BWFWTools - Perl scripts for manipulating Beyonwiz firmware

Advanced Discussions on Programing for & Modifying Beyonwiz Products.

Moderators: Gully, peteru

prl
Wizard God
Posts: 32697
Joined: Tue Sep 04, 2007 13:49
Location: Canberra; Black Mountain Tower transmitters

Post by prl » Fri Jun 19, 2009 13:13

The BWFWTools release page has moved home.

Jani is no longer able to continue supporting the BeyonwizSoftware BB. Many thanks to Jani for providing the service.

BWFWTools releases are now available from the OpenWiz Software page.

Subversion access to the BWFWTools source is unchanged.

The Windows command line disassembler for the ARM processor is also available from the same page (prl din't write that one).
Peter
T4 HDMI
U4, T4, T3, T2, V2 test/development machines
Sony BDV-9200W HT system
LG OLED55C9PTA 55" OLED TV

prl
Wizard God
Posts: 32697
Joined: Tue Sep 04, 2007 13:49
Location: Canberra; Black Mountain Tower transmitters

Post by prl » Mon Jul 20, 2009 15:41

How big is the FV-L1's flash?

I'd like to update BWFWTools to handle FV-L1 firmware update files. I'm pleasantly surprised that unpack_wrp and wrp_hdrs could be made to work just by adding the System Id information for the FV-L1 to wrp_hdrs.

When Dave? added the FV-L1 to the Openwiz Firmware Versions page, he entered a "Spare firmware space" value that appears to be based on the FV-L1 having an 8MB firmware flash. Can anyone confirm this? Dave?

I want to have a solid value for that before I code it into pack_wrp.

It appears that most of the difference in firmware size between the FV-L1 and the non-FV models is due to the FV-L1's wizdvp program (drives most of the PVR & GUI functions) being about 270kB smaller.
Peter
T4 HDMI
U4, T4, T3, T2, V2 test/development machines
Sony BDV-9200W HT system
LG OLED55C9PTA 55" OLED TV

User avatar
peteru
Uber Wizard
Posts: 9730
Joined: Tue Jun 12, 2007 23:06
Location: Sydney, Australia
Contact:

Post by peteru » Mon Jul 20, 2009 16:46

Hanjo mentioned that the DP-P2 flash part is 16MB, but I recall hearing somewhere that only 12MB is addressable.

I would expect that the FV-L1 flash hardware would be similar to the DP-P2.

"Beauty lies in the hands of the beer holder."
Blog.

prl
Wizard God
Posts: 32697
Joined: Tue Sep 04, 2007 13:49
Location: Canberra; Black Mountain Tower transmitters

Post by prl » Mon Jul 20, 2009 17:30

peteru wrote:Hanjo mentioned that the DP-P2 flash part is 16MB, but I recall hearing somewhere that only 12MB is addressable.

I would expect that the FV-L1 flash hardware would be similar to the DP-P2.
Thanks, Peter.

The 12MB wasn't in Hanjo's post in the beta forum about the DP-P2 flash (apologies to non-beta folk for the non-accessible link). It looks like I'll have to get my hands dirty and delve into the kernel binaries to look at the blkmem arena array :(.

Unless someone can post the results of "cat /dev/mtd" on the DP-P2 and the FV-L1. That would be nice :)
Peter
T4 HDMI
U4, T4, T3, T2, V2 test/development machines
Sony BDV-9200W HT system
LG OLED55C9PTA 55" OLED TV

User avatar
DaveR
Wizard
Posts: 2527
Joined: Tue May 29, 2007 01:24
Location: Sydney

Post by DaveR » Mon Jul 20, 2009 20:34

prl wrote:Unless someone can post the results of "cat /dev/mtd" on the DP-P2 and the FV-L1. That would be nice :)
I'll have a look... if I have time and remember...

From what I've seen I suspect that the FV-L1 is a lot closer to a DP-P1 than a DP-P2 (hardware wise). I've even seen a DP-P1 with a SATA HDD, running regular DP-P1 firmware... and bootloader apparently (but I didn't get time to check the bootloader version myself). You guys are clever enough to realise what that means for adventurous FV-L1 owners. Hmm, note to self "check bootloader version on FV-L1 and compare to DP-P1".
cheers
DaveR

IceTV, T4, T3, T2, P2, S1, FV-L1(P1 fw), TRF-2460, HDR-7500 and Skippa

prl
Wizard God
Posts: 32697
Joined: Tue Sep 04, 2007 13:49
Location: Canberra; Black Mountain Tower transmitters

Post by prl » Mon Jul 20, 2009 21:33

Dave? wrote:...You guys are clever enough to realise what that means for adventurous FV-L1 owners. Hmm, note to self "check bootloader version on FV-L1 and compare to DP-P1".
Hmmm... where can I get my hands on an FV-L1 (or a DP-P1, for that matter). :twisted:

Do FV-L1's sell above or below the price for a P1? :wink:
Peter
T4 HDMI
U4, T4, T3, T2, V2 test/development machines
Sony BDV-9200W HT system
LG OLED55C9PTA 55" OLED TV

prl
Wizard God
Posts: 32697
Joined: Tue Sep 04, 2007 13:49
Location: Canberra; Black Mountain Tower transmitters

Post by prl » Mon Jul 20, 2009 21:35

Dave? wrote:
prl wrote:Unless someone can post the results of "cat /dev/mtd" on the DP-P2 and the FV-L1. That would be nice :)
I'll have a look... if I have time and remember...
...
Thanks! :)
Peter
T4 HDMI
U4, T4, T3, T2, V2 test/development machines
Sony BDV-9200W HT system
LG OLED55C9PTA 55" OLED TV

