I-Appliance BBS
The Official Source for Internet Appliance Upgrades and Mods
Click Here!
BBS Main List | Sign In | Sign Up | Search | Help | Linux-Hacker.netReply to Thread | Printer |

Home / MISC Areas / Mattel JuiceBox
Custom Cartridge Success
Custom Cartridge Success

New MessageCustom Cartridge Success (modified 0 times) prpplague
Profile
i'm happy to report i've successfully booted a custom kernel and ramdisk from a custom cartridge:

http://www.elinux.org/wiki/JuiceBoxUMDCart


thanks to newell(aka JoeBleau on the wiki) as well as everyone else that helped in making it happen!

10-19-2005 07:23:13

New MessageRE:Custom Cartridge Success (modified 0 times) adeptwiz
Profile
MOST COOL !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! :)

Could you post it? (kernel source and binary and directions)

Also, have you discovered whether this is possible from an MMC card?

The boot sequence I see says that the receive side of the serial port driver is disabled and sounds like with right file on an MMC card one might reenable the receive side and get a plain shell?

I tried some simple stuff with no apparent response: image.bin, image.img, juicebox.bin

CONGRATULATIONS,
wiz

p.s.- Glad to know where you hang your shingle.

10-19-2005 14:23:46

New MessageRE:Custom Cartridge Success (modified 0 times) jbfan
Profile
Yes, congratulations!

Can't wait to give it a try. Did you use the Emsoft source as is? any major modifications?

I really like the MMC to xD solution to the programming issue. Had been wondering why you wanted to use both interfaces at the same time; now I know.

Good work!

-J

10-19-2005 15:55:27

New MessageRE:Custom Cartridge Success (modified 0 times) prpplague
Profile
Could you post it? (kernel source and binary and directions)

as sooon as i'm finished testing and clean up the code.

Did you use the Emsoft source as is? any major modifications?

the only thing i really needed to add was the lcd settings as the emsoft souce doesn't including the settings for the lcd. joe_bleau was able to get the register values for the lcd so i just had to plug them into the source.

The boot sequence I see says that the receive side of the serial port driver is disabled and sounds like with right file on an MMC card one might reenable the receive side and get a plain shell?

i'm not sure what you are asking here, but after booting uclinux kernel and ramdisk you have a full serial console working.

I tried some simple stuff with no apparent response: image.bin, image.img, juicebox.bin

what exactly did you try with these files?

10-20-2005 07:11:10

New MessageRE:Custom Cartridge Success (modified 0 times) adeptwiz
Profile
Hi prppl,

GREAT JOB!

Let me try to answer your questions:

It occured to me that if I were the juicebox designer, I would have left a 'backdoor' so I could run custom code on the juicebox to help with final checkout, etc. I noticed that when I put in a MMC card with at least one file on it I would get a full uclinux boot up message string from the serial port (115k baud).

Reading these messages, I determined that at least my juicebox uses 2.4.20, etc. When the serial driver is loaded it says that the input side of the serial driver has been disabled for the 'production version'. (I am not sure how to include those bootup messages in this message or I would.)

Anyways I tried some random names for the MMC files in hopes that I would see the kernel trying to load my 'custom kernel'. For the files themselves I took the Image.rom from the romboot directory from juicebox.tar.gz and gave it several different names. I was thinking that maybe the kernel would look at the file, like it and try to load it and that I would see that somewhere in the kernel messages. I didn't.

I was also thinking that maybe just a patch to the serial driver, or just turning some flag to on would enable the receive side of the serial UART.

I used jtager to halt the CPU and examine the rx serial port parameters. I didn't notice anything obvious (to me). But, I am not much of an ARM hacker, at least not yet.

I have written a program which does enable the serial port for both input and output and DOES echo serial characters. So at least my hardware is known to work and the juicebox is capable of supporting serial input and output.

Anyways, once we have a real kernel we can examine the original juicebox kernel and maybe figure out a patch to reenable the receive UART, examine the running juicebox kernel and fileset, run their code, look at their drivers, upload their files, etc. to see how things really work. Obviously the mp3 codec, the video codec, etc. all then become fair game.

The juicebox port appears to have some promise as a general purpose expansion port. We already have MMC, and flash chips supported.

Lots of fun :)

Hope the above helps.

Happy hacking,
wiz

10-20-2005 09:38:59

New MessageRE:Custom Cartridge Success (modified 0 times) prpplague
Profile
Reading these messages, I determined that at least my juicebox uses 2.4.20, etc. When the serial driver is loaded it says that the input side of the serial driver has been disabled for the 'production version'. (I am not sure how to include those bootup messages in this message or I would.)

those dmesg's are already on the wiki and i assume there wasn't a big need to enable it since they didn't expect anyone to be hacking on it.

