|
|
Thread Tools | Search this Thread |
09-09-2010, 01:28 AM | #46 |
Connoisseur
Posts: 52
Karma: 216
Join Date: Apr 2010
Device: PRS-T1
|
How did you figure out the diagnostic MS card thing? Also, how did you get the cramfs images for the 600 and 900 in the first place? I'm really interested how this kind of high wizardry is done, and there isn't really much in the ways of "tutorials" as such... so maybe you'll throw a hint or two my way
|
09-09-2010, 02:56 PM | #47 | ||||
Member
Posts: 18
Karma: 10
Join Date: Sep 2010
Device: PRS900
|
Quote:
(I just tried the "About" page this time -- nothing...., except that it is *unauthorized* now -- which is better than when I started since it was locked up with someone else's authorization -- and resets didn't get rid of it. So, that's a new message I am seeing -- but it doesn't help.) Quote:
I didn't use "option" for most of these tests, because I understood the instructions to require booting diagnostics before doing that .... I'll try that before opening diagnostics. If it is something that simple .... Quote:
I'd rather be embarrassed than frustrated, really! It would be NICE to have done something wrong for once -- I'm used to doing it right and having wrong hardware. It took me over a week to make a hackintosh because my hardware was slightly incompatible.... lost a bit of money on that, because my mac died and I needed a replacement up pronto; but I eventually modified the hack to work ... that was big time frustrating! just rotten luck. Quote:
|
||||
Advert | |
|
09-09-2010, 04:14 PM | #48 | |
Member
Posts: 18
Karma: 10
Join Date: Sep 2010
Device: PRS900
|
oh well .. it was worth a shot... nothing happened. Quote:
It has a diag_card_update directory, and inside the directory is PRS-900\ Updater.package and a script called update.sh; The first time I simply copied those two items to the root directory of my SD card -- and left the autorun.xml where it was. That didn't do anything at all ... my sony was locked up (crashed) from attempting a factory init from diagnostics at the time. I didn't expect it to work -- but just wanted to try the default first. Then I followed the instructions to run create_900_Update.sh on the diag_card_update directory -- and it didn't work because of a bug. So, I debugged the shell script -- and found that my version of dd is specifically programmed not to read the /dev/stdin or /dev/stdout files -- a quirk. (Sort of like what ps -ax | grep xxx will do, some programmers idea of a joke... do it ps ax | grep xxx .... ) In any event, looking at the expanded trace of the shell it was clear that the dd command always received the stdin, stdout in order to pipe information into sed, awk, etc -- so since that is the default behavior of sed without if= or of= specified, I removed those extra parameters from the scripts -- and it worked correctly. The main issue there is that "update.sh" is intended to be customized, and has to be made executable (it isn't) before running the create_900_Update.sh -- to be retentive I re-unpacked the files in the original state, overwrote the corrected scripts and ran the create_900... on the diag_card_update directory. Then I copied it to the memory card again, inserted the card -- hard reset rebooted, and the Sony rebooted several times and then came up as it would normally. YAY! undead sony... I have a train to catch, so I'll have to keep the cramfs discussion short -- but essentially, under Linux there is an item called a loopback device (often it is a module, modprobe loop) which allows one to take a file and pretend it is a hard drive/flash drive/etc. In the flasher package we all downloaded, the .img file is an "image" of a partition to be copied onto the Sony. So one can simply do a mount -o loop xxx.img /foo_directory_to_mount and the cramfs image inside of it will become mounted on that directory. Then you can "cd" into the mount, look at all the files of the cramfs as if it were a normal hard drive, and tinker with them. In the flasher package, the image file is in the directory test-flash. --Cheers, and I'll be back at it in a few weeks. Now to use the reader for a long boring train ride, and dream of bug fixes and a mobile linux box.... Last edited by customelectronic; 09-09-2010 at 04:19 PM. |
|
09-09-2010, 05:01 PM | #49 | |
2B || !2B
Posts: 851
Karma: 194010
Join Date: Feb 2010
Location: Austria
Device: Sony PRS505/650/T1/tolino vision 5
|
Quote:
without using WINE or any other virtualiser, you haven't executed this line .\ebook_msc.exe um recovery taken from the 900 1.5a.zip flash_reader.bat And AFAIS this utility initalize the flashing. Last edited by Mark Nord; 09-09-2010 at 05:03 PM. |
|
09-09-2010, 07:50 PM | #50 | ||||||
Wizard
Posts: 3,442
Karma: 300001
Join Date: Sep 2006
Location: Belgium
Device: PRS-500/505/700, Kindle, Cybook Gen3, Words Gear
|
Quote:
Quote:
Quote:
Quote:
You could enter the serial bootloader of the chip if you know which pins to ground (as someone did with i.MXL), but that's not really doable without a service manual. Quote:
Quote:
FWIW, attached is the dmesg output for the 900. Last edited by igorsk; 09-09-2010 at 07:55 PM. |
||||||
Advert | |
|
09-09-2010, 10:40 PM | #51 |
Fanatic
Posts: 556
Karma: 1057213
Join Date: Sep 2006
Location: North Eastern U.S.
