Hacking does not work Audi-Nativev7.02

[DasBoenni]

Hi everyone,

at first I want to say... amazing forum! Got a lot of questions answered while reading through all that stuff. After I got an idea how everything works and what I have to do I started to hack my PhatBox to be able to use another (bigger) drives and in case my original one dies, to have an option to replace it.

That's what I've done so far:

At first I wiped/cleaned my whole data partition with the PMM function in the settings menu. (just to avoid that useless stuff is beein backed up during the process) After that I downloaded the latest (2.14) PhatHack DMS Tools and fired up the HackWizard. After it did some magic on my drive I wen't to my car, plugged the drive in, switched my player on and the only thing that happened was, that my player kept talking something i couldn't understand (english voice synth trying to speak german   ) over and over again. After 10 Minutes of waiting I switched the player off and took the DMS back to the docking station. Running the HackWizard again endet in the advice to post the following logfile here in this forum. As far as I understand there is missing a file but I don't have an idea what to do.

It would be great if someone can give me a hint what I'm doing wrong.

Much thanks in advance!


Logfile @ Pastebin (i shortened the logfile a bit because it keeps repeating after some entries)

[VorTechS]

Hi, sorry for not getting to you sooner.  Right, as far as I can tell from the log (and what you describe above) the missing file is a TTS file that the box wants to play for the PhatHack playlist generated by the DMS tools.  The fact this file is missing is not really relevant.

There appears to be another file it plays, as you say, which appears to be German - which is completely unrelated to the hack.  *shrug*

The behaviour you should expect, when switching to Playlist 1, Track 1 is:

1. An announcement explaining about the hack, and that the hack is about to run
2. The hack will run (instantaneously)
3. If successful, you should hear 'Your PhatBox is unlocked'.

If you don't hear the announcement and the PhatBox moves on to playing the remaining audio files on the DMS, this is neither indicative of failure, nor that your box is not hacked.
When the hack runs, we would normally expect to see another log file (which was what we were really looking for, not the one you posted). 

Unfortunately it has been so long since I looked at the source code, I can't remember the name of it   However, there are also some issues with the version of the hack in the current version of the DMS tools that seems to cause the relevant log file not to be generated.

Anyway, I can't see anything particularly wrong without checking the files on your DMS.  It may well be, that your hack has run since you posted.  If not, please reply back and we'll go from wherever you happen to be.

[DasBoenni]

First, thanks for your reply! I'm very patient with such things, a good thing is worth waiting for 

I browsed through the files currently on the phatbox after running the hack wizard and the audio-files you are talking about are stored on the harddisk, and i can play them on my computer. Maybe the hack doesn't work because i wiped all the music off the data partition before i ran the hacking wizard? I think i hear that strange talking noise because there is nothing else on the box that can be played. Should I put some music on the DMS? I haven't used the phatbox since the failed hack because the logfile keeps "looping". What I mean is that the box stores the same entries over and over again and I am afraid of that this logfile will fill up over time and my system-partition will run out of space.

What about reinstalling the Audi Firmware, flashing the box again, re-running the hack and giving it another try? Could that work? What do I have to do, just downloading the four archives and extracting them into the system-partition and plug them into the box? You wrote that there are some issues with the current version of the hack in the dms-tools, is there a newer version of the hack somewhere? I've no problem in running a batch/shell-script

[VorTechS]

I wouldn't worry so much about the firmware or reflashing the box - as clearly the firmware is working, otherwise your box would be doing nothing

Wiping the DMS of music isn't a bad thing either, in fact probably better given the way the DMS tools writes playlists and phatbox files (generally not very well) being as the source is some very old code I wrote that has since been patched to be correct in PhatHack Media Manager.

The problems with the current version of the hack that I mentioned, is only to do with the hack writing an output file to verify the state of the hack.  I think I have a newer version of the DMS tools with a newer version of the actual patch/hack file lying around.  I don't know if anyone ever got round to trying it, you are more than welcome to if I can find it!

So moving forward, you could completely wipe PHTDTA, use your favourite software to add a new playlist to the DMS, then re-run the hack wizard.  Re-try it in the car and see how it goes.
Which version of the DMS tools you use to do this, is entirely up to you!

