How to unlock MMCS
#21
RE: How to unlock MMCS
Thanks Otaku! Your efforts are _greatly_ appreciated.
Regarding from your website:
Count me in as (brave && stupid && willing)
Regarding from your website:
I have had a preliminary shuftie : I might try knocking together a new firmware image if I can find someone (brave|stupid|willing) enough to install it ..
#22
RE: How to unlock MMCS
ORIGINAL: brian360
Thanks Otaku! Your efforts are _greatly_ appreciated.
Regarding from your website:
Count me in as (brave && stupid && willing)
Thanks Otaku! Your efforts are _greatly_ appreciated.
Regarding from your website:
I have had a preliminary shuftie : I might try knocking together a new firmware image if I can find someone (brave|stupid|willing) enough to install it ..
Will do..
If I can knock together a Platform Builder BSP, I'll shove it up on the site as a starting point..
#23
RE: How to unlock MMCS
Oh, also, FYI..
The unlock keys are stored in ata_hdd.dll
The one from the firmware image I unpacked appears to have 2
B2 BA B3 BC B0 DF AC BE B1 BB BE DF B1 AD D2 CD C9 CE AA B2 DF B1 9E 89 96 DF AA 8C 9A 8D DF DF
B2 BA B3 BC B0 DF AC BE B1 BB BE DF B1 AD D2 CD C9 CE AA B2 DF B1 9E 89 96 DF B2 9E 8C 8B 9A 8D
One is a User key, the other is a Master key.
atb
O.
The unlock keys are stored in ata_hdd.dll
The one from the firmware image I unpacked appears to have 2
B2 BA B3 BC B0 DF AC BE B1 BB BE DF B1 AD D2 CD C9 CE AA B2 DF B1 9E 89 96 DF AA 8C 9A 8D DF DF
B2 BA B3 BC B0 DF AC BE B1 BB BE DF B1 AD D2 CD C9 CE AA B2 DF B1 9E 89 96 DF B2 9E 8C 8B 9A 8D
One is a User key, the other is a Master key.
atb
O.
#24
RE: How to unlock MMCS
I have had a preliminary shuftie : I might try knocking together a new firmware image if I can find someone (brave|stupid|willing) enough to install it ..
#25
RE: How to unlock MMCS
I have had a preliminary shuftie : I might try knocking together a new firmware image if I can find someone (brave|stupid|willing) enough to install it ..
#26
RE: How to unlock MMCS
ORIGINAL: rcostin
For the 261EM version (Outlander 07) I can also test an image. I don't think there is something to screw as long as I use another disk. So, count on me
I have had a preliminary shuftie : I might try knocking together a new firmware image if I can find someone (brave|stupid|willing) enough to install it ..
I _believe_ it should be ok... I'll see if there is a fairly low level way of backing up an existing working system before we try screwing around with it ..
atb.
O.
#27
RE: How to unlock MMCS
ORIGINAL: Otaku
Heh..
I _believe_ it should be ok... I'll see if there is a fairly low level way of backing up an existing working system before we try screwing around with it ..
atb.
O.
Heh..
I _believe_ it should be ok... I'll see if there is a fairly low level way of backing up an existing working system before we try screwing around with it ..
atb.
O.
Here's my results.
I downloaded the modified image you created for the dvd-in-motion hack and pulled the hard drive from the MMCS and updated the loading.kwi file with yours and put the drive back in.
When I turned the ignition key on, the MMCS booted as usual. Turns out you have to disconnect power from the MMCS for a few minutes to get it to do a "Cold" boot. I assume a cold boot is the only time the bootloader code is invoked.
Anyway, the bootloader came up with the message "Program version-up in progress." with a progress bar that filled up within about a second. Once the progress bar filled up, the screen went blank and nothing would happen. Sigh Each time I turned the ignition key off and on, it'd just do the same thing.
Since I figured this modified firmware wasn't going to work, I decided to do some experimenting with the bootloader.
I removed the hard drive from the unit and turned the key back on. I got a message "Insert a program disk."
I already had a CD burned with the mitsubishi's original "loading.kwi" file on it, so I stuck it in the drive and got a message "Now checking the disk." After a few moments, it came back with this message "Program writing error. Turn the engine key off to retry." Oh well.
After that, I put the original loading.kwi back onto the hard drive, it did the 'program update' just as it had been before, then immediately after got a message "Checking screen data.", then shortly after a message "Screen data check has been completed. Restarting"
And all was back to normal.
Sounds to me like we are _extremely_ close to being able to modify the OS on this thing! Stay tuned!
#28
RE: How to unlock MMCS
I already ghosted the hdd. That was the very first operation after I unlocked it. And then I used another cloning tool just to be sure (or paranoic).
So I can try loading the new OS ...
Costin
So I can try loading the new OS ...
Costin
#29
RE: How to unlock MMCS
ORIGINAL: rcostin
I already ghosted the hdd. That was the very first operation after I unlocked it. And then I used another cloning tool just to be sure (or paranoic).
So I can try loading the new OS ...
Costin
I already ghosted the hdd. That was the very first operation after I unlocked it. And then I used another cloning tool just to be sure (or paranoic).
So I can try loading the new OS ...
Costin
ICBW, but the bootloader refers to a disk-on-chip device.. Can you confirm that the OS is loaded from the hard-drive as opposed to that ? If so, that makes things easier ..
If anyone has hi-res pictures of the circuit boards in the nav unit, I'd appreciate copies.
atb.
O.
#30
RE: How to unlock MMCS
What kind of disk-on-chip device? Like flash memory? Or maybe just RAM? I could only get the bootloader to look for a new OS by cold-booting the system. It appears that during a cold boot, it'll look for the OS wherever it can find it (CDROM drive, hard drive), or give an error message "Insert program disk" if it can't find it.
I suppose if the OS is stored in RAM, losing power would wipe the contents so it has to load it again from disk. Hopefully myself or someone else will take some pics of the circuit boards so we can get more info.
In the mean time, I'm willing to keep experimenting with different loading.kwi files until we figure out how to get it to take!
I suppose if the OS is stored in RAM, losing power would wipe the contents so it has to load it again from disk. Hopefully myself or someone else will take some pics of the circuit boards so we can get more info.
In the mean time, I'm willing to keep experimenting with different loading.kwi files until we figure out how to get it to take!