User avatar
DaveR
Wizard
Posts: 2527
Joined: Tue May 29, 2007 01:24
Location: Sydney

Post by DaveR » Mon Jul 20, 2009 22:54

prl wrote:Do FV-L1's sell above or below the price for a P1? :wink:
320GB FV-L1 RRP is $749
500GB FV-L1 RRP is $849
250GB DP-P1 was RRP $899 (no longer in production)
cheers
DaveR

IceTV, T4, T3, T2, P2, S1, FV-L1(P1 fw), TRF-2460, HDR-7500 and Skippa

prl
Wizard God
Posts: 32697
Joined: Tue Sep 04, 2007 13:49
Location: Canberra; Black Mountain Tower transmitters

Post by prl » Mon Jul 20, 2009 23:10

Dave? wrote:
prl wrote:Do FV-L1's sell above or below the price for a P1? :wink:
320GB FV-L1 RRP is $749
500GB FV-L1 RRP is $849
250GB DP-P1 was RRP $899 (no longer in production)
I see what you mean about "adventurous owners," then :D
Peter
T4 HDMI
U4, T4, T3, T2, V2 test/development machines
Sony BDV-9200W HT system
LG OLED55C9PTA 55" OLED TV

prl
Wizard God
Posts: 32697
Joined: Tue Sep 04, 2007 13:49
Location: Canberra; Black Mountain Tower transmitters

Post by prl » Tue Jul 21, 2009 18:06

Dave? wrote:
prl wrote:Unless someone can post the results of "cat /dev/mtd" on the DP-P2 and the FV-L1. That would be nice :)
I'll have a look... if I have time and remember...
...
I now have a script that can extract the blkmem driver arena (for root file system and /flash space allocations) and the /dev/mtd driver partition definitions, so I can find out the sizes of these things just from the firmware, without needing to have the machine.

The DP-S1 definitely has a 16MiB flash. 15.5MiB is available for the /flash device (16MiB - 4*128kiB for the other flash partitions for config, boot, etc).

The other models (DP & FV) have 8MB flash, of which 8MiB-5*64kiB is available for /flash.

The definition of the blkmem device for /flash is weird, though. On all the models with 8MiB flash, the blkmem device is defined to be 64kiB larger than the space allocated for /dev/mtd1 where the /flash file system lives. This means that the blkmem device maps both the /flash filesystem in /dev/mtd1 and the Config1 flash partition in /dev/mtd2 into the same Unix block device. I have no idea whether that is deliberate.

Even weirder is that on the P2, the /flash blkmem partition, instead of being 16252928 (0xf80000) bytes (16Mib-4*64kiB), the same as /dev/mtd1, or 16384000 (0xfa0000) bytes (16Mib-3*64kiB), the size of /mtd1 + /mtd2 (consistent with how the other models are set up, it's a whopping 263192576 (0x0fb00000) bytes (251MiB!), way larger than the flash chip. I think that it may have been intended to be 0xfa0000, and there's been a bit of a typo! :)

Kernel debugging from the raw binary. Got to love it :)
Peter
T4 HDMI
U4, T4, T3, T2, V2 test/development machines
Sony BDV-9200W HT system
LG OLED55C9PTA 55" OLED TV

prl
Wizard God
Posts: 32697
Joined: Tue Sep 04, 2007 13:49
Location: Canberra; Black Mountain Tower transmitters

Post by prl » Sun Aug 02, 2009 17:19

A new version of BWFWTools (0.2.2) is available from the OpenWiz Software page.

It adds support for the FV-L1 machine codes. It also requires a newer version of the Perl IO::Compress::Gunzip package (2.017). Firmware unpack & repack tools exit with an error message if your version of Gunzip isn't up to date.
Peter
T4 HDMI
U4, T4, T3, T2, V2 test/development machines
Sony BDV-9200W HT system
LG OLED55C9PTA 55" OLED TV

jim16
Apprentice
Posts: 19
Joined: Thu Feb 14, 2008 07:15

Post by jim16 » Sat Aug 08, 2009 08:39

Hi prl,

Just attempted to patch the DPP2 301 firmware with the Telnet hack and got the following:

Code: Select all

user@user-desktop:~/Desktop/Misc/Wiz FW Hacking/BWFWTools$ ./bw_patcher.pl ../DPP2_Firmware_04Jun2009_ver_01.05.301.wrp ../DPP2Patched301.wrp Beyonwiz::Hack::Telnet
Extract application file system ../DPP2_Firmware_04Jun2009_ver_01.05.301.wrp into /tmp/flash26787
romfs image name: `mambo'
romfs image size: 7954960
Extract root file system into /tmp/root26787
Context for arena - Expected 0xe59f927c at 0x90097bd4 in /tmp/linux.bin: got 0xe1833c21
Context for arena - Expected 0xe59f927c at 0x90097bd0 in /tmp/linux.bin: got 0xe1833422
Context for arena - Expected 0xe59f927c at 0x90097b48 in /tmp/linux.bin: got 0xe91ba800
1 error in finding kernel symbols
Extraction of /tmp/flash26787/root.romfs from /tmp/linux.bin failed
Unpack of ../DPP2_Firmware_04Jun2009_ver_01.05.301.wrp into /tmp/flash26787 and /tmp/root26787 failed
I have downloaded the firmware multiple times via multiple methods from both wiztv and beyonwiz sites to rule out a corrupt download. Every download has the following size

Code: Select all

user@user-desktop:~/Desktop/Misc/Wiz FW Hacking$ ls -l DPP2*
-rw-r--r-- 1 user user 7956480 2009-08-08 08:23 DPP2_Firmware_04Jun2009_ver_01.05.301.wrp
Tried on a Windows VM and get the same error output.
When I attempt 280 or 261 firmware versions they work as expected with no errors.
Using the latest version detailed in the post above.