Anyways I tried some random names for the MMC files in hopes that I would see the kernel trying to load my 'custom kernel'. For the files themselves I took the Image.rom from the romboot directory from juicebox.tar.gz and gave it several different names. I was thinking that maybe the kernel would look at the file, like it and try to load it and that I would see that somewhere in the kernel messages. I didn't.

not sure why you are having trouble understanding this, we have already dumped the bootrom code and looked at it, there is _NO_ way to load from the sd/mmc card in the bootrom.

Anyways, once we have a real kernel we can examine the original juicebox kernel and maybe figure out a patch to reenable the receive UART, examine the running juicebox kernel and fileset, run their code, look at their drivers, upload their files, etc. to see how things really work. Obviously the mp3 codec, the video codec, etc. all then become fair game.

we already have the kernel binary and source to look at. the image i'm booting now already supports a serial terminal. sounds like you are rehashing ground we've already covered.

10-20-2005 10:33:55

New MessageRE:Custom Cartridge Success (modified 0 times) newell
Profile
we already have the kernel binary

Do we? Is the image.rom in the distribution bootable? I can't build uclinux yet, but I'd really like to have something to test out my MMC + NAND setup.

10-20-2005 12:17:29

New MessageRE:Custom Cartridge Success (modified 0 times) inx3us
Profile
Saw this over at Hack-a-Day and remembered this thread.
http://www.hackaday.com/entry/1234000420064224/
10-21-2005 10:05:46

New MessageRE:Custom Cartridge Success (modified 0 times) jbfan
Profile
prpplague,
Had a few questions about the UMDCart document http://www.elinux.org/wiki/JuiceBoxUMDCart
pin 12 of the card edge normally connects to pin 2 of the sd/mmc card... ...will need to be connect to pin 4 of the card edge.
But pin 4 is already connected to MMC-CS. The connection table implies that pin 6 (not 4) is the correct connection point.

The table also has a few inconsistencies; nRDY, ALE, CLE are listed as connected to pins 57, 58, 59 of the xD card. Assume this should be pins 17, 13, and 14 respectively?

Thanks.

-J

10-21-2005 14:09:47

New MessageRE:Custom Cartridge Success (modified 0 times) prpplague
Profile
But pin 4 is already connected to MMC-CS. The connection table implies that pin 6 (not 4) is the correct connection point.
The table also has a few inconsistencies; nRDY, ALE, CLE are listed as connected to pins 57, 58, 59 of the xD card. Assume this should be pins 17, 13, and 14 respectively?


guilty as charged, guess i didn't proof read as well as i thought i had! i'll get the corrections up today!

good catch!

10-24-2005 06:37:50

New MessageRE:Custom Cartridge Success (modified 0 times) bootdsc
Profile
wow good work man...so im sure every one has been asking for the source, even a buggy one would be nice for testing
10-31-2005 18:47:47

New MessageRE:Custom Cartridge Success (modified 0 times) prpplague
Profile
so im sure every one has been asking for the source, even a buggy one would be nice for testing

i'm totally swampped with my day job(gotta pay the bills) for another week or so, then i can get back to JB hacking with some new features.

11-01-2005 06:44:31

New MessageRE:Custom Cartridge Success (modified 0 times) bootdsc
Profile
sorry to hear your busy prpplague, you seem to be the only one who is working on this.
11-07-2005 01:25:52

New MessageRE:Custom Cartridge Success (modified 0 times) adeptwiz
Profile
bootdsc,

I wonder if we could take the code from a known working cartridge and put it into a flash chip and use that as the first "kernel". Then replace parts of it to get to a bootable kernel. (Not knowing whether checksums, etc. are really needed by the juicebox kernel code). FWIW - If we can just patch a jump into one executed location to our test code we will be up and running :)

I haven't yet figured out how to dump the code from a known working game cartridge; I have two. Their interface seems to be a series of serial bytes that you read one at a time. I suppose their contents could be dumped to the serial port and captured from there. They are pretty big, 16M, but probably there is not much actual ARM code.

There are some comments around about the cartridge format, but not enough for me to be sure what is going on.

Also, I am just learning ARM, so that adds to my fun!

warm regards,
wiz

11-07-2005 07:43:16

New MessageRE:Custom Cartridge Success (modified 0 times) jbfan
Profile
I wonder if we could take the code from a known working cartridge and put it into a flash chip and use that as the first "kernel". Then replace parts of it to get to a bootable kernel.
I assume that is what prpplague has already done (see the title of this thread). Maybe not copying the code but at least reverse engineering the cartridge boot sequence to enable booting an arbitrary image.

I haven't yet figured out how to dump the code from a known working game cartridge...
Didn't realize the JB had any games . As far as dumping a cart, go to the wiki and get the nand_1 package. By default it dumps the entire contents of the cartridge to the serial port.