[DasBoenni]

Okay, I'm back. I wiped (formated) the Data-Partition, fired up my PMM and created a new playlist named "Music". I throwed a few tracks in it and stored them on the DMS. After that I re-applied the hack and plugged it into the box. The box booted up, named the Playlist and the two Phathack-Audiofiles started to play. For about five Minutes this two tracks kept on playing again and again. No message about a sucessful hacked box and even i could not notice the box rebooting. I switched my Audio off and took my DMS back to the pc. The Wizard told me that the process failed again.

[VorTechS]

Okay, try corrupting the file ramdisk.sig.  That's should just be a case of throwing a random character in the file and saving it.
Stick the DMS back in the car, and see if anything different happens.

Also, after, check on PHTSYS for any log files (not the one you posted previously) - we're looking for one that looks like this:

Update: hack  ...
...  1a00
Verified!
Patch 5 @ 0354: make ramdisk invalid signature return 0 instead of  ...
...  13a0
Verified!
Patch 6 @ 0c80: make ramdisk signature check verify 0 instead of 1: [ ...
...  e350
Verified!
Patch 7 @ 0358: make ramdisk valid signature return 0 instead of 1: [ ...
... !
Patch 8 @ 0330: don't try to read ramdisk.sig (boot without any .sig files): [bl  ...
...  4 already applied
Patch 5 @ 0354: make ramdisk invalid signature return 0 instead of  ...
...  5 already applied
Patch 6 @ 0c80: make ramdisk signature check verify 0 instead of 1: [ ...
...  6 already applied
Patch 7 @ 0358: make ramdisk valid signature return 0 instead of 1: [ ...
...
Patch 8 @ 0330: don't try to read ramdisk.sig (boot without any .sig files): [bl  ...

[DasBoenni]

After typing a random character into the ramdisk.sig the Phatbox does not boot at all. In the bootload logfile the last entry is "Boot*-X: Failed"

[VorTechS]

Hmmm, obviously remove that random character then to at least get it booting again!

I'll prod and poke a bit to see what I can turn up in terms of help....

[DasBoenni]

I backed up the ramdisk.sig file and it seems that it wasn't a bad idea
Thanks for your efforts, I really appreciate that!

[DasBoenni]

Back again. I found some time to give this thing anoter try. At first I used the Phathack DMS Tools to start over with my stock DMS. I reflashed the audi native v7.02 and tried to hack it again. Same s*** different day, no success with it. I'm running out of ideas here... Spent hours of searching this forum and the web without finding something useful.

Any suggestions?

I created a zip-file out of the contents of my phatsys-partition and uploaded it to sendspace, maybe it will help you guys troubleshooting.

http://www.sendspace.com/file/oucwl7

[DasBoenni]

SUCCESS!  
Hell yeah I did it. I don't know why but the following steps turned that my box is now hacked.

- Used the DMS tools to reformat the original drive and put the latest Firmware on with the option activated to reflash the box.
- Booted up the PhatBox, waited until re-flash was finished and sucessful.
- Put some music on it
- Went to the car and played that music
- This time I used another computer (Windows Vista 32bit).
(The first time I used Win7 x64 and the second time XP, don't know if that matters...?)
- Applied the patch
- Booted the PhatBox
- At first there was a voice talking about that my box will now be hacked and after a few seconds another voice told me that it was successful  
- Went back to the computer and the wizard also told me, that my box is now hacked and ready for use with another harddrive.

Next step: 160GB WD Harddrive  

Thank you all guys who developed the hack, awesome work!

Greetings from Germany
Ben


Edit:

Just to be sure (...and because I've problems getting a new disk (tried a WD 160gb and a WD 80gb) recognized in Windows, original one works fine ), did the patch run successful??

