t-hack.com - Hack X300T / X301T - User contributions [en]

Firmware Aufbau Arcor

2008-12-30T15:58:44Z

Pcgeil:

Die Firmware ''Release_FW_1.7.12.zip'' ist wie folgt aufgebaut.

Nach dem entpacken hat man die Datei ''telecomstb-1.7.12-0001-PROD-Rel.tar.gz._SIGNED''.

Diese Datei hat eine 0x80 Signatur(128 Byte).
<pre>
dd if=telecomstb-1.7.12-0001-PROD-Rel.tar.gz._SIGNED bs=128 skip=1 | tar xzvf -
//bzw.
dd if=telecomstb-1.7.12-0001-PROD-Rel.tar.gz._SIGNED bs=128 skip=1 > newroot.tar.gz
</pre>
Nun hat man den Ordner newroot und das Linux Filesystem. Jedoch ist dies bei weitem noch nicht alles!

In dem Rootdir ist nun z.B. die Datei ''flash-image-1.7.12-0001-PROD-Rel.BIN.kr._SIGNED''. Nach der 0x80 Signatur befindet sich ein '''romfs'''.
<pre>
dd if=flash-image-1.7.12-0001-PROD-Rel.BIN.kr._SIGNED bs=256 skip=1 >flash-image-1.7.12-0001-PROD-Rel.BIN
mkdir mount
mount -o loop flash-image-1.7.12-0001-PROD-Rel.BIN mount/
</pre>

Die Datei ''zbimage-splash-xrpc_rossoalice_480_HDMI_OK_PROD'' ist direkt ein '''romfs'''.
<pre>
mount -o loop zbimage-splash-xrpc_rossoalice_480_HDMI_OK_PROD mount/
</pre>

Ebenso die Datei ''zbimage-yamon-PROD-Rel._SIGNED''.
<pre>
mount -o loop zbimage-yamon-PROD-Rel._SIGNED mount/
</pre>

Gefolgt von der Datei ''zbimage-yamon-recovery-PROD-Rel._SIGNED''.
<pre>
mount -o loop zbimage-yamon-recovery-PROD-Rel._SIGNED mount/
</pre>

Wenn man sich die ''flash-image-1.7.12-0001-PROD-Rel.BIN'' von der Größe her anschaut, muss sich in der noch mehr verbergen als das erste '''romfs'''.

Im Header des '''romfs''' steht die Größe, 0x14C1E0. Dies enspricht in etwa der enthaltenen Datei.

Bis zu 0x1FFF00, 2096896 Bytes steht entweder 0x00 oder 0xff. Anschließend folgt ein cramfs File.
<pre>
dd if=flash-image-1.7.12-0001-PROD-Rel.BIN bs=2096896 skip=1 > flash-image-1.7.12-0001-PROD-Rel.BIN.cramfs
mount -o loop flash-image-1.7.12-0001-PROD-Rel.BIN.cramfs mount/
</pre>
Dieses cramfs File enthält wiederum ein Linux Filesystem.

Firmware Aufbau Arcor

2008-12-30T15:57:57Z

Pcgeil: New page: Die Firmware ''Release_FW_1.7.12.zip'' ist wie folgt aufgebaut. Nach dem entpacken hat man die Datei ''telecomstb-1.7.12-0001-PROD-Rel.tar.gz._SIGNED''. Diese Datei hat eine 0x80 Signat...

Die Firmware ''Release_FW_1.7.12.zip'' ist wie folgt aufgebaut.

Nach dem entpacken hat man die Datei ''telecomstb-1.7.12-0001-PROD-Rel.tar.gz._SIGNED''.

Diese Datei hat eine 0x80 Signatur(128 Byte).
<pre>
dd if=telecomstb-1.7.12-0001-PROD-Rel.tar.gz._SIGNED bs=128 skip=1 | tar xzvf -
//bzw.
dd if=telecomstb-1.7.12-0001-PROD-Rel.tar.gz._SIGNED bs=128 skip=1 > newroot.tar.gz
</pre>
Nun hat man den Ordner newroot und das Linux Filesystem. Jedoch ist dies bei weitem noch nicht alles!

In dem Rootdir ist nun z.B. die Datei ''flash-image-1.7.12-0001-PROD-Rel.BIN.kr._SIGNED''. Nach der 0x80 Signatur befindet sich ein '''romfs'''.
<pre>
dd if=flash-image-1.7.12-0001-PROD-Rel.BIN.kr._SIGNED bs=256 skip=1 >flash-image-1.7.12-0001-PROD-Rel.BIN
mkdir mount
mount -o loop flash-image-1.7.12-0001-PROD-Rel.BIN mount/
</pre>

Die Datei ''zbimage-splash-xrpc_rossoalice_480_HDMI_OK_PROD'' ist direkt ein '''romfs'''.
<pre>
mount -o loop zbimage-splash-xrpc_rossoalice_480_HDMI_OK_PROD mount/
</pre>

Ebenso die Datei ''zbimage-yamon-PROD-Rel._SIGNED''.
<pre>
mount -o loop zbimage-yamon-PROD-Rel._SIGNED mount/
</pre>

Gefolgt von der Datei ''zbimage-yamon-recovery-PROD-Rel._SIGNED''.
<pre>
mount -o loop zbimage-yamon-recovery-PROD-Rel._SIGNED mount/
</pre>

Wenn man sich die ''flash-image-1.7.12-0001-PROD-Rel.BIN'' von der Größe her anschaut, muss sich in der noch mehr verbergen als das erste '''romfs'''.