On the subject; has anyone else attempted to copy a cartridge to nand? So far my experiments have failed, checksums don't match and the screen turns gray on power up. I thought this would be a good test of my (rather slow) jtag write routines but no luck. Can not find where the data mismatch is occurring. I'm not spending too much time on this as it seems we have a solution, or will have once prpplague has time to share the details of his work (always hate it when the job gets in the way of "real" work).

Have been tempted to hookup the cart to a logic analyzer to see what happens on boot but I'm far too lazy^H^H^H^H busy right now. Anyway not much need if there is code that just works.

-J

11-07-2005 12:17:34

New MessageRE:Custom Cartridge Success (modified 0 times) bootdsc
Profile
adeptwiz,

that was jsut what i was thinking, but on a sad not i was adding a mmc adapter to my jb and i am now left with a vary dead jb, its some tihng with the screen...so untill i buy a new one i cant really do any thing. but feel free to bounce some questions my way and maybe i can help.

11-08-2005 10:58:44

New MessageRE:Custom Cartridge Success (modified 0 times) adeptwiz
Profile
bootdsc,

Sorry to hear about dead juicebox. I've got 4. I was going to put MMC inside and give them to my grand kids. Their dad/mom however didn't seem very interested, so right now I use one as an MP3 player with speaker. I gave one to my wife and put her favorite CDs on it (but so far it is unused). and I took one and rigged a wigger jtag port to it as well as a serial port.

I got interested mostly to learn about ARM 7. It's been a fun project!

I think it would be neat to make some plug-in cards with code and custom I/O.

Hopefully prpplague will get the time to put some code up on the web.

warm regards,
wiz

11-08-2005 12:16:01

New MessageRE:Custom Cartridge Success (modified 0 times) bootdsc
Profile
RIP blue/gray juicebox

so i hope to buy a new one in the next few days...if any one needs a new screen tell me. i dont know much bout using jtag, have you been able to get any code off the jb with it?

11-08-2005 22:44:47

New MessageRE:Custom Cartridge Success (modified 0 times) adeptwiz
Profile
bootdsc,

Yes, I have been able to transfer code from juicebox memory to my PC, send code from my PC to the juicebox, and start my program running.

I started with the Xilinx j-tag interface, but discovered that jtager only worked with a wiggler style interface, which I built. It took me a while to understand it enough to figure out that is WAS working correctly.

Next I built a serial port interface and connected that to the juicebox. When an MMC card with at least one valid .mp3 or picture on it is installed, the juicebox sends a full bootup message string out the serial port at 115k baud. Of note, the bootup message states that the serial input has been disabled (for the production version of the code). From what I can tell this is true. However, if I knew where to patch, to enable the input side of the serial port, we would have FULL SHELL access to the running juicebox code. Perhaps a small patch and boot piece could be done. You load your magic code, it patches the juicebox kernel and then starts it running with the serial input enabled. If I just understood ARM better !!

At this point I have my juicebox plugged into the PC serial port and into the parallel port (for the wiggler interface). It all works!!

I have written a small script which echoes back what is received on the input serial port. So all that works.

It would be nice to just plug a cartridge into the juicebox and have it execute my program. Apparently this is possible, but I haven't figured out how.

Let me know if I can be of further help.

warm regards,
wiz

11-09-2005 09:36:40

New MessageRE:Custom Cartridge Success (modified 0 times) NickE
Profile
This is possibly not the thread to post this to. I'm sorry if it is. I have recently discovered this project and am interested in joining in. I have the background to assist in both the hardware and software end. To get up to speed however, I need the JB hardware. Any ideas where to get the 8M version? It looks like a crapshoot on eBay, with most units probably being the 2M version. Any assistance on this matter would be greatly appreciated. I am eager to assist in turning this amazing hardware into something that can play custom video.
11-15-2005 11:00:20

New MessageRE:Custom Cartridge Success (modified 0 times) jester30
Profile
Has anyone seen the new toy just out by Hasbro? It is called Vugo and is what the Juicebox should have been. It is retailing now for about $99 at Walmart and Target. It has 128mb of ram and expandable to 2Gb through SD port. Plays MP3s, jpegs, video (MPEG1 avi, asf wmv) and can record live video from video out ports on tv/dvd. Looks pretty interesting in print but no other specifications on video fram rate. There is a website www.vugo.com

I know you guys have worked hard to get where your at now but it just seems this new toy is what we were after in the beginning.