Any ideas? Is there something special needed for 301 firmwares?

Jim16

prl
Wizard God
Posts: 32697
Joined: Tue Sep 04, 2007 13:49
Location: Canberra; Black Mountain Tower transmitters

Post by prl » Sat Aug 08, 2009 09:56

jim16 wrote:Hi prl,

Just attempted to patch the DPP2 301 firmware with the Telnet hack and got the following:

Code: Select all

user@user-desktop:~/Desktop/Misc/Wiz FW Hacking/BWFWTools$ ./bw_patcher.pl ../DPP2_Firmware_04Jun2009_ver_01.05.301.wrp ../DPP2Patched301.wrp Beyonwiz::Hack::Telnet
Extract application file system ../DPP2_Firmware_04Jun2009_ver_01.05.301.wrp into /tmp/flash26787
romfs image name: `mambo'
romfs image size: 7954960
Extract root file system into /tmp/root26787
Context for arena - Expected 0xe59f927c at 0x90097bd4 in /tmp/linux.bin: got 0xe1833c21
Context for arena - Expected 0xe59f927c at 0x90097bd0 in /tmp/linux.bin: got 0xe1833422
Context for arena - Expected 0xe59f927c at 0x90097b48 in /tmp/linux.bin: got 0xe91ba800
1 error in finding kernel symbols
Extraction of /tmp/flash26787/root.romfs from /tmp/linux.bin failed
Unpack of ../DPP2_Firmware_04Jun2009_ver_01.05.301.wrp into /tmp/flash26787 and /tmp/root26787 failed
I have downloaded the firmware multiple times via multiple methods from both wiztv and beyonwiz sites to rule out a corrupt download. Every download has the following size

Code: Select all

user@user-desktop:~/Desktop/Misc/Wiz FW Hacking$ ls -l DPP2*
-rw-r--r-- 1 user user 7956480 2009-08-08 08:23 DPP2_Firmware_04Jun2009_ver_01.05.301.wrp
Tried on a Windows VM and get the same error output.
When I attempt 280 or 261 firmware versions they work as expected with no errors.
Using the latest version detailed in the post above.

Any ideas? Is there something special needed for 301 firmwares?

Jim16
I don't always test the pack/unpack code on all models. The bit of code that's failing is where unpack_wrp is trying to extract the ROMFS root file system from the middle of the kernel. It looks for some instruction context when it gets the start address of the root file system, and fails if the context is wrong. That's what the "Context" errors are about. What version od BWFWTools are you using? The location of the ROMFS address changed in Beyonwiz firmware 01.05.283, and only more recent versions of BWFWTools have the correct address.. I'll try to check it this weekend and post a quick fix release if necessary.
Peter
T4 HDMI
U4, T4, T3, T2, V2 test/development machines
Sony BDV-9200W HT system
LG OLED55C9PTA 55" OLED TV

jim16
Apprentice
Posts: 19
Joined: Thu Feb 14, 2008 07:15

Post by jim16 » Sat Aug 08, 2009 10:06

prl wrote:What version od BWFWTools are you using?
BWFWTools-0.2.2


jim16

prl
Wizard God
Posts: 32697
Joined: Tue Sep 04, 2007 13:49
Location: Canberra; Black Mountain Tower transmitters

Post by prl » Sat Aug 08, 2009 11:49

jim16 wrote:
prl wrote:What version od BWFWTools are you using?
BWFWTools-0.2.2


jim16
Hi, jim16. I'm afraid I can't reproduce the problem you're seeing, either with my installed copy of BWFWTools 0.2.2 or with a fresh download of the ZIP file from OpenWiz.

My best guess is that the copy of BWFWTools you are running isn't using the correct Beyonwiz::Kernel module, where all the kernel addresses I use are stored. This could be because the perl programs in BWFWTools are picking up old versions of the modules from the perl module search path. Is your PERLLIB environment variable set to something that could cause that? The correct arena values in Beyonwiz/Kernel.pm are:

Code: Select all

    arena => [
        [
            {   # before 01.05.243, and FV-L1 01.07.12 and earlier
                loc => 0x90097e58,
                magics => [
                    [ 0x90097bd4, 0xe59f927c ],
                 ]
            },
        ],
        [
            {   # 01.05.243 and before 01.05.269
                loc => 0x90097e54,
                magics => [
                    [ 0x90097bd0, 0xe59f927c ],
                 ]
            },
        ],
        [
            {   # 01.05.269 and later
                loc => 0x90097dcc,
                magics => [
                    [ 0x90097b48, 0xe59f927c ],
                 ]
            },
        ],
        [
            {   # 01.05.283 and later
                loc => 0x90097de8,
                magics => [
                    [ 0x90097b64, 0xe59f927c ],
                 ]
            },
        ],
    ],
For recent firmware you need to have the "01.05.283 and later" entry in the Beyonwiz::Kernel package that's loaded by unpack_wrp.pl (which is run from bw_patcher.pl).

You can check whether you're loading the module that you think you are by first checking whether Beyonwiz/Kernel.pm contains the correct values in the arena data, and then changing the start of the Beyonwiz/Kernel.pm (make a backup copy of it first, perhaps) from

Code: Select all

package Beyonwiz::Kernel;

to

Code: Select all

package Beyonwiz::Kernel;

warn "Loading 0.2.2 Beyonwiz::Kernel\n";

and running bw_patcher.pl. If it prints Loading 0.2.2 Beyonwiz::Kernel somewhere before the error messages, then it is loading the correct module, and we need to dig a bit deeper. If it doesn't print the "Loading" string, then it's loading some older copy of the module, and you need to find it and delete it.

