Subject: [E3-hacking] previous amstrad emailer

From: [email-masked]
Date: Thu, 24 Mar 2005 10:53:56 +0000

I haven't got an e3 yet, but since they've just come down in price I
might get a pair. However, I do have a couple of the previous versions
of the emailer which I just use as normal phones. I did have a bit
of a look at the emailer to stop it having to dial up to premium
rate numbers which annoyed me a bit.

What I did was configure the emailer to dial another modem instead
of the premium rate number by using a cheap 4 port pbx. This, as
someone else mentioned dials up and authenticates via CHAP. By
prompting the emailer for authentication, I learned its username
and password. You then see the amstrad try to connect to various
servers and request configuration files over HTTP amongst other
things. I configured my box to respond to all IP addresses and
learnt what it was requesting. You could then use the above info
to request the config files from the real server.

If you look in the retrieved gamma_a_live.config you see things
like redial intervals, next advert collect time and stuff
that you can alter to more reasonable values and feed to the
emailer. I never registered the second emailer at all and it
works fine.

Interestingly, the previous version had a config option:
CameraSupport=0
so I presume the process is very similar, if not identical for the e3.

Paul

---

From: David Given <[email-masked]>
Date: Thu, 24 Mar 2005 11:11:46 +0000

On Thu, 2005-03-24 at 10:53 +0000, [email-masked] wrote:
[...]
> of the premium rate number by using a cheap 4 port pbx.

That's rather interesting; it opens up the possibility for an
alternative mechanism for reflashing it by pretending to be an official
Amstrad firmware update...

Incidentally, while I was poking about on Usenet, I found a number of
reports that if you prevent the e-mailer from calling the 0800 advert
retrieval number for more than a few weeks, it'll stop working
completely. How long have you had it set up like that?

(This isn't a problem with *my* E2, because I long since accidentally
erased a chunk of the firmware I hadn't backed up...)

-- 
+- David Given --McQ-+ (base 10) = (base pi)
|  [email-masked]    | 1 = 1; 2 = 2; 3 = 3
| ([email-masked]) | 3.1415926... = 10.0
+- www.cowlark.com --+ 4 = 12.201220211...

---

From: [email-masked]
Date: Thu, 24 Mar 2005 11:26:13 +0000

> Amstrad firmware update...

Yes, presumably. I think I have some firmware updates somewhere.
Something like this maybe?

$ strings -a AppMmeBotDebug.pmt |sed 5q
RebaseMot V1.0 BOT.pmt
Q;Q;
5s3%
@(#)BOT V1.0 Build:0046
 s3%

> completely. How long have you had it set up like that?

A year or so. It's next due to dial up for some adverts in about 2020
I think :)

There's some flag that is to do with locking out, but I forget what
I altered, maybe one of these:

UseLockout=1
UseV2Lockout=1

This is interesting :-)

AllowSnooping=1

Paul

---

From: [email-masked]
Date: Thu, 24 Mar 2005 11:49:41 +0000

> Amstrad firmware update...

This is one of the upgrades, though it's quite old:

$ strings -a 13.up3|grep '@(#)' | sed 6q
@(#)SBY V13.0 Build:0096
@(#)SUI V13.0 Build:0273
@(#)M_WTLHTML V12.0 Build:0013
@(#)U_UBPICT V9.0 Build:0007
@(#)U_UBROM V9.0 Build:0004

Paul

---

From: Jonathan McDowell <[email-masked]>
Date: Wed, 30 Mar 2005 17:34:39 +0100

On Thu, Mar 24, 2005 at 10:53:56AM +0000, [email-masked] wrote:
> of the emailer which I just use as normal phones. I did have a bit of
> a look at the emailer to stop it having to dial up to premium rate
> numbers which annoyed me a bit.
> 
> What I did was configure the emailer to dial another modem instead of
> the premium rate number by using a cheap 4 port pbx. This, as someone
> else mentioned dials up and authenticates via CHAP. By prompting the
> emailer for authentication, I learned its username and password. You
> then see the amstrad try to connect to various servers and request
> configuration files over HTTP amongst other things. I configured my
> box to respond to all IP addresses and learnt what it was requesting.
> You could then use the above info to request the config files from the
> real server.

Do you have any documentation you could share on what it tries to
connect to and request? Also what format are the username/password in -
I tried to connect to the Amstrad dialup stuff with my Amserve details
and a normal PC, but that didn't seem to do the trick.

(Don't have a PBX to test such things myself at present, but have been
meaning to buy some FXS bits to get Asterisk up and running locally, so
might get round to it soon.)

J.

-- 
                 /------------------------------------\
                 |        noodles is not pasta        |
                 \------------------------------------/

---

From: [email-masked]
Date: Wed, 30 Mar 2005 18:39:51 +0100

> and a normal PC, but that didn't seem to do the trick.

