main/index.php?topic=2922.0)
Title: Re: WDTV LIVE FW 1.01.17 Unpack-Pack-Flash success
Post by: godissexy on January 29, 2010, 01:44:15 AM
Oh, sorry man !
I was very tired, when wrote this post.
Thanks for info, all works like champ  ;D
Congrats, but your source of info is a bit wrong.
check here for the author
http://wdtvforum.com/main/index.php?topic=2922.0 (http://wdtvforum.com/main/index.php?topic=2922.0)
Title: Re: WDTV LIVE FW 1.01.17 Unpack-Pack-Flash success
Post by: lilibabe on January 29, 2010, 03:59:26 AM
Good to know ! I didn't want to be the 1st to try this... Thank you !  ;)
Title: Re: WDTV LIVE FW 1.01.17 Unpack-Pack-Flash success
Post by: cgmark on January 29, 2010, 06:09:13 AM
Congrats.
Until we get a working jtag on the box I wouldn't advise others to start playing with the flash. Right now there is only two ways to recover without sending the box back to the manufacturer. Flash the chip on the board with external programmer, I will post a walk through on how to do that if anyone is interested. Remove the chip and flash it ( not advised unless you have a ton of experience with smd ) . Jtag , I'm still working on this one.
Title: Re: WDTV LIVE FW 1.01.17 Unpack-Pack-Flash success
Post by: godissexy on January 29, 2010, 06:21:26 AM
Probably it should be possible to implement some kind of recovery loader, as done in FlashMe for Nintendo DS.
I tried to access jtag using old nokia cable as adapter. Console output is messy and garbled, but there's kernel & booting messages. Maybe, wrong cable or baudrate.
Title: Re: WDTV LIVE FW 1.01.17 Unpack-Pack-Flash success
Post by: cgmark on January 29, 2010, 06:36:23 AM
Probably it should be possible to implement some kind of recovery loader, as done in FlashMe for Nintendo DS.
I tried to access jtag using old nokia cable as adapter. Console output is messy and garbled, but there's kernel & booting messages. Maybe, wrong cable or baudrate.

They are using NAND for the flash, same stuff in usb sticks, to store the flash. It has a boot block but you cannot alter it in any way or the box will not boot. The Sigma chip has a hardware key inside that it expects the boot loader to match, if not, no boot :(

The port CN4 is not a jtag. That is a serial debug port,  it works fine if you have the wiring and baud set correctly. It will not give you access to anything though as input is disabled until after the kernel boots.

Title: Re: WDTV LIVE FW 1.01.17 Unpack-Pack-Flash success
Post by: godissexy on January 29, 2010, 06:45:52 AM
Thanks for info, cgmark ! It will be cool to have some JTAG access & recovery howto  :)
Title: Re: WDTV LIVE FW 1.01.17 Unpack-Pack-Flash success
Post by: lilibabe on January 30, 2010, 04:27:23 AM
Just a question godissexy, does the file 'wdtvlive.fff' still must be put on the usb stick with the new wdtvlive.bin created ?
Title: Re: WDTV LIVE FW 1.01.17 Unpack-Pack-Flash success
Post by: rezmus on January 30, 2010, 04:55:58 AM
it;s kernel update, if u did it before by flashing original 1.01.17 u don't have to use it again.
Title: Re: WDTV LIVE FW 1.01.17 Unpack-Pack-Flash success
Post by: lilibabe on January 30, 2010, 05:09:40 AM
it;s kernel update, if u did it before by flashing original 1.01.17 u don't have to use it again.