What system are you running BWFWTools on? Have you done a "make install"? Is your PERLLIB environment variable set?
Peter
T4 HDMI
U4, T4, T3, T2, V2 test/development machines
Sony BDV-9200W HT system
LG OLED55C9PTA 55" OLED TV

jim16
Apprentice
Posts: 19
Joined: Thu Feb 14, 2008 07:15

Post by jim16 » Sun Aug 09, 2009 17:08

Hi prl,

Thanks for your help all is working now. Was exactly what you suggested. It was using an old version that I must have manually installed rather than the make install.

jim16

prl
Wizard God
Posts: 32697
Joined: Tue Sep 04, 2007 13:49
Location: Canberra; Black Mountain Tower transmitters

Post by prl » Sun Aug 09, 2009 18:14

jim16 wrote:Hi prl,

Thanks for your help all is working now. Was exactly what you suggested. It was using an old version that I must have manually installed rather than the make install.

jim16
I'm gald you've sorted it. Happy hacking!

The next version will have version compatibilty checking. :)

Cheers,
Peter
T4 HDMI
U4, T4, T3, T2, V2 test/development machines
Sony BDV-9200W HT system
LG OLED55C9PTA 55" OLED TV

jim16
Apprentice
Posts: 19
Joined: Thu Feb 14, 2008 07:15

Post by jim16 » Thu Aug 13, 2009 16:19

Hi all,

I have successfully patched the DPP2 301 firmware enabling telnet using the Beyonwiz::Hack::Telnet via this utility.

Does this method retain the hack on a firmware upgrade?

If not what should I modify to ensure this hack stays when another firmware upgrade becomes available? Reading the WizRemote thread there is mention of the /tmp/config folder. Is it a matter of editing a file in there e.g. rc.local

jim16

prl
Wizard God
Posts: 32697
Joined: Tue Sep 04, 2007 13:49
Location: Canberra; Black Mountain Tower transmitters

Post by prl » Thu Aug 13, 2009 17:21

jim16 wrote:Hi all,

I have successfully patched the DPP2 301 firmware enabling telnet using the Beyonwiz::Hack::Telnet via this utility.

Does this method retain the hack on a firmware upgrade?

If not what should I modify to ensure this hack stays when another firmware upgrade becomes available? Reading the WizRemote thread there is mention of the /tmp/config folder. Is it a matter of editing a file in there e.g. rc.local

jim16
The Beyonwiz::Hack::Telnet hack only enables telnet for that copy of the firmware. If you upload unhacked firmware, telnet goes away. There's a good and a bad aspect to this.

If you hack the firmware using Beyonwiz::Hack::BwhackSupport, that installs a /tmp/config/rc.local file that allows you to enable and disable various small hacks remotely, including the telnet hack. The script bwhack.pl does the enabling and disabling, then you restart. Because the "real" hack script is in /tmp/config it isn't affected by firmware upgrades,(and is saved/restored along with the rest of the config suuff across standby). The procedure for uninstalling it is in te documentation.

You can also write your own rc.local and use the telnet hack to copy it from a Windows share. That way you can add anything you like to the startup of the Beyonwiz, provided the command to do it is in the firmware. Tonymy01 has quite an elaborate hacked firmware setup, including extra compiled commands stored on the HDD on his BW.
Peter
T4 HDMI
U4, T4, T3, T2, V2 test/development machines
Sony BDV-9200W HT system
LG OLED55C9PTA 55" OLED TV

User avatar
tonymy01
Uber Wizard
Posts: 6373
Joined: Fri Jun 01, 2007 15:25
Location: Sydney, Australia DP-S1-1TB, DP-P2-2TB, DP-T4-2TB, DP-T4-BB... too many!
Contact:

Post by tonymy01 » Thu Aug 13, 2009 19:12

Although now the ntp client is no longer of use since 301 (or was it 280?) since it was introduced into the f/w finally... so I don't run any bins now. But I do mount /tmp/mnt/idehdd/.whatever to /opt and when I telnet in, I have the path setup to include bins from /opt (and the login uses a better bash/etc from a newer busybox I compiled up and is running in /opt/bin).
I modded the usb hack script to be 99% the example one you had in one of these threads, thanks to your superior shell programming skills (only looking for Sab_script and looking thru all mount points rather than just the handful I was doing), but I don't use this myself, some people are more interested in doing it this way with the USB inserted to enable the mod, removed disables the mod, where as I can do anything from the console & telnet shell anyway (including edit the rc.local to add startup stuff).

edit:
wow, I really need to work on making my messages comprehensible. What I was trying to say was that I have somewhere a better USB tweak system but don't personally use it... I have given it as an update script to those who had my original one running that asked for it (only about 3 people I think).
Regards
Tony

prl
Wizard God
Posts: 32697
Joined: Tue Sep 04, 2007 13:49
Location: Canberra; Black Mountain Tower transmitters

Post by prl » Fri Aug 14, 2009 08:56

tonymy01 wrote:... What I was trying to say was that I have somewhere a better USB tweak system but don't personally use it... I have given it as an update script to those who had my original one running that asked for it (only about 3 people I think).
Regards
I took your (old?) USB tweak system and adapted it so it can be installed in the firmware using a bw_patcher module. In fact two bw_patcher modules support it, Beyonwiz::Hack::USBSupport, and Beyonwiz::Hack::BwhackSupport. The first one works on all BW models (as far as I know), and Beyonwiz::Hack::BwhackSupport only works on internal HDD models. With Beyonwiz::Hack::BwhackSupport you can turn the USB tweak capability on and off remotely.

