I-Appliance BBS The Official Source for Internet Appliance Upgrades and Mods BBS Main List | Sign In | Sign Up | Search | Help | Linux-Hacker.net Reply to Thread | Printer |

Home / MISC Areas / Mattel JuiceBox Hacking Update Hacking Update

Hacking Update (modified 0 times) prpplague Profile Here is an update for all your JuiceBox hackers: 1. the lcd register values have now been posted on the elinux wiki, http://www.elinux.org/wiki/JuiceBoxLCD 2. the juiceware cart flash is NAND flash compatible and can be read by connecting it to a usb thumb drive that uses NAND flash http://www.adata.com.tw/en/products-f-usb-pd8.htm 3. the juiceware cart does contain a copy of a bootloader that is copied to ram 4. the juiceware cart flash can be replaced with a compatible NAND flash (see the USB thumbdrive) 5. the bootloader that is distributed with the source from Emsoft can be loaded to the NAND flash and used. 6. the juicebox jtag page has been updated with a jtag app(linux only) for the juicebox(s3c44b0x) http://www.elinux.org/wiki/JuiceBoxJTAG 7. some of the specifics of the bootrom on the onboard flash has been posted http://www.elinux.org/wiki/JuiceBoxBootRom so in summary, we now have all the information needed to make our own juiceware carts to boot a custom uclinux distro without modifing the mainboard. 08-17-2005 13:16:30

RE:Hacking Update (modified 1 times) Tom61 Profile | Email Cool, so you got your own code to execute I take it. Thanks for the update. Can you post pics of your current setup? 08-17-2005 13:27:05

RE:Hacking Update (modified 0 times) adeptwiz Profile I too would be interested in the jtag setup you are using (software and hardware). I'd like to set it up here. i.e.- Which jtag software/hardware have you found most useful. Your procedure (when not obvious). Thanks. 08-18-2005 08:37:06

RE:Hacking Update (modified 0 times) prpplague Profile all the info for the JTAG is on http://www.elinux.org/wiki/JuiceBoxJTAG the jtag software was gathered from http://www.ecst.csuchico.edu/~borisov/ another package is armtool - http://hri.sourceforge.net/tools/armtool.html i have several different jtag wigglers here are some of them: http://www.lart.tudelft.nl/projects/jtag/jtag-lart_schematic.pdf http://hri.sourceforge.net/tools/ http://www.sparkfun.com/shop/index.php?&cat=74& the http://www.elinux.org/wiki/JTAG page also has a list of some other jtag software and hardware 08-18-2005 09:27:00

RE:Hacking Update (modified 0 times) adeptwiz Profile Thanks for your help. Links most helpful. Can't seem to get jtag_src to compile?! I assume I am doing something stupid . I am trying to compile jtag-0.5.1 with more or less stock 2.4.27 (knoppix 3.6). I am not sure what the argument to detectflash should look like? make: Leaving directory `/mount/jtag/jtag-0.5.1/libbrux/po' make: Entering directory `/mount/jtag/jtag-0.5.1/libbrux' if gcc -DHAVE_CONFIG_H -I. -I. -I. -I/usr/local/include/openwince -I/usr/local/include/openwince/device -I/usr/local/include/openwince/arm -I./../include -g -O2 -Wall -MT cmd_detectflash.o -MD -MP -MF ".deps/cmd_detectflash.Tpo" \ -c -o cmd_detectflash.o `test -f 'cmd/cmd_detectflash.c' || echo './'`cmd/cmd_detectflash.c; \ then mv -f ".deps/cmd_detectflash.Tpo" ".deps/cmd_detectflash.Po"; \ else rm -f ".deps/cmd_detectflash.Tpo"; exit 1; \ fi cmd/cmd_detectflash.c: In function `cmd_detectflash_run': cmd/cmd_detectflash.c:43: error: too few arguments to function `detectflash' make: *** [cmd_detectflash.o] Error 1 make: Leaving directory `/mount/jtag/jtag-0.5.1/libbrux' make: *** [all-recursive] Error 1 make: Leaving directory `/mount/jtag/jtag-0.5.1/libbrux' make: *** [all] Error 2 make: Leaving directory `/mount/jtag/jtag-0.5.1/libbrux' make: *** [all-recursive] Error 1 make: Leaving directory `/mount/jtag/jtag-0.5.1' make: *** [all] Error 2 08-18-2005 10:17:44

