PhatHack

Hi there,

I tried patching my Audi/VW Phatbox, but it didn't succeed. I used the Windows DMS Hack Tools 2.10 and prepared my original 20GB DMS with the help of the assistant, then I unplugged the cable from the Phatbox for a few minutes to ensure it is powered off, installed the cable and the DMS again and turned the ignition (and the radio) on. The box started to play music immediately (Track01, so it did not remember where I left off last time) and nothing else happened. I tried this several times, it's always the same.

Back to the PC, I looked at the disk: there is NO patch.log and NO patchverify.log!!

The bootload.log says:

BOOT0-0: OK
BOOT0-1: OK
BOOT0: Successful
BOOT9: Successful
BOOTB: Successful
BOOTF: Successful
BOOT*: Successful


I tried corrupting the ramdisk.sig - the effect is, that the PB won't start up anymore (green light flashing, PB is not recognized by the headunit). After restoring the backup of ramdisk.sig, everything works fine again - but the patch is still not applied.

Can anybody help me with this problem?

I am using a native Audi Concert II headunit. The firmware on the box should be 7.02 (so says the Phatnoise Music Manager). The announcement by the box itself that can be found in the menu ("About this firmware") says something else (359xxx, I'm not quite sure, if this is important I will write it down).

I'm running Windows XP with SP2 (german version).

Okay, please ZIP up and send me a copy of PHTSYS so I can take a look at the files.

That would be great, thanks! I will send you the file as soon as I'm home from work today.

Best regards!
Warstein

its likely that your bootload.log is old and not being written to at all anymore.

my suggestion is this:

chkdsk /f the phtsys partition

erase all the files in the root of the phtsys partition (you can leave the folders if you want, but rename or backup the plugin folder if it exists)

extract your head unit's firmware files (four zip files) onto the phtsys partition

remove forceupdate and forcesettings files

try and boot the phatbox that way.

it's likely that the patch never attempted to apply or something else is wrong.  if you can reset the DMS to factory files on phtsys that would be a good way to test.

Hi,
thanks for the quick response!

The bootload.log is definitely new - as I said, I tried corrupting the ramdisk.sig and the PB didn't boot up correctly anymore, resulting in a "boot*- fail" at the end of the bootload.log. As you can see, this is gone now - so the file must be new.

I will try your suggestions anyway and report back.

Best regards,
Warstein

Yep, you have the file 'forcesettings' in the zip file you uploaded and this is used by the PhatBox to do it's own update process.
Removing this file might help.

I checked the usual suspect 'exec.sig' but this appears to be fine.

If after the removal of the file 'forcesettings' it still doesn't work, then you can download the rc level 10 pair, which will generate a log that we might be able to use to find out what's wrong.

Ok, so I will first try to remove the 'forcesettings' file and see if it works. If that doesn't help I will try removing all files in the partition and restoring them from the firmware files as judb suggested...

Hope this helps!

I'm back with bad news: both suggestions didn't work.

I first removed the forcesettings-file and booted the box (off course after unplugging the cable for a moment, it seems this is always necessary in Audi cars): the radio display showed CDC1 Track01 00:00 for about 5 seconds, then it showed "No magazine" and switched to FM. I switched back to CDC - and it started playing music right away. As you can guess, there still was no sign of the patch being applied...

Then I removed every file in the root of the phtsys-partition (including the plugins-directory) and extracted the firmware files onto it (yes, I removed the forceupdate-file). Back at my car, the box booted without any problems. So I used the DMS Hack Tools again to prepare the DMS and booted the box with it: the effect was the same as above, "CDC1 Track01 00:00" for a moment, then "No magazine" and after I switched back to CDC it started playing music - without applying the patch.

Where do I find the rc level 10 pair and what do I have to do with it?

Thanks again for the help! Without you, I might have tried disassembling the box and re-programming the microcontroller itself... But this might have taken a while. ;-)

Okay, a couple of things for clarity.