I'd be interested in looking at your newer one to see if there are any ideas I can pinch form it :) Edit: On re-reading your posts it looks like most of your changes are taken from my USB tweal script, but I'd be interested in looking anyway.
Peter
T4 HDMI
U4, T4, T3, T2, V2 test/development machines
Sony BDV-9200W HT system
LG OLED55C9PTA 55" OLED TV

jim16
Apprentice
Posts: 19
Joined: Thu Feb 14, 2008 07:15

Post by jim16 » Fri Aug 14, 2009 09:51

Hi prl,

Thanks for the details. I created a simple rc.local file in vi (Good to see the wiz has this) that loads wizremote and starts telnet on the presense of a folder on the HDD. I have also included the wait until hard drive is started to allow the disk check to still work.

jim16

prl
Wizard God
Posts: 32697
Joined: Tue Sep 04, 2007 13:49
Location: Canberra; Black Mountain Tower transmitters

Post by prl » Fri Aug 14, 2009 09:58

jim16 wrote:Hi prl,

Thanks for the details. I created a simple rc.local file in vi (Good to see the wiz has this) that loads wizremote and starts telnet on the presense of a folder on the HDD. I have also included the wait until hard drive is started to allow the disk check to still work.

jim16
Sounds good. The presence of vi in the firmware is not guaranteed. It's more often seen in beta versions than in releases, but it's very handy when it is there.
Peter
T4 HDMI
U4, T4, T3, T2, V2 test/development machines
Sony BDV-9200W HT system
LG OLED55C9PTA 55" OLED TV

jim16
Apprentice
Posts: 19
Joined: Thu Feb 14, 2008 07:15

Post by jim16 » Fri Aug 14, 2009 10:09

prl wrote:Sounds good. The presence of vi in the firmware is not guaranteed. It's more often seen in beta versions than in releases, but it's very handy when it is there.
It was certainly a suprise to find it but very nice to have.

User avatar
tonymy01
Uber Wizard
Posts: 6373
Joined: Fri Jun 01, 2007 15:25
Location: Sydney, Australia DP-S1-1TB, DP-P2-2TB, DP-T4-2TB, DP-T4-BB... too many!
Contact:

Post by tonymy01 » Fri Aug 14, 2009 18:51

prl wrote:I'd be interested in looking at your newer one to see if there are any ideas I can pinch form it :) Edit: On re-reading your posts it looks like most of your changes are taken from my USB tweal script, but I'd be interested in looking anyway.
It is 99.9% your idea from an old thread:

Code: Select all

#!/bin/sh
PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/flash/bin; export PATH
sleep 2
echo `date -u` >>/tmp/tweakbootlog
MNTPT=/tmp/mnt/usbtemp
/bin/mkdir $MNTPT

for dev in /dev/scsi/host[12]/bus*/target*/lun*/part*; do
    if [ -b $dev ]; then
        for type in vfat ntfs; do
            if mount -t $type $dev $MNTPT; then
                if [ -d $MNTPT/etc/init.d ]; then
				  for z in $MNTPT/etc/init.d/S[0-9][0-9]* ; do 
                   echo "loading tweak $z" >>/tmp/tweakbootlog
				   . $z
				  done
                fi
				cat /tmp/tweakbootlog >> $MNTPT/etc/tweakbootlog.txt
                umount $dev
                break        # don't bother trying another type if one works
            fi
        done
    fi
done
/bin/rmdir $MNTPTse
edit:keh? How did that "se" get tacked on there? Strange.. will have to fix that.
Regards
Tony

prl
Wizard God
Posts: 32697
Joined: Tue Sep 04, 2007 13:49
Location: Canberra; Black Mountain Tower transmitters

Post by prl » Mon Sep 27, 2010 12:25

A new version of BWFWTools (0.2.3) is available.

It adds support for the DP-Lite machine codes and for firmware 01.07.035 and more recent versions of that firmware line (support for the 01.05 line continues). It includes a new tool, print_flash.pl, which extracts and prints the sizes of the flash memory partitions from an uncompressed Beyonwiz kernel file (linux.bin).

It requires version 20100914 of Wiz Firmware Tools. Executable for Windows and Cygwin are included in the BWFWTools distribution.
Peter
T4 HDMI
U4, T4, T3, T2, V2 test/development machines
Sony BDV-9200W HT system
LG OLED55C9PTA 55" OLED TV

prl
Wizard God
Posts: 32697
Joined: Tue Sep 04, 2007 13:49
Location: Canberra; Black Mountain Tower transmitters

Post by prl » Sat Jan 29, 2011 17:40

A new version of BWFWTools (0.2.4) is available.

It adds a new hack module for bw_patcher.pl that allows the remote control codeset in the Beyonwiz firmware to be changed.

This makes it possible to, for example, make a non-DP-P2 Beyonwiz to use the DP-P2's codeset. It also allows the other codesets (DP-P2 uses codeset 1, and the other Beyonwizes use codeset 0) to be set in the firmware. The DP-P2's remote, the BR-02 can be set to use any of the codesets 0..7 by pressing and holding down buttons 1..8 while holding down OK (until the STB led flashes three times). The button must be 1 greater than the codeset used on the Beyonwiz. I've confirmed this for codesets 0, 1, 2 and 7 on my correspondingly codeset-hacked DP-H1

It requires version 20110129 of Wiz Firmware Tools. Executable for Windows and Cygwin are included in the BWFWTools distribution.[/quote]
Peter
T4 HDMI
U4, T4, T3, T2, V2 test/development machines
Sony BDV-9200W HT system
LG OLED55C9PTA 55" OLED TV

pbezza
Apprentice
Posts: 22
Joined: Sun Oct 24, 2010 14:34
Location: Baranduda

Post by pbezza » Thu Jul 28, 2011 16:13

I'm trying to apply the Telnet patch in Win XP but don't understand how to add gunzip.pl in active perl. I have manually copied all the files from gzip's bin directory to the BWFWTools directory which allows me to use the scripts but would rather have the gunzip package installed.