Im Header des **romfs** steht die Größe, 0x14C1E0. Dies enspricht in etwa der enthaltenen Datei.

Bis zu 0x1FFF00, 2096896 Bytes steht entweder 0x00 oder 0xff. Anschließend folgt ein cramfs File.
<pre>
dd if=flash-image-1.7.12-0001-PROD-Rel.BIN bs=2096896 skip=1 > flash-image-1.7.12-0001-PROD-Rel.BIN.cramfs
mount -o loop flash-image-1.7.12-0001-PROD-Rel.BIN.cramfs mount/
</pre>
Dieses cramfs File enthält wiederum ein Linux Filesystem.

Main Page

2008-12-30T15:52:38Z

Pcgeil: /* Linux */

__NOTOC__

==Welcome to the wiki of t-hack.com==

T-hack.com has been founded at the 14. December 2007, to invent/improve the software on X300T/X301T and similar boxes, like DIT9719 / KISS KMM / BT Vision/ Bluewin TV-Box /V-BOX / VIP 1216.

'''You can only edit the wiki, if you registered an account before (Spam/Bot-protect)'''

'''You are able to upload files with following extension (max file size 100MB):
png, gif, jpg, jpeg, zip, rar, pdf, ace'''

Visit the [http://www.t-hack.com/forum t-hack-Board]

== Status quo (Dec 2008)==
<div style="margin:0;background-color:#ff0000;font-family:sans-serif;font-size:120%;font-weight:bold;border:1px solid;text-align:left;color:#000;padding-left:0.4em;padding-top:0.2em;padding-bottom:0.2em; width:10%;">[http://www.t-hack.com/forum/index.php?topic=252.0 How-To (English)]</div>

'''Linux'''
* You can boot linux, but the microcodes can't (yet) be loaded . So unfortunaly you won't have an Image and sound.

'''Windows CE'''
* Its possible to compile and run own native as well as .NET-based applications on the box. Also its possible to debug it with MSVC2005 & MSVC2008 (MSVC = Microsoft Visual Studio).

'''You can run any Code on the box''' but you need a Modchip or an external PC to patch the security-features. Soldering is required! Also you've to connect the internal HD to a PC for software-modifications once.

==Willkommen zum Wiki von t-hack.com==

Das t-hack.com - Projekt wurde am 14. Dezember 2007 ins Leben gerufen, um eine alternative Software für die Multimedia-Box X300T bzw. X301T und baugleiche Boxen zu entwickeln bzw. die originale zu verbessern ;)

'''Das Wiki ist zum Schutz vor Spambots nur von registrierten Usern nutzbar.'''

'''Es ist möglich folgende Dateitypen hochzuladen (max Dateigröße 100MB):
png, gif, jpg, jpeg, zip, rar, pdf, ace'''

Besuchen Sie auch das [http://www.t-hack.com/forum t-hack-Forum]

== Momentaner Status (Dez 2008)==

<div style="margin:0;background-color:#ff0000;font-family:sans-serif;font-size:120%;font-weight:bold;border:1px solid;text-align:left;color:#000;padding-left:0.4em;padding-top:0.2em;padding-bottom:0.2em; width:10%;">[http://www.t-hack.com/forum/index.php?topic=244.0 How-To (Deutsch)]</div>

'''Linux'''
* Linux kann auf der Box gebootet werden, da aber immer noch keine Microcodes geladen werden können, macht das wenig Sinn (Keine Ausgabe von Bild/Ton möglich).

'''Windows CE'''
* Es ist möglich eigene native Anwendungen als auch .net-basierende Anwendungen auf der Box auszuführen und mit MSVC2005 & MSVC2008 (MSVC = Microsoft Visual Studio) zu debuggen.

Konkret heisst das : <b>Beliebigen, eigenen Code auf der Box ausführen ist möglich!</b>

Erforderlich ist ein Modchip oder ein zusätzlicher Rechner (zum Patchen), <u>jegliche</u> Modifikation setzt das Löten an der Box und das zumindest einmalige Ausbauen der Festplatte voraus!

{| cellpadding="10"
| valign="top" width="30%"|

== Hardware ==
*[[Picture]]
*[[Schematic/Boardlayout]]
*[[hardware-versions]]
*[[SMP8634]]
*[[eJTAG|eJTAG on PCB]]
*[[eJTAG on SMP]]
*[[UART0|Serial Debug Port]]
*[[Display]]
*[[XRPC]]

==Linux==
* How Sigma's [[RUA]] Package works
*[[Toolchain]]
*[[Howto boot Linux]]
*[[Setup NFS-Root-Filesystem]]
*IPTV-fähiger Router mit [[fli4l]]
**[[Grundinformationen]]
**[[Wir legen los]]
**[[Konfiguration anpassen]]
**[[Wichtige Links]]
**[[ein Wort in eigener Sache]]
*[[some additional output regarding Linux]]
*[[Firmware Aufbau Arcor]]
| valign="top" width="30%"|

==Software==
*[[Boot Process]]
**[[Bootloader]]
***[[pictures inside bootloader]]
*[[Tools]]
**[[Dump X300T Bootloader]]
**[[Disable X300T Signature Check]]
**[[Upload YAMON]]
**[[NK.BIN_toolset]]
**[[MakeNK]]
**[[Download Update Files]]
**[[NK.BIN Patcher]]
**[[Debug Files for remote debugging]]
*[[Bootstrap-Message]]
*[[HDD-Layout]]
*[[Network-Bootstrap]]
*[[TV2ClientCE.exe]]
*[[BooterCE.exe]]
*[[TFTP]]
*[[ATmega88]]