When you run the new DMS Hack tools, forceupdate and forcesettings should NOT be present.  Is that the case?
Similarly there could still be a problem with 'exec.sig', but there shouldn't be.  To be sure go here:

http://www.phathack.com/plsign.cgi

...browse to 'exec.ini' on PHTSYS and submit.  Open the file the website returns you.  Open the 'exec.sig' on PHTSYS and they should be the same.  Are they?

If not, save the file generated by the website over the top of the existing one.

The RC pairs can be downloaded from here: http://downloads.phathack.com/bushing/rc_pairs.zip

I'm not sure about my first run, but after you mentioned to remove forceupdate and forcesettings I made sure to remove them. At my last try with the new extracted firmware files, they were definitely not present.

My exec.sig is the same as the one the website returns to me.

I'll make a run with the rc level 10 pairs, which log-file do you need afterwards?

Okay, it's difficult sometimes to work out whether something relates to the 'manual extraction' of the firmware or the automated one because you are doing both!

You should perhaps just concentrate on one method so there is no chance of ambiguity.

I'm not exactly sure what you mean...

I manually extracted the firmware just once, that was the last try. After extracting it from the four files, I removed forceupdate and forcesettings and used the Hack Tools on the DMS.

Hmm, well judb wanted you to make sure that when you wiped the PHTSYS partition and extracted the firmware back onto it (removing the forceupdate and forcesettings file) that when you then inserted the DMS into the PhatBox, the PhatBox works in it's factory state. 

I don't see any mention of you doing this particular test. 
Your posts sugggest you did the firmware, then put the hack on and tried it in the car.

Anyway, let's see what the rc pair throws at us....

Ok, now I know what you mean! I tried that (as you can read in my post from 12:09:40 PM), but I think the PB was NOT back to factory defaults. It should have played back the "Welcome" sound or something like that, shouldn't it? :-x

Ah sorry yes - it's me, I missed the 'Back at my car it booted without problems'.... :-*

No, it would have played whatever playlists you have stored on PHTDTA, I'm assuming you left PHTDTA alone?

The 'Welcome to phatnoise' is a single-item playlist auto-generated by PhatNoise Media Manager when it encounters a new DMS, which of course all that could have been on PHDTA. ;)

Ah, ok, that's what it did. How can I find out if it was back to factory settings?

If it played your existing playlists, and booted up from a cleaned partition with the firmware extracted - that's back to factory settings enough for us.

After running the new DMS tools, running the Hack Wizard should make a number of modifications to the DMS.
You should be able to see what the tools do, by checking 'My Documents\PhatHack Media Manager\Logs' and opening up 'PhatHack_Wizard_Log.txt'.

Actually, you know something.  My bad, I've been so busy over the last few days I completely forgot to ask - can I have a copy of this file? :D

Maybe there's something in there not completing!

I've send you a link to the file in a PM. As far as I can see, everything seems to be fine with it...  ???

Okay, I've just taken a look into the PhtSYS you uploaded and as I posted elsewhere the hack has put on the level 10 RC pair.  There is a 'logfile.txt' in there.

Now all you need is someone who can read it, and  tell you what's up!  (And that's not my area of knowledge yet :()

Not sure if anyone other than sbingner knows how to read what's up but here's a link to the rc logfile I was sent earlier:

http://phatnoise.org.uk/PhatHack/logfile.txt

That old logfile is very big, I attached the new logfile that was created after I re-installed the firmware. The "error" should be in there, too, but this file is much smaller.

so to make sure we have clarity here, this log file was created AFTER you wiped the DMS and extracted the firmware files as I suggested but it doesn't play music?

The log file appears to indicate the unit is functioning properly.

Keep in mind that the phatbox does not stamp time or date on any files so you can't rely on that to tell you if a file has been modified or not.

I don't mean to be obtuse but I'd like to make sure I understand the circumstances that led to the creation of the log file output and the problem you are having right now.

jud: the story (as far s I understand) is;

PHTSYS wiped, original firmware manually extracted to it.  DMS tested in phatbox, confirmed to work okay.