I successfully used the below command to add telnet support, how do I confirm the patch worked?
bw_patcher.pl -c 9 OrigFw.wrp PatchedFw.wrp Beyonwiz::Hack::Telnet

prl
Wizard God
Posts: 32697
Joined: Tue Sep 04, 2007 13:49
Location: Canberra; Black Mountain Tower transmitters

Post by prl » Thu Jul 28, 2011 23:00

pbezza wrote:I'm trying to apply the Telnet patch in Win XP but don't understand how to add gunzip.pl in active perl. I have manually copied all the files from gzip's bin directory to the BWFWTools directory which allows me to use the scripts but would rather have the gunzip package installed.
There are instructions about how to add the necessary packages in the README.txt file in the distribution.
pbezza wrote: I successfully used the below command to add telnet support, how do I confirm the patch worked?
bw_patcher.pl -c 9 OrigFw.wrp PatchedFw.wrp Beyonwiz::Hack::Telnet
Two methods - load the firmware onto the Beyonwiz and try to telnet in, or unpack the modified firmware and the unmodified firmware and do a recursive diff on the corresponding unpacked directories to check what changes were made. Unfortunately, you have to know what the patch is supposed to do for the second one :) But it's a pretty simple patch.

Beyonwiz::Hack::Telnet is pretty reliable, though.

Just out of curiosity: once you've telnetted in, what do you want to do?
Peter
T4 HDMI
U4, T4, T3, T2, V2 test/development machines
Sony BDV-9200W HT system
LG OLED55C9PTA 55" OLED TV

pbezza
Apprentice
Posts: 22
Joined: Sun Oct 24, 2010 14:34
Location: Baranduda

Post by pbezza » Fri Jul 29, 2011 08:00

Cheers.
Telnet required for WizRemote.

Unfortunately my DP-P2 has error 0000 at the moment and it is getting repaired. Fingers crossed I have it back shortly.

pbezza
Apprentice
Posts: 22
Joined: Sun Oct 24, 2010 14:34
Location: Baranduda

Post by pbezza » Sat Oct 22, 2011 13:53

My DP-P2 was repaired and I just remembered that I hadn't patched the firmware for Telnet access.

After successfully patching the firmware I tried to apply it to the DP-P2 but it says "Firmware version is not recognizable".

How do I get around this?

prl
Wizard God
Posts: 32697
Joined: Tue Sep 04, 2007 13:49
Location: Canberra; Black Mountain Tower transmitters

Post by prl » Sat Oct 22, 2011 16:28

pbezza wrote:My DP-P2 was repaired and I just remembered that I hadn't patched the firmware for Telnet access.

After successfully patching the firmware I tried to apply it to the DP-P2 but it says "Firmware version is not recognizable".

How do I get around this?
Beats me. I've never had that problem. Exactly what did you do?
Peter
T4 HDMI
U4, T4, T3, T2, V2 test/development machines
Sony BDV-9200W HT system
LG OLED55C9PTA 55" OLED TV

pbezza
Apprentice
Posts: 22
Joined: Sun Oct 24, 2010 14:34
Location: Baranduda

Post by pbezza » Sat Oct 22, 2011 21:04

I've tried the BWFWTools Pearl script to patch the firmware - DPP2_Firmware_30Nov2010_ver_0107350.wrp

Also tried the WizToolsGUI but it didn't have the DP-P2 to repack so I repacked via command line with WizFwTools using this command:
wiz_pack -T 090800000A229E3C -V wiz_pack -i newimage.img -o P2Telnet350.wrp

But DP-P2 still doesn't like the .wrp file.

prl
Wizard God
Posts: 32697
Joined: Tue Sep 04, 2007 13:49
Location: Canberra; Black Mountain Tower transmitters

Post by prl » Sat Oct 22, 2011 22:34

You still haven't really told me what you've done. Anyway, the simplest way to apply the telnet patch to firmware is:

bw_patcher.pl unpatched_firmware.wrp patched_firmware.wrp Beyonwiz::Hack::Telnet

If you're running this on Windows and haven't put the BWFWTools Beyonwiz Perl (no 'a' in this Perl) you'll need to run bw_patcher.pl in the BWFWTools source directory.

I'm not sure why the P2 doesn't recognise the firmware you've packed that way with wiz_pack. That may be because I haven't got a clue how the newimage.img file you're passing to wiz_pack has been created. The firmware version number is encoded in a file name in the firmware package (it appears in the directory /flash/version when the firmware is running). It could be that that filename was mangled somehow.

By the way, if you want to specify a Beyonwiz machine type to any of the BWFWTools commands, -t DP-P2 is much easier to type than -T 090800000A229E3C.
Peter
T4 HDMI
U4, T4, T3, T2, V2 test/development machines
Sony BDV-9200W HT system
LG OLED55C9PTA 55" OLED TV

pbezza
Apprentice
Posts: 22
Joined: Sun Oct 24, 2010 14:34
Location: Baranduda

Post by pbezza » Sun Oct 23, 2011 06:09

Yes, perl script I meant
bw_patcher.pl unpatched_firmware.wrp patched_firmware.wrp Beyonwiz::Hack::Telnet

Which says "Firmware version is not recognizable".

Can you send me a patched .wrp file?

prl
Wizard God
Posts: 32697
Joined: Tue Sep 04, 2007 13:49
Location: Canberra; Black Mountain Tower transmitters

Post by prl » Sun Oct 23, 2011 09:50

pbezza wrote:Yes, perl script I meant
bw_patcher.pl unpatched_firmware.wrp patched_firmware.wrp Beyonwiz::Hack::Telnet

Which says "Firmware version is not recognizable".