==WinCE==
*[[Disable TrustModel]]

| valign="top" width="30%"|
==Links/Information==
*[[Bootlog??|Bootlog of Beta X300T]]
*[[x300tBeta|Flash dump of Beta X300T]]
*[[Workaround, damit mehrere Settopboxen im Netz sind und die Timeshift-Funktion erhalten bleibt]]
*[[PKG.DIR]]
==Pirelli STB HY100 (aka IP100)==
*[[UART0 output]]
*[[Pictures]]

Pictures inside bootloader

2008-12-28T12:19:58Z

Pcgeil:

The dump of the bootloader contains 4 different pictures.
They are packed with deflate and the following program is able to find the pictures and inflate them.

<pre>
python2.5 /Users/xxx/Desktop/zlib-decrypt.py
License: GPLv2
Author: pcgeil
search inside a file for zlib headers and extract them

Version: 0.1beta - 10-12-2008

Usage:
<argv1> source file
<argv2> dest file
[<argv3> offset dezimal]
[<argv4> end dezimal]

</pre>

The following output is with the bootloader v1051.
<pre>
python2.5 /Users/xxx/Desktop/zlib-decrypt.py /Users/xxx/Desktop/BOOTLOADER_20081128_204145_1 /Users/xxx/Desktop/test.txt 430000 440000

License: GPLv2
Author: pcgeil
search inside a file for zlib headers and extract them

Version: 0.1beta - 10-12-2008

Using:
Source: /Users/xxx/Desktop/BOOTLOADER_20081128_204145_1
Dest: /Users/xxx/Desktop/test.txt

Length is: 0x100000
0x69bac
Found at address: 0x69bac
0x6a05c
Found at address: 0x6a05c
0x6a3f4
Found at address: 0x6a3f4
0x6a6d4
Found at address: 0x6a6d4
0x6b6bf Now extract the files which are found
[+]Done writing to /Users/xxx/Desktop/test.txt-0
[+]Done writing to /Users/xxx/Desktop/test.txt-1
[+]Done writing to /Users/xxx/Desktop/test.txt-2
[+]Done writing to /Users/xxx/Desktop/test.txt-3
</pre>

Download Python-Script:
[http://www.t-hack.com/wiki/images/5/55/Zlib-decrypt_py.zip]

Bootloader V1039:

0x00067bac . 1192 --> 307396

0x0006805c . 909 --> 307400

0x000683f4 . 727 --> 307376

0x000686d4 .. 4064 --> 307826

Bootloader V1053:

0x0006bbac . 1192 --> 307396

0x0006c05c . 909 --> 307400

0x0006c3f4 . 727 --> 307376

0x0006c6d4 .. 4064 --> 307826

File:Atmega88-signature.png

2008-12-23T17:16:36Z

Pcgeil:

File:Atmega88-locks.png

2008-12-23T17:16:22Z

Pcgeil:

ATmega88

2008-12-23T17:16:12Z

Pcgeil:

The front display has an ATmega88 processor.

It is possible to dump the flash and eeprom very easy, because there is no lock set.
I used an AVR Dragon. I soldered some wires to J3 and connect them with my Dragon.

Here are the settings I used in AVR Studio.

[[Image:atmega88-fuses.png]]

[[Image:atmega88-locks.png]]

[[Image:atmega88-signature.png]]

File:Atmega88-fuses.png

2008-12-23T17:15:46Z

Pcgeil:

ATmega88

2008-12-23T17:14:16Z

Pcgeil: New page: The front display has an ATmega88 processor. It is possible to dump the flash and eeprom very easy, because there is no lock set. I used an AVR Dragon. I soldered some wires to J3 and con...

The front display has an ATmega88 processor.

It is possible to dump the flash and eeprom very easy, because there is no lock set.
I used an AVR Dragon. I soldered some wires to J3 and connect them with my Dragon.

Here are the settings I used in AVR Studio.
[[Image:atmega88-fuses.jpg]]
[[Image:atmega88-locks.jpg]]
[[Image:atmega88-signature.jpg]]

Main Page

2008-12-23T17:10:08Z

Pcgeil: /* Software */

__NOTOC__

==Welcome to the wiki of t-hack.com==

T-hack.com has been founded at the 14. December 2007, to invent/improve the software on X300T/X301T and similar boxes, like DIT9719 / KISS KMM / BT Vision/ Bluewin TV-Box /V-BOX / VIP 1216.

'''You can only edit the wiki, if you registered an account before (Spam/Bot-protect)'''

'''You are able to upload files with following extension (max file size 100MB):
png, gif, jpg, jpeg, zip, rar, pdf, ace'''

Visit the [http://www.t-hack.com/forum t-hack-Board]

== Status quo (Dec 2008)==
<div style="margin:0;background-color:#ff0000;font-family:sans-serif;font-size:120%;font-weight:bold;border:1px solid;text-align:left;color:#000;padding-left:0.4em;padding-top:0.2em;padding-bottom:0.2em; width:10%;">[http://www.t-hack.com/forum/index.php?topic=252.0 How-To (English)]</div>

'''Linux'''
* You can boot linux, but the microcodes can't (yet) be loaded . So unfortunaly you won't have an Image and sound.

