Volvo DMS patch fails

[heinrichnak]

Tried to patch a Volvo (XC70 model) branded Phatbox, but with no luck. All steps until "!!!!NOW FOR THE IMPORTANT PART!!!! " are successful, but the actual patch of the Phatbox in the car fails. Tried all playlists, waited for several minutes... When I insert the DMS cartridge, the head unit just starts playing music from the cartridge.
The logfiles (/log/Phatpatch.log etc.) are showing "Mismatch!" but no "Verified!" messages.

Is the Volvo branded Phatbox supported by the Phathack method? Any suggestions how to patch this motha?

[judb]

Does it have the latest volvo phat noise firmware on it already?  

post the content of the logs so we can see exactly whats going on.

[heinrichnak]

Firmware is up to date.
I'm not near the car right now, and I'll be away for a week, so I'll post the logs next week.

[heinrichnak]

The logging, as requested.

patch.log:

Code: [Select]


: No such file or directory
2048+0 records in
2048+0 records out

hdparm - get/set hard disk parameters - version v3.9

Usage:  hdparm  [options] [device] ..

Options:
 -a   get/set fs readahead
 -A   set drive read-lookahead flag (0/1)
 -c   get/set IDE 32-bit IO setting
 -C   check IDE power mode status
 -d   get/set using_dma flag
 -D   enable/disable drive defect-mgmt
 -E   set cd-rom drive speed
 -f   flush buffer cache for device on exit
 -g   display drive geometry
 -h   display terse usage information
 -i   display drive identification
 -I   read drive identification directly from drive
 -k   get/set keep_settings_over_reset flag (0/1)
 -K   set drive keep_features_over_reset flag (0/1)
 -L   set drive doorlock (0/1) (removable harddisks only)
 -m   get/set multiple sector count
 -n   get/set ignore-write-errors flag (0/1)
 -p   set PIO mode on IDE interface chipset (0,1,2,3,4,...)
 -P   set drive prefetch count
 -Q   print out the drive id only (60bytes\n)
 -q   change next setting quietly
 -r   get/set readonly flag (DANGEROUS to set)
 -R   register an IDE interface (DANGEROUS)
 -S   set standby (spindown) timeout
 -t   perform device read timings
 -T   perform cache read timings
 -u   get/set unmaskirq flag (0/1)
 -U   un-register an IDE interface (DANGEROUS)
 -v   default; same as -acdgkmnru (-gr for SCSI, -adgr for XT)
 -V   display program version and exit immediately
 -W   set drive write-caching flag (0/1) (DANGEROUS)
 -w   flush os cache and wakeup drive
 -X   set IDE xfer mode (DANGEROUS)
 -y   put IDE drive in standby mode
 -Y   put IDE drive to sleep
 -Z   disable Seagate auto-powersaving mode
PhatPatch v0.4 - original code by bushing, additional patches by sbingner
Verifying:
Patch 1 @ 0bb8: make drive signature check always succeed: [bne verify_sig_failed -> bne PC+1]
Expected: 0000 1a00    Actual: 32c0 e59f
Unverified!
Patch 2 @ 0bec: make rc.sh signature check always succeed: [bne verify_sig_failed -> bne PC+1]
Expected: 0000 1a00    Actual: 329c e59f
Unverified!
Patch 3 @ 0c20: make phatd signature check always succeed: [bne verify_sig_failed -> bne PC+1]
Expected: 0000 1a00    Actual: 326c e59f
Unverified!
Patch 4 @ 0c54: make linux signature check always succeed: [bne verify_sig_failed -> bne PC+1]
Expected: 0000 1a00    Actual: 0003 e152
Unverified!
Patch 5 @ 0354: make ramdisk invalid signature return 0 instead of 0xFFFFFFFF: [movlne r0, 0xFFFFFFFF -> movlne r0, #0]
Expected: 0000 13a0    Actual: 000a aa00
Unverified!
Patch 6 @ 0c80: make ramdisk signature check verify 0 instead of 1: [cmp r0, #1 -> cmp r0, #0]
Expected: 0000 e350    Actual: 3214 e59f
Unverified!
Patch 7 @ 0358: make ramdisk valid signature return 0 instead of 1: [moveq r0, #1 -> moveq r0, #0]
Expected: 0000 03a0    Actual: 3004 e7d5
Unverified!

