I haven't got an e3 yet, but since they've just come down in price I might get a pair. However, I do have a couple of the previous versions of the emailer which I just use as normal phones. I did have a bit of a look at the emailer to stop it having to dial up to premium rate numbers which annoyed me a bit. What I did was configure the emailer to dial another modem instead of the premium rate number by using a cheap 4 port pbx. This, as someone else mentioned dials up and authenticates via CHAP. By prompting the emailer for authentication, I learned its username and password. You then see the amstrad try to connect to various servers and request configuration files over HTTP amongst other things. I configured my box to respond to all IP addresses and learnt what it was requesting. You could then use the above info to request the config files from the real server. If you look in the retrieved gamma_a_live.config you see things like redial intervals, next advert collect time and stuff that you can alter to more reasonable values and feed to the emailer. I never registered the second emailer at all and it works fine. Interestingly, the previous version had a config option: CameraSupport=0 so I presume the process is very similar, if not identical for the e3. Paul
On Thu, 2005-03-24 at 10:53 +0000, paul@e3.sbrk.co.uk wrote: [...]
What I did was configure the emailer to dial another modem instead of the premium rate number by using a cheap 4 port pbx.
That's rather interesting; it opens up the possibility for an alternative mechanism for reflashing it by pretending to be an official Amstrad firmware update... Incidentally, while I was poking about on Usenet, I found a number of reports that if you prevent the e-mailer from calling the 0800 advert retrieval number for more than a few weeks, it'll stop working completely. How long have you had it set up like that? (This isn't a problem with *my* E2, because I long since accidentally erased a chunk of the firmware I hadn't backed up...) -- +- David Given --McQ-+ (base 10) = (base pi) | dg@cowlark.com | 1 = 1; 2 = 2; 3 = 3 | (dg@tao-group.com) | 3.1415926... = 10.0 +- www.cowlark.com --+ 4 = 12.201220211...
On Thu, Mar 24, 2005 at 11:11:46AM +0000, David Given wrote:
On Thu, 2005-03-24 at 10:53 +0000, paul@e3.sbrk.co.uk wrote: [...]
What I did was configure the emailer to dial another modem instead of the premium rate number by using a cheap 4 port pbx.
That's rather interesting; it opens up the possibility for an alternative mechanism for reflashing it by pretending to be an official Amstrad firmware update...
Yes, presumably. I think I have some firmware updates somewhere. Something like this maybe? $ strings -a AppMmeBotDebug.pmt |sed 5q RebaseMot V1.0 BOT.pmt Q;Q; 5s3% @(#)BOT V1.0 Build:0046 s3%
Incidentally, while I was poking about on Usenet, I found a number of reports that if you prevent the e-mailer from calling the 0800 advert retrieval number for more than a few weeks, it'll stop working completely. How long have you had it set up like that?
A year or so. It's next due to dial up for some adverts in about 2020 I think :) There's some flag that is to do with locking out, but I forget what I altered, maybe one of these: UseLockout=1 UseV2Lockout=1 This is interesting :-) AllowSnooping=1 Paul
On Thu, Mar 24, 2005 at 11:11:46AM +0000, David Given wrote:
On Thu, 2005-03-24 at 10:53 +0000, paul@e3.sbrk.co.uk wrote: [...]
What I did was configure the emailer to dial another modem instead of the premium rate number by using a cheap 4 port pbx.
That's rather interesting; it opens up the possibility for an alternative mechanism for reflashing it by pretending to be an official Amstrad firmware update...
This is one of the upgrades, though it's quite old: $ strings -a 13.up3|grep '@(#)' | sed 6q @(#)SBY V13.0 Build:0096 @(#)SUI V13.0 Build:0273 @(#)M_WTLHTML V12.0 Build:0013 @(#)U_UBPICT V9.0 Build:0007 @(#)U_UBROM V9.0 Build:0004 Paul
On Thu, Mar 24, 2005 at 10:53:56AM +0000, paul@e3.sbrk.co.uk wrote:
I haven't got an e3 yet, but since they've just come down in price I might get a pair. However, I do have a couple of the previous versions of the emailer which I just use as normal phones. I did have a bit of a look at the emailer to stop it having to dial up to premium rate numbers which annoyed me a bit.
What I did was configure the emailer to dial another modem instead of the premium rate number by using a cheap 4 port pbx. This, as someone else mentioned dials up and authenticates via CHAP. By prompting the emailer for authentication, I learned its username and password. You then see the amstrad try to connect to various servers and request configuration files over HTTP amongst other things. I configured my box to respond to all IP addresses and learnt what it was requesting. You could then use the above info to request the config files from the real server.
