I-Appliance BBS The Official Source for Internet Appliance Upgrades and Mods Click Here! BBS Main List | Sign In | Sign Up | Search | Help | Linux-Hacker.net Reply to Thread | Printer |

Home / Other I-Appliances / MSNTV2 msntv2 first day .. msntv2 fist day ..

msntv2 first day .. (modified 0 times) codeman Profile | Email 11/10/05 just picked up a msntv2 box today and here is what i found so far .. intel 830 chipset .. bios chip st m50fw080 in LPC mode http://www.st.com/stonline/products/literature/ds/7764/m50fw080.pdf header J2600 left front by leds .. serial debug port .. 1-tx 2-rx 3-gnd 4-3.3v unsoldered and socketed the bios have not had time to read it yet .. here is some of the startup from the debug port .. # FF FA EE FA AB 83C FAPDebug Serial Init SysInit: GDTBase=81370020 IDTBase=81394140 KData=81399800 Windows CE Kernel for i486 Built on Jun 24 2004 at 18:23:42 g_pPageDir = 8139e000 X86Init done, OEMAddressTable = 802a46b8. Crashlog registered SetAudioMute(0) gSMSC_RuntimeBaseAddr=800 ...... ...... ect .... codeman 11-10-2005 13:10:51

RE:msntv2 first day .. (modified 0 times) Salvage Profile Found one in the trash yesterday. Had a small amount of 7up type soda pop on the casing....sticky,sticky yuk! I opened it up hopeing it had a 2.5" harddisk drive, Naw 64MB Sandisk.... Small amount of pop got onto pcb.... Missing the 12vdc adapter and remote. Ebay material? I've made almost $1k in ebay sales of "RECYCLED" materials this year. 100% positive feedback! Helps finance toys! My hats off to 02u2! Quick photos, Nuthin' I'm proud of, http://pg.photos.yahoo.com/ph/salvage4free/my_photos 11-11-2005 11:34:44

RE:msntv2 first day .. (modified 0 times) importmastr Profile Has anyone considered trying to run a linux live CD from a USB CD ROM drive. I realized that you won't be able to boot from it, but Damn Small Linux is set up so you can supposedly run it from within windows. This might work since this platform runs on Windows CE. If this does work maybe you can then change the BIOS. 11-20-2005 02:53:49

RE:msntv2 first day .. (modified 0 times) Niacin Profile I have managed to dump a vaild image of the msntv2 bios. Thanks for your tips on the location of the debug port. If you get a chance msg me on icq or join my irc network (irc.toc2rta.com) and msg me. 11-20-2005 22:12:43

RE:msntv2 first day .. (modified 0 times) codeman Profile | Email i have dumped the bios and looked at it some and it looks like a custom bios not standard stuff .. i think this board is based on the intel 830m4 Development Platform http://developer.intel.com/design/celect/830m/prodbref.htm so maby call intel and ask for the bios for that board .. or reverse the way the box updates the sofware and get it to update with our own image .. there is a lot of debug text in the bios but i dont know yet where it is sending it to .. codeman 11-21-2005 12:44:58

RE:msntv2 first day .. (modified 0 times) yug1taht Profile Codeman-- Please excuse me for being stupid... When you connected to J2600 how did you wire it back to the computer (9 pin?) so you could connect to it. I realize that 1-tx 2-rx 3-gnd 4-3.3v but how would you connect a 9 pin up to it? I have tried a few different ways and instead of frying my box I thought I would ask you... I dont see a UART chip on my board so hacking it via serial port may be out. Also, today I got a PS2 soldered onto the board, tomorrow I will try and tackle soldering the VGA and IDE header onto the board. I also have been doing some reading on the Linux dev kit so hopefully if we can get the bloody thing to open up, there are some resources to leverage other than using CE... It also appears that J3201 is reset, J3202 is power and it looks like U3002 could be digital audio out (trival, I know). Sorry about the rambling 11-24-2005 02:03:34

RE:msntv2 first day .. (modified 0 times) codeman Profile | Email for the serial port you will have to make a rs232 adapter if you want to plug it in the serial port on your pc what i did is use a usb adapter from a cell phone http://www.cellphoneshop.net/usbdacaforlg6.html just cut off the phone end and you can reverse the wires to the serial to usb chip cp2102 115200 baud codeman 11-24-2005 10:17:25