Tnahk you ! Actually I have the very fisrt firmware installed, so I have to put all the files for the update ?
Title: Re: WDTV LIVE FW 1.01.17 Unpack-Pack-Flash success
Post by: rezmus on January 30, 2010, 05:12:49 AM
yep, if they update kernel with new fw u have to update it as well. it's needed once, then u can just flash modded .bin without kernel update.

anyway i strongly advice using ext3-boot style fw to load those .bin files as live is easier to brick then old wdtv and hard to recover.
Title: Re: WDTV LIVE FW 1.01.17 Unpack-Pack-Flash success
Post by: lilibabe on January 30, 2010, 05:16:05 AM
yep, if they update kernel with new fw u have to update it as well. it's needed once, then u can just flash modded .bin without kernel update.

anyway i strongly advice using ext3-boot style fw to load those .bin files as live is easier to brick then old wdtv and hard to recover.

Thank you rezmus, I will try not to brick a WDTV a second time !  ;)
Title: Re: WDTV LIVE FW 1.01.17 Unpack-Pack-Flash success
Post by: lilibabe on February 06, 2010, 08:57:51 AM
I tried to repack the .bin file using these instructions and these one (http://wdtvforum.com/main/index.php?topic=2922.msg22806#msg22806 (http://wdtvforum.com/main/index.php?topic=2922.msg22806#msg22806)) but it seems there's a problem ! The WDTV stops on the logo screen...

What's wrong ?!

I used the files provided by pibos (cramfsck/mkcramfs). Do these files are already modified according to the instructions above ?

On my usb stick, I put the files wdtvlive.bin, wdtvlive.ver (modified) and my Live is already version 1.01.17

Thank you for your help !

Edit : I think cramfsck is the good one but not mkcramfs (4096*4). So, I modified the file mkcramfs.c, then 'make -f GNUmakefile', but here is what I get :

gcc -W -Wall -O2 -g -I.   mkcramfs.c  -lz -o mkcramfs
mkcramfs.c:37:18: error: zlib.h: Aucun fichier ou dossier de ce type
mkcramfs.c: In function ‘parse_directory’:
mkcramfs.c:245: warning: passing argument 4 of ‘scandir’ from incompatible pointer type
/usr/include/dirent.h:252: note: expected ‘int (*)(const struct dirent **, const struct dirent **)’ but argument is of type ‘int (*)(const void *, const void *)’
mkcramfs.c:287: warning: pointer targets in assignment differ in signedness
mkcramfs.c: In function ‘write_superblock’:
mkcramfs.c:392: warning: implicit declaration of function ‘crc32’
mkcramfs.c:392: error: ‘Z_NULL’ undeclared (first use in this function)
mkcramfs.c:392: error: (Each undeclared identifier is reported only once
mkcramfs.c:392: error: for each function it appears in.)
mkcramfs.c:399: warning: pointer targets in passing argument 1 of ‘strncpy’ differ in signedness
/usr/include/bits/string3.h:119: note: expected ‘char * __restrict__’ but argument is of type ‘u8 *’
mkcramfs.c:401: warning: pointer targets in passing argument 1 of ‘strncpy’ differ in signedness
/usr/include/bits/string3.h:119: note: expected ‘char * __restrict__’ but argument is of type ‘u8 *’
mkcramfs.c: In function ‘write_directory_structure’:
mkcramfs.c:480: warning: pointer targets in passing argument 1 of ‘strlen’ differ in signedness
/usr/include/string.h:397: note: expected ‘const char *’ but argument is of type ‘unsigned char *’
mkcramfs.c: In function ‘do_compress’:
mkcramfs.c:598: warning: implicit declaration of function ‘compress2’
mkcramfs.c:598: error: ‘Z_BEST_COMPRESSION’ undeclared (first use in this function)
mkcramfs.c:599: error: ‘Z_OK’ undeclared (first use in this function)
mkcramfs.c:600: warning: implicit declaration of function ‘zError’
mkcramfs.c: In function ‘write_data’:
mkcramfs.c:647: warning: pointer targets in passing argument 3 of ‘do_compress’ differ in signedness
mkcramfs.c:578: note: expected ‘const char *’ but argument is of type ‘unsigned char *’
mkcramfs.c: In function ‘main’:
mkcramfs.c:824: error: ‘Z_NULL’ undeclared (first use in this function)
make: *** [mkcramfs] Erreur 1


Please help me, I really I don't know anything about linux !  :-\
Title: Re: WDTV LIVE FW 1.01.17 Unpack-Pack-Flash success
Post by: thumper42 on February 07, 2010, 07:15:05 PM
hey, lilibabe.