'''Windows CE'''
* Its possible to compile and run own native as well as .NET-based applications on the box. Also its possible to debug it with MSVC2005 & MSVC2008 (MSVC = Microsoft Visual Studio).

'''You can run any Code on the box''' but you need a Modchip or an external PC to patch the security-features. Soldering is required! Also you've to connect the internal HD to a PC for software-modifications once.

==Willkommen zum Wiki von t-hack.com==

Das t-hack.com - Projekt wurde am 14. Dezember 2007 ins Leben gerufen, um eine alternative Software für die Multimedia-Box X300T bzw. X301T und baugleiche Boxen zu entwickeln bzw. die originale zu verbessern ;)

'''Das Wiki ist zum Schutz vor Spambots nur von registrierten Usern nutzbar.'''

'''Es ist möglich folgende Dateitypen hochzuladen (max Dateigröße 100MB):
png, gif, jpg, jpeg, zip, rar, pdf, ace'''

Besuchen Sie auch das [http://www.t-hack.com/forum t-hack-Forum]

== Momentaner Status (Dez 2008)==

<div style="margin:0;background-color:#ff0000;font-family:sans-serif;font-size:120%;font-weight:bold;border:1px solid;text-align:left;color:#000;padding-left:0.4em;padding-top:0.2em;padding-bottom:0.2em; width:10%;">[http://www.t-hack.com/forum/index.php?topic=244.0 How-To (Deutsch)]</div>

'''Linux'''
* Linux kann auf der Box gebootet werden, da aber immernoch keine Microcodes geladen werden können macht das wenig Sinn (Keine Ausgabe von Bild/Ton möglich).

'''Windows CE'''
* Es ist möglich eigene native Anwendungen als auch .net-basierende Anwendungen auf der Box auszuführen und mit MSVC2005 & MSVC2008 (MSVC = Microsoft Visual Studio)zu debuggen.

Konkret heisst das : <b>Beliebigen eigenen Code auf der Box ausführen !</b>

Es ist ein Modchip oder ein zusätzlicher Rechner (zum Patchen) erforderlich, <u>jegliche</u> Modifikationen setzen das Löten an der Box und das zumindest einmalige Ausbauen der Festplatte voraus !

{| cellpadding="10"
| valign="top" width="30%"|

== Hardware ==
*[[Picture]]
*[[Schematic/Boardlayout]]
*[[hardware-versions]]
*[[SMP8634]]
*[[eJTAG|eJTAG on PCB]]
*[[eJTAG on SMP]]
*[[UART0|Serial Debug Port]]
*[[Display]]
*[[XRPC]]

==Linux==
* How Sigma's [[RUA]] Package works
*[[Toolchain]]
*[[Howto boot Linux]]
*[[Setup NFS-Root-Filesystem]]
*IPTV-fähiger Router mit [[fli4l]]
**[[Grundinformationen]]
**[[Wir legen los]]
**[[Konfiguration anpassen]]
**[[Wichtige Links]]
**[[ein Wort in eigener Sache]]
*[[some additional output regarding Linux]]
| valign="top" width="30%"|

==Software==
*[[Boot Process]]
**[[Bootloader]]
***[[pictures inside bootloader]]
*[[Tools]]
**[[Dump X300T Bootloader]]
**[[Disable X300T Signature Check]]
**[[Upload YAMON]]
**[[NK.BIN_toolset]]
**[[MakeNK]]
**[[Download Update Files]]
**[[NK.BIN Patcher]]
**[[Debug Files for remote debugging]]
*[[Bootstrap-Message]]
*[[HDD-Layout]]
*[[Network-Bootstrap]]
*[[TV2ClientCE.exe]]
*[[BooterCE.exe]]
*[[TFTP]]
*[[ATmega88]]

==WinCE==
*[[Disable TrustModel]]

| valign="top" width="30%"|
==Links/Information==
*[[Bootlog??|Bootlog of Beta X300T]]
*[[x300tBeta|Flash dump of Beta X300T]]
*[[Workaround, damit mehrere Settopboxen im Netz sind und die Timeshift-Funktion erhalten bleibt]]
*[[PKG.DIR]]
==Pirelli STB HY100 (aka IP100)==
*[[UART0 output]]
*[[Pictures]]

Display

2008-12-14T10:57:17Z

Pcgeil:

==Display==
[[Image:Display.JPG|thumb|left]]

The Display contains an Atmega88 and one PT6302LQ-001

{| cellpadding="5" cellspacing="0" border="1"
! J3
! ATMEGA88 - Pin-Number
|-
| 1
| 16 (MISO/PB4/PCINT4)
|-
| 2
| 18 (VCC)
|-
| 3
| 17 (SCK/PB5/PCINT5)
|-
| 4
| 15 (MOSI/PB3/PCINT3/OC2A)
|-
| 5
| 29 (-RESET/PC6/PCINT14)
|-
| 6
| GND
|-
| 7
| 14 (-SS/PB2/PCINT2/OC1B))
|-
| 8
| GND
|-
| 9
| NC
|-
| 10
| NC
|-
| 11
| 31 (TxD/PD1/PCINT17)
|-
| 12
| 30 (RxD/PD0/PCINT16)
|}