RE:msntv2 first day .. (modified 0 times) yug1taht Profile Since I dont currently have the proper cable to connect to J2600, I have played from the other end, seeing how it updates itself. So I deleted the contents of the CF card If you delete the contents of the flash card- BOOT.PRF BOOTARC.PRF BOOTLOG.TXT BOOTPRF.BAK are automatically re-created without connecting to the dialup or ethernet. A bit like the twighlight zone, it just knows to do it... If there is not net connection it dials 18668056278 for an update If there is a web connection it runs a DNS query on headwaiter.msntv.msn.com which seems to be aliases for sync-sg2.trusted.msntv.msn.com, sync-sg3.trusted.msntv.msn.com and possibly sync-sg4.trusted.msntv.msn.com It then attempts to download http://headwaiter.msntv.msn.com/syncserver/dr.sync?file=PKG.DIR There is some interesting header information that also gets passed in the GET - they are X-MSNTV-Boot-Version: 1 X-MSNTV-Boot-Client: XXXXXXXX (8 digit - obfuscated becuase this is unique and I believe could be linked back to hardware) X-MSNTV-Boot-ID: XXXXXXXXXXXXXXXXXXXx (also obfuscated because it is unique) This get returns a 302 Found and redirects to http://sync-sg2.trusted.msntv.msn.com/syncserver/dr.sync Where it then re-requests the PKG.DIR but this time from sync-sg2 and not headwaiter This returns a file named PKG.DIR which contains file information for it to parse In the header it has a X-MSNTV-Session-ID and in the file it has NAME: TDP NORTHAMERICA/rmonkey@BM-JUDO Fri 11/11/2005 17:10:20.39 BUILD: 000018C0 00040004 DATE: 11/11/2005 PARTITION: 01E84800 00A9 01502F0C 015FBC43 PART000.DAT 8AB8A265 312DD448 4EAC44CC 60562709 1F5DF 20BD6 2 ...(abbreviated for length)... PART168.DAT 0D452EA3 294795F3 FC99BD99 3E13ABF9 16751 16751 0 #00002986 BF6BF8A1 28AC583E E940656A DEFC65F9 It appears to be partition information/what files to download and reassemble It then downloads http://sync-sg2.trusted.msntv.msn.com/syncserver/dr.sync?file=PART000.DAT thru http://sync-sg2.trusted.msntv.msn.com/syncserver/dr.sync?file=PART168.DAT yes, it downloads 169 files. Each get request has the X-MSNTV-Boot-Version, X-MSNTV-Boot-Client and X-MSNTV-Boot-ID (the Boot-ID seems to change with every GET request) After that it appears the MSNTV assembles the files and partitions the CF card based on what the PKG.DIR file says (I can only assume) The CF is partitioned into 32 (FAT32), 15 (unformatted) and 14 (unformatted) MB partitions (thats what Disk Managment says anyway) There may be a way to the beasts heart by doing some DNS spoofing and getting creative with the PKG.DIR but may also have to get around whatever BIOS level check there is to validate the software. Just a thought 11-25-2005 00:28:29

RE:msntv2 first day .. (modified 0 times) codeman Profile | Email I found the Service Menu if you hook upto the serial port you can access the Service Menu after starting the box it will send a # thru the serial port just send back a $ and you get #$OK MSNTV Service Menu BoxID: xxxxxxxxxxxxxxxxxxxx (<- Box Serial # Stored in serial eeprom U5G1) Version: 1 Build: 387 MSNTV CRC: 758646167 MD5: FEC7884E 15CB25B6 8C59A9FA 4A6D0195 POST: 00 Choose option: @: Ping IP address a: Audio test A: Audio Player b: Southbridge/SuperIO tests c: RTC and CMOS test d: Dial a phone number e: Ethernet test f: CF test F: Erase CF g: Ethernet parameters { address mask dns1 dns2 gateway } h: List commands i: Echo IR input j: Load and run service application k: Force reload customer application l: Blink LEDs m: Modem test n: Northbridge test o: Send log to server p: PIC test q: quit and reboot r: RAM test s: Serial port test t: Timer test u: USB test v: Video test and show test screen w: Reset factory settings W: Reset service clock x: Examine memory y: Show Box Info Y: Show Box Hardware Info z: List contents of CF *: Run all tests in sequence > codeman 11-25-2005 10:21:51

