Tried to patch a Volvo (XC70 model) branded Phatbox, but with no luck. All steps until "!!!!NOW FOR THE IMPORTANT PART!!!! " are successful, but the actual patch of the Phatbox in the car fails. Tried all playlists, waited for several minutes... When I insert the DMS cartridge, the head unit just starts playing music from the cartridge.
The logfiles (/log/Phatpatch.log etc.) are showing "Mismatch!" but no "Verified!" messages.
Is the Volvo branded Phatbox supported by the Phathack method? Any suggestions how to patch this motha?
Does it have the latest volvo phat noise firmware on it already?
post the content of the logs so we can see exactly whats going on.
Firmware is up to date.
I'm not near the car right now, and I'll be away for a week, so I'll post the logs next week.
The logging, as requested.
patch.log:
: No such file or directory
2048+0 records in
2048+0 records out
hdparm - get/set hard disk parameters - version v3.9
Usage: hdparm [options] [device] ..
Options:
-a get/set fs readahead
-A set drive read-lookahead flag (0/1)
-c get/set IDE 32-bit IO setting
-C check IDE power mode status
-d get/set using_dma flag
-D enable/disable drive defect-mgmt
-E set cd-rom drive speed
-f flush buffer cache for device on exit
-g display drive geometry
-h display terse usage information
-i display drive identification
-I read drive identification directly from drive
-k get/set keep_settings_over_reset flag (0/1)
-K set drive keep_features_over_reset flag (0/1)
-L set drive doorlock (0/1) (removable harddisks only)
-m get/set multiple sector count
-n get/set ignore-write-errors flag (0/1)
-p set PIO mode on IDE interface chipset (0,1,2,3,4,...)
-P set drive prefetch count
-Q print out the drive id only (60bytes\n)
-q change next setting quietly
-r get/set readonly flag (DANGEROUS to set)
-R register an IDE interface (DANGEROUS)
-S set standby (spindown) timeout
-t perform device read timings
-T perform cache read timings
-u get/set unmaskirq flag (0/1)
-U un-register an IDE interface (DANGEROUS)
-v default; same as -acdgkmnru (-gr for SCSI, -adgr for XT)
-V display program version and exit immediately
-W set drive write-caching flag (0/1) (DANGEROUS)
-w flush os cache and wakeup drive
-X set IDE xfer mode (DANGEROUS)
-y put IDE drive in standby mode
-Y put IDE drive to sleep
-Z disable Seagate auto-powersaving mode
PhatPatch v0.4 - original code by bushing, additional patches by sbingner
Verifying:
Patch 1 @ 0bb8: make drive signature check always succeed: [bne verify_sig_failed -> bne PC+1]
Expected: 0000 1a00 Actual: 32c0 e59f
Unverified!
Patch 2 @ 0bec: make rc.sh signature check always succeed: [bne verify_sig_failed -> bne PC+1]
Expected: 0000 1a00 Actual: 329c e59f
Unverified!
Patch 3 @ 0c20: make phatd signature check always succeed: [bne verify_sig_failed -> bne PC+1]
Expected: 0000 1a00 Actual: 326c e59f
Unverified!
Patch 4 @ 0c54: make linux signature check always succeed: [bne verify_sig_failed -> bne PC+1]
Expected: 0000 1a00 Actual: 0003 e152
Unverified!
Patch 5 @ 0354: make ramdisk invalid signature return 0 instead of 0xFFFFFFFF: [movlne r0, 0xFFFFFFFF -> movlne r0, #0]
Expected: 0000 13a0 Actual: 000a aa00
Unverified!
Patch 6 @ 0c80: make ramdisk signature check verify 0 instead of 1: [cmp r0, #1 -> cmp r0, #0]
Expected: 0000 e350 Actual: 3214 e59f
Unverified!
Patch 7 @ 0358: make ramdisk valid signature return 0 instead of 1: [moveq r0, #1 -> moveq r0, #0]
Expected: 0000 03a0 Actual: 3004 e7d5
Unverified!
