Author Topic: Archospma-430 Bootflash-signature Check' Removed!  (Read 12549 times)

sashz

  • Sr. Member
  • ****
  • Posts: 388
    • View Profile
    • http://
Archospma-430 Bootflash-signature Check' Removed!
« on: January 04, 2006, 04:31:03 pm »
If you like our work - please consider donating on http://www.pdaxrom.org

Here is the Archos PMA 400/430 flash hack which is avoid the bootloader checksum.

Unlike the Zaurus, the Archos bootloader checks the aimage.img for correct signature. Because it stops people for custom building aimage.img, i hacked flash bootloader for disable signature checkin.

Heres manual:

1) Download http://mail.pdaxrom.org/archos.ru/experime...ack-0.1.tar.bz2
2) Unpack it on PC
3) Check you bootrom to see if its compatible with the bootloader hack need the same flash images by following the next steps
4) Connect PMA to PC
5) From phys directory on the PC copy files phys_m.o, xxx1 to PMA
6) Disconnect PMA from PC
7) Run console on PMA
8) Go in directory where files, probably it will /media :
Code: [Select]
cd /media9) Load kernel module phys_m.o:
Code: [Select]
insmod ./phys_m.o10) Run xxx1 for get your flash rom:
Code: [Select]
./xxx111) Check md5sum for the flash image and cut some from flash  :
Code: [Select]
cd /tmp
dd if=bios.rom of=bios.rom.part bs=1 count=128000
md5sum bios.rom.part
The checksum must be
Code: [Select]
f67a0f5d320be1b0dc8bfa602ca6cdac  bios.rom.part12) If your md5sum is different, stop here - you cannot use this hack  gzip rom file and send it me
13) If md5sum OK, connect PMA to PC again
14) Copy file flash_m.o to PMA
15) Disconnect PMA
16) Run console on PMA and go to directory where file is placed
17) Load module:
Code: [Select]
insmod ./flash_m.o18) Ohh, there error! hehe , dont worry. It is ok - we just run flash patcher in kernel space and then come back.
19) Run dmesg:
Code: [Select]
dmesg20) There must be messages "Sector 0xD patched!" and "Sector 0xE patched!"
21) DONE!!! Now your PMA wil able run aimage.img with any signature

if you got message "Unknown flash chip!", that mean your device uses M29W400BB flash. Go to step 14 and use flash-m29_m.o file for hack your device

There russian version PMA-430 system, with custom aimage.img :
http://mail.pdaxrom.org/archos.ru/experime..._rus-050106.zip

If you like our work - please consider donating on http://www.pdaxrom.org
« Last Edit: January 04, 2006, 06:09:16 pm by sashz »

grond

  • Newbie
  • *
  • Posts: 4
    • View Profile
Archospma-430 Bootflash-signature Check' Removed!
« Reply #1 on: January 05, 2006, 05:16:01 am »
Quote
Here is the Archos PMA 400/430 flash hack which is avoid the bootloader checksum.

You are my hero!!! Thank you so much, I just followed your instructions and it works. I overwrote the signature with "Hello, Archos, seems like your bootloader isn't as secure as you said!" and my PMA still boots...  

I hope that those other bootroms can soon be hacked too...  

sashz

  • Sr. Member
  • ****
  • Posts: 388
    • View Profile
    • http://
Archospma-430 Bootflash-signature Check' Removed!
« Reply #2 on: January 05, 2006, 05:42:36 am »
Fast guide how build custom aimage)

in flash-hack archive ( http://mail.pdaxrom.org/archos.ru/experime...ack-0.1.tar.bz2 ) look aimage directory.
There 2 utils: extract and build.

extract will write cramfs image and kernel image from exists aimage.img:

Code: [Select]
./extract aimage.img
when it will finish you get 2 files: rootfs.bin and zImage

for unpack cramfs you must use cramfs stuff with XIP feature (sticky files is uncompressed), for example this: http://mail.pdaxrom.org/archos.ru/experime...-archos.tar.bz2

Code: [Select]
cramfsck -x root rootfs.bin
all files from archos system will in directory root.  Now you can hack it and add your own features in system:) for roll new cramfs image use mkcramfs utility:

Code: [Select]
mkcramfs root rootfs.bin
New rootfs.bin will created.