RE:msntv2 first day .. (modified 0 times) onmitsu Profile Does anyone know what the solder pads marked as C3000 is for? They are located right next to the Right Audio (Red), could they be for more USB ports? I read somewhere that the i830 chipset supports (4 or 6, but I cant remember which right now) Great job CodeMan, your findings are encouraging. (ps, the floppy power connector from a normal power supply fits the 4 pronged connector great) I will play with it tonight and see if I can get it to work. 11-28-2005 18:34:36

RE:msntv2 first day .. (modified 0 times) yug1taht Profile I believe it is for digital audio out. A pic I saw for the development board had a digital audio out next to it 11-28-2005 23:09:56

RE:msntv2 first day .. (modified 0 times) yug1taht Profile I believe it could be for optical audio (SPDIF/TOSLink). A pic I saw for the development board had a digital audio out next to it. Take a look at page 14 of this document http://download.intel.com/design/celect/swd/WinCE_5_0_BSP_User_Guide.pdf 11-28-2005 23:22:51

RE:msntv2 first day .. (modified 0 times) linux_junkie Profile This is great! I don't feel so alone anymore in my quest. Here is what I have discovered so far. I contacted Thomson electronics for the original bios image and they said they were not able to help me. They directed me to RCA but RCA could not help me due to a contract with msn. I have removed the bios chip and soldered on a PLCC32 socket. I used the Uni-flash program on an i810 board (host) and a spare chip to flash a bios image from a laptop that uses the i830. No go, when I put the laptop chip in the msntv2 and hit the power button on the keyboard nothing happens. Here is my question. Could anyone out there with a dumped image comapre it to a dumped image from a i830 laptop to get this thing to boot to disk?? Could a hybred image be created between the two?? Hack it! Set-Top-Linux 12-03-2005 09:52:31

RE:msntv2 first day .. (modified 0 times) linux_junkie Profile Interesting... on that link for the development board (http://download.intel.com/design/celect/swd/WinCE_5_0_BSP_User_Guide.pdf) It gives some original bios info: BIOS Version: 08.00.10 Build Date: 10/05/2004 ID: ASGLB008 Hack it! Set-Top-Linux 12-05-2005 17:02:25

RE:msntv2 first day .. (modified 0 times) Niacin Profile I got another msntv today. Strange thing happened. I tested it. Works fine, I noticed on the bottom instead of the thompson label on all my other ones. "Engineering Sample" and then when i opened it up inside. It has an intel bios, not the standard one. Also some of the header pins on the bottom right have been desoldered and used. http://www.intel.com/design/chipsets/datashts/290658.htm . I desoldered the intel bios and put it on the other board i socketed. Booted fine, The cf didn't have any bins on it. So it defaults to update mode. I havn't had much luck dumping the intel bios as my eprom programmer crapped its self. I have another one on the way. Will let you know. 12-09-2005 13:26:38

RE:msntv2 first day .. (modified 0 times) superhappyfunmarket Profile Has anyone made any progress on this? I have a similar box to the MSNTV box. It has a different ROM, and has headers soldered in for PCI and IDE. I believe that the ROM is not a bios, but a boot rom. I've tried loading RedBoot in to the bootrom, but so far haven't had any luck. 01-07-2006 12:40:16

RE:msntv2 first day .. (modified 1 times) outatyme Profile what kind of box is it superhappy? i was sorta hoping this thread wouldnt die but i guess i should do more posting instead of lurking ;-> could be a tompson ip1000 i dont know how many of you have heard of or seen a WebTV unit but the MSNTV2 is supposedly a successor to it (however) the hardware is completely different. 01-07-2006 20:31:21

RE:msntv2 first day .. (modified 0 times) superhappyfunmarket Profile The box is an IP1000. It's nearly identical to the MSNTV2 box. The rom is different, and there are slight hardware differences (no modem, connections on the board instead of just solder pads, etc...). But I have seen both boxes, and they are essentially the same. I'll dumped the rom using a eeprom burner/reader, and I've attempted various replacements without luck. 01-11-2006 10:46:27