Do you have any documentation you could share on what it tries to connect to and request? Also what format are the username/password in - I tried to connect to the Amstrad dialup stuff with my Amserve details and a normal PC, but that didn't seem to do the trick. (Don't have a PBX to test such things myself at present, but have been meaning to buy some FXS bits to get Asterisk up and running locally, so might get round to it soon.) J. -- /------------------------------------\ | noodles is not pasta | \------------------------------------/
On Wed, Mar 30, 2005 at 05:34:39PM +0100, Jonathan McDowell wrote:
Do you have any documentation you could share on what it tries to connect to and request? Also what format are the username/password in - I tried to connect to the Amstrad dialup stuff with my Amserve details and a normal PC, but that didn't seem to do the trick.
I think there is a single username and password that is common to all the amstrads. This username and password is stored in the configuration file that it starts out with and that it downloads. I'm not sure I feel comfortable in disclosing it publicly though. All the URLs it requests are also stored in the config file, i.e. the ones for registration and adverts etc. All you need to do to determine it is to set up a PPP server and get the amstrad to dial it. I'm sure you can change the registration number manually so you don't need a pbx to do this. The reason I'm not comfortable is that once you have these details, their charging system for SMSs, games etc. crumbles into nothingness. I'm certainly not interested in sending SMSs from the amstrad or playing games on it, but just wanted it as a decent answering machine. Paul
On Wed, Mar 30, 2005 at 06:39:51PM +0100, paul@gamma.sbrk.co.uk wrote:
On Wed, Mar 30, 2005 at 05:34:39PM +0100, Jonathan McDowell wrote:
Do you have any documentation you could share on what it tries to connect to and request? Also what format are the username/password in - I tried to connect to the Amstrad dialup stuff with my Amserve details and a normal PC, but that didn't seem to do the trick. I think there is a single username and password that is common to all the amstrads. This username and password is stored in the configuration file that it starts out with and that it downloads. I'm not sure I feel comfortable in disclosing it publicly though. All the URLs it requests are also stored in the config file, i.e. the ones for registration and adverts etc.
Interesting; I can't find a similar file stored on the E3 filesystem. I wonder if it gets written after registration and is in the binary until then.
All you need to do to determine it is to set up a PPP server and get the amstrad to dial it. I'm sure you can change the registration number manually so you don't need a pbx to do this.
I couldn't figure out a way to do this; I tried setting a prefix, but it didn't want to let me. Perhaps I should try harder. :)
The reason I'm not comfortable is that once you have these details, their charging system for SMSs, games etc. crumbles into nothingness. I'm certainly not interested in sending SMSs from the amstrad or playing games on it, but just wanted it as a decent answering machine.
That's reasonable enough. I want to turn the E3 into a SIP phone I think, once I actually get software access to it. J. -- Been through Hell?? and what did you bring me??
On Wed, Mar 30, 2005 at 08:03:30PM +0100, Jonathan McDowell wrote:
On Wed, Mar 30, 2005 at 06:39:51PM +0100, paul@gamma.sbrk.co.uk wrote:
I think there is a single username and password that is common to all the amstrads. This username and password is stored in the configuration file that it starts out with and that it downloads. I'm not sure I feel comfortable in disclosing it publicly though. All the URLs it requests are also stored in the config file, i.e. the ones for registration and adverts etc.
Interesting; I can't find a similar file stored on the E3 filesystem. I wonder if it gets written after registration and is in the binary until then.
Very possible.
All you need to do to determine it is to set up a PPP server and get the amstrad to dial it. I'm sure you can change the registration number manually so you don't need a pbx to do this.
I couldn't figure out a way to do this; I tried setting a prefix, but it didn't want to let me. Perhaps I should try harder. :)
I seem to remember that if you try to register several times and always fail, it eventually prompts you for a new phone number. It's been a year since I had to do this though. Paul
On Wed, Mar 30, 2005 at 08:07:37PM +0100, paul@gamma.sbrk.co.uk wrote:
On Wed, Mar 30, 2005 at 08:03:30PM +0100, Jonathan McDowell wrote:
On Wed, Mar 30, 2005 at 06:39:51PM +0100, paul@gamma.sbrk.co.uk wrote:
I think there is a single username and password that is common to all the amstrads. This username and password is stored in the configuration file that it starts out with and that it downloads. I'm not sure I feel comfortable in disclosing it publicly though. All the URLs it requests are also stored in the config file, i.e. the ones for registration and adverts etc. ... All you need to do to determine it is to set up a PPP server and get the amstrad to dial it. I'm sure you can change the registration number manually so you don't need a pbx to do this.
