Easy As Pie - firmware rewrites 4 all!

Can you please explain how I can verify the patch word? I assume it is the offset to the mass storage routine? Do you click on "view posts since last visit" each time you login? If so you should have seen: forumer.com/viewtopic.php?p=48421#48421" target="_blank">http://camerahacks.10.forumer.com/viewtopic.php?p=48421#48421 The -*test*-('") has already been confirmed but you should also perform the same -*test*-('") to increase your own experience and understanding.

ok as yu may or may not know by now i have a m200 fw 23.84 m200 how would I do it with this?

You need to find: For mass storage: 1) The right monitor command for your FW (can be found in the OPS source) 2) The free block pointer 3) The location of the mass storage routine 4) The patchlocation: this is the location that is reached when delete is pressed but not confirmed. Best way to find it: demip the firmware, else you could compare dumps of your firmware and one that is already hacked For permanent unlock: 1) The right monitor command for your FW (can be found in the OPS source) 2) The free block pointer 3) The patchlocation in the firmware. Same story how to get it Most important hint: read all the postings of Brite-eye about this subject. Search for "free block pointer" and try to understand and replicate all the experiments so far. Be aware that it takes some time to understand all this. I personally understand the concept, but am still learning about this advanced hacking. Also be aware that there are some fundamental differences between the m200 and the m230, which my cause you some headaches... Peter

SUCCESS!!!! BRITE_EYE, YOU DID IT AGAIN!!!! FW53.05 UNLOCKED!!! My FW53.05 camera's are now permanently unlocked and I can activate mass storage on every PC!!!! Could not have done it without Brite_eye, he infact wrote the required code If somebody is willing to host, I can post the executables for FW53.05 Peter

SUCCESS!!!! BRIT_EYE, YOU DID IT AGAIN!!!! FW53.05 UNLOCKED!!! My FW53.05 camera's are now permanently unlocked and I can activate mass storage on every PC!!!! Could not have done it without Brit_eye, he infact wrote the required code If somebody is willing to host, I can post the executables for FW53.05 Peter I don't have web space, but id appreciate it if you could send it to me. thanks. di2356@gmail.com

I will host it also PM Good job as always guys.

My FW53.05 camera's are now permanently unlocked and I can activate mass storage on every PC!!!! ... If somebody is willing to host, I can post the executables for FW53.05 I assume that you still have an issue with Windows properly mounting the drive unless you fake it out. Are you using a partition table at end of bootsector that points back to the same bootsector (which goes away if you click on OPS format - right?). Peter - please take the time to add a detailed description of your implementation and place in the "How To" forum so that others can follow it on 53.12s and 53.18s. Note that a major difficulty is explaining only using offsets from PD's firmware - I assume the admins would delete a post containing pieces of actual firmware code.

Yeah. i tried his exes, and they my 53.05 still doesn't mount in windows.

I assume that you still have an issue with Windows properly mounting the drive unless you fake it out. Are you using a partition table at end of bootsector that points back to the same bootsector (which goes away if you click on OPS format - right?). Peter - please take the time to add a detailed description of your implementation and place in the "How To" forum so that others can follow it on 53.12s and 53.18s. Note that a major difficulty is explaining only using offsets from PD's firmware - I assume the admins would delete a post containing pieces of actual firmware code. Hi Brite, Yes, you are quite right! The partition table issue still exists. you need to apply another hack to be able to use mass storage, as fw 53.05 has no partition table and as such will not show up in Windows. You have two options: - Create a partition entry in the first sector of the physical disk that shows up in Windows when you press "Delete" without confirming. If you are familiar with hex-editors and know what you are doing, this is a more or less safe hack. You indeed make the partition table point to the same sector to be able to make this work without reformatting - Reformat the partition from Linux. Reports say that this has been -*test*-('")ed succesfully. However, if you accidentally make a mistake (change the clustersize, use FAT32 instead of FAT16), you probably will brick your camcorder. This should be considered the proper (but risky) way. I definately intent to make a walkthrough (I owe it to this forum I think) and would appreciate it if you would review it before I post it. I hope to have it ready in a few days. The big problem will be, as you say, how to publish it clear enough to reproduce it and vague enough to keep within legal limits. Also, I want to add a FW -*test*-('") in the code to prevent using the code on the wrong FW thus bricking your camera. Peter

To fix the "partition table issue" using a hex editor, here are the steps: 1) make a complete dump of all flash 2) Search for "NO_NAME" untils you find the sector starting with "E9" and where "NO_NAME" is followed by FAT16. This is the boot sector (at 0x260200 for FW 53.05) 3) Scroll back one sector and look at 0x2601be through 0x2601cd and print these bytes (starts with 0x80) 4) Now enable mass storage 5) Open the physical disk (look for the name "Zoran") in your diskeditor 6) Copy the bytes you printed to offset 0x1be of the boot sector with two modifications: at offset 0x1c0 change 02 in 01 and at offset 0x1c6 change 01 in 00 7) Write the changes 8 )Power the camera down and up again 9) When you enable mass storage it should now show up Note: make sure you are familiar with the disk- and hexeditor before trying this!!!!

ok all of this sounds too complicated for a noob like me

To fix the "partition table issue" using a hex editor, here are the steps: 1) make a complete dump of all flash 2) Search for "NO_NAME" untils you find the sector starting with "E9" and where "NO_NAME" is followed by FAT16. This is the boot sector (at 0x260200 for FW 53.05) 3) Scroll back one sector and look at 0x2601be through 0x2601cd and print these bytes (starts with 0x80) 4) Now enable mass storage 5) Open the physical disk (look for the name "Zoran") in your diskeditor 6) Copy the bytes you printed to offset 0x1be of the boot sector with two modifications: at offset 0x1c0 change 02 in 01 and at offset 0x1c6 change 01 in 00 7) Write the changes 8 )Power the camera down and up again 9) When you enable mass storage it should now show up Note: make sure you are familiar with the disk- and hexeditor before trying this!!!! how do you write the changes if you cant upload all flash using OPS? thanks. EDIT: Nevermind. Can anyone recommend a good disk editor?

I followed palbeda's process for adding a partition table to the NO_NAME boot sector on a 53.12 and issued "wl 801c9ca4 0xa" (53.12) using OPS send monitor feature. After hitting playback, it automatically mounts as a basic disk rather than a removable disk (which even without palbeda's process I thought was rather odd); however I can now easily access the videos without any difficulty. I wonder if there is a way to get all partitions to mount allowing the other updates which still require OPS (splash screens, USP.BIN parameters, sound effects ...). I used HxD to add palbeda's suggested partition table entry. http://www.mh-nexus.de/hxd/

ok all of this sounds too complicated for a noob like me Admitted, it is not a simple process. Maybe I can write a program to do it... And Brite_eye, thanks for verifying my instructions, good to know it also works with FW version 53.12! Some notes about this proces: - Hitting format flash reverses the process - Partition magic does not like this partition table, but it works!! - The description I posted expects that the mass storage hack has already been applied and that not acknowledging "Delete" triggers the mass storage mode. Peter

I think i understand. do i download the flash using OPS download "all accessible flash"? or some other method? maybe something with download memory? Copy the bytes you printed to offset 0x1be of the boot sector with two modifications: at offset 0x1c0 change 02 in 01 and at offset 0x1c6 change 01 in 00 what do you mean by 02 in 01? anyway, thanks. if you make a walkthrough, i look forward to it.

View Full Version: Easy As Pie - firmware rewrites 4 all!