RE:msntv2 first day .. (modified 0 times) outatyme Profile ah yeah the msntv2 was developed from the ip1000 as far as i know. so yes they are very close when the msntv2 first came out (i've been interested in it since it came out but i havent had much money to get one..) i had seen the ip1000 and wondered if the bios would work. i remember reading somewheres (probably in the msntv2 news announcement when the unit first came out) that and this is a quote "The standard anti-hacking tricks are in place" LOL not sure what they mean by that but it couldnt be anything too hard. if you read the bios in it'd be nice to see a dump of it (the bin file) but i cant promise i can do anything. so if you could get the contents of the msntv2 rom and maybe the ip1000 i'd appreciate it. i'll tell everyone though if there is something preventing you from loading another os then it is in the bios/bootloader. this is an x86 based system so it shouldnt be that hard to repourpose. i'd love to help out if i can though. 01-13-2006 10:35:47

RE:msntv2 first day .. (modified 0 times) codeman Profile | Email ya i would like to see that ip1000 bios also im trying to figure out the debug stuff on the serial port codeman codeman@linux-hacker.net 01-13-2006 16:10:40

RE:msntv2 first day .. (modified 0 times) outatyme Profile if we can get a patched bootloader on there we can probably get linux running or winxp running or a custom build of winCE i know i read that the ip1000 can run winxp. not sure if they meant winxp embedded though... 01-13-2006 20:34:01

RE:msntv2 first day .. (modified 0 times) Niacin Profile Ok :) Finally i had some time this week ( got sick and took a sick day). I have managed to boot the Linux kernel (2.6.13) on the msntv. Yes you heard it right! i finally managed to boot Linux on the msntv 2. I havn't mounted a rootfs yet, tonight when i get home i will do that. But for now i just thought i would let everyone know. I will be posting my findings in a few days on my site www.toc2rta.com so check it out. Thanks to codeman for the discovery about serial. This was very helpful :) 02-08-2006 08:39:08

RE:msntv2 first day .. (modified 0 times) vaelek Profile Very cool Niacin! I have been lurking in this forum for a while now to see if anything came of all of this. I have been "renting" a D-Link Medialounge and am wholly unimpressed. I have visited your site and see there is no info up as of yet. I am all for giving time to properly document your findings, however, any chance you could be talked into at least letting us all know if the solution you have found will require any additional hardware or if those of us who are not excelling in the areas of eproms and serial interfaces will be able to perform this magic? Cheers! -Vaelek- 02-08-2006 16:06:27

RE:msntv2 first day .. (modified 0 times) Curious Profile Niacin, I went to your site, two items: 1. under PSP exploits the overflow.tif file caused a virus alert when I tried to download. 2. have you figured out how to unbrick a PSP? 02-08-2006 17:17:52

RE:msntv2 first day .. (modified 2 times) Niacin Profile Yeah i havn't posted anything yet. I have *just* about 5mins ago managed to get a shell :) At the moment there is no real support for any of the hardware. All it does is boot and you get a simple shell. I used an eprom programmer to flash the bios and then just put the Linux kernel on the cf disk along with the rootfs. I think i have figured out a way to mod it with out socketing the bios. But you would require serial access to the machine. (I will release a simple diagram of how to wire it). It will be a few days before i release my findings. I'm trying to get a bit more support for the hardware i.e vga / network / usb etc. I will post the kernel dmesg output later tonight on here. If you would like to talk to me futher you can join irc.toc2rta.com and msg niacin. \Niacin Toc2rta 02-08-2006 19:59:52

RE:msntv2 first day .. (modified 0 times) Niacin Profile OK. Well so far i have the nic card working and looks like the sound card works. Everything seems pretty standard. The video card might take a little longer to get running. Here is the kernel out put from the first boot http://toc2rta.com/msnlog.txt. I have some ideas about how to flash with out having to remove the bios. I will post back with some more information either later today or tomorrow. \Niacin Toc2rta 02-09-2006 11:36:14

RE:msntv2 first day .. (modified 0 times) codeman Profile | Email did you try intel's linux for the 830 http://www.intel.com/design/celect/swd/linux830.htm codeman 02-09-2006 16:56:23