I think there is a single username and password that is common to
all the amstrads. This username and password is stored in the configuration
file that it starts out with and that it downloads. I'm not sure I
feel comfortable in disclosing it publicly though. All the URLs it
requests are also stored in the config file, i.e. the ones for registration
and adverts etc. All you need to do to determine it is to set up a PPP
server and get the amstrad to dial it. I'm sure you can change the
registration number manually so you don't need a pbx to do this.

The reason I'm not comfortable is that once you have these details,
their charging system for SMSs, games etc. crumbles into nothingness.
I'm certainly not interested in sending SMSs from the amstrad or
playing games on it, but just wanted it as a decent answering machine.

Paul

---

From: Jonathan McDowell <[email-masked]>
Date: Wed, 30 Mar 2005 20:03:30 +0100

On Wed, Mar 30, 2005 at 06:39:51PM +0100, [email-masked] wrote:
> > connect to and request? Also what format are the username/password
> > in - I tried to connect to the Amstrad dialup stuff with my Amserve
> > details and a normal PC, but that didn't seem to do the trick.
> I think there is a single username and password that is common to all
> the amstrads. This username and password is stored in the
> configuration file that it starts out with and that it downloads. I'm
> not sure I feel comfortable in disclosing it publicly though. All the
> URLs it requests are also stored in the config file, i.e. the ones for
> registration and adverts etc.

Interesting; I can't find a similar file stored on the E3 filesystem. I
wonder if it gets written after registration and is in the binary until
then.

> All you need to do to determine it is to set up a PPP server and get
> the amstrad to dial it. I'm sure you can change the registration
> number manually so you don't need a pbx to do this.

I couldn't figure out a way to do this; I tried setting a prefix, but it
didn't want to let me. Perhaps I should try harder. :)

> playing games on it, but just wanted it as a decent answering machine.

That's reasonable enough. I want to turn the E3 into a SIP phone I
think, once I actually get software access to it.

J.

-- 
Been through Hell?? and what did you bring me??

---

From: [email-masked]
Date: Wed, 30 Mar 2005 20:07:37 +0100

> wonder if it gets written after registration and is in the binary until

Very possible.

> didn't want to let me. Perhaps I should try harder. :)

I seem to remember that if you try to register several times and
always fail, it eventually prompts you for a new phone number. It's
been a year since I had to do this though.

Paul

---

From: Jonathan McDowell <[email-masked]>
Date: Tue, 5 Apr 2005 21:18:37 +0100

> > > registration and adverts etc.
...  
> been a year since I had to do this though.

I ended up buying the FXS kit I'd been meaning to and have now got the
E3 talking to my laptop over the modem. I think I've got the firmware
update details figured out too, but I haven't yet figured out how to
make the E3 do a firmware poll or what its pattern is for doing so, so
can't be sure I have the update details right yet.

J.

-- 
] http://www.earth.li/~noodles/ []     We are talking one charming     [
]  PGP/GPG Key @ the.earth.li   []         motherf**king pig.          [
] via keyserver, web or email.  []                                     [
] RSA: 4DC4E7FD / DSA: 5B430367 []                                     [

---

From: [email-masked]
Date: Tue, 5 Apr 2005 22:23:09 +0100

> can't be sure I have the update details right yet.

"PLEASE NOTE - Your e-mailer is NOT updated to"
"latest version of software. To check version,"
"return to standby display then press [SETUP] 1."
"Main software version should be V7 or higher."

"If your e-mailer has not been auto-updated, you"
"can update it manually by pressing the 3 keys:"
"SHIFT SYMBOL and EMAIL together (on keyboard)."

Try that maybe?

Paul

---

From: Jonathan McDowell <[email-masked]>
Date: Tue, 5 Apr 2005 23:00:56 +0100

> "SHIFT SYMBOL and EMAIL together (on keyboard)."

Lovely; thanks. Now just to figure out why it doesn't like the images
I'm sending. :/

J.

-- 
Portable:  Survives system reboot.
This .sig brought to you by the letter E and the number  8
Product of the Republic of HuggieTag

---

From: Jonathan McDowell <[email-masked]>
Date: Wed, 6 Apr 2005 00:03:47 +0100

> Lovely; thanks. Now just to figure out why it doesn't like the images

Meh. And now I've managed it and overwritten the kernel so it no longer
boots. :/

J.

-- 
                 /------------------------------------\
                 |      Hats off to the insane.       |
                 \------------------------------------/

---

From: David Given <[email-masked]>
Date: Wed, 06 Apr 2005 10:23:40 +0100

On Wed, 2005-04-06 at 00:03 +0100, Jonathan McDowell wrote:
[...]
> Meh. And now I've managed it and overwritten the kernel so it no longer

If you're lucky, you've just overwritten the NAND flash, aka the
filesystem, and PBL's intact. If you're unlucky, you've overwritten PBL.