PatchVerify.log:
Starting Patch Process
PhatPatch v0.4 - original code by bushing, additional patches by sbingner
Verifying:
Patch 1 @ 0bb8: make drive signature check always succeed: [bne verify_sig_failed -> bne PC+1]
Expected: 0000 1a00 Actual: 32c0 e59f
Unverified!
Patch 2 @ 0bec: make rc.sh signature check always succeed: [bne verify_sig_failed -> bne PC+1]
Expected: 0000 1a00 Actual: 329c e59f
Unverified!
Patch 3 @ 0c20: make phatd signature check always succeed: [bne verify_sig_failed -> bne PC+1]
Expected: 0000 1a00 Actual: 326c e59f
Unverified!
Patch 4 @ 0c54: make linux signature check always succeed: [bne verify_sig_failed -> bne PC+1]
Expected: 0000 1a00 Actual: 0003 e152
Unverified!
Patch 5 @ 0354: make ramdisk invalid signature return 0 instead of 0xFFFFFFFF: [movlne r0, 0xFFFFFFFF -> movlne r0, #0]
Expected: 0000 13a0 Actual: 000a aa00
Unverified!
Patch 6 @ 0c80: make ramdisk signature check verify 0 instead of 1: [cmp r0, #1 -> cmp r0, #0]
Expected: 0000 e350 Actual: 3214 e59f
Unverified!
Patch 7 @ 0358: make ramdisk valid signature return 0 instead of 1: [moveq r0, #1 -> moveq r0, #0]
Expected: 0000 03a0 Actual: 3004 e7d5
Unverified!
according to your logs, you might actually have a different firmware. The patcher won't change it if the old data isn't what's expected.... do you have a dump of the firmware on the old drive now? I think the patch disk makes one, if so I might be able to look at that
Very strange that your firmware would be different, so far EVERY phatbox has had identical boot firmware
I have copied the content of the PHTSYS partition of the original PMS cartridge to my harddisk. Is firmware.pac what you're looking for? How would you like to receive the firmware?
the bootloader from your flash chip would be in the backup folder.. thats what Sam is refering to. I forget the exact file name but it should be there. part of our script should make a backup before it runs. if its not there we can tell you how to modify the script to make a dump.
These files reside in the backup folder:
P0.idx
aadec-hacked
aadec-hacked.sig
patchcomplete.mp3
flacplay-hacked
flacplay-hacked.sig
phatpatch
patch.sh
p0.sig
p0.pbx
p0.m3u
version.txt
phatpatch-v2
flacplay
flacplay.sig
aadec
aadec.sig
drive-sig-1mb.bin
dms-serialnumbeumber.txt
You don't have what we need - you need to modify the scripts to run:
/dos/backup/phatpatch s /dos/backup/flash.rom
Finally got the chance to proceed with this issue. I managed to get the flash.rom from the Volvo.
How can I upload this ROM?
Didn't the initial Red/Beta Phatbox units not care if the drive was signed (and presumably have a different bootloader?)? Maybe the OP has one of these?
QuoteFinally got the chance to proceed with this issue. I managed to get the flash.rom from the Volvo.
How can I upload this ROM?
try emailing sam the rom or hop in the IRC channel.. zip it and put it on rapidshare or something.
Okay, I sent the firmware to Sam by email. It 's also on Tripod, for those who
are interested:
http://heinrichnak.tripod.com/flash.zip
It IS different, but similar - should have a patch for you in a few mins
DISCLAIMER: THIS HAS NOT BEEN TESTED; YOU CAN MAKE YOUR BOX ESSENTIALLY UNBOOTABLE
with that out of the way, you should be fine replacing the 'phatpatch' binary with the file located at http://downloads.phathack.com/sbingner/phatpatch-volvo-0.6.gz (once you extract it with winzip etc)
Source code is at http://downloads.phathack.com/sbingner/phatpatch-volvo-0.6.c
Thanks! I will test this on Sunday (I'm not with the car until then), and let you all know the results.
Just to be sure: the updated patch in the previous post is not gzipped, but it appears to be the binary file itself. Is that correct?