RE:msntv2 first day .. (modified 0 times) Niacin Profile Ok. I have wrote a program that will basicly patch the bios when its loaded in memory then run the Linux kernel from the CF card. You will need a serial connection to the machine and this will give you a choice of either leaving the M$ bios on the machine or flashing the bios with the modified one (from Linux). I havn't had time to look into much depth at the vga stuff yet. But USB / Network / Sound / Modem all work. IR stuff will likely work too. \Niacin Toc2rta 02-09-2006 23:37:11

RE:msntv2 first day .. (modified 0 times) Niacin Profile Good news. I have managed to flash the msntv with out an eprom programmer. Using the service menu i have manage to write over a function in ram and then use it to run the existing flash bios command. I'm writing up my page on how to do it all. If you get a chance check out some pictures of my msntv cluster http://toc2rta.com/msnpics/ and check out my site later tonight / tomo to find out how to get Linux on your msntv :) 02-11-2006 20:56:17

RE:msntv2 first day .. (modified 0 times) vaelek Profile Is it possible after replacing the bios to boot the original wince? 02-12-2006 03:11:49

RE:msntv2 first day .. (modified 0 times) Niacin Profile Once you flash the new bios.bin you won't be able to boot wince. But if you really wanted to go back to wince. You can reflash the orginal bios.bin and go back. So yes you can restore wince. I can't release the modified bios.bin directly ( fear of being sued ). 02-12-2006 09:09:58

RE:msntv2 first day .. (modified 0 times) Niacin Profile Ok. I have posted it on my site. For any questions join my irc network irc.toc2rta.com and message me. My site is http://www.toc2rta.com Thanks for all your support. 02-12-2006 10:55:17

RE:msntv2 first day .. (modified 0 times) onmitsu Profile Has anyone had any luck getting with the IDE connection? Apart from having to solder in the pins, does it look like a viable boot option sometime? Also, what is the possibility of adding a pci card to the msntv2? I know that it has the traces on the mainboard, is there any other reason apart from the lack of space that would stop you from using it? 02-13-2006 16:42:52

RE:msntv2 first day .. (modified 0 times) linux_junkie Profile Niacin, You Are The Man!! Great work!! Few questions, Does the patched Bios.bin get loaded into the msntv2's eeprom on every boot or just for the first initial loading? Also is there any progress on the 64MB CF limit? I was thinking of getting a 8 gig microdrive and installing a full linux distro. Hack it! Set-Top-Linux 02-22-2006 21:26:00

RE:msntv2 first day .. (modified 0 times) whatz Profile | Email about the ide connection. the cf card slot is actualy a ide port if you could make up a cable you can put in a harddrive no problem http://www.cfide.co.uk/ 03-03-2006 07:28:17

RE:msntv2 first day .. (modified 0 times) forumworx Profile You can find these adapters for much cheaper on ebay than http://www.cfide.co.uk/. Search for "cf-to-ide" and you'll see tons. 03-08-2006 11:33:15

RE:msntv2 first day .. (modified 1 times) whatz Profile | Email that was just for example what you would need to do is make your own adapter out of ribon cable with ide and cf header's. No other components needed (no caps or resitors just power for the hd) 03-19-2006 07:34:40

RE:msntv2 first day .. (modified 0 times) whitewiz Profile Gaaaa; I can't win for losing. I got a cell cable and got into the debug menu btw kyocera txdta10017 cable $1.80 it has a sipex sp3238eea chip in it http://www.sipex.com/productDetails.aspx?part=SP3238E p1 tx blu p2 rx org p3 gr blk p4 3v brn tested working and now toc2rta.com isn't up! I have all the files downloaded i just don't have the examine memory strings to flash the bios patch. (http://mirror.toc2rta.com/cmds.txt) Does anyone have the strings or can we get the page back up somewhere new? (google cached pages didn't cache the offsite links) 07-11-2006 17:20:18

RE:msntv2 first day .. (modified 0 times) jpe_dty Profile I put a copy of cmd.txt in: http://jpedty.net/msntv2/ 07-11-2006 18:57:32

RE:msntv2 first day .. (modified 0 times) ik632 Profile I should be getting my MSNTV2 tomorrow (according to UPS) and I have downloaded all the files except the bios (the link isn't working). Does anyone have a copy that they could send to me? If you do please send it to ik632(at)yahoo.com Thanks, ik632 07-18-2006 09:45:04