Did you see this post:  http://wdtvforum.com/main/index.php?topic=3594.0 (http://wdtvforum.com/main/index.php?topic=3594.0)

Its possible your problem is related to the signature and not with compiling cramfs, i also had several warnings when i compiled, but the compiled files are good.

I used thecramfs source from pibos post:
 http://wdtvforum.com/main/index.php?topic=2922.msg22806#msg22806 (http://wdtvforum.com/main/index.php?topic=2922.msg22806#msg22806)

I edited mkcramfs.c following b33rm4t post:
 http://wdtvforum.com/main/index.php?topic=2922.msg27200#msg27200 (http://wdtvforum.com/main/index.php?topic=2922.msg27200#msg27200)


I repacked using info from the same post by b33rm4t, with one big exception!

The original firmware has the signature added before the md5sum is calculated and added!!


I don't understand the signature well enough to sign modified firmware. So i tested by simply unpacking and repacking the original firmware and copying the original firmware signature to the newly packed firmware before calculating and adding the new md5sum.

Using what b33rm4t posted and changing to account for signature, i repacked using...
Code: [Select]
mkcramfs rootfs wdtvlive.cramfs
tail --bytes=16 >> wdtvlive.cramfs
md5sum wdtvlive.cramfs | dd bs=32 count=1 > wdtvlive.md5
cat wdtvlive.md5 wdtvlive.cramfs > wdtvlive.bin.new


I tested this method with version 1.01.00, 1.01.11 and 1.01.17, And my repacked firmware was identical to the original firmware, md5sum and all!

I don't know if the signature is actually vital or if it's even related to your problem! But the original firmware is signed and if you account for the signature the instructions on repacking are accurate.





Title: Re: WDTV LIVE FW 1.01.17 Unpack-Pack-Flash success
Post by: thumper42 on February 07, 2010, 07:23:57 PM

 Correction! ???

 The repacking instructions....
Code: [Select]
mkcramfs rootfs wdtvlive.cramfs
tail --bytes=16 wdtvlive.bin >> wdtvlive.cramfs
md5sum wdtvlive.cramfs | dd bs=32 count=1 > wdtvlive.md5
cat wdtvlive.md5 wdtvlive.cramfs > wdtvlive.bin.new

Never claimed to be the brightest crayon in the box! :)

Title: Re: WDTV LIVE FW 1.01.17 Unpack-Pack-Flash success
Post by: lilibabe on February 07, 2010, 10:39:56 PM
Thank you thumper42, but finally godissexy send me the files I wanted, no it works !
Title: Re: WDTV LIVE FW 1.01.17 Unpack-Pack-Flash success
Post by: pibos on February 08, 2010, 01:06:46 AM
I have already documented wetv live fw structure completly here (http://wdtvforum.com/main/index.php?topic=3594.0 (http://wdtvforum.com/main/index.php?topic=3594.0))
You can find details about the 16 bytes ending header there
Title: WDTV LIVE Brik
Post by: funi on June 20, 2014, 12:55:35 AM
Hello I would like to ask if there is any news about unbrik the WDTV live model as the serial port and cable ttl can not log in Yamon by pressing the 0 key at startup the consol gives me this message:

"39idxfsef2f712148b75194ab1d3c691b55bd4d3a5e956dS                                               

#xos2P4a-99 (sfla 128kbytes. subid 0xac/ac) [serial#52aa8ed10bc92da5e9e7de3cdeea                                                                               
bc9b]     
#stepxmb 0xac             
#DRAM setup (method=0x10015858) ...                                   
#DRAM0 Window  :    0x#24#26#24#26# (18)                                       
#DRAM1 Window  :    0x#2a#2c#26#28# (19)                                       
#DRAM0 Settings: WD=0x0b0b0b0b RG=0x08090809 RR=0x08090809 RF=0x090a090a                                                                       
#DRAM1 Settings: WD=0x0b0b0b0b RG=0x0a0a0909 RR=0x0a0a0909 RF=0x0a0a0a0a                                                                       
#poisoned 131072 pages with 0x8f155ca6                                     
#step6 @0*** zxenv has been customized compared to build ***                                                           
--- review xmasboot/configs/922-A2.config for details [xmbb7-ezboot98-nand_st2]                                                                               
---   
xloadsize=59444               
xload rc=6         
subrom SHA-256: 43b5383fcd2ecd1f5366bea4eafc03bd740dc0a113af58d02846c117fb581b5b                                                                               

ezboot98 @0xd00e5a94 (nand_st2) (actual cpu=@499MHz/dsp=333MHz/sys=333MHz)                                                                         
 on 8655 rev ES5 (subid 0xac) a2=0x00000002 a3=0x00000003                                                         
step12     
#step22       
ruamm0 [0x80000000,0x8f2f0000[ (~254738432 bytes)                                                 
ruamm1 [0xcca00000,0xcfd60000[ (~53870592 bytes)                                               
[0xcfd20000,xos_public_ga=0xcfd20000[ and [0xcfd40000,0xcfd5ffff[ are lost for                                                                             
lignment)         
channel#ei         
x_ga=0xcfd1fcd4               
[0x8e800000,ios_ga=0x8e800000[ and [0x8eeacfc1,0x8f2f0000[ are lost for alignmen                                                                               
t) 
GW32 0x0006f008 0xc0000000 [va=0x84000000]                                         
GW32 0x0006f00c 0xc4000000 [va=0x88000000]                                         
GW32 0x0006f010 0xc8000000 [va=0x8c000000]                                         
step33     
xos2k client version=19, server version=19                                         
xos2 SHA-1 = ef2f712148b75194ab1d3c691b55bd4d3a5e956d (version 0x4a)                                                                   
xos2 serial = 52aa8ed10bc92da5e9e7de3cdeeabc9b                                             
Using zbootxenv ga=0xcfd0bcbc (va=0xbbd0bcbc)                                             