RE:Hacking Update (modified 0 times) prpplague Profile i've tested on several boxes with the source distributed on the wiki and have not been able to replicate your problem. i'd suggested starting fresh. remove the directory, extract the files, run configure script, and try make again 08-18-2005 10:34:00

RE:Hacking Update (modified 0 times) adeptwiz Profile I tried knoppix 3.3 (installed on a different partition) with identical results. I am thinking that my problem resides with include-0.4.1, which must be installed prior to compiling jtag. I downloaded the 'current' version from wince.sf.net/include. I notice there were no older versions on the site? So I wonder if you might be using a different version of those headers? 08-18-2005 13:19:36

RE:Hacking Update (modified 0 times) prpplague Profile i just downloaded the source, untar'd it, ran configure, and then make. i suggest you try posting your issue on the openwince mailing list for further assistance. 08-19-2005 08:18:42

RE:Hacking Update (modified 0 times) jbfan Profile Awesome progress prpplague! From my poking around with jtag it appears that the JuiceBox is expecting the cartridge to contain a chip from one of three manufactures; Matrix (of course), Macronix, or Samsung. I have not been able to find the unit you are using (Adata PD8) locally yet and am a little hesitant to go to the trouble of wiring up my Hynix (3.3v) based thumb drive without knowing if it has a chance of working. From the data sheets the read and write commands look about the same but I know nothing about the compatibility between different NAND FLASH chips. What chip manufacturer is used on the USB thumb drive you have had success with? Are you programing the FLASH from USB? If so do you need to separate the power between the FLASH and the controller while using the FLASH with the JuiceBox? Thanks. -J 08-20-2005 13:07:52

RE:Hacking Update (modified 0 times) prpplague Profile "From my poking around with jtag it appears that the JuiceBox is expecting the cartridge to contain a chip from one of three manufactures; Matrix (of course), Macronix, or Samsung." where did you see that? i didn't notice it checking the flash id anywhere, must have just missed it! if you have disassembled memory address for this check that would be helpful. "I have not been able to find the unit you are using (Adata PD8) locally yet and am a little hesitant to go to the trouble of wiring up my Hynix (3.3v) based thumb drive without knowing if it has a chance of working. From the data sheets the read and write commands look about the same but I know nothing about the compatibility between different NAND FLASH chips." right now this is a guessing game as to what will and won't work. the best i can offer is as long as it is a 3.3v, x8 , and has a serial interface, it should work. "What chip manufacturer is used on the USB thumb drive you have had success with?" the chip on the Adata PD8 is made by Adata and no specs, but since it was connected to the PL-2518 i assumed it was pretty standard. "Are you programing the FLASH from USB? If so do you need to separate the power between the FLASH and the controller while using the FLASH with the JuiceBox?" yes i program the flash from the usb interface. the PL-2518 has a reset line. i simply hold the reset low(active) when i'm using the flash with the juicebox, and high when using the usb interface. this keeps the PL-2518's lines from having contention with the juicebox. 08-22-2005 06:46:10

RE:Hacking Update (modified 0 times) jbfan Profile ""... three manufactures; Matrix (of course), Macronix, or Samsung." where did you see that?..." Maybe I am assuming too much here. Have not had much luck parsing the disassembly (used to be able to read 68k asm, long ago, but ARM looks a little different). For this I am running /usr/bin/strings on the memory dump. In what I believe to be the "Production Test" (ver 2.6) section there are four consecutive lines starting at about 0x5920d8; Manufacturer : Samsung : Macronix : Matrix As the cartridge test will print out "Manufacturer: Matrix" it would make sense that the above is an array of the possible manufactures. Maybe only the "diags" is checking for type, or I could be totally misreading this ... "right now this is a guessing game as to what will and won't work. the best i can offer is as long as it is a 3.3v, x8 , and has a serial interface, it should work." That is encouraging, will have to try the Hynix part when I get a chance. Thanks. -J 08-22-2005 16:15:09

