Re: [Fwd: TOC hack and also a firmware hack idea]

Interesting.
When I have time I shall try and figure out how much
of the NVRAM has been accounted for.
I'm thinking of the way some apps are cracked easily
by finding a flag the programmers put in to make a
limited product demo with a simple recompile.
Flip the flag, unleash the functionality.

Way too optimistic really. If the DSP can be traced
it'll probably be reprogrammable until a protect fuse
is blown - unless the firmware is PROM not EEPROM to
cut costs on mass production.

I'm doing a degree in computing for realtime systems
and we've had it stressed to us many time that though
a few pence/cents/whatever seems like nothing, when
you intend to make a few 100,000 of the buggers it soon
makes a big difference.

Though, if they make their own silicon with the firmware on the
masks, it would make PROM/etc irrelevent, cracking the USB
comms would be the only way.

It's a shame I don't know much about windows programming.
I used to love reverse engineering on the Amiga, and I don't
mind assembly, but windows is an ugly piece of shit.
Revulsion alone will stop me looking into OpenMG!

Adam.


Pete Bentley wrote:
> Thanks to Matt Preston for forwarding this to me!
> 
> 
> 
>>-------- Original Message --------
>>Subject: TOC hack and also a firmware hack idea
>>Date: Sat, 17 May 2003 22:37:15 +0100
>>From: Adam <[email protected]>
>>
>>Firmware
>>~~~~~~~~
>>
>>Whilst doing some research I found that there is a flash ram chip,
>>refered to by Sony (service manual) as IC804 (AK6417AM-E2) that can be
>>programmed via the USB port when either this chip or the mainboard has
>>been replaced.
>>This requires a program called PatchWriter that some nice service
>>engineer may leak some day. Or not.
> 
> 
> I did spend a while playing phone tag with Sony, who eventually
> said that only authorised repair centres could get hold of
> PatchWriter.  I made a few enquiries with some service centres
> picked at random, but they were generally totally unaware of
> the software, and certainly unwilling to supply it to a mere
> end user.
> 
> 
>>The thing is, the mainboard is also for the N505 and i wonder if the
>>reason this is refered to as patch data is because it merely tells
>>software burnt into IC801 the configuration of the buttons, etc, rather
>>than being the actual firmware.
> 
> 
> The NVRAM just contains config data, user settings etc.  There's
> an interesting article on minidisc.org on hacking the NVRAM
> contents via service mode to "upgrade" an MZ505 to have some of
> the functions of a MZ707, for example.  There's probably other
> stuff that could be done too.
> 
> Also, if you read the description of how to use PatchWriter in
> one of the service manuals, it's pretty evident that it's just 
> storing config info.
> 
> The actual firmware is probably stored in the main system
> controller... If I recall right, it's built around an ARM core
> and those tend to have integrated ROM and RAM.
> 
> There is, however, a tantalising hint here:-
> http://md-l.amulation.com/archive/200303/frm00011.html
> 
> which suggests that the firmware can be replaced, and that
> with the correct firmware both ATRAC and PCM data can be
> transferred both ways over USB.
> 
> It may be that the firmware is upgradable via USB (using a 
> program like PatchWriter) or it may be a factory procedure
> when the units are being built, using contacts on the main
> board or something.
> 
> Pete.