I-Appliance BBS The Official Source for Internet Appliance Upgrades and Mods BBS Main List | Sign In | Sign Up | Search | Help | Linux-Hacker.net Reply to Thread | Printer |

Home / Other I-Appliances / MailStation Just Deals Mailstations Firmware and user limts for Mailstations

Just Deals Mailstations (modified 0 times) hd1910c Profile I just got 5 Mailstations from Just Deals. They have Firmware 2.54Y, which I've come to find out allows only one user and locks the information. No changes can be made to the e-mail account info if there is an entry error. Talking with Just Deals, I've found out that some of the units they have are firmware 2.55Y, which allows up to 5 users and will allow edits. Just Deals has agreed to return or replace the units, if I choose. For those who have 2.54Y like me, I've found one way to reset the info: 1. With the power off, hold down FN-SHIFT-T. 2. Press and release the Power button. 3. The unit will enter the Diagnostics menu and tell you the firmware version you have. 4. Choose #3 (F/A Tester) 5. Choose #6 (Flash Test) 6. Press the Back key 7. Press Q to quit. 8. The unit will scan memory and come up with Rest System Data menu 9. Choose whateven option to see fit, EXCEPT for the Restore Default Account option. You can now re-enter an e-mail account. Looks like I've missed my chance to get the firmware off Freedrive. Does anyone know where else I might be able to find this upgrade? 11-12-2001 13:10:04

RE:Just Deals Mailstations (modified 0 times) wildcard Profile hd1910c Good find. Fn Shift T and power on is an interesting key combination. On two different machines I come up with 9 + 6 digit serial numbers printed on the bottoms of the machine. Lots of other interesting options that I haven't seen before. Thanks for sharing that keycombination. 11-12-2001 21:34:18

RE:Just Deals Mailstations (modified 0 times) wildcard Profile As a btdt, Even that my machines were 5 users unlocked, I tried out hd1910c suggestion. The flash test is slow. but it erases all the account information that you have stored in the machine. Even that on the reset system data menu you choose, no clear, all your account information is gone. By the way, on the 5 user unlocked version, I am not presented with a choice of Restore Default Account 11-12-2001 22:16:01

RE:Just Deals Mailstations (modified 0 times) cgenman Profile Excellent find! Are you going to claim the 100 dollar prize? No restore default account option on mine either, a one user black / yahoo unit. Completing the timely flash test is also not necessary, just pulling the battery out as the test starts is enough corruption make the unit forget its masters. Oddly, that seems to be the only thing that will corrupt just the right part of memory, as doing the same during a save operation will cause a quick memory recovery check and the standard reset button screen but will not trigger a configuration imput screen 11-19-2001 16:47:41

RE:Just Deals Mailstations (modified 2 times) hd1910c Profile I'll claim the prize, if I can get hold of HackerHoward (I think this is the prize you're refering to). What firmware version do you have, cgenman? The restore default option sets the unit with Cidco's servers and a phone number in the 415 area code. It's better that you not have it. I've also heard that the units can be reflashed with PC based software and a parallel cable. I'm looking for the 5 user unlocked firmware (2.55Y) and the software to flash it. Any pointers in the right direction would be appreciated. -hd1910c 11-20-2001 02:06:04

RE:Just Deals Mailstations (modified 0 times) wildcard Profile hd1910c I have a Zip copy of the Mail Station Rom that had been in a freedrive account. If you provide an email account, I will send it to you. I do not know what firmware version it is. It has also been my speculation that the units can be reflashed with PC based software and a parallel cable. Do you know what software it needs? 11-22-2001 12:25:26