RE:Hacking Update (modified 0 times) prpplague Profile "consecutive lines starting at about 0x5920d8; Manufacturer : Samsung : Macronix : Matrix" i double check the startup code, it doesn't appear from what i'm seeing that the bootrom cares about manufacturer during normal boot. however during my search of the code i did turn up some additional checks of the content of the cartridge flash, i'm not entirely sure what they are at this point in time but i'll be researching them further. some hardware info, i've found this company that sells some breakout boards for tsop48 flash http://www.sivava.com/Product_T.htm they have both the removable socket and solder type. my next round of dev will be using these. digikey has some compatible flash chips: http://www.digikey.com/scripts/DkSearch/dksus.dll?Detail?Ref=14321&Row=506295&Site=US http://www.digikey.com/scripts/DkSearch/dksus.dll?Detail?Ref=14321&Row=506261&Site=US they are non-stock items but digikey assured me they would ship them. i've double checked the external connector and found that we have enough gpio lines to bit bang a spi interface along with using the nand flash interface. as soon as the next round of testing is complete and everthing is working, i'll be laying out a pcb with the cardedge connector, nand flash, and sd/mmc interface. this is a long ways off, but progress is being made. 08-24-2005 08:41:02

RE:Hacking Update (modified 0 times) adeptwiz Profile Hi, Got JTAG working :) Key to compile Knoppix 3.6 was to use JTAG-0.4. Using Xilinx cable. Can read CPU ID :) So hardware is probably working OK :) But CPU ID is apparently not recognized by this version of JTAG :( I have .bdsl file. Do I need to do something special to JTAG to get it to use the .bdsl file, or do I need to figure out how to get JTAG-0.5.1 to compile (because the .bdsl data needs to be compiled into the JTAG image?) Also, how to I proceed from here to read memory from juicebox cpu/flash? Thanks, wiz 09-04-2005 15:33:09

RE:Hacking Update (modified 0 times) adeptwiz Profile built WIGGLER interface for juicebox (because jtager doesn't support Xilinx cable). WORKS :) with JTAG-0.4 and with JTAGER :) JTAGER looks pretty useful (but not for thumb mode). What is everyone using as JTAG debugger? Now just gotta figure out memory map? Seems like I read about it somewhere? 09-05-2005 05:51:45

Looking at JuiceBox Code ? (modified 0 times) adeptwiz Profile I think I am looking at disassembled ARM code :) But with big end/little end issues I would like to be sure. prplplague could you give me a few instructions starting at 0x248? thanks, wiz 09-06-2005 10:28:43

RE:Hacking Update (modified 0 times) prpplague Profile "prplplague could you give me a few instructions starting at 0x248?" i can't post that section of code. but you can look at the address 0x5d0000 which should be identical to the bootrom distributed by emsoft in their uclinux tarball. here is some of the code from the distributed bootroom provided by emsoft with source, which should be identical with the offset of 0x5d0000 in the juicebox rom: 0: ea00000d b 0x3c 4: e59ff014 ldr pc, [pc, #14] ; 0x20 8: e59ff014 ldr pc, [pc, #14] ; 0x24 c: e59ff014 ldr pc, [pc, #14] ; 0x28 10: e59ff014 ldr pc, [pc, #14] ; 0x2c 14: e59ff014 ldr pc, [pc, #14] ; 0x30 18: e59ff014 ldr pc, [pc, #14] ; 0x34 1c: e59ff014 ldr pc, [pc, #14] ; 0x38 20: 0c000004 stceq 0, cr0, [r0], -#16 24: 0c000008 stceq 0, cr0, [r0], -#32 28: 0c00000c stceq 0, cr0, [r0], -#48 2c: 0c000010 stceq 0, cr0, [r0], -#64 30: 0c000014 stceq 0, cr0, [r0], -#80 34: 0c000018 stceq 0, cr0, [r0], -#96 38: 0c00001c stceq 0, cr0, [r0], -#112 3c: e3a000d3 mov r0, #211 ; 0xd3 40: e121f000 msr CPSR_c, r0 44: e59f0264 ldr r0, [pc, #264] ; 0x2b0 48: e59f1310 ldr r1, [pc, #310] ; 0x360 4c: e5801000 str r1, [r0] 09-12-2005 06:38:48