New DMS Hack Tools run, DMS successfully prepared to run the hack (hack wizard applies rc level 10).

DMS inserted into the PhatBox, no sign of the hack ever starting (no patchverify.log)

Yes, that's the story. The box plays music and works correctly, but it doesn't apply the patch.

The logfile that I posted yesterday was created AFTER phtsys was wiped. The logfile posted by VorTechS was created BEFORE wiping phtsys (after I first tried to apply the patch a few days ago).

One question: if I try to patch a PB that is already patched, what would happen? And another question: if I try to use a new DMS without having patched the PB, what would happen?

Nothing would happen if your PhatBox is already patched, although a PatchVerify.log should have been written.  If you tried to use a custom disk in a DMS, on a PhatBox that isn't patched - the PhatBox would not work.

If you have a custom disk in your DMS, with playlists and the firmware on and everything is working - then you've got a hacked box.

Ah ok, so it's not possible that my phatbox is already patched and I just didn't know. Anyway, I could try to use a custom disk in my PB and see if it works. The box does not lock itself up or something like that if I try it and it is not patched, does it?

No, use the Hack Tools to create your new DMS (DO NOT choose the option to reflash)... load up a playlist onto it and then try it in the box.  If it works, the box is patched.

If, when that logfile was created, the DMS was configured to apply the hack... the problem appears to be that it never tried to run the startup sound.   Vortechs experienced this problem once, so it is possible.   What you could do is add a file to your playlists (say Disc1 Track1) that is a file ending in ".hack" -- if you can't figure out how to do this, maybe we could talk vortechs into adding an option to do this to the hack tools... perhaps have it replace all the playlists on the DMS with a single hack playlist... then revert when done?

You may be right, because as I remember, my box never played a startup sound. So (as I read out of this) the hack is applied when the box runs the startup sound? Hm, actually I don't know how to do this, but I will try to figure it out. Any suggestions?

actually... the easiest way for you to be sure it'll run...

1. rename PHTSYS:\nmp3 to PHTSYS:\nmp3.real
2. rename PHTSYS:\nmp3.sig to PHTSYS:\nmp3sig.real
3. copy PHTSYS:\patcher to PHTSYS\nmp3
4. copy PHTSYS:\patcher.sig to PHTSYS\nmp3.sig

that will make it try to apply the patch whenever it tries to play an MP3... but it will never play the completed sound or the MP3 so you'll just have to check the logs after letting it run for a few moments.  When it's done just put the real version of nmp3 back.

Alternatively replace "nmp3" with "flacplay" above, and put a flac file in a playlist... that will make it try to execute when a flac file is played, and it will be able to play the completed sound.

With everything else I've done recently on PhatHack Media Manager, I could actually go that one step further and insert a playlist as the first playlist specifically to run the hack.  I could go that route anyway, skip the startup sound create a nice TTS announcement to go with it.  So it would be kind of:

Box starts up, loads playlist 1
Play track 1 = MP3 voice announcement saying.... I'm about to run the hack, your box may re-boot several times
Play track 2 = run hack

I'll branch the source later this week and start on this approach soonish.

Sounds like a good idea! This way it should work. I will test this as soon as I have some time left... :-X For today, I have to focus on my PSoC microcontroller and how to implement medical sensors with it...  :-\

Quote from: Warstein on November 20, 2007, 09:17:53 AM
Sounds like a good idea! This way it should work. I will test this as soon as I have some time left... :-X For today, I have to focus on my PSoC microcontroller and how to implement medical sensors with it...  :-\

Yes, sounds like you'll fit right-in here!

Yes!! It finally worked! :-) Just at this moment I'm copying my complete music on my new DMS-drive...  8)

That's what I've done: I created a new playlist 1 with only a single flac-file in it on the DMS. Then I replaced flacplay by patcher and flagplay.sig by patcher.sig and booted the box. It re-booted about 5 times and then it changed to playlist 2 and started to play music. Back at my computer I verified that the patch was applied correctly and started to create a new DMS. And it works! Yeeehaaaw!  ;D

Thanks for all the help guys! And I hope this experience helps to improve the Hack Tools in future releases for other users with the same problem.  ;)

Thanks for the confirmation, as soon as I've caught up with work stuff etc I'll convert the entire process to use a playlist as we discussed.