Quote
Note:
cramfs image must be ~21MB - need better understand aimage header

For build aimage.img use build utility. Copy aimage.hdr in directory where your zImage and rootfs.bin and run build:

Code: [Select]
./build
that will create new aimage.img
« Last Edit: January 05, 2006, 05:44:11 am by sashz »

sashz

  • Sr. Member
  • ****
  • Posts: 388
    • View Profile
    • http://
Archospma-430 Bootflash-signature Check' Removed!
« Reply #3 on: January 05, 2006, 05:47:39 am »
Quote
Quote
Here is the Archos PMA 400/430 flash hack which is avoid the bootloader checksum.

You are my hero!!! Thank you so much, I just followed your instructions and it works. I overwrote the signature with "Hello, Archos, seems like your bootloader isn't as secure as you said!" and my PMA still boots...  

I hope that those other bootroms can soon be hacked too...  
[div align=\"right\"][a href=\"index.php?act=findpost&pid=109618\"][{POST_SNAPBACK}][/a][/div]

hope there no another bootloaders  with different md5sum:)
« Last Edit: January 05, 2006, 05:48:11 am by sashz »

sashz

  • Sr. Member
  • ****
  • Posts: 388
    • View Profile
    • http://
Archospma-430 Bootflash-signature Check' Removed!
« Reply #4 on: January 06, 2006, 05:39:56 am »
latest flash-hack tools updated and uploaded

http://mail.pdaxrom.org/archos.ru/experime...ack-0.2.tar.bz2

now you can restore default bootloader for archos warranty

for SST39VF400A owners: rev-flash_m.o

for M29W400BB owners: rev-flash-m29_m.o

ZDevil

  • Hero Member
  • *****
  • Posts: 1998
    • View Profile
    • http://
Archospma-430 Bootflash-signature Check' Removed!
« Reply #5 on: January 06, 2006, 05:50:57 am »
That's awesome.... Perhaps if Sharp stops making Zaurii Archos is the way.

Life is too precious for hacking *too much*
Visit my Z screencap gallery[/color]
My EeePC 701 Black = Debian (Lenny) on IceRocks + Transcend SDHC Class6 8GB + 2GB RAM
My Zaurus SL-C3200 = Debian EABI (kernel 2.6.24.3-yonggun) on a swapped internal Sandisk Extreme III CF 16gb
My Debian EABI feed: http://matrixmen.free.fr/zaurus/debian/
My OpenBSD/Zaurus feeds:  Link1, Link2
[/i][/font][/color][/size]

bam

  • Hero Member
  • *****
  • Posts: 1213
    • View Profile
    • http://thegrinder.ws
Archospma-430 Bootflash-signature Check' Removed!
« Reply #6 on: January 06, 2006, 02:32:53 pm »
if sharp quits makeing the z I will buy at least 3 more 3100's for stock
SL-C3100 current: Stock/Tetsu 18h
Socket BT CF Card
Linksys WCF-12 802.11b/Cheapie USB Ethernet

The Grinder

sashz

  • Sr. Member
  • ****
  • Posts: 388
    • View Profile
    • http://
Archospma-430 Bootflash-signature Check' Removed!
« Reply #7 on: January 11, 2006, 10:20:54 am »

Jaffar

  • Newbie
  • *
  • Posts: 1
    • View Profile
    • http://
Archospma-430 Bootflash-signature Check' Removed!
« Reply #8 on: January 14, 2006, 05:12:50 pm »
Hi and thanks, works like a charm I can now read my favorite bulgarian web pages. BUT the cyrkeyboard does not work and you have to remove the cyrkeyboard input applet otherwise you get the safe mode until you disable it. Small bug for a great job though. Well done!