11-16-2005 04:43:38

New MessageRE:Custom Cartridge Success (modified 0 times) prpplague
Profile
I know you guys have worked hard to get where your at now but it just seems this new toy is what we were after in the beginning.

well, i guess i can only speak for myself, but this was mainly a learning excersise for me. with the inexpensive cost, the JB was a great platform to experiement with technologies that are normally very expensive to work with. this has always been, for me, about a low cost arm7tdmi development board. short list of areas that can learned from the JB:

jtag interfacing
rs-232 basics
arm assembly
arm debugging
reverse engineering
nand and nor flash functions
arm bootloaders


so for someone who wants a good arm7tdmi board, the JB is perfect as a learning tool

11-16-2005 08:36:42

New MessageRE:Custom Cartridge Success (modified 0 times) Tom61
Profile | Email
NickE: If I'm remembering right, all the lime-green JBs are 8MB. Though, with the custom cartridge, it doesn't matter as much now since we were mainly wanting to have a TSOP that was removable, and all 2MB versions had chip blobs for roms. Pending you're not intending to port an app that needs more 2MB, you should be OK even with a 2MB card.

jester30: I'm with prpplague on this, I was in it for the hacking. I already had a PDA that could decode 320x240 DivX on a nice 3.5" transflective TFT when I got my JBs.

I'm still strongly considering using a JB intergrated into my PC's case for visuallization. Being able to send raw frequency data and having another device decode and display is very appealing to me.

For newer hacking and video playback, I'm getting a nice uCLinux powered 3.5" touchscreen 20GB PMP for $200 from geeks.com.

11-16-2005 12:36:12

New MessageRE:Custom Cartridge Success (modified 0 times) JustJeanna
Profile
I cannot make custom cartridges - anyone know where I can get some?

My goal is to be able to download my own songs into the Juicebox players (I have 5 of them for my kids)as I understand you cannot download your own videos....

Help please
jmdh@htva.net

06-15-2006 12:23:22

New MessageRE:Custom Cartridge Success (modified 0 times) rrando
Profile
To use the juicebox for your own music or photos you don't need a custom cartridge, just a mmc adapter and the memory card.
not hard at all.... You can get the adapters from ebay or directly from mattel (see this thread):

http://www.linux-hacker.net/cgi-bin/UltraBoard/UltraBoard.pl?Action=ShowPost&Board=MJB&Post=73

(or make your own from a ribbon cable from the old style floppy (5-1/4 inch) drives).

and the mmc or sd flash memory cards from any electronics or office outlet. As for software, for music I think you just
copy your mp3s to the flash. They have to be at 128khz sample rate or slower, though.
For photos, due to the weird juicebox format, you have to use either the juicebox mp3-kit software which works great, but I
don't know where you can get it unless you buy the mp3 kit (or maybe someone here can help), or else use the jbp converter
program someone wrote (there are a couple of ones I found).

06-15-2006 14:02:21

New MessageRE:Custom Cartridge Success (modified 0 times) garyamort
Profile
If you send me your mailling address, I can send out a copy of the CD as I'm using multiple juiceboxes, but only 1 PC, so I've got extra CDROM's.
06-16-2006 11:36:14

New MessageRE:Custom Cartridge Success (modified 1 times) noobie15teen
Profile
yea hi i'm a real noob at this so i was hoping that prpplague could install linux on my juice box for me.


thanks

07-21-2006 12:05:10

New MessageRE:Custom Cartridge Success (modified 0 times) prpplague
Profile
uh........no


people hack devices because they want to do it themselves. besides i've taken the juicebox about as far as it can go and moved on to hacking other devices.

07-22-2006 06:09:52

New MessageRE:Custom Cartridge Success (modified 0 times) noobie15teen
Profile
ok then can u help me understand the whole thing better. can u take pics of wat the juice box looks like when it's hacked cause i dont get it

plz

07-22-2006 13:00:00

New MessageRE:Custom Cartridge Success (modified 0 times) prpplague
Profile
everything is documented at http://www.elinux.org/wiki/JuiceBox
07-22-2006 13:54:57

New MessageRE:Custom Cartridge Success (modified 0 times) noobie15teen
Profile
i know but i still need some help. if this sounds stupid forgive me but how do u cut ground trace to R2???
07-22-2006 17:30:05

New MessageRE:Custom Cartridge Success (modified 0 times) prpplague
Profile
"i know but i still need some help. if this sounds stupid forgive me but how do u cut ground trace to R2???"


hmm, my first guess would be with a knife.........

07-23-2006 13:38:46

New MessageRE:Custom Cartridge Success (modified 0 times) noobie15teen
Profile
i no but ground trace?
07-23-2006 18:45:06

Reply to Thread | Printer |
All times are PSTPowered by UltraBoard v1.62


Copyright © 2000, Netmake Inc. All Rights Reserved.
See Terms and Conditions for more information.




i-opener opener laptop notebook computer help drivers dll free windows dos repair fix linux mac macintosh 2000 95 98 nt pc configure hardware software sound video netscape explorer network networking lan wan software cmos fat bios printer card mouse modem ide scsi cd rom controllers scanner tape hard drive cgi scripts source code mp3