RE:Hacking Update (modified 0 times) adeptwiz Profile Hi prpplague, Just tried to get code from 0x5d0000. I get all zeroes :(. I retried jtager with command memdump --base=0x248 --size=0x200 --outfile =junk1. Hexedit shows the first few bytes as: bo 01 1f e5 10 ff 2f e1 e8 03 95 e5 00 10 a0 e3 I am not fluent in arm7, but I notice last byte is mostly the same as e5 with some e1 and e3, so I wonder if the is little endian arm? I can objdump to get disassembled arm, but am still learning to read it. The location of some jumps would help? Hardware is wiggler hooked up to juicebox (which appears to me as hardware OK). Additional stuff: 0x0003c88 appears to have some probable code (thumb?): df ee 1b 55 99 92 ee ee ff 99 ee bf ff ee 3b af 0x04000000 appears to have ??? maybe reading some hardware device or just junk? df ff ff ee ab ee ee ee ff ee ee d6 ee be ff a8 2nd read of same location: ee ff fe ff ee 1b 85 ff ff 33 ee ff aa 8c ff ff Does ARM read unused space as FF or just a junk (as above)? Any comments appreciated :) regards, wiz 09-14-2005 08:00:09

RE:Hacking Update (modified 0 times) adeptwiz Profile Hi, It now looks like I may be close to making sense :) It appears that high byte=ea is branch, 0a is beq,eb is bl, 1a is bne. Thanks to all, wiz 09-14-2005 08:47:08

RE:Hacking Update (modified 0 times) prpplague Profile adeptwiz, i'm really confused as to why you are having so much trouble. the jtag app i linked to on the wiki works fine with no modifications: http://www.ecst.csuchico.edu/~borisov/axs/ax.cgi?http://www.ecst.csuchico.edu/~borisov/jtag_src.tgz did you download the distributed rom image from emsoft and use the arm-linux-objdump command i listed and compare it to what i posted? 09-14-2005 11:24:13

RE:Hacking Update (modified 0 times) adeptwiz Profile Hi, Thanks for your note. Why is it so difficult for me? Well the simple answer is that this is the first time I have dealt with jtag or with ARM processors. When I saw that juiceboxes were on sale for a great price AND that there was a most impressive effort on the web help figure things out, I couldn't resist. Plus we REALLY need to upgrade our products.... More and more obsolete chips etc. We use simple 8 bit micros that aren't nearly as complex as ARM. That said, I always seem to the find the hard way of doing things. Which means I really have to understand them. I am not sure why jtag_src won't compile under Knoppix 3.6, but it won't. The older version does :). That was my first jtag success (using a clone Xilinx cable I built). The jtager program seems also to work but only with a wiggler interface (so I built one of those.). Perhaps of interest, I did do a detailed schematic of the two types of cards which plug into juicebox. (Which I really SHOULD post somewhere.) There is 1-100k resistor which tells the processor that a module has been inserted and another 100k resistor which ties either to +3.3v or to gnd to indicate which type of module has been inserted (mmc or rom). I assume that the software does or did use this to tell which type of module has been inserted. Anyways, I will try again to carefully follow your directions. I may be smart enough at this point to get success :) Thanks again. regards, wiz 09-14-2005 13:39:26