{| cellpadding="5" cellspacing="0" border="1"
! J1
! ATMEGA88
|-
| 1
| GND (Pin 21 & 3)
|-
| 2
| 14 (PCINT2/SS/OC1B)
|-
| 3
| 17 (SCK/PCINT5)
|-
| 4
| 15 (PCINT3/OC2A/MOSI)
|-
| 5
| 16 (PCINT4/MISO)
|-
| 6
| MCU Reset over Transistor (Active high)
|-
| 7
| 26 (PC3/ADC3/PCINT11)
|-
| 8
| 2 (PD4/PCINT20/XCK/T0)
|-
| 9
| NU
|-
| 10
| 22 (ADC7)
|-
| 11
| GND (Pin 21 & 3)
|}

{| cellpadding="5" cellspacing="0" border="1"
! J?
! Power supply connector
|-
| 1
| Display VNEG -30V
|-
| 2
| GND
|-
| 3
| Display Heater
|-
| 4
| Display Heater
|-
| 5
| GND
|-
| 6
| Vcc (+5V)
|-
| 7
| NU
|-
| 8
| NC
|}

{| cellpadding="5" cellspacing="0" border="1"
! MCU
! ATMEGA88 pins
|-
| 1
| PD3 (PCINT19/OC2B/INT1) Reserved for IR-Sender?
|-
| 2
| PD4 (PCINT20/XCK/T0) to J1 (Pin 8)
|-
| 3
| GND
|-
| 4
| Vcc (+5V)
|-
| 5
| GND
|-
| 6
| Vcc (+5V)
|-
| 7
| PB6 (PCINT6/XTAL1/TOSC1) Display Clock
|-
| 8
| PB7 (PCINT7/XTAL2/TOSC2) Display Data
|-
| 9
| PD5 (PCINT32/OC0B/T1) Panel-button-matrix
|-
| 10
| PD6 (PCINT22/OC0A/AIN0) Panel-button-matrix
|-
| 11
| PD7 (PCINT23/AIN1) Panel-button-matrix
|-
| 12
| PB0 (PCINT0/CLKO/ICP1) Display ChipSelect
|-
| 13
| PB1 (PCINT1/OC1A) Panel-button-matrix
|-
| 14
| PB2 (PCINT2/-SS/OC1B) to J3 (Pin 7)
|-
| 15
| PB3 (PCINT3/OC2A/MOSI) to J3 (Pin 4)
|-
| 16
| PB4 (PCINT4/MISO) to J3 (Pin 1)
|-
| 17
| PB5 (SCK/PCINT5) to J3 (Pin 3)
|-
| 18
| AVcc (+5V)
|-
| 19
| ADC6 (Connected to ARef)
|-
| 20
| ARef (Connected with capacitor to GND)
|-
| 21
| GND
|-
| 22
| ADC7 (to J1 Pin 10)
|-
| 23
| PC0 (ADC0/PCINT8) Panel-button-matrix
|-
| 24
| PC1 (ADC1/PCINT9) Panel-button-matrix
|-
| 25
| PC2 (ADC2/PCINT10) Display reset
|-
| 26
| PC3 (ADC3/PCINT11) to J1 (Pin 7)
|-
| 27
| PC4 (ADC4/SDA/PCINT12) Powerbutton LED1 (HI to light)
|-
| 28
| PC5 (ADC5/SCL/PCINT13) Powerbutton LED2 (HI to light)
|-
| 29
| PC6 (-RESET/PCINT14) to J3 (Pin 5) + Over transistor to J1 (Pin 6)
|-
| 30
| PD0 (RxD/PCINT16) to J3 (Pin 12) + 10k pullup to Vcc
|-
| 31
| PD1 (TxD/PCINT17) to J3 (Pin 11) + 10k pullup to Vcc
|-
| 32
| PD2 (INT0/PCINT18) Infrared receiver
|}

Pictures inside bootloader

2008-12-10T21:00:56Z

Pcgeil:

Pictures inside bootloader

2008-12-10T21:00:27Z

Pcgeil:

The dump of the bootloader contains 4 different pictures.
They are packed with deflate and the following program is able to find the pictures and inflate them.

<pre>
python2.5 /Users/xxx/Desktop/zlib-decrypt.py
License: GPLv2
Author: pcgeil
search inside a file for zlib headers and extract them

Version: 0.1beta - 10-12-2008

Usage:
<argv1> source file
<argv2> dest file
[<argv3> offset dezimal]
[<argv4> end dezimal]

</pre>

The following output is with the bootloader v1051.
<pre>
python2.5 /Users/xxx/Desktop/zlib-decrypt.py /Users/xxx/Desktop/BOOTLOADER_20081128_204145_1 /Users/xxx/Desktop/test.txt 430000 440000

License: GPLv2
Author: pcgeil
search inside a file for zlib headers and extract them

Version: 0.1beta - 10-12-2008

Using:
Source: /Users/xxx/Desktop/BOOTLOADER_20081128_204145_1
Dest: /Users/xxx/Desktop/test.txt

Length is: 0x100000
0x69bac
Found at address: 0x69bac
0x6a05c
Found at address: 0x6a05c
0x6a3f4
Found at address: 0x6a3f4
0x6a6d4
Found at address: 0x6a6d4
0x6b6bf Now extract the files which are found
[+]Done writing to /Users/xxx/Desktop/test.txt-0
[+]Done writing to /Users/xxx/Desktop/test.txt-1
[+]Done writing to /Users/xxx/Desktop/test.txt-2
[+]Done writing to /Users/xxx/Desktop/test.txt-3
</pre>

[[Image:zlib-decrypt.py.zip|Here you can download the program.]]