pyknite

  • Full Member
  • ***
  • Posts: 118
    • View Profile
    • http://pyknite.monserveurperso.com
Archospma-430 Bootflash-signature Check' Removed!
« Reply #9 on: January 14, 2006, 06:14:55 pm »
Quote
Hi and thanks, works like a charm I can now read my favorite bulgarian web pages. BUT the cyrkeyboard does not work and you have to remove the cyrkeyboard input applet otherwise you get the safe mode until you disable it. Small bug for a great job though. Well done!
[div align=\"right\"][a href=\"index.php?act=findpost&pid=110971\"][{POST_SNAPBACK}][/a][/div]


hum... archos is here
zaurus sl-c3000 - under pdaXrom1.0.1 for sl-c3000
Wifi +BT CF card
utopik Blog
Mirror for pdaXrom sl-c3000

sashz

  • Sr. Member
  • ****
  • Posts: 388
    • View Profile
    • http://
Archospma-430 Bootflash-signature Check' Removed!
« Reply #10 on: January 16, 2006, 01:16:57 am »
Quote
Hi and thanks, works like a charm I can now read my favorite bulgarian web pages. BUT the cyrkeyboard does not work and you have to remove the cyrkeyboard input applet otherwise you get the safe mode until you disable it. Small bug for a great job though. Well done!
[div align=\"right\"][{POST_SNAPBACK}][/a][/div]

that because settings for keyboard applet in russian backup
else i uploaded settings for keyboard there:

[a href=\"http://mail.pdaxrom.org/archos.ru/experimental/keymaps.zip]http://mail.pdaxrom.org/archos.ru/experimental/keymaps.zip[/url]

download and extract it on archos harddrive. There included danish  english  english-uk  german  macedonian  russian  slovak keymaps. Look /media/pda/Applications/cyrillica/russian for example and build bulgarian keymap (i know there different cyrillic chars location than on russian). I had it before when made it for zauruses, but probably lost.

chrissy

  • Newbie
  • *
  • Posts: 2
    • View Profile
Archospma-430 Bootflash-signature Check' Removed!
« Reply #11 on: May 10, 2006, 05:44:17 am »
Hi,
 I've just got an Archos PMA400 and am interested in playing around with it a little more than designed.  Unforunately the flash-hack and cramfs links on this page are leading to a 'page not found' area.  Don't suppose anyone has the latest versions of each of these available anywhere?....

  Cheers

    Chris

sashz

  • Sr. Member
  • ****
  • Posts: 388
    • View Profile
    • http://
Archospma-430 Bootflash-signature Check' Removed!
« Reply #12 on: May 10, 2006, 05:48:04 am »
Hi,
it moved to http://openpma.org/

My PMA400 brocken (fall 0.5 meter) and i stop any development for it.
« Last Edit: May 10, 2006, 05:49:47 am by sashz »

chrissy

  • Newbie
  • *
  • Posts: 2
    • View Profile
Archospma-430 Bootflash-signature Check' Removed!
« Reply #13 on: May 10, 2006, 06:02:56 am »
Hi,
 Thanks for the quick reply - unfortunately (unless I'm being very dense) it looks like everywhere on the net that has info related to this boot-flash (or in particular the extract and create bins) links to the same download page on mail.pdaxrom.org/archos.ru/experimental which is down....oh well.


Quote
Hi,
it moved to http://openpma.org/

My PMA400 brocken (fall 0.5 meter) and i stop any development for it.
[div align=\"right\"][a href=\"index.php?act=findpost&pid=126380\"][{POST_SNAPBACK}][/a][/div]

That's rough - no plans on replacing it?.  I've only had mine a few days but it is impressive (to a point, which is where I want to take it up!).  As a system admin, having a proper(ish) hand held wifi linux box is hopefully gonna be pretty useful.

Cheers anyway...