**************************************                                     
* SMP86xx zboot st               
* Version: 3.1.0               
* Started at 0xd00ed770.                       
* Configurations (chip revision: 1):                                   
*    Enabled checkpoints.                         
**************************************                                     
DRAM0 dunit_cfg/delay0_ctrl (0x3514001a/0x4565132b).                                                   
DRAM1 dunit_cfg/delay0_ctrl (0x3514001a/0x4565132b).                                                   
Using UART port 0 as console.                             
Board ID.: villa_d2                   
Setting up H/W from XENV block at 0xbbd0bcbc.                                             
  Setting <SYSCLK avclk_mux> to 0x17400000.                                           
  Setting <SYSCLK hostclk_mux> to 0x00000130.                                             
  Setting <IRQ rise edge trigger lo> to 0xff28ca00.                                                   
  Setting <IRQ fall edge trigge                             
  Setting <IRQ rise edge trigger hi> to 0x0c10009f.                                                   
  Setting <IRQ fall edge trigger hi> to 0x00000000.                                                   
  Setting <IRQ GPIO map> to 0x000a0800.                                       
  Setting <PB default timing> to 0x03080202.                                           
  Keeping <PB timing0> to 0x03080202.                                     
  Keeping <PB Use timing0> to 0x000003f3.                                         
  Keeping <PB CS Config> to 0x00330003.                                       
  Enabled Devices: 0x001b3efc                             
    PCIHost Ethernet Ethernet1 IR FIP I2CM I2CS USB PCIDev1 PCIDev2 PCIDev3 PCID                                                                               
ev4 SATA SCARD SCARD1                     
  PCI IRQ routing:                 
    IDSEL 1: INTA(#14) INTB(#14) INTC(#14) INTD(#14)                                                   
    IDSEL 2: INTA(#14) INTB(#14) INTC(#14) INTD(#14)                                                   
    IDSEL 3: INTA(#14) INTB(#14) INTC(#14) INTD(#14)                                                   
    IDSEL 4: INTA(#14) INTB(#14) INTC(#14) INTD(#14)                                                   
  Smartcard pin assignments:                           
    OFF pin = 2               
    5V pin = 0             
    CMD pin = 1               
  Smartcard1 pin assignments:                             
    OFF pin = 2               
    5V pin = 0             
    CMD pin = 1               
cd#0 disabled             
cd#1 disabled             
cd#2 want 96000000Hz: setting of 0x0000000021c00000-2^28                                                       
cd#2 cannot measure                   
cd#3 disabled             
cd#4 want 33333333Hz: setting of 0x0000000061333343-2^28                                                       
cd#4 measured to 33336kHz                         
cd#5 di     
cd#6 disabled             
cd#7 disabled             
cd#8 disabled             
cd#9 disabled             
cd#10 disabled             
cd#11 disabled             
  GPIO dir/data = 0x00000880/0x00000880                                       
  UART0 GPIO mode/dir/data = 0x6e/0x00/0x00                                           
  UART1 GPIO mode/dir/data = 0x6e/0x04/0x04                                           
  UART2 GPIO mode/dir/data = 0x00/0x00/0x00                                           
  Generate pulse(s) with GPIO7 .. 1,0(16us),1                                             
  MAC0: 00:90:a9:74:96:6a                         
  MAC1: 00:16:e8:e7:de:3c                         
XENV block processing completed.                               
Default boot index: 1, sel:1                           
xmboot booted from devtype: 0, chipsel: 0, phyblocknum: 0                                                         
Explicit boot order specified:                             
  0x00 : devty           
  0x01 : devtype=0, CS=1                       
  0x20 : devtype=2, CS=0                       
  0x21 : devtype=2, CS=1                       
WARNING: ezboot encroaches upon ruamm#0 zone                                           
ezboot buffers, setup in DRAM bank#0:                                     
  Alloting 1048576 bytes for heap.                                 
  Alloting 8388608 bytes for reading.                                     
  Alloting 8388608 bytes for decryption.                                       
xmat romfs goes to 0xcfc0bca0 (ga)                                 
xmat romfs goes to 0xb3c0bca0 (va)                                 
Trying devtype=0 chipsel=0                         
nand_probe 0x0xd00f6ed0                       
nand_Mg_open 0             
Reading NAND CS0, addr 0x016c0000, size 0x00000800 to 0xb3c0bca0               
Not a valid ROMFS
Trying devtype=0 chipsel=1
nand_probe 0x0xd00f6ed0
Failed to init!
Failed to find valid xmat romfs in any device / chip select!
freeing xmat romfs buffer at 0xcfc0bca0
xmat romfs process failed.
Trying devtype=0 chipsel=0
reading z.boot1 (vzx=0xbbd0bcbc) is 0x000c0000
Reading NAND CS0, addr 0x000c0000, size 0x00000800 to 0x01740000
Not a valid ROMFS
reading z.boot2 (vzx=0xbbd0bcbc) is 0x003c0000
Reading NAND CS0, addr 0x003c0000, size 0x00000800 to 0x01740000
Not a valid ROMFS
Skipping boot container 3.
Skipping boot container 4.
Skipping boot container 5.
Skipping boot container 6.
Skipping boot container 7.
Trying devtype=0 chipsel=1
nand_probe 0x0xd00f6ed0
Failed to init!
Trying devtype=2 chipsel=0


There is no other procedure?
Thank