數位天堂

我看到幾台便宜的數位相框這兩天已被人掃走，八成是我們站裡的人下的單，

若有何心得可別藏私，上來跟大家交流分享吧，不然就我一個人玩挺無聊的。

這樣就比較麻煩了. 保險的作法就是購買前實測, 檢查USB id.

有買用失敗的人可以來個負面表列嗎?
避免再踩地雷 

測試平台為PC LINUX系統(因assembleme無法於RT-N16中正常執行)



1.將數位相框連接PC USB傳輸線後,選擇USB Update

2.確認數位相框是否正確連接
lsusb
Bus 002 Device 002: ID 1403:0001 Sitronix Digital Photo Frame

3.下載破解程式及編譯程式
mkdir /opt/src
cd /opt/src
wget http://www.neophob.com/files/st2205tool-1.4.3.tar.gz
tar zxvf st2205tool-1.4.3.tar.gz
cd st2205tool
make
make install

4.執行破解程序
./hackfw.sh /dev/sdb
Making a working copy...
Looking for a known device profile...
hack/m_coby_dp151 ...
...nope.
hack/m_coby_dp151_v8 ...
...nope.
Sorry, I couldn't find a matching device profile. If you want to give
creating it yourself a shot, please read ./hack/newhack.txt for more
info.
(Btw: this can also mean your device already has a hacked firmware. If
you want to upgrade your device using this script, please flash back
the fwimage.bak the previous version saved first.)
以上資訊為無法找到合適之裝置,但仍然有機會可以破解成功

5.先備份原始韌體
cp fwimage.bin original-fwimage.bin

6.下載新裝置破解程式
wget http://elparaito.googlepages.com/newhack_sh.tar.gz
tar zxvf newhack_sh.tar.gz

7.將裝置目錄名稱更名,僅保留m_coby_dp151(因新裝置破解程式需參考dp151設定檔)
cd hack
for x in `ls -1d m_* | grep -v m_coby_dp151`; do mv $x xxx_$x; done

8.執行新裝置破解程式
./newhack.sh test /dev/sdb
..
Firmware dumped.
1+0 records in
1+0 records out
16384 bytes (16 kB) copied, 7.1198e-05 s, 230 MB/s
1+0 records in
1+0 records out
16384 bytes (16 kB) copied, 8.2598e-05 s, 198 MB/s
1+0 records in
1+0 records out
16384 bytes (16 kB) copied, 0.00417589 s, 3.9 MB/s
1+0 records in
1+0 records out
16384 bytes (16 kB) copied, 8.7e-05 s, 188 MB/s
CMP_VAR = 037a:037b 1
PATCH_AT = 34a3
EMPTY_AT = 3648 small:no
SEND_CSW = 336b
LENs = 036c, 036d, 036e, 036f
CTRTYPE = 0 ;PCF8833
Follow this instructions refered to m_test/spec:
- Fill out CONF_XRES, CONF_YRES with the horizontal and vertical resolution of
  your device.
  Leave CONF_PROTO at 0, which is the PCF8833-protocol.
- Regenerate the binaries using the 'assembleme'-script. You'll need to have
  crasm installed for this.
- Try the hackfw script. If the script finds your device profile and asks if
  you really want to flash the hacked firmware, !disconnect your device! and
  enter 'yes'.
- The hacked firmware now is in the 'fwimage.bin'-file. Please revise the
  patched areas around PATCH_AT and EMPTY_AT: a mistake here could in theory
  brick your device.
- If you're sure it'll work, you can try the hackfw.sh script for real.
- Rejoice if you see the 'It Works!' image
- If you see a garbled mess or if the image is offset, your OFFX, OFFY or
  CONF_BPP-settings are wrong. Go to the setpic-dir and run
./setpic /dev/sdX -test test.png
  and fiddle with the keys. As soon as your image is correct, you can copy
  the displayed settings to the spec-file.
- Zip up the m_yourmachine directory and mail it to
  me , if you like.
出現以上資訊,則代表找出破解之相關資訊

9.產生破解韌體
./assembleme
Assembling m_test...
Assembling  hack.asm into m_test/hack.bin...
Pass #1
Pass #2
Assembling  hack_jmp.asm into m_test/hack_jmp.bin...
Pass #1
Pass #2
Assembling  lookforme.asm into m_test/lookforme.bin...
Pass #1
Pass #2
m_test assembled.
All done.
出現以上資訊,則代表完成破解韌體

10.再次執行破解程序
cd ..
./hackfw.sh /dev/sdb
...
We have a match!
Requirements OK, we can try to hack the device. Proceed? (yes/no)
出現以上資訊,則代表找到合適之破解韌體,請輸入yes執行破解韌體更新

Patching fw...

Uploading fw
Firmware update! If unsure, press ctrl-C NOW!
Too late. Commencing firmware update...
..
Firmware upgraded. Un- and replug USB connection to restart device.


All done. To test, disconnect the device and when it has rebooted, connect
it again, go into 'update mode' and press enter. To quit, use ctrl-c.
請拔除USB線,再重新插入後,選USB Update,
數位相框會出現IT WORKS!

11.測試顯示圖片及移動控制
cd setpic
./setpic /dev/sdb -test test.png
libst2205: detected device, 128x128, 24 bpp.
Found device: 128x128, 24 bpp
With this mode, you can find some values for a new specfile.
u and d moves picture up and down
l and r moves picture left and right
t toggles bpp
i gives this info
q quits
pressed
Current settings: offx=4 offy=4 bpp=24

12.若要恢復原始韌體,請參考下列指令
cd ..
./phack -uf original-fwimage.bin /dev/sdb

13.output目錄內有lcd4linux.conf的範例檔,請記得確認磁碟路徑/dev/sdb及圖檔路徑是否與您的環境是否相符


備註:
並非所有USB ID: Vender: 1403 (Sitronix) Device: 0001  皆適用,所以還是要看運氣.

最後修改： ardayang (2011-07-30 23:55:51)

Aven 提到:

讚
ardayang兄前前後後應該繳了不少學費吧，最後成功這一台是在哪買的?

是繳了很多學費沒錯!!
都是在露天買的,但成功的這台,賣家不是很績極,過了多很天才收到物品,所以可以買到這台也算運氣.