Can you send me a patched .wrp file?
I don't distribute hacked Beyonwiz firmware. I will try reproducing the problem on my Lite. I don't have a P2 that I can use. It may help if you posted the output of bw_patcher. By the way, your post above makes it sound as though "Firmware version is not recognizable" comes from bw_patcher, but in I assume you didn't intend that.
Peter
T4 HDMI
U4, T4, T3, T2, V2 test/development machines
Sony BDV-9200W HT system
LG OLED55C9PTA 55" OLED TV

prl
Wizard God
Posts: 32697
Joined: Tue Sep 04, 2007 13:49
Location: Canberra; Black Mountain Tower transmitters

Post by prl » Sun Oct 23, 2011 15:13

I just tried using bw_patcher.pl from BWFWTools 0.2.4, and it didn't work at all on Win7 - no patched .wrp file was created. That obviously needs fixing, but which version of BWFWTools are you using and on what operating system? I've assumed some variety of Windows, but you haven't even said whether it's Windows at all.
Peter
T4 HDMI
U4, T4, T3, T2, V2 test/development machines
Sony BDV-9200W HT system
LG OLED55C9PTA 55" OLED TV

pbezza
Apprentice
Posts: 22
Joined: Sun Oct 24, 2010 14:34
Location: Baranduda

Post by pbezza » Sun Oct 23, 2011 16:07

BWFWTools-0.2.4

I'm using Windows 7 Pro x64.

I downloaded Gzip and placed the gzip.exe and gunzip file in the same directory as BWFWTools which made the perl scripts function without errors.

prl
Wizard God
Posts: 32697
Joined: Tue Sep 04, 2007 13:49
Location: Canberra; Black Mountain Tower transmitters

Post by prl » Sun Oct 23, 2011 16:26

pbezza wrote:BWFWTools-0.2.4

I'm using Windows 7 Pro x64.

I downloaded Gzip and placed the gzip.exe and gunzip file in the same directory as BWFWTools which made the perl scripts function without errors.
Could you post the output of a run of bw_patcher, including cut/pasting the command as it was run?

The gzip executable was inadvertently left out of the distribution, and a bug prevented the Perl Gzip module from taking over to do the compression in its place.
Peter
T4 HDMI
U4, T4, T3, T2, V2 test/development machines
Sony BDV-9200W HT system
LG OLED55C9PTA 55" OLED TV

prl
Wizard God
Posts: 32697
Joined: Tue Sep 04, 2007 13:49
Location: Canberra; Black Mountain Tower transmitters

Post by prl » Sun Oct 23, 2011 17:59

I've just built a telnet-patched .wrp for my DP-Lite on Win7 Home Premium with bw_patcher.pl ... Beyonwiz::Hack::Telnet using the gzip executable from Cygwin for compression; it loaded without any issues, and I can telnet in. I'll try again tomorrow using the gzip windows native binary and see if that makes a difference.
Peter
T4 HDMI
U4, T4, T3, T2, V2 test/development machines
Sony BDV-9200W HT system
LG OLED55C9PTA 55" OLED TV

pbezza
Apprentice
Posts: 22
Joined: Sun Oct 24, 2010 14:34
Location: Baranduda

Post by pbezza » Sun Oct 23, 2011 19:04

Cheers. Maybe I'll have to go down this road as well. Could be a compatibility issue with the Windows gzip?

prl
Wizard God
Posts: 32697
Joined: Tue Sep 04, 2007 13:49
Location: Canberra; Black Mountain Tower transmitters

Post by prl » Sun Oct 23, 2011 21:50

pbezza wrote:Cheers. Maybe I'll have to go down this road as well. Could be a compatibility issue with the Windows gzip?
As I said, it's a possibility I intend to test.
prl wrote:Could you post the output of a run of bw_patcher, including cut/pasting the command as it was run?
Peter
T4 HDMI
U4, T4, T3, T2, V2 test/development machines
Sony BDV-9200W HT system
LG OLED55C9PTA 55" OLED TV

prl
Wizard God
Posts: 32697
Joined: Tue Sep 04, 2007 13:49
Location: Canberra; Black Mountain Tower transmitters

Post by prl » Mon Oct 24, 2011 17:46

Hi, pbezza.

I've tried creating a bw_patcher.pl ... Beyonwiz::Hack::Telnet patched .wrp for my Lite using the native Windows version of gzip instead of the usual Cygwin version. Same result as before - no problem.

Do you know for sure that the source .wrp file that you're using as the input to bw_patcher is OK? Does it load on your P2?

If you run wrp_hdrs.pl on your patched .wrp file, what is the output?

I'd still be interested in seeing the output from your run of bw_patcher.pl.

Beyond that, all I can suggest is to unpack both the patched and unpatched versions of the firmware with unpack_wrp.pl and compare the corresponding root and flash file systems to see whether they differ in unexpected places, e.g. using diff -r on Unixoid systems. I don't know if there's a comparable tool for Windows.

I will try doing that with the same DP-P2 firmware package you're trying, and see if there's anything obvious that's being broken.
Peter
T4 HDMI
U4, T4, T3, T2, V2 test/development machines
Sony BDV-9200W HT system
LG OLED55C9PTA 55" OLED TV

pbezza
Apprentice
Posts: 22
Joined: Sun Oct 24, 2010 14:34
Location: Baranduda

Post by pbezza » Tue Oct 25, 2011 17:50

Thanks prl.