Code: [Select]

patch.log

2048+0 records in
2048+0 records out
Verifying patch progress
There are  patches not yet applied
Beginning patch process
Patching to ramdisk corruption
Corrupting ramdisk
Completing Patch
Patch complete



Code: [Select]

PatchVerify.log

PhatPatch v0.8 - original code by bushing, additional patches by sbingner
Finding patch offsets:
Verified standard patch offsets
Verifying:
Patch 1 @ 0bb8: make drive signature check always succeed: [bne verify_sig_failed -> bne PC+1]
Expected: 0000 1a00    Actual: 0033 1a00
Unverified!
Patch 2 @ 0bec: make rc.sh signature check always succeed: [bne verify_sig_failed -> bne PC+1]
Expected: 0000 1a00    Actual: 0026 1a00
Unverified!
Patch 3 @ 0c20: make phatd signature check always succeed: [bne verify_sig_failed -> bne PC+1]
Expected: 0000 1a00    Actual: 0019 1a00
Unverified!
Patch 4 @ 0c54: make linux signature check always succeed: [bne verify_sig_failed -> bne PC+1]
Expected: 0000 1a00    Actual: 000c 1a00
Unverified!
Patch 5 @ 0354: make ramdisk invalid signature return 0 instead of 0xFFFFFFFF: [movlne r0, 0xFFFFFFFF -> movlne r0, #0]
Expected: 0000 13a0    Actual: 0000 13e0
Unverified!
Patch 6 @ 0c80: make ramdisk signature check verify 0 instead of 1: [cmp r0, #1 -> cmp r0, #0]
Expected: 0000 e350    Actual: 0001 e350
Unverified!
Patch 7 @ 0358: make ramdisk valid signature return 0 instead of 1: [moveq r0, #1 -> moveq r0, #0]
Expected: 0000 03a0    Actual: 0001 03a0
Unverified!
Patch 8 @ 0330: don't try to read ramdisk.sig (boot without any .sig files): [bl sector_read_suzy -> bl PC+1]
Expected: 0000 eb00    Actual: 02db eb00
Unverified!
Patch 9 @ 02c0: don't try to read linux.sig (boot without any .sig files): [bl sector_read_suzy -> bl PC+1]
Expected: 0000 eb00    Actual: 02f7 eb00
Unverified!
PhatPatch v0.8 - original code by bushing, additional patches by sbingner
Finding patch offsets:
Verified standard patch offsets
Verifying:
Patch 1 @ 0bb8: make drive signature check always succeed: [bne verify_sig_failed -> bne PC+1]
Expected: 0000 1a00    Actual: 0000 1a00
Verified!
Patch 2 @ 0bec: make rc.sh signature check always succeed: [bne verify_sig_failed -> bne PC+1]
Expected: 0000 1a00    Actual: 0000 1a00
Verified!
Patch 3 @ 0c20: make phatd signature check always succeed: [bne verify_sig_failed -> bne PC+1]
Expected: 0000 1a00    Actual: 0000 1a00
Verified!
Patch 4 @ 0c54: make linux signature check always succeed: [bne verify_sig_failed -> bne PC+1]
Expected: 0000 1a00    Actual: 0000 1a00
Verified!
Patch 5 @ 0354: make ramdisk invalid signature return 0 instead of 0xFFFFFFFF: [movlne r0, 0xFFFFFFFF -> movlne r0, #0]
Expected: 0000 13a0    Actual: 0000 13a0
Verified!
Patch 6 @ 0c80: make ramdisk signature check verify 0 instead of 1: [cmp r0, #1 -> cmp r0, #0]
Expected: 0000 e350    Actual: 0000 e350
Verified!
Patch 7 @ 0358: make ramdisk valid signature return 0 instead of 1: [moveq r0, #1 -> moveq r0, #0]
Expected: 0000 03a0    Actual: 0000 03a0
Verified!
Patch 8 @ 0330: don't try to read ramdisk.sig (boot without any .sig files): [bl sector_read_suzy -> bl PC+1]
Expected: 0000 eb00    Actual: 0000 eb00
Verified!
Patch 9 @ 02c0: don't try to read linux.sig (boot without any .sig files): [bl sector_read_suzy -> bl PC+1]
Expected: 0000 eb00    Actual: 0000 eb00
Verified!