RE:Hacking Update (modified 0 times) adeptwiz Profile Hi, Well I just DID follow your directions. They work :) (Or put more simply, I manage to have figured out what they mean.) I have yet to burn anything into the juicebox flash, but I am in no hurry to. I assume it is pretty straightforward? It would be interesting to translate my debugger to ARM and download it into RAM and have it available on the serial port. There are several steps I need to complete to do this: 1. Serial port hookup - Well documented. Just do it :) 2. Way to get debugger linked into Juicebox resident code. I need to get processor at approximately a 100hz rate. This is probably available somewhere in the resident code, but where? How do I find it? 3. Understand enough ARM to translate 500 bytes of code to ARM. Not difficult. 4. Understand enough about the CPUs serial port to get it running (I usually start out bit banging 'cause it is way easier to get up and running). Thanks :) wiz 09-14-2005 14:02:41

RE:Hacking Update (modified 0 times) prpplague Profile " Well I just DID follow your directions. They work :) (Or put more simply, I manage to have figured out what they mean.)" what part of the instructions were confusing? " I have yet to burn anything into the juicebox flash, but I am in no hurry to. I assume it is pretty straightforward?" you have replaced the internal OTP with flash? " Perhaps of interest, I did do a detailed schematic of the two types of cards which plug into juicebox. (Which I really SHOULD post somewhere.) There is 1-100k resistor which tells the processor that a module has been inserted and another 100k resistor which ties either to +3.3v or to gnd to indicate which type of module has been inserted (mmc or rom). I assume that the software does or did use this to tell which type of module has been inserted." this info was previously already on the wiki untill last week when some smartass script kiddie decided to deface the wiki. why don't you sign up at the wiki for posting pictures and howto info? 09-15-2005 12:41:57

RE:Hacking Update (modified 0 times) adeptwiz Profile Hi, What parts of the procedure were confusing? I guess for me I come from the background of 8 bit micros. Simple memory map, etc. I tend to use hexedit to figure out where the bytes are and tend to read opcodes to figure out what is happening. When I finally did look at Image.bin and saw the bytes you spoke of the whole thing began to make sense. Also, I have yet to really learn how the ARM really works, so that has also made it confusing. Basically a lot more mental bandwidth seems to be required to 'understand' the ARM micro. That and the fact that I don't tend to 'think' in C. (In fact, I seem to get some pretty obscure bugs when I try to use it for other than simple stuff.) Have I replaced the internal OTP with flash? No. The Juicebox I am using has chip and wire for both CPU and flash/OTP. The DRAM is discrete. I gather I 'could' put a discrete flash in it's place. I seem to recall reading about that somewhere on some site or other? At this point it would seem to me to make more sense to load whatever code I want to test into RAM (with jtag or serial) and execute it from there? Of course having the development platform makes things much easier :). I gather someone (you?) has one. Your suggestion of getting envolved in the WIKI is well taken. I will look into that. I gather from what you have done that we are almost at the point where test software can be loaded onto a SmartMedia card and simply plugged into the Juicebox? I am certainly impressed with their 'cart' system. I wish I could buy backplane (not surface mount) connectors like the one on the Juicebox. I would use them in our new products. It is truly amazing to me how much microprocessor can be purchased for so little $$ :) I would be interested in your suggestions as to what might be an easy way to get some assembly code I write into the Juicebox RAM to test it out? It appears this may be possible with jtager, but I am not sure how to start execution of my code? Once I can do this, the rest seems pretty straightforward. So here is a trivial question. I notice that your 'nic' seems to be for purple plague which I suspect not too many youngsters remember. I cut my teeth on the Intel 4004, So I wonder what your background might be? regards, wiz 09-16-2005 06:33:19