I'm out of the country for a bit. I'll try your suggestions when I get back. Will post results.

prl
Wizard God
Posts: 32697
Joined: Tue Sep 04, 2007 13:49
Location: Canberra; Black Mountain Tower transmitters

Post by prl » Mon Oct 31, 2011 13:04

I have run bw_patcher.pl ... Beyonwiz::Hack::Telnet on DPP2_Firmware_30Nov2010_ver_0107350.wrp, then unpacked both the original and the modified .wrp's, and compared them. The hack module appears to me to be doing exactly the right thing. I'm not in a position to try out the modified firmware on anything.
Peter
T4 HDMI
U4, T4, T3, T2, V2 test/development machines
Sony BDV-9200W HT system
LG OLED55C9PTA 55" OLED TV

pbezza
Apprentice
Posts: 22
Joined: Sun Oct 24, 2010 14:34
Location: Baranduda

Post by pbezza » Tue Nov 01, 2011 08:54

Can you give me a megaupload link and I'll see if it works on my P2?

That's the same firmware version I patched and it's also the same version I've currently got on my P2. The 30Nov2010_ver_0107350 firmware might thoroughly inspect the firmware file and is rejecting it because it has been modified? Backrolling to an older firmware then applying the patched 30Nov2010_ver_0107350 firmware could be a way around this?

prl
Wizard God
Posts: 32697
Joined: Tue Sep 04, 2007 13:49
Location: Canberra; Black Mountain Tower transmitters

Post by prl » Tue Nov 01, 2011 13:38

pbezza wrote:Can you give me a megaupload link and I'll see if it works on my P2?

That's the same firmware version I patched and it's also the same version I've currently got on my P2. The 30Nov2010_ver_0107350 firmware might thoroughly inspect the firmware file and is rejecting it because it has been modified? Backrolling to an older firmware then applying the patched 30Nov2010_ver_0107350 firmware could be a way around this?
I've used patched 01.05.350 firmware on my H1 (the Beyonwiz::Hack::Codeset hack runs in my normal H1 firmware) and I've run my DP-Lite with 01.07.350 patched with Beyonwiz::Hack::Telnet. There doesn't seem to be any generic check for hacked firmware in 01.07.350, but of course I can't discount the possibility that there's something different on the DP-P2.

Beyonwiz engineers know about my efforts in modifying Beyonwiz firmware, but while they obviously don't officially approve of what I do, they have never expressed any disapproval. The only hack I've ever seen them comment on negatively is modifying the .wrp headers in order to run DP-P1 firmware on an FV-L1 (to free it from Freeview). They have said that there are hardware differences between them that make that hack liable to cause problems.

Can you load the unmodified DPP2_Firmware_30Nov2010_ver_0107350.wrp firmware package on your DP-P2?

Can you make your original and patched version of the firmware available to me (on megaupload or I can PM you my email)? If I had access to that I'd be in a better position to find out why the patch makes the firmware unusable.
Peter
T4 HDMI
U4, T4, T3, T2, V2 test/development machines
Sony BDV-9200W HT system
LG OLED55C9PTA 55" OLED TV

pbezza
Apprentice
Posts: 22
Joined: Sun Oct 24, 2010 14:34
Location: Baranduda

Post by pbezza » Tue Nov 01, 2011 21:12

Original Firmware is fine - no errors.


C:\BWFWTools>bw_patcher.pl -c 9 OrigFw.wrp PatchedFw.wrp Beyonwiz::Hack::Telnet
Extract application file system OrigFw.wrp into C:\Users\user\AppData\Local\Temp\flash6116
romfs image name: `mambo'
romfs image size: 7790400
Extract root file system into C:\Users\user\AppData\Local\Temp\root6116
Found Root ROMFS at kernel file location 0x00275000 size: 16652016
Root ROMFS sizes
Root ROMFS padded file size: 16652288
Free space available for larger Root ROMFS: 2320 bytes
Maximum Root ROMFS update size: 16654336 bytes
romfs image name: `mambo'
romfs image size: 16652016
Patching in Telnet hack on C:\Users\user\AppData\Local\Temp\root6116
Using default machine type DPP2 (--machtype=DPP2)
Construct root file system from C:\Users\user\AppData\Local\Temp\root6116
Insert the root file system into the kernel image C:\Users\user\AppData\Local\Temp\flash6116\001x_linux.bin.gz
Found Root ROMFS at kernel file location 0x00275000 size: 16652016
Root ROMFS sizes before update
Root ROMFS padded file size: 16652288
Free space available for larger Root ROMFS: 2320 bytes
Maximum Root ROMFS update size: 16654336 bytes
Root ROMFS sizes after update
Updated Root ROMFS size: 16648240
Updated Root ROMFS padded file size: 16649216
Free space available for larger Root ROMFS after update: 2000 bytes
Construct BW firmware file PatchedFw.wrp from C:\Users\user\AppData\Local\Temp\flash6116
PatchedFw.wrp uses: 7792640 bytes; available: 16252928; spare: 8460288

Using 'Firmware Identifier' on the orig firmware, the F/W Vesion is DPP2-01.07.350__Official

When I use it on the patched firmware, the F/w Version area is blank.


Will send PM.

User avatar
peteru
Uber Wizard
Posts: 9730
Joined: Tue Jun 12, 2007 23:06
Location: Sydney, Australia
Contact:

Post by peteru » Wed Nov 02, 2011 10:52

prl wrote:Beyonwiz engineers know about my efforts in modifying Beyonwiz firmware, but while they obviously don't officially approve of what I do, they have never expressed any disapproval.
Maybe not to you directly. When they became aware of these activities, they were planning on making a number of changes to prevent it and to lock down the unit more. I had to work pretty hard to convince them to not make these changes. It was worthwhile, because in the process I managed to convince them to actually go the other way and tweak the firmware to improve the hackability. The RCU code set switch and httpd fixes are among some of the things I was able to persuade Beyonwiz to work on.

"Beauty lies in the hands of the beer holder."
Blog.

Post Reply

Return to “Software Developers”