Device: Sony Reader
|
If you have a diagnostic card, you can install updates from it in normal mode. However, our current publicly described method of updating presumes that you are able to switch your reader into the recovery mode. The ebook_msc utility allows you to do just that. The utility itself doesn't do a whole lot, but it utilizes the functions from Sony's DLLs, which allow it to communicate with the reader. Those functions may be partially ported into Calibre, but the port may not be up-to-date with the current reader models. I would recommend that you use some Windows box to initiate the flashing of the reader. At least until you make a diagnostic card, which will allow you to execute updates from normal mode.
|
09-10-2010, 12:19 AM | #52 |
Connoisseur
Posts: 52
Karma: 216
Join Date: Apr 2010
Device: PRS-T1
|
First: I wrote something incorrect above. It's always been HOME and VOL+. Not OPTION. I apologise for the brain fart. Correct sequence is: start normally, go to home screen, insert SD card (which has "/Sony Reader/software/autorun.xml" on it) while holding HOME and VOL+.
I would suggest, before desoldering from the board, to just go over to someone's house/office with a windows machine and try a flash from there. I normally use linux on all my machines, but my laptop is capable of booting into some outdated version of XP for precisely these circumstances (or get a rescue CD with usb capabilities). Once you can convince yourself that flashing and arbitrary code execution is possible on your device, then you will not only be happier, but you can figure out how to recreate the situation under linux, which would be a big benefit to the linux-using PRS hackers like me (having to find and boot my laptop to flash my 600 is very tedious). Taking customelectric's observation that the 900's kernel sources have stuff related to subcpu in subcpu.h that the 600's kernel sources do not, I have found that SONY is already distributing the 650's sources, so it might be worth going hunting around inside those to see if I can find anything new. |
09-30-2010, 11:25 AM | #53 |
Member
Posts: 18
Karma: 10
Join Date: Sep 2010
Device: PRS900
|
progress on 900 hack; and a hint
Hi all,
I managed to miss my train home, so I am staying on vacation a little longer than expected I built the newest Slackware release on a virtual box here and reinstalled my tool base from home, so I'm online finally! A surprise hit; the Sony registered four memory devices sdb,c,d,e on this system, where it only registered one on my older Slackware 12.2 release; eg: the ebook memory directory, but not the Linux root directory, The intermediate sdc,sdd are "MS" and "SD" slots, sdb is the basic ebook user memory/data, and the last directory is labeled "Launcher". When I look in launcher, I see a "Mac" and "Windows" directory and this is pertinent: Code:
ls -R * ...snip... Mac/Setup Reader Library.app/Contents/Frameworks: tinyhttp.framework Mac/Setup Reader Library.app/Contents/Frameworks/tinyhttp.framework: Resources Versions tinyhttp Mac/Setup Reader Library.app/Contents/Frameworks/tinyhttp.framework/Versions: A Current Mac/Setup Reader Library.app/Contents/Frameworks/tinyhttp.framework/Versions/A: Resources tinyhttp Mac/Setup Reader Library.app/Contents/Frameworks/tinyhttp.framework/Versions/A/R sources: Info.plist Mac/Setup Reader Library.app/Contents/MacOS: Setup Reader Library Mac/Setup Reader Library.app/Contents/Resources: FskCore.xsb FskinLocalize.so eblSetup.so fsZip.so FskImage.so Setup Reader Library.icns eblSetup.xml kconfig.xml Fskin.so Setup Reader Library.rsrc eblSetupConfig.xml scripts Mac/Setup Reader Library.app/Contents/Resources/scripts: Apptitle_dialog.png assets.png background.jpg regions ReaderLogo_dialog.png assets.xml languages ... snip ... Bus 001 Device 002: ID 054c:031e Sony Corp. PRS-505 reader I didn't see this before, and don't have time to tinker around today -- but it looks like something might have updated after all; unless that PRS-505 is an artifact of my Slackware distro or something, all the flash hacks seem to have PRS505 stuff internally suggesting this directory is an update of some kind. hmmm..... |
09-30-2010, 11:43 AM | #54 |
Wizard
Posts: 3,442
Karma: 300001
Join Date: Sep 2006
Location: Belgium
Device: PRS-500/505/700, Kindle, Cybook Gen3, Words Gear
|
Launcher partition is just for the Reader Library installer (actually, a downloader for the real installer).