Pictures inside bootloader

2008-12-10T20:58:07Z

Pcgeil:

The dump of the bootloader contains 4 different pictures.
They are packed with deflate and the following program is able to find the pictures and inflate them.

<pre>
python2.5 /Users/xxx/Desktop/zlib-decrypt.py
License: GPLv2
Author: pcgeil
search inside a file for zlib headers and extract them

Version: 0.1beta - 10-12-2008

Usage:
<argv1> source file
<argv2> dest file
[<argv3> offset dezimal]
[<argv4> end dezimal]

</pre>

The following output is with the bootloader v1051.
<pre>
python2.5 /Users/xxx/Desktop/zlib-decrypt.py /Users/xxx/Desktop/BOOTLOADER_20081128_204145_1 /Users/xxx/Desktop/test.txt 430000 440000

License: GPLv2
Author: pcgeil
search inside a file for zlib headers and extract them

Version: 0.1beta - 10-12-2008

Using:
Source: /Users/xxx/Desktop/BOOTLOADER_20081128_204145_1
Dest: /Users/xxx/Desktop/test.txt

Length is: 0x100000
0x69bac
Found at address: 0x69bac
0x6a05c
Found at address: 0x6a05c
0x6a3f4
Found at address: 0x6a3f4
0x6a6d4
Found at address: 0x6a6d4
0x6b6bf Now extract the files which are found
[+]Done writing to /Users/xxx/Desktop/test.txt-0
[+]Done writing to /Users/xxx/Desktop/test.txt-1
[+]Done writing to /Users/xxx/Desktop/test.txt-2
[+]Done writing to /Users/xxx/Desktop/test.txt-3
</pre>

[[Media:zlib-decrypt.py.zip|Here you can download the program.]]

Pictures inside bootloader

2008-12-10T20:57:27Z

Pcgeil:

The dump of the bootloader contains 4 different pictures.
They are packed with deflate and the following program is able to find the pictures and inflate them.

<pre>
python2.5 /Users/xxx/Desktop/zlib-decrypt.py
License: GPLv2
Author: pcgeil
search inside a file for zlib headers and extract them

Version: 0.1beta - 10-12-2008

Usage:
<argv1> source file
<argv2> dest file
[<argv3> offset dezimal]
[<argv4> end dezimal]

</pre>

The following output is with the bootloader v1051.
<pre>
python2.5 /Users/xxx/Desktop/zlib-decrypt.py /Users/xxx/Desktop/BOOTLOADER_20081128_204145_1 /Users/xxx/Desktop/test.txt 430000 440000

License: GPLv2
Author: pcgeil
search inside a file for zlib headers and extract them

Version: 0.1beta - 10-12-2008

Using:
Source: /Users/xxx/Desktop/BOOTLOADER_20081128_204145_1
Dest: /Users/xxx/Desktop/test.txt

Length is: 0x100000
0x69bac
Found at address: 0x69bac
0x6a05c
Found at address: 0x6a05c
0x6a3f4
Found at address: 0x6a3f4
0x6a6d4
Found at address: 0x6a6d4
0x6b6bf Now extract the files which are found
[+]Done writing to /Users/xxx/Desktop/test.txt-0
[+]Done writing to /Users/xxx/Desktop/test.txt-1
[+]Done writing to /Users/xxx/Desktop/test.txt-2
[+]Done writing to /Users/xxx/Desktop/test.txt-3
</pre>

[[Media:zlib-decrypt.py.bz2|Here you can download the program.]]

Pictures inside bootloader

2008-12-10T20:55:09Z

Pcgeil: New page: The dump of the bootloader contains 4 different pictures. They are packed with deflate and the following program is able to find the pictures and inflate them. <pre> python2.5 /Users/xxx/...

The dump of the bootloader contains 4 different pictures.
They are packed with deflate and the following program is able to find the pictures and inflate them.

<pre>
python2.5 /Users/xxx/Desktop/zlib-decrypt.py
License: GPLv2
Author: pcgeil
search inside a file for zlib headers and extract them

Version: 0.1beta - 10-12-2008

Usage:
<argv1> source file
<argv2> dest file
[<argv3> offset dezimal]
[<argv4> end dezimal]

</pre>

The following output is with the bootloader v1051.
<pre>
python2.5 /Users/xxx/Desktop/zlib-decrypt.py /Users/xxx/Desktop/BOOTLOADER_20081128_204145_1 /Users/xxx/Desktop/test.txt 430000 440000

License: GPLv2
Author: pcgeil
search inside a file for zlib headers and extract them

Version: 0.1beta - 10-12-2008

Using:
Source: /Users/xxx/Desktop/BOOTLOADER_20081128_204145_1
Dest: /Users/xxx/Desktop/test.txt

Length is: 0x100000
0x69bac
Found at address: 0x69bac
0x6a05c
Found at address: 0x6a05c
0x6a3f4
Found at address: 0x6a3f4
0x6a6d4
Found at address: 0x6a6d4
0x6b6bf Now extract the files which are found
[+]Done writing to /Users/xxx/Desktop/test.txt-0
[+]Done writing to /Users/xxx/Desktop/test.txt-1
[+]Done writing to /Users/xxx/Desktop/test.txt-2
[+]Done writing to /Users/xxx/Desktop/test.txt-3
</pre>

[[Media:zlib-decrypt.py.tar|Here you can download the program.]]