I couldn't figure out a way to do this; I tried setting a prefix, but it didn't want to let me. Perhaps I should try harder. :)
I seem to remember that if you try to register several times and always fail, it eventually prompts you for a new phone number. It's been a year since I had to do this though.
I ended up buying the FXS kit I'd been meaning to and have now got the E3 talking to my laptop over the modem. I think I've got the firmware update details figured out too, but I haven't yet figured out how to make the E3 do a firmware poll or what its pattern is for doing so, so can't be sure I have the update details right yet. J. -- ] http://www.earth.li/~noodles/ [] We are talking one charming [ ] PGP/GPG Key @ the.earth.li [] motherf**king pig. [ ] via keyserver, web or email. [] [ ] RSA: 4DC4E7FD / DSA: 5B430367 [] [
On Tue, Apr 05, 2005 at 09:18:37PM +0100, Jonathan McDowell wrote:
I ended up buying the FXS kit I'd been meaning to and have now got the E3 talking to my laptop over the modem. I think I've got the firmware update details figured out too, but I haven't yet figured out how to make the E3 do a firmware poll or what its pattern is for doing so, so can't be sure I have the update details right yet.
"PLEASE NOTE - Your e-mailer is NOT updated to" "latest version of software. To check version," "return to standby display then press [SETUP] 1." "Main software version should be V7 or higher." "If your e-mailer has not been auto-updated, you" "can update it manually by pressing the 3 keys:" "SHIFT SYMBOL and EMAIL together (on keyboard)." Try that maybe? Paul
On Tue, Apr 05, 2005 at 10:23:09PM +0100, paul@e3.sbrk.co.uk wrote:
"PLEASE NOTE - Your e-mailer is NOT updated to" "latest version of software. To check version," "return to standby display then press [SETUP] 1." "Main software version should be V7 or higher."
"If your e-mailer has not been auto-updated, you" "can update it manually by pressing the 3 keys:" "SHIFT SYMBOL and EMAIL together (on keyboard)."
Try that maybe?
Lovely; thanks. Now just to figure out why it doesn't like the images I'm sending. :/ J. -- Portable: Survives system reboot. This .sig brought to you by the letter E and the number 8 Product of the Republic of HuggieTag
On Tue, Apr 05, 2005 at 11:00:56PM +0100, Jonathan McDowell wrote:
On Tue, Apr 05, 2005 at 10:23:09PM +0100, paul@e3.sbrk.co.uk wrote:
"PLEASE NOTE - Your e-mailer is NOT updated to" "latest version of software. To check version," "return to standby display then press [SETUP] 1." "Main software version should be V7 or higher."
"If your e-mailer has not been auto-updated, you" "can update it manually by pressing the 3 keys:" "SHIFT SYMBOL and EMAIL together (on keyboard)."
Try that maybe?
Lovely; thanks. Now just to figure out why it doesn't like the images I'm sending. :/
Meh. And now I've managed it and overwritten the kernel so it no longer boots. :/ J. -- /------------------------------------\ | Hats off to the insane. | \------------------------------------/
On Wed, 2005-04-06 at 00:03 +0100, Jonathan McDowell wrote: [...]
Meh. And now I've managed it and overwritten the kernel so it no longer boots. :/
If you're lucky, you've just overwritten the NAND flash, aka the filesystem, and PBL's intact. If you're unlucky, you've overwritten PBL. In case 1, all you have to do is to use PBL to write a bootable image to the flash filesystem; PBL ought to be able to dial up and get a clean image from Amserve. You can tell if PBL's okay because the lights on the screen will flash manically as it scans the flash. In case 2... er. I think you'll need a JTAG cable to rewrite PBL. I don't know how you'd do that, though, and it does require a soldering iron. (Incidentally, I'm still working on my E2, or rather working on the boot loader/mini OS that I'm going to put on it. I've been sorting out filesystem code. Whee. Does anyone know if such a thing as a small, portable USB stack exists?) -- +- David Given --McQ-+ "[One shot of the Death Star's superlaser has | dg@cowlark.com | enough power] to send Marty McFly to the Big Bang | (dg@tao-group.com) | and back 1.4x10^29 times." --- William Clifford +- www.cowlark.com --+
(Incidentally, I'm still working on my E2, or rather working on the boot loader/mini OS that I'm going to put on it. I've been sorting out filesystem code. Whee. Does anyone know if such a thing as a small, portable USB stack exists?)