|
10-04-2010, 02:34 PM | #55 | |
Member
Posts: 18
Karma: 10
Join Date: Sep 2010
Device: PRS900
|
Quote:
I found Calilbre, and am looking at it now to see how it works. Setting up a windows emulator is a pain, so I will work on calibre for a couple of days. Historically, using porkupan's stuff... In the one package I downloaded, the ?msc? script was also in python -- and I looked through it. However, what I am hearing from the thread is that msc.exe does something not obvious. I'll have to re-download everything for I can't access what I did from my vacation spot, and look through it again too. One of the packages generated check-summed binaries for the Sony using Linux scripts, and I don't think it required msc to launch it. When I look at dmesg after plugging in my Sony, the only information I am given is about the usb memory emulation for each of the filesystems on the sony. That puzzles me -- for there does not appear to be an interface other than the filesystems. Are you suggesting that there is some kind of command sony issues to the control endpoint of the Sony/Linux USB driver through windows DLL's which causes it to enter a special mode? If so, what ought I look for in calibre to see how this works? Or does anyone have a USB packet dump of the transactions I can use to write my own Linux interface driver to probe it? Thanks for the help. |
|
10-04-2010, 03:57 PM | #56 |
Wizard
Posts: 3,442
Karma: 300001
Join Date: Sep 2006
Location: Belgium
Device: PRS-500/505/700, Kindle, Cybook Gen3, Words Gear
|
It's a standard trick - messages are sent to/from the device using a custom SCSI command. See modules/usb_gadget/file_storage.c in the Sony sources (SC_SONY_EXTENDED).
|
10-04-2010, 11:14 PM | #57 | |
Member
Posts: 18
Karma: 10
Join Date: Sep 2010
Device: PRS900
|
Quote:
The actual extended command appears to be associated with a 4K static buffer (usbtg_ebook5_gfile.h); and there seems to be both proc and device driver interfaces to that buffer; so I presume this is not writing to the root filesystem, but rather this communication buffer is opened by another process as if it were a file. eg: /proc/usbtg/foo_bar /dev/usbtg ... or at least ...device w/ major 126, minor 0 Since this is a character device on the Sony, but the SCSI is a block device ... I am not quite sure how to operate the interface; I'll see if I can code a SONY_EXTENDED command to read a 4K block and see what happens.... Side note: I don't see anything helpful (so far) in calibre with regard to this interface, did I miss something? ..But I did happen to notice earlier in the thread that someone was mentioning peculiarities/problems with subcpu and the USB charging interface for the Sony. In the source code for the ioctl()'s for usbtg there is the standard "powernego" file operation, but (surprise) also a "usbcharge" file operation. Also in the IOCTL there are USBTG_PD_SET_USBCHARGE and USBTG_GET_USBCHARGE, so perhaps that will help someone find the charging switch they were looking for? usbtg_ebook5.c: case USBTG_PD_SET_USBCHARGE: usbtg_ebook5.h:#define USBTG_PD_SET_USBCHARGE _IOW('u', 0x06, unsigned int) |
|
10-05-2010, 11:51 AM | #58 |
Wizard
Posts: 3,442
Karma: 300001
Join Date: Sep 2006
Location: Belgium
Device: PRS-500/505/700, Kindle, Cybook Gen3, Words Gear
|
Yes, Calibre does not use the SCSI commands because it can do everything it needs with normal file operations. The SCSI commands are only used for "system" stuff, such as registering Reader for Adobe ID and firmware update functionality.
|
10-05-2010, 05:06 PM | #59 | |
Member
Posts: 18
Karma: 10
Join Date: Sep 2010
Device: PRS900
|
Quote:
I am able to access the SC_SONY_EXTENDED command using Linux scsi generic interface, and verify that the code is functional on my Sony. But ... the usbotg driver gets the size of the SCSI extended transfer from the USB bulk in or out command; the size isn't part of the SCSI command itself. I imagine the buffer size (input and output) passed to the Linux SCSI generic interface might properly set the direction of the data flow under Linux; ? ; but otherwise, this might require some kernel hacking ... Looking at the DLL's in the flasher package: DriveManager.dll USBDLL.dll MSCEncComm.dll prsctr.dll Only prsctr links to dll's on the Sony, and it isn't linked to ebook_msc.exe; so it is pretty safe to assume that the dll's of the flasher package do all the work; Is the source code available for them in order to make a Linux flasher package? I can use wine to run the exe, but it doesn't appear to recognize the USB port under Linux. Last edited by customelectronic; 10-05-2010 at 05:40 PM. |
|
10-05-2010, 05:55 PM | #60 |
Wizard
Posts: 3,442
Karma: 300001
Join Date: Sep 2006
Location: Belgium
Device: PRS-500/505/700, Kindle, Cybook Gen3, Words Gear
|
|
Thread Tools | Search this Thread |
|
Similar Threads | ||||
Thread | Thread Starter | Forum | Replies | Last Post |
PRS-600 Touchscreen "soft" spot | fugue | Sony Reader | 6 | 01-16-2010 01:20 AM |
Netronix new 5", 8", 9,7", 6" touchscreen and WiFi E-Ink readers | Charbax | News | 4 | 06-08-2009 11:08 AM |
BUG: GUI View button not working if Author tag contains "ë" | ShellShock | Calibre | 1 | 11-15-2008 01:21 PM |
"BOOKS" button leads to an empty display after configured to the CF card? | genome2k | iRex | 12 | 09-24-2008 08:14 AM |
New "Portalinks" Eink device with touchscreen? | mrdini | News | 3 | 03-30-2008 01:26 PM |