Main Page

2008-12-10T20:49:12Z

Pcgeil: /* Software */

__NOTOC__

==Welcome to the wiki of t-hack.com==

T-hack.com has been founded at the 14. December 2007, to invent/improve the software on X300T/X301T and similar boxes, like DIT9719 / KISS KMM / BT Vision/ Bluewin TV-Box /V-BOX / VIP 1216.

'''You can only edit the wiki, if you registered an account before (Spam/Bot-protect)'''

'''You are able to upload files with following extension (max file size 100MB):
png, gif, jpg, jpeg, zip, rar, pdf, ace'''

Visit the [http://www.t-hack.com/forum t-hack-Board]

== Status quo (September 2008)==
<div style="margin:0;background-color:#ff0000;font-family:sans-serif;font-size:120%;font-weight:bold;border:1px solid;text-align:left;color:#000;padding-left:0.4em;padding-top:0.2em;padding-bottom:0.2em; width:10%;">[http://www.t-hack.com/forum/index.php?topic=252.0 How-To (English)]</div>

'''Linux'''
* You can boot linux, but the microcodes can't (yet) be loaded . So unfortunaly you won't have an Image and sound.

'''Windows CE'''
* Its possible to compile and run own native as well as .NET-based applications on the box. Also its possible to debug it with MSVC2005 & MSVC2008 (MSVC = Microsoft Visual Studio).

'''You can run any Code on the box''' but you need a Modchip or an external PC to patch the security-features. Soldering is required! Also you've to connect the internal HD to a PC for software-modifications once.

==Willkommen zum Wiki von t-hack.com==

Das t-hack.com - Projekt wurde am 14. Dezember 2007 ins Leben gerufen, um eine alternative Software für die Multimedia-Box X300T bzw. X301T und baugleiche Boxen zu entwickeln bzw. die originale zu verbessern ;)

'''Das Wiki ist zum Schutz vor Spambots nur von registrierten Usern nutzbar.'''

'''Es ist möglich folgende Dateitypen hochzuladen (max Dateigröße 100MB):
png, gif, jpg, jpeg, zip, rar, pdf, ace'''

Besuchen Sie auch das [http://www.t-hack.com/forum t-hack-Forum]

== Momentaner Status (September 2008)==

<div style="margin:0;background-color:#ff0000;font-family:sans-serif;font-size:120%;font-weight:bold;border:1px solid;text-align:left;color:#000;padding-left:0.4em;padding-top:0.2em;padding-bottom:0.2em; width:10%;">[http://www.t-hack.com/forum/index.php?topic=244.0 How-To (Deutsch)]</div>

'''Linux'''
* Linux kann auf der Box gebootet werden, da aber immernoch keine Microcodes geladen werden können macht das wenig Sinn (Keine Ausgabe von Bild/Ton möglich).

'''Windows CE'''
* Es ist möglich eigene native Anwendungen als auch .net-basierende Anwendungen auf der Box auszuführen und mit MSVC2005 & MSVC2008 (MSVC = Microsoft Visual Studio)zu debuggen.

Konkret heisst das : <b>Beliebigen eigenen Code auf der Box ausführen !</b>

Es ist ein Modchip oder ein zusätzlicher Rechner (zum Patchen) erforderlich, <u>jegliche</u> Modifikationen setzen das Löten an der Box und das zumindest einmalige Ausbauen der Festplatte voraus !

{| cellpadding="10"
| valign="top" width="30%"|

== Hardware ==
*[[Picture]]
*[[Schematic/Boardlayout]]
*[[hardware-versions]]
*[[SMP8634]]
*[[eJTAG|eJTAG on PCB]]
*[[eJTAG on SMP]]
*[[UART0|Serial Debug Port]]
*[[Display]]
*[[XRPC]]

==Linux==
*[[RUA]]
*[[Toolchain]]
*[[Howto boot Linux]]
*[[Setup NFS-Root-Filesystem]]
*[[fli4l]]
**[[Grundinformationen]]
**[[Wir legen los]]
**[[Konfiguration anpassen]]
**[[Wichtige Links]]
**[[ein Wort in eigener Sache]]
*[[some additional output regarding Linux]]
| valign="top" width="30%"|

==Software==
*[[Tools]]
**[[Dump X300T Bootloader]]
**[[Disable X300T Signature Check]]
**[[Upload YAMON]]
**[[NK.BIN_toolset]]
**[[MakeNK]]
**[[Download Update Files]]
**[[NK.BIN Patcher]]
**[[Debug Files for remote debugging]]
*[[Boot Process]]
*[[Bootstrap-Message]]
*[[HDD-Layout]]
*[[Network-Bootstrap]]
*[[TV2ClientCE.exe]]
*[[BooterCE.exe]]
*[[TFTP]]
*[[Bootloader]]
**[[pictures inside bootloader]]

==WinCE==
*[[Disable TrustModel]]

| valign="top" width="30%"|
==Links/Information==
*[[Bootlog??|Bootlog of Beta X300T]]
*[[x300tBeta|Flash dump of Beta X300T]]
*[[Workaround, damit mehrere Settopboxen im Netz sind und die Timeshift-Funktion erhalten bleibt]]
*[[PKG.DIR]]
==Pirelli STB HY100 (aka IP100)==
*[[UART0 output]]
*[[Pictures]]

Bootloader

2008-12-10T20:48:36Z

Pcgeil: New page: Here are some information containing the bootloader of X300T

Here are some information containing the bootloader of X300T

Main Page

2008-12-10T20:48:04Z

Pcgeil: /* Software */

__NOTOC__

==Welcome to the wiki of t-hack.com==

T-hack.com has been founded at the 14. December 2007, to invent/improve the software on X300T/X301T and similar boxes, like DIT9719 / KISS KMM / BT Vision/ Bluewin TV-Box /V-BOX / VIP 1216.