RE:msntv2 first day .. (modified 0 times) whitewiz Profile i don't think i patched the bios correctly for frame buffer video cuz all i get is a black screen on the rca outputs serial looks good tho: [ 14.240556] VFS: Mounted root (ext3 filesystem). [ 14.245652] Freeing unused kernel memory: 188k freed ... we come in. sh-2.05b# ls bin dev lib proc sys usr busybox etc lost+found sbin tmp sh-2.05b# trying to find some online storage to host the files until Niacin gets his site rebuilt.... trying http://www.streamload.com .... 07-18-2006 19:24:56

RE:msntv2 first day .. (modified 0 times) whitewiz Profile files located at http://www.openomy.com login msntv2 pw msntv2 07-19-2006 15:24:51

RE:msntv2 first day .. (modified 0 times) whitewiz Profile i'm a little stuck at this point - apply 'intelfb-rm4100.patch' to your 2.6.15.1 (or so) kernel tree ('patch -p1 <intelfb-rm4100.patch' if you are in the root of the kernel source tree) - build a suitable kernel with the intelfb framebuffer driver little help, plz? 07-19-2006 16:20:42

RE:msntv2 first day .. (modified 0 times) linux_junkie Profile First the bad news: Looks like Niacin's Site (http://www.toc2rta.com) is no longer up and running. Shame there was a good thing going on there. Now the good news: I got sick of wondering if http://www.toc2rta.com would come back up and decided to start a new site. Come and check it out http://www.smittys.pointclark.net/rm4100/index.php Niacin where are you??? If you were able to salvage your database please send it to me and I will integrate it. This means we are going to start all over. Well I had saved a copy of Niacin's main page (awhile ago) with all the files and posted them on my site. Come and check it out! Hack it! Set-Top-Linux 07-20-2006 10:37:26

RE:msntv2 first day .. (modified 0 times) whitewiz Profile Darn; I soldered a VGA connector onto the board, nothing comes out. Must be disabled in the BIOS. 07-25-2006 18:17:11

RE:msntv2 first day .. (modified 0 times) linux_junkie Profile The above site is no longer valid (http://www.smittys.pointclark.net/rm4100/index.php). The new site for the MSNTV2 can be found here: http://www.settoplinux.org By the way I now have the coreboot bios running on the MSNTV2. :) Hack it! Set-Top-Linux 05-08-2008 10:16:04

Reply to Thread | Printer | All times are PST Powered by UltraBoard v1.62

I-Appliance BBS General - NEWS, Breaking NEWS - linux-hacker.net BBS on CD Questions - User Groups in Your Town - E-Bay, Yahoo Auction LINKS ONLY (MODERATED) - Jokes & Humor - usdtv box I-Opener Areas - I-Opener General Posts - I-Opener Technical Stuff - I-Opener Technical Info Reference (MODERATED) WebSurfer Areas - WebSurfer General Posts - WebSurfer Technical Stuff - WebSurfer Technical Info Reference (MODERATED) Other I-Appliances - Virgin Webplayer - WebPal - MailStation - 3Com Audrey - ThinkNIC / Oracle NIC - Gateway/AOL Connected Touch Pad - Philips/AOL-TV - ACER NT-150 STB - MSN Companion - Compaq IA - Emachines IA - IBM NetVista IA - Intel dot.station - MSNTV2 Network Computers - Fujitsu-Siemens Scovery Linux Net Computers - GallantWeb Server Consoles - Dreamcast - xbox hacking Web Pads - Epods One General Post - Panasonic CF-01 - Fujitsu Stylistic 1200 - Cybiko Thin Clients - Thin Clients DigitalVideoRecorders - DTV Recorders, Replay, TiVo, Etc... - Tivo Hacks Linux - Midori Linux General Board - ITX MotherBoards Single Board Computers - Earth Computers mARMalade Elite Member Area MISC Areas - The Swap Meet WE TAKE NO RESPONSIBILITY FOR ANY TRANSACTION HERE AND NO COMMERCIAL POST PERIOD !!! - Wireless Net - Cameras - Robotics - Routers/Gateways - Mattel JuiceBox