.gz = it is gzipped
Yeah, that's what I thought... But it isn't recognized by gzip (or any other decompresion utility) as a gzip file.
Also it has the same file structure as my original phatpatch. I'm going to try to patch with this file anyway.
You browser may have decompressed it inline
Tried the patched patch, but no luck yet.
patch.log:
PhatPatch v0.6 - original code by bushing, additional patches by sbingner
Verifying:
Patch 1 @ 0d90: make drive signature check always succeed: [bne verify_sig_failed -> bne PC+1]
Expected: 0000 1a00 Actual: 0033 1a00
Unverified!
Patch 2 @ 0dc4: make rc.sh signature check always succeed: [bne verify_sig_failed -> bne PC+1]
Expected: 0000 1a00 Actual: 0026 1a00
Unverified!
Patch 3 @ 0df8: make phatd signature check always succeed: [bne verify_sig_failed -> bne PC+1]
Expected: 0000 1a00 Actual: 0019 1a00
Unverified!
Patch 4 @ 0e2c: make linux signature check always succeed: [bne verify_sig_failed -> bne PC+1]
Expected: 0000 1a00 Actual: 000c 1a00
Unverified!
Patch 5 @ 051c: make ramdisk invalid signature return 0 instead of 0xFFFFFFFF: [movlne r0, 0xFFFFFFFF -> movlne r0, #0]
Expected: 0000 13a0 Actual: 0000 13e0
Unverified!
Patch 6 @ 0e58: make ramdisk signature check verify 0 instead of 1: [cmp r0, #1 -> cmp r0, #0]
Expected: 0000 e350 Actual: 0001 e350
Unverified!
Patch 7 @ 0520: make ramdisk valid signature return 0 instead of 1: [moveq r0, #1 -> moveq r0, #0]
Expected: 0000 03a0 Actual: 0001 03a0
Unverified!
Patch 8 @ 04f4: don't try to read ramdisk.sig (boot without any .sig files): [bl sector_read_suzy -> bl PC+1]
Expected: 0000 eb00 Actual: 02e0 eb00
Unverified!
Patch 9 @ 0460: don't try to read linux.sig (boot without any .sig files): [bl sector_read_suzy -> bl PC+1]
Expected: 0000 eb00 Actual: 0305 eb00
Unverified!
/dos/backup/patch.sh: cannot create /dos: Is a directory
PhatPatch v0.6 - origin
There seems to be a problem with /dos. I'll look into that.
There's no a PatchWrite.log, but there is a PatchVerify.log:
Starting Patch Process
PhatPatch v0.6 - original code by bushing, additional patches by sbingner
Verifying:
Patch 1 @ 0d90: make drive signature check always succeed: [bne verify_sig_failed -> bne PC+1]
Expected: 0000 1a00 Actual: 0033 1a00
Unverified!
Patch 2 @ 0dc4: make rc.sh signature check always succeed: [bne verify_sig_failed -> bne PC+1]
Expected: 0000 1a00 Actual: 0026 1a00
Unverified!
Patch 3 @ 0df8: make phatd signature check always succeed: [bne verify_sig_failed -> bne PC+1]
Expected: 0000 1a00 Actual: 0019 1a00
Unverified!
Patch 4 @ 0e2c: make linux signature check always succeed: [bne verify_sig_failed -> bne PC+1]
Expected: 0000 1a00 Actual: 000c 1a00
Unverified!
Patch 5 @ 051c: make ramdisk invalid signature return 0 instead of 0xFFFFFFFF: [movlne r0, 0xFFFFFFFF -> movlne r0, #0]
Expected: 0000 13a0 Actual: 0000 13e0
Unverified!
Patch 6 @ 0e58: make ramdisk signature check verify 0 instead of 1: [cmp r0, #1 -> cmp r0, #0]
Expected: 0000 e350 Actual: 0001 e350
Unverified!
Patch 7 @ 0520: make ramdisk valid signature return 0 instead of 1: [moveq r0, #1 -> moveq r0, #0]
Expected: 0000 03a0 Actual: 0001 03a0
Unverified!
