OPS update needed An updated OPS is needed for newer cams (53.14 and EZ105) that respond to an F801 get coach version with:
A1 82 00 00 57 06 00 00 0D 35
The problem is that either the firmware or Zoran chip logic on these newer cams requires that USB_RECIP_DEVICE be used instead of USB_RECIP_INTERFACE on ControlMessageRead usb interactions. I have been able to retrieve my EZ105 challenge using bmRequestType "C0" but it fails when using C1. Both C0 and C1 work on my model 200. If I hadn't followed daBass' example when coding my short bcc55 routine I may never have found this needle.
Example:
CVS-*test*-('").exe 0xC0 0x06 0x9201 0x9203 0x0000 4096
http://www.digitalfluff.net/CVS/
Hopefully the semi-retired PD hacker BillW will be willing to release a new version soon. If not are there any other C coders that want to jump in and maintain OPS?
CamCam- 04-04-2007
Does it have an 05 challenge or is it still 03 or 04?
Anonymous- 04-05-2007
...
brite_eye- 04-05-2007
Still an 04. Don't dispair. If the semi-retired OPS guru can't manage a 1 bit OPS change, I will eventually supply info on how to hexedit the OPS executable. My main efforts now are again directed at firmware rewrites and hopefully that same retired guru can fix the buggy brickmaker.
BillW- 04-05-2007
I'm willing to update, but it will be delayed.
I accidentally killed my laptop power supply last weekend. I'm expecting the replacement in next week. An Ops update will follow shortly after I get my hands on it.
Nice work brite! Feel free to release your patch in the meantime if you like.
BTW, if anybody wants to jump in and maintain Ops, as brite suggests, let me know. The time I have for camera hacking isn't what it once was. The only qualifications are having the ability to compile it, and a demonstrated coder+hacker spirit.
enigma-- 04-05-2007
BillW, when you have added your patch, mind assisting me with applying it to the linux version.
BillW- 04-05-2007
Under the Windows version, you would go to the ControlMessageRead() function, and change USB_RECIP_INTERFACE to USB_RECIP_DEVICE. I imagine the change will probably be the exact same under the Linux version.
If you can't find it, just globally replace USB_RECIP_INTERFACE in all of the sources except USB.h.
brite_eye- 04-05-2007
Under the Windows version, you would go to the ControlMessageRead() function, and change USB_RECIP_INTERFACE to USB_RECIP_DEVICE. I imagine the change will probably be the exact same under the Linux version.
If you can't find it, just globally replace USB_RECIP_INTERFACE in all of the sources except USB.h.
Can you provide a windows executable offset? There were too many C1s for me to identify the right location. Actually a C1 might not exist since you or the usb bits together in ControlMessageRead. Even the usb.h define may be impossible to find in the ops...exe.
Anonymous- 04-05-2007
My main efforts now are again directed at firmware rewrites and hopefully that same retired guru can fix the buggy brickmaker.
I am awaiting the new re-release of brickmaker. I will have to try it on m230 I am out of 220
I need someone with a new camera version to -*test*-('") it. just boot into a livecd. anyone? brite_eye?
BillW- 04-05-2007
brite...
USB_ENDPOINT_IN | USB_TYPE_VENDOR | USB_RECIP_INTERFACE == 0xC1
...so you're looking for the right byte value, but it's a needle in a haystack right now. I tried searching for more unique values in nearby functions, but nothing popped up at me.
Time is a bit tight, and on top of wheezing and work, I am now on a roadtrip this weekend. You're on your own for now. ;)
brite_eye- 04-05-2007
I need someone with a new camera version to -*test*-('") it. just boot into a livecd. anyone? brite_eye?
Sorry not now - trying to get a firmware rewrite before the holiday weekend ends. I have had success demonstrating that while nandreadp and nandread both return the boot sector when requesting sector 0 only nandread returns the right sector (when calculating a sector number based on a complete image dump) further into the flash. 8)
SaturnNiGHTS- 04-06-2007
i'd gladly help if i had a camcorder to -*test*-('") it on.
TigerShark- 04-10-2007
If a new version is forthcoming, please consider making a version that uses the 20060827 snapshot. That version gets rid of the problem with "Safely Remove Devices".
Forumer™ is Voted #1 Free Forum Hosting provider
Build your own community today with the largest message board hosting company.