Hm. So am I... (I was aiming for What I'd Like PBL To Have Been, i.e. give you a shell & let you YMODEM things into DRAM/flash etc. More of a 2ndstage bootloader for uCLinux more than anything else.) Hmm. -Matt
On Wed, 2005-04-06 at 12:52 +0100, Matt Evans wrote: [...]
(I was aiming for What I'd Like PBL To Have Been, i.e. give you a shell & let you YMODEM things into DRAM/flash etc. More of a 2ndstage bootloader for uCLinux more than anything else.)
Hmm.
Yes, indeed. Mine seems to be insisting on turning into what would seem to be one of the very few microkernel-based CP/M clones ever made. (Although it's more inspired by CP/M rather than a straight copy.) The idea is that you should be able to get something useful on a new platform by simply implementing serial read and write routines; it doesn't even need interrupts --- but it ought to be scalable to do a lot more than that. The next tricky bit is a file system driver. I have a read-only MinixFS driver, but I need a block driver for it... accessing the NAND flash is trickier than it looks, particularly if you want to write to it. (NAND flash is notoriously unreliable and you need to be able to do ECC, bad block remapping, and wear levelling in order to avoid killing it.) Ideally I'd like to skip all that completely and go straight to USB. Yeah, right. -- +- David Given --McQ-+ "Under communism, man exploits man. Under | dg@cowlark.com | capitalism, it's just the opposite." --- John | (dg@tao-group.com) | Kenneth Galbrith +- www.cowlark.com --+
On Wed, Apr 06, 2005 at 10:23:40AM +0100, David Given wrote:
On Wed, 2005-04-06 at 00:03 +0100, Jonathan McDowell wrote: [...]
Meh. And now I've managed it and overwritten the kernel so it no longer boots. :/ If you're lucky, you've just overwritten the NAND flash, aka the filesystem, and PBL's intact. If you're unlucky, you've overwritten PBL.
As I say, I've overwritten the kernel, so only some of NAND. PBL and LDR are still there ok. My boot has gone from: System module loader - LDR V1.5 Build:0008 Assert Mod scan 10010100 to 10230100 MEM - 10024000 (flash 00404000) PARMS - 10024400 (flash 00404400) LDR - 10024800 (flash 00404800) LINUX - 10044000 (flash 00424000) to System module loader - LDR V1.5 Build:0008 Assert Mod scan 10010100 to 10230100 MEM - 10024000 (flash 00404000) PARMS - 10024400 (flash 00404400) LDR - 10024800 (flash 00404800) PARMS - 10044000 (flash 00424000) Ooops.
In case 1, all you have to do is to use PBL to write a bootable image to the flash filesystem; PBL ought to be able to dial up and get a clean image from Amserve. You can tell if PBL's okay because the lights on the screen will flash manically as it scans the flash.
Hmmmm. I hadn't thought of making it ring Amserve; I've been trying to figure out how to feed PBL 4.9 an image myself at present. I wonder how I kick off an Amserve call home. J. -- "Scattered f***ing showers my ass." -- Noah
On Wed, Apr 06, 2005 at 06:16:47PM +0100, Jonathan McDowell wrote:
On Wed, Apr 06, 2005 at 10:23:40AM +0100, David Given wrote:
In case 1, all you have to do is to use PBL to write a bootable image to the flash filesystem; PBL ought to be able to dial up and get a clean image from Amserve. You can tell if PBL's okay because the lights on the screen will flash manically as it scans the flash. Hmmmm. I hadn't thought of making it ring Amserve; I've been trying to figure out how to feed PBL 4.9 an image myself at present. I wonder how I kick off an Amserve call home.
The Amserve call home unfortunately no longer works; it just seems to eventually get answered by voicemail. Shame really. However it does do a ymodem download and it seems to accept Q;Q; format blocks that way. Haven't quite figured out what it does with them yet though, other than print the details to the serial console. Anyone like to recommend some ARM decompilation tools? I've just used objdump to disassemble the PBL, but I'm sure there must be something that can be a bit more helpful? J. -- Is this real - that's the first thing I think every morning.
participants (5)
-
David Given -
Jonathan McDowell -
Matt Evans -
paul＠e3.sbrk.co.uk -
paul＠gamma.sbrk.co.uk