'''You can only edit the wiki, if you registered an account before (Spam/Bot-protect)'''

'''You are able to upload files with following extension (max file size 100MB):
png, gif, jpg, jpeg, zip, rar, pdf, ace'''

Visit the [http://www.t-hack.com/forum t-hack-Board]

== Status quo (September 2008)==
<div style="margin:0;background-color:#ff0000;font-family:sans-serif;font-size:120%;font-weight:bold;border:1px solid;text-align:left;color:#000;padding-left:0.4em;padding-top:0.2em;padding-bottom:0.2em; width:10%;">[http://www.t-hack.com/forum/index.php?topic=252.0 How-To (English)]</div>

'''Linux'''
* You can boot linux, but the microcodes can't (yet) be loaded . So unfortunaly you won't have an Image and sound.

'''Windows CE'''
* Its possible to compile and run own native as well as .NET-based applications on the box. Also its possible to debug it with MSVC2005 & MSVC2008 (MSVC = Microsoft Visual Studio).

'''You can run any Code on the box''' but you need a Modchip or an external PC to patch the security-features. Soldering is required! Also you've to connect the internal HD to a PC for software-modifications once.

==Willkommen zum Wiki von t-hack.com==

Das t-hack.com - Projekt wurde am 14. Dezember 2007 ins Leben gerufen, um eine alternative Software für die Multimedia-Box X300T bzw. X301T und baugleiche Boxen zu entwickeln bzw. die originale zu verbessern ;)

'''Das Wiki ist zum Schutz vor Spambots nur von registrierten Usern nutzbar.'''

'''Es ist möglich folgende Dateitypen hochzuladen (max Dateigröße 100MB):
png, gif, jpg, jpeg, zip, rar, pdf, ace'''

Besuchen Sie auch das [http://www.t-hack.com/forum t-hack-Forum]

== Momentaner Status (September 2008)==

<div style="margin:0;background-color:#ff0000;font-family:sans-serif;font-size:120%;font-weight:bold;border:1px solid;text-align:left;color:#000;padding-left:0.4em;padding-top:0.2em;padding-bottom:0.2em; width:10%;">[http://www.t-hack.com/forum/index.php?topic=244.0 How-To (Deutsch)]</div>

'''Linux'''
* Linux kann auf der Box gebootet werden, da aber immernoch keine Microcodes geladen werden können macht das wenig Sinn (Keine Ausgabe von Bild/Ton möglich).

'''Windows CE'''
* Es ist möglich eigene native Anwendungen als auch .net-basierende Anwendungen auf der Box auszuführen und mit MSVC2005 & MSVC2008 (MSVC = Microsoft Visual Studio)zu debuggen.

Konkret heisst das : <b>Beliebigen eigenen Code auf der Box ausführen !</b>

Es ist ein Modchip oder ein zusätzlicher Rechner (zum Patchen) erforderlich, <u>jegliche</u> Modifikationen setzen das Löten an der Box und das zumindest einmalige Ausbauen der Festplatte voraus !

{| cellpadding="10"
| valign="top" width="30%"|

== Hardware ==
*[[Picture]]
*[[Schematic/Boardlayout]]
*[[hardware-versions]]
*[[SMP8634]]
*[[eJTAG|eJTAG on PCB]]
*[[eJTAG on SMP]]
*[[UART0|Serial Debug Port]]
*[[Display]]
*[[XRPC]]

==Linux==
*[[RUA]]
*[[Toolchain]]
*[[Howto boot Linux]]
*[[Setup NFS-Root-Filesystem]]
*[[fli4l]]
**[[Grundinformationen]]
**[[Wir legen los]]
**[[Konfiguration anpassen]]
**[[Wichtige Links]]
**[[ein Wort in eigener Sache]]
*[[some additional output regarding Linux]]
| valign="top" width="30%"|

==Software==
*[[Tools]]
**[[Dump X300T Bootloader]]
**[[Disable X300T Signature Check]]
**[[Upload YAMON]]
**[[NK.BIN_toolset]]
**[[MakeNK]]
**[[Download Update Files]]
**[[NK.BIN Patcher]]
**[[Debug Files for remote debugging]]
*[[Boot Process]]
*[[Bootstrap-Message]]
*[[HDD-Layout]]
*[[Network-Bootstrap]]
*[[TV2ClientCE.exe]]
*[[BooterCE.exe]]
*[[TFTP]]
*[[Bootloader]]
**[[pictures]]

==WinCE==
*[[Disable TrustModel]]

| valign="top" width="30%"|
==Links/Information==
*[[Bootlog??|Bootlog of Beta X300T]]
*[[x300tBeta|Flash dump of Beta X300T]]
*[[Workaround, damit mehrere Settopboxen im Netz sind und die Timeshift-Funktion erhalten bleibt]]
*[[PKG.DIR]]
==Pirelli STB HY100 (aka IP100)==
*[[UART0 output]]
*[[Pictures]]