Code: [Select]

PatchWrite.log

PhatPatch v0.8 - original code by bushing, additional patches by sbingner
Finding patch offsets:
Verified standard patch offsets
first 2 words of flash=c102 0025
testing offsets 0x555 and 0x2aa
writing auto-id command (AA, 55, 90)
Flash chip reports manufacturer id=0001, device id=22bf
offsets 0x555 and 0x2aa verified
Resetting flash.
Testing patch locations:
Patch 1 @ 0bb8: make drive signature check always succeed: [bne verify_sig_failed -> bne PC+1]
Expected: 0033 1a00    Actual: 0033 1a00
Match! Programming...
Wrote 0000
Patch 2 @ 0bec: make rc.sh signature check always succeed: [bne verify_sig_failed -> bne PC+1]
Expected: 0026 1a00    Actual: 0026 1a00
Match! Programming...
Wrote 0000
Patch 3 @ 0c20: make phatd signature check always succeed: [bne verify_sig_failed -> bne PC+1]
Expected: 0019 1a00    Actual: 0019 1a00
Match! Programming...
Wrote 0000
Patch 4 @ 0c54: make linux signature check always succeed: [bne verify_sig_failed -> bne PC+1]
Expected: 000c 1a00    Actual: 000c 1a00
Match! Programming...
Wrote 0000
Patch 5 @ 0354: make ramdisk invalid signature return 0 instead of 0xFFFFFFFF: [movlne r0, 0xFFFFFFFF -> movlne r0, #0]
Expected: 0000 13e0    Actual: 0000 13e0
Match! Programming...
Wrote 13a0
PhatPatch v0.8 - original code by bushing, additional patches by sbingner
Finding patch offsets:
Verified standard patch offsets
first 2 words of flash=c102 0025
testing offsets 0x555 and 0x2aa
writing auto-id command (AA, 55, 90)
Flash chip reports manufacturer id=0001, device id=22bf
offsets 0x555 and 0x2aa verified
Resetting flash.
Testing patch locations:
Patch 1 @ 0bb8: make drive signature check always succeed: [bne verify_sig_failed -> bne PC+1]
Expected: 0033 1a00    Actual: 0000 1a00
Detected patch 1 already applied
Patch 2 @ 0bec: make rc.sh signature check always succeed: [bne verify_sig_failed -> bne PC+1]
Expected: 0026 1a00    Actual: 0000 1a00
Detected patch 2 already applied
Patch 3 @ 0c20: make phatd signature check always succeed: [bne verify_sig_failed -> bne PC+1]
Expected: 0019 1a00    Actual: 0000 1a00
Detected patch 3 already applied
Patch 4 @ 0c54: make linux signature check always succeed: [bne verify_sig_failed -> bne PC+1]
Expected: 000c 1a00    Actual: 0000 1a00
Detected patch 4 already applied
Patch 5 @ 0354: make ramdisk invalid signature return 0 instead of 0xFFFFFFFF: [movlne r0, 0xFFFFFFFF -> movlne r0, #0]
Expected: 0000 13e0    Actual: 0000 13a0
Detected patch 5 already applied
Patch 6 @ 0c80: make ramdisk signature check verify 0 instead of 1: [cmp r0, #1 -> cmp r0, #0]
Expected: 0001 e350    Actual: 0001 e350
Match! Programming...
Wrote 0000
Patch 7 @ 0358: make ramdisk valid signature return 0 instead of 1: [moveq r0, #1 -> moveq r0, #0]
Expected: 0001 03a0    Actual: 0001 03a0
Match! Programming...
Wrote 0000
Patch 8 @ 0330: don't try to read ramdisk.sig (boot without any .sig files): [bl sector_read_suzy -> bl PC+1]
Expected: 02db eb00    Actual: 02db eb00
Match! Programming...
Wrote 0000
Patch 9 @ 02c0: don't try to read linux.sig (boot without any .sig files): [bl sector_read_suzy -> bl PC+1]
Expected: 02f7 eb00    Actual: 02f7 eb00
Match! Programming...
Wrote 0000



Code: [Select]

Bootload.log

BOOT0-0: OK
BOOT0-1: OK
BOOT0: Successful
BOOT9: Successful
BOOTB: Successful
BOOTF: Successful
BOOT*: Successful