I know what you're talking about... I'm currently working on my master's thesis and that doesn't leave much time for the fun-things.  ;)

OK, I seem to be having the same problem. I have an original 20GB DMS and an Audi version Phatbox. I was having trouble with applying the hack and then found this thread.

I've followed the suggestions here but still cannot get the hack to take. I've run the Hack wizard, removed the forcesettings file, renamed flacplay and flacplay.sig files and copied the patch files to flacplay and flacplay.sig. I've placed one flac play list on the dms. I went to the car (Phatbox was disconnected from the power for 10mins), powered up the radio and phatbox, system boots and I get a "currupt player" message and the green light just flashes every second.  >:(

You could try the same procedure with nmp3. Be sure to use the right .sig file for the patcher, otherwise it won't work.

Maybe you should start from scratch be wiping the phtsys-partition and unpacking the system- and headunit-files onto it. Then run the wizard again and afterwards backup and overwrite nmp3 with patcher and nmp3.sig with patcher.sig.

What do you mean by the right .sig file for the patcher? I copied patcher to flacplay and patcher.sig to flacplay.sig.

I also seem to have a new problem now.

I started from scratch and wiped the root of phtsys. I then extracted the 4 zip files in that phtsys partition. I then run the DMS tools hack wizard but it goes from step 1 straight to step 6. Looking at the files on the phtsys partion I don't see any of the files that were supposed to be copied over.  ??? So I copied the files over mnually from the dms_utils folder.

How to you restore the backups?

The backups aren't really something you need to worry about.

The hack wizard goes to step 6, because it's waiting for you to check out if the patch was applied.  There should be a reset button on one of these screens where it's ready to verify the hack has been applied.  Hit this, and the wizard will reset to wanting to apply the hack.

To reset youir firmware, try using the 'Update Firmware' process of the tools (Click on Create New DMS, select your DMS, Select the firmware, check the option 'Install non-hacked firmware' and then click on 'Update Firmware').

This'll save you having to mess around with the zip files.

Once you've gotten that far, re-run the hack wizard to apply the patch files and then rename flacplay and flacplay.sig by adding .old to each filename.  Then rename patcher, flacplay and patcher.sig flacplay.sig.  Add a FLAC file to a new playlist, make it the first playlist on the DMS (by changing the order) and then stick the DMS in your box.  Switch to the PhatBox, it'll start 'playing' the first playlist/track and then start applying the hack.  It'll reboot a few times, each time it reboots switch back to the phatbox.  Eventually you'll get your hack message.

Once done, rename flacplay, patcher and flacplay.sig, patcher.sig and also rename flacplay.old, flacplay and flacplay.sig.old to flacplay.sig.  Re-run the wizard to verify the patch worked and then your done.

Thanks I got it working finally. I'm not realy sure what I did to make it work as I just repeated everything I had already tried. I have now replaced my 20GB with a 60GB HDD which I pulled from an old laptop.

Question. Why is it so important to keep the old HDD that came out of the DMS? Isn't enough to keep the backups?

EDIT. PS How do I make a donation  ;D

Quote from: cyberdude on November 25, 2007, 09:24:02 AM
Question. Why is it so important to keep the old HDD that came out of the DMS? Isn't enough to keep the backups?

A "blessed" (original) drive from PhatNoise has a hardware serial number which matches a signature held in an area of the drive outside the PHTSYS / PHTDTA partitions. Even with a full-disk image of the drive, the only place that image can be restored to and still work in an un-patched PhatBox is the same drive it came from.

If you don't care about being able to hack other boxes, you could re-use the original drive for any purpose you want.

Donations can be made to sam@bingner.com via Paypal.