PatchVerify.log:

Code: [Select]

Starting Patch Process
PhatPatch v0.4 - original code by bushing, additional patches by sbingner
Verifying:
Patch 1 @ 0bb8: make drive signature check always succeed: [bne verify_sig_failed -> bne PC+1]
Expected: 0000 1a00    Actual: 32c0 e59f
Unverified!
Patch 2 @ 0bec: make rc.sh signature check always succeed: [bne verify_sig_failed -> bne PC+1]
Expected: 0000 1a00    Actual: 329c e59f
Unverified!
Patch 3 @ 0c20: make phatd signature check always succeed: [bne verify_sig_failed -> bne PC+1]
Expected: 0000 1a00    Actual: 326c e59f
Unverified!
Patch 4 @ 0c54: make linux signature check always succeed: [bne verify_sig_failed -> bne PC+1]
Expected: 0000 1a00    Actual: 0003 e152
Unverified!
Patch 5 @ 0354: make ramdisk invalid signature return 0 instead of 0xFFFFFFFF: [movlne r0, 0xFFFFFFFF -> movlne r0, #0]
Expected: 0000 13a0    Actual: 000a aa00
Unverified!
Patch 6 @ 0c80: make ramdisk signature check verify 0 instead of 1: [cmp r0, #1 -> cmp r0, #0]
Expected: 0000 e350    Actual: 3214 e59f
Unverified!
Patch 7 @ 0358: make ramdisk valid signature return 0 instead of 1: [moveq r0, #1 -> moveq r0, #0]
Expected: 0000 03a0    Actual: 3004 e7d5
Unverified!


[sbingner]

according to your logs, you might actually have a different firmware.  The patcher won't change it if the old data isn't what's expected....   do you have a dump of the firmware on the old drive now?   I think the patch disk makes one, if so I might be able to look at that

Very strange that your firmware would be different, so far EVERY phatbox has had identical boot firmware

[heinrichnak]

I have copied the content of the PHTSYS partition of the original PMS cartridge to my harddisk. Is firmware.pac what you're looking for? How would you like to receive the firmware?

[judb]

the bootloader from your flash chip would be in the backup folder..  thats what Sam is refering to.  I forget the exact file name but it should be there.  part of our script should make a backup before it runs.  if its not there we can tell you how to modify the script to make a dump.

[heinrichnak]

These files reside in the backup folder:

P0.idx
aadec-hacked
aadec-hacked.sig
patchcomplete.mp3
flacplay-hacked
flacplay-hacked.sig
phatpatch
patch.sh
p0.sig
p0.pbx
p0.m3u
version.txt
phatpatch-v2
flacplay
flacplay.sig
aadec
aadec.sig
drive-sig-1mb.bin
dms-serialnumbeumber.txt

[sbingner]

You don't have what we need - you need to modify the scripts to run:

Code: [Select]

/dos/backup/phatpatch s /dos/backup/flash.rom

[heinrichnak]

Finally got the chance to proceed with this issue. I managed to get the flash.rom from the Volvo.

How can I upload this ROM?

[BigDish]

Didn't the initial Red/Beta Phatbox units not care if the drive was signed (and presumably have a different bootloader?)?  Maybe the OP has one of these?

[judb]

Finally got the chance to proceed with this issue. I managed to get the flash.rom from the Volvo.

How can I upload this ROM?

try emailing sam the rom or hop in the IRC channel.. zip it and put it on rapidshare or something.  

[heinrichnak]

Okay, I sent the firmware to Sam by email. It 's also on Tripod, for those who
are interested:

http://heinrichnak.tripod.com/flash.zip

[sbingner]

It IS different, but similar - should have a patch for you in a few mins

[sbingner]

DISCLAIMER: THIS HAS NOT BEEN TESTED; YOU CAN MAKE YOUR BOX ESSENTIALLY UNBOOTABLE

with that out of the way, you should be fine replacing the 'phatpatch' binary with the file located at http://downloads.phathack.com/sbingner/phatpatch-volvo-0.6.gz (once you extract it with winzip etc)

Source code is at http://downloads.phathack.com/sbingner/phatpatch-volvo-0.6.c

[heinrichnak]

Thanks! I will test this on Sunday (I'm not with the car until then), and let you all know the results.

[heinrichnak]

Just to be sure: the updated patch in the previous post is not gzipped, but it appears to be the binary file itself. Is that correct?

[sbingner]

.gz = it is gzipped

[heinrichnak]

Yeah, that's what I thought... But it isn't recognized by gzip (or any other decompresion utility) as a gzip file.
Also it has the same file structure as my original phatpatch. I'm going to try to patch with this file anyway.

[sbingner]

You browser may have decompressed it inline