In case 1, all you have to do is to use PBL to write a bootable image to
the flash filesystem; PBL ought to be able to dial up and get a clean
image from Amserve. You can tell if PBL's okay because the lights on the
screen will flash manically as it scans the flash.

In case 2... er. I think you'll need a JTAG cable to rewrite PBL. I
don't know how you'd do that, though, and it does require a soldering
iron.

(Incidentally, I'm still working on my E2, or rather working on the boot
loader/mini OS that I'm going to put on it. I've been sorting out
filesystem code. Whee. Does anyone know if such a thing as a small,
portable USB stack exists?)

-- 
+- David Given --McQ-+ "[One shot of the Death Star's superlaser has
|  [email-masked]    | enough power] to send Marty McFly to the Big Bang
| ([email-masked]) | and back 1.4x10^29 times." --- William Clifford
+- www.cowlark.com --+

---

From: Matt Evans <[email-masked]>
Date: Wed, 6 Apr 2005 12:52:19 +0100

> portable USB stack exists?)

Hm.  So am I...

(I was aiming for What I'd Like PBL To Have Been, i.e. give you a shell 
& let you YMODEM things into DRAM/flash etc.  More of a 2ndstage 
bootloader for uCLinux more than anything else.)

Hmm.

-Matt

---

From: David Given <[email-masked]>
Date: Wed, 06 Apr 2005 17:04:42 +0100

On Wed, 2005-04-06 at 12:52 +0100, Matt Evans wrote:
[...]
> bootloader for uCLinux more than anything else.)

Yes, indeed.

Mine seems to be insisting on turning into what would seem to be one of
the very few microkernel-based CP/M clones ever made. (Although it's
more inspired by CP/M rather than a straight copy.) The idea is that you
should be able to get something useful on a new platform by simply
implementing serial read and write routines; it doesn't even need
interrupts --- but it ought to be scalable to do a lot more than that.

The next tricky bit is a file system driver. I have a read-only MinixFS
driver, but I need a block driver for it... accessing the NAND flash is
trickier than it looks, particularly if you want to write to it. (NAND
flash is notoriously unreliable and you need to be able to do ECC, bad
block remapping, and wear levelling in order to avoid killing it.)

Ideally I'd like to skip all that completely and go straight to USB.
Yeah, right.

-- 
+- David Given --McQ-+ "Under communism, man exploits man. Under
|  [email-masked]    | capitalism, it's just the opposite." --- John
| ([email-masked]) | Kenneth Galbrith
+- www.cowlark.com --+

---

From: Jonathan McDowell <[email-masked]>
Date: Wed, 6 Apr 2005 18:16:47 +0100

> filesystem, and PBL's intact. If you're unlucky, you've overwritten PBL.

As I say, I've overwritten the kernel, so only some of NAND. PBL and LDR
are still there ok. My boot has gone from:

System module loader - LDR V1.5 Build:0008 Assert
Mod scan 10010100 to 10230100
MEM - 10024000 (flash 00404000)
PARMS - 10024400 (flash 00404400)
LDR - 10024800 (flash 00404800)
LINUX - 10044000 (flash 00424000)

to

System module loader - LDR V1.5 Build:0008 Assert
Mod scan 10010100 to 10230100
MEM - 10024000 (flash 00404000)
PARMS - 10024400 (flash 00404400)
LDR - 10024800 (flash 00404800)
PARMS - 10044000 (flash 00424000)

Ooops.

> In case 1, all you have to do is to use PBL to write a bootable image
> to the flash filesystem; PBL ought to be able to dial up and get a
> clean image from Amserve. You can tell if PBL's okay because the
> lights on the screen will flash manically as it scans the flash.

Hmmmm. I hadn't thought of making it ring Amserve; I've been trying to
figure out how to feed PBL 4.9 an image myself at present. I wonder how
I kick off an Amserve call home.

J.

-- 
              "Scattered f***ing showers my ass." -- Noah

---

From: Jonathan McDowell <[email-masked]>
Date: Sun, 17 Apr 2005 11:22:24 +0100

> I kick off an Amserve call home.

The Amserve call home unfortunately no longer works; it just seems to
eventually get answered by voicemail. Shame really.

However it does do a ymodem download and it seems to accept Q;Q; format
blocks that way. Haven't quite figured out what it does with them yet
though, other than print the details to the serial console.

Anyone like to recommend some ARM decompilation tools? I've just used
objdump to disassemble the PBL, but I'm sure there must be something
that can be a bit more helpful?

J.

-- 
Is this real - that's the first thing I think every morning.