Patch 8 @ 04f4: don't try to read ramdisk.sig (boot without any .sig files): [bl sector_read_suzy -> bl PC+1]
Expected: 0000 eb00 Actual: 02e0 eb00
Unverified!
Patch 9 @ 0460: don't try to read linux.sig (boot without any .sig files): [bl sector_read_suzy -> bl PC+1]
Expected: 0000 eb00 Actual: 0305 eb00
Unverified!
Looks like phatpatch didn't find the right code...
That's strange -- do you have from where it tried to patch? Expected won't have all 00's on the left in that on
Looking closer, looks like all my offsets are right -- but it didn't patch it for some reason, possibly the unlock codes didn't work... can you post the whole log?
Here you go:
http://heinrichnak.tripod.com/patch_logs.zip
That's strange - it never TRIED to patch, all it's doing is try to verify it over and over again.... make sure patch.sh calls it as "phatpatch patch" or "phatpatch p" although if it's called without an option it should say "invalid option"
Sam
You'll be able to tell when it actually tried to patch because you will get something similar to the following:
first 2 words of flash=%04x %04x
testing offsets 0x555 and 0x2aa
writing auto-id command (AA, 55, 90)
My patch.sh (it's from the patch cd ISO):
#!/bin/sh
# Scripts created for www.phathack.com
#
# Copyright 2005 Jud Barron jud.barron@gmail.com
#
# Released under the GPL: http://www.gnu.org/licenses/licenses.html
#
#
# This script will patch your music keg or phatbox firmware to allow
# any hard drive to be used provided it has been properly prepared.
# Proper preperation of a DMS drive includes having the first 1 megabyte
# of the drive copied from an working phatnoise original DMS.
#
# The first partition must start AFTER the first 1 megabyte of the drive
# so that the signature area is undisturbed. Also an MSDOS boot sector
# must be present on the drive.
/bin/dd if=/dev/hda of=/dos/backup/drive-sig-1mb.bin bs=512 count=2048
/dos/hdparm -q > /dos/backup/dms-serialnumber.txt
echo Starting Patch Process > /dos/log/PatchVerify.log
/dos/backup/phatpatch v >> /dos/log/PatchVerify.log 2>&1
while ! /dos/backup/phatpatch v;
do
/dos/backup/phatpatch p >> /dos/log/PatchWrite.log 2>&1
sleep 2
done
/dos/nmp3 /dos/backup/patchcomplete.mp3
/dos/backup/phatpatch v >> /dos/log/PatchVerify.log 2>&1
/bin/dmesg > /dos/log/dmesg.log
Your problem (strangely) is here:
/dos/backup/phatpatch p >> /dos/log/PatchWrite.log 2>&1
try changing it to:
/dos/backup/phatpatch p >> /dos/backup/PatchWrite.log 2>&1
or, if that doesn't work
/dos/backup/phatpatch p
It seems like it's probably some sort of issue with a null character or something else strange in patch.sh since it worked for the verify output, are you sure you didn't do anything that could have modified or 'translated' patch.sh?
Oh yes, be careful what you use to edit it... I reccomend getting a copy of WinVI http://www.winvi.de/en/ ( http://www.winvi.de/winvi32.zip ) to do it, that way you won't introduce any other strange formatting problems ;)
I really wonder how this could have happened (I mean the option "v" instead of "p", and the log location).
Again, I'm not with the car. I'll let you know the results later...
Thanks for the editor tip (I 've used SimpleText for these sort of jobs)!
It's nothing wrong with the options or the location, it's just not running for some reason
Thats where the "/dos" error is coming from
did you ever get this working?
Still didn't get the chance to try it. It's not my car and the owner is out a lot. Sorry to let you wait...
Whoohoooo! Spoke to the owner today, and he told me he was hearing a woman's voice from his radio saying that the hack is succesful. Payed him a visit, and completed the DMS swap (replaced the 20 GB by a 80 GB Toshiba drive), and all is fine now!
Thanks a lot for all your help. Volvo branded Phatbox can be added to your list.
I'll try to put the support for this into a single binary with detection of the two flashes this evening... thanks for the feedback :)