RE:Hacking Update (modified 0 times) Qwertys Profile hey, I'm new here and i'm trying to get into the juicebox hacking. I am having trouble using OCD commander, it reports the cable is disconnected. I made a wiggler compatable device, connected pin 8 to 15, and put my parallel port into epp mode. Problem i had was soldering up the jtag wires because from the pics on the wiki its the 8mb juicebox, I have the 2 mb juicebox and it appears there are some changes to the PCB. so I took a guess based on the pic to solder up the connections. when I start up the software, the juicebox will halt, and thats about it. 09-26-2005 22:18:51

RE:Hacking Update (modified 0 times) newell Profile hey, I'm new here and i'm trying to get into the juicebox hacking. I am having trouble using OCD commander, it reports the cable is disconnected. I think everyone with a homemade wiggler and OCD Commander has seen that at least once. Might try restarting OCD if you lose your connection. v2.4.6, for me at least, didn't seem to want to connect once the connection failed. and put my parallel port into epp mode. Did you try spp mode? 09-27-2005 06:52:14

RE:Hacking Update (modified 0 times) timothyso Profile | Email Ok, I just bought the Juicebox for $4.00 ( I had access to 144 of them but did not invest.) My objective was Simply to beable to drop in the sd cards of 512 or larger and play mpegs or somekind of video. Turns out 8 year - 14 years love this thing with its video in cars. NOT for the music. But I can't figure out from all of this if I can put my own video on a card and get it to play! Somewhere I saw that just putting mpeg4 on an sd card should make it play but I tried that and it doesn't work. SO Has anygot your own video running on the device? If so please post how I can do it. My hack experiecne is nill, but I have been running various forms of linus for years so I am not that worried about learning Thanks 01-16-2006 16:46:20

RE:Hacking Update (modified 0 times) Tom61 Profile | Email You can't just pop video onto a SD card and play it. You have to do a bit of hardware and software hacking. You need to get your own image of Linux running (the built-in one isn't configured to be very usuable), either by removing the internal ROM and replacing it with a flash ROM with your image on it, or doing the cart mod featured on the elinux.org wiki and jtaging in your image. Also you'll need to tweak and compile an embedded video player (the iPod Linux video player might be suitable), and then convert all the videos to the required format (most likely raw frames). Also, no one that I've heard of has made it play there own video, so no guides for video playing. You are going to have to learn alot about hacking, most likely on your own, before you'll be able to hack this into a video player yourself. 01-17-2006 15:52:42

Reply to Thread | Printer | All times are PST Powered by UltraBoard v1.62

I-Appliance BBS General - NEWS, Breaking NEWS - linux-hacker.net BBS on CD Questions - User Groups in Your Town - E-Bay, Yahoo Auction LINKS ONLY (MODERATED) - Jokes & Humor - usdtv box I-Opener Areas - I-Opener General Posts - I-Opener Technical Stuff - I-Opener Technical Info Reference (MODERATED) WebSurfer Areas - WebSurfer General Posts - WebSurfer Technical Stuff - WebSurfer Technical Info Reference (MODERATED) Other I-Appliances - Virgin Webplayer - WebPal - MailStation - 3Com Audrey - ThinkNIC / Oracle NIC - Gateway/AOL Connected Touch Pad - Philips/AOL-TV - ACER NT-150 STB - MSN Companion - Compaq IA - Emachines IA - IBM NetVista IA - Intel dot.station - MSNTV2 Network Computers - Fujitsu-Siemens Scovery Linux Net Computers - GallantWeb Server Consoles - Dreamcast - xbox hacking Web Pads - Epods One General Post - Panasonic CF-01 - Fujitsu Stylistic 1200 - Cybiko Thin Clients - Thin Clients DigitalVideoRecorders - DTV Recorders, Replay, TiVo, Etc... - Tivo Hacks Linux - Midori Linux General Board - ITX MotherBoards Single Board Computers - Earth Computers mARMalade Elite Member Area MISC Areas - The Swap Meet WE TAKE NO RESPONSIBILITY FOR ANY TRANSACTION HERE AND NO COMMERCIAL POST PERIOD !!! - Wireless Net - Cameras - Robotics - Routers/Gateways - Mattel JuiceBox