RE:Just Deals Mailstations (modified 0 times) wildcard Profile Fn/ Shift /T and power. And the mailstation breaks into a new area. Looking back at the freedrive material I find this code which is controlling the responses. 0056A0 5786578E579057935797579B579F57A457A957AE57B857BD57C157CC57D557E0 W.W.W.W.W.W.W.W.W.W.W.W.W.W.W.W. 0056C0 57E957EF57F45743757272656E7420544553540044544D462054455354004261 W.W.W.WCurrent TEST.DTMF TEST.Ba 0056E0 7474657279205445535400452D6D61696C2054455354005072696E7465722054 ttery TEST.E-mail TEST.Printer T 005700 45535400524F4D20544553540052414D205445535400464C4153482054455354 EST.ROM TEST.RAM TEST.FLASH TEST 005720 0041504F2F5254432054455354004C4344205445535400454C2054455354004C .APO/RTC TEST.LCD TEST.EL TEST.L 005740 434D2054455354004B657920426F617264205445535400462F41205445535445 CM TEST.Key Board TEST.F/A TESTE 005760 520052554E2D494E2054455354005141204556414C554154494F4E00504F5745 R.RUN-IN TEST.QA EVALUATION.POWE 005780 52204F46460041504F2F52544300310035300031303000323030003530300031 R OFF.APO/RTC.1.50.100.200.500.1 0057A0 30303000323030300035303030004641535420544553540044544D4600454D49 000.2000.5000.FAST TEST.DTMF.EMI 0057C0 004E4F524D414C2052554E004D5442462052554E004D4F44454D205445535400 .NORMAL RUN.MTBF RUN.MODEM TEST. 0057E0 46534B2054455354004E616D653A004E6F2E3A0054696D653A00050001020304 FSK TEST.Name:.No.:.Time:....... 005800 0405060708000502000C05060507010304080505060709010500020304110309 ................................ 005820 1A0D0000030E0F100000051213141516031718190000031C1B1F000003212223 .............................!"# 005840 0000485853585F584F3A204F6E204C696E6500463A204F6666204C696E650042 ..HXSX_XO: On Line.F: Off Line.B 005860 41434B3A2052657475726E006E5849646C6500755852756E007B584F66660085 ACK: Return.nXIdle.uXRun.{XOff.. 005880 588A588E5848696768004C6F7700446F776E009558416C6C009B584D61696E20 X.X.XHigh.Low.Down..XAll..XMain 0058A0 426F617264204155544F2054657374204D61696E204D656E7500BC5844494147 Board AUTO Test Main Menu..XDIAG 0058C0 4E4F53544943204D41494E204D454E5520202056657273696F6E3A2000DF584C NOSTIC MAIN MENU Version: ..XL 0058E0 434D2054455354204D454E5500EF58462F4120544553544552204D41494E204D CM TEST MENU..XF/A TESTER MAIN M 005900 454E5500065952554E2D494E2054455354204D454E5500195952554E2D494E20 ENU..YRUN-IN TEST MENU..YRUN-IN 005920 54455354204E47204954454D204C495354003459464153542020544553540047 TEST NG ITEM LIST.4YFAST TEST.G 005940 595059565959594C3A204C4F4F505300434F554E54004F4B004E470068596F59 YPYVYYYL: LOOPS.COUNT.OK.NG.hYoY 005960 785985598E599A59523A2052756E00503A205061757365004241434B3A205265 xY.Y.Y.YR: Run.P: Pause.BACK: Re 005980 7475726E004C3A204C6F6F707300533A2053686F77206C6F6700433A20436C65 turn.L: Loops.S: Show log.C: Cle 0059A0 61720001002B005F00AA00DC001B0100001D0027003E00250034002400000002 ar...+._...........'.>.%.4.$.... 0059C0 000B05060701030408050607090100020304087E0019017E001901BA00230100 ...................~...~.....#.. 0059E0 0000002E006000090AEB594F3A204F4B00F3594E3A204E4700FB5941504F2F52 .....`....YO: OK..YN: NG..YAPO/R 005A00 54432054455354494E47000D5A43757272656E742054455354494E47202D2D2D TC TESTING..ZCurrent TESTING --- 005A20 3E00245A426174746572792054455354494E4700385A425A49444C45204D6F64 >.$ZBattery TESTING.8ZBZIDLE Mod 005A40 650052554E204D6F6465004D5A506C6561736520696E70757420796F75722073 e.RUN Mode.MZPlease input your s 005A60 656C656374696F6E006B5A507265737320656E74657220746F20636F6E74696E election.kZPress enter to contin 005A80 756500855A4469616C696E672E2E2E001193FFCD6B05217B00395E2356216C00 ue..ZDialing........k.!{.9^#V!l. 005AA0 39732372217D00395E2356216E003973237223363F23360123367F233600217F 9s#r!}.9^#V!n.9s#r#6?#6.#6.#6.! 11-22-2001 12:38:02

RE:Just Deals Mailstations (modified 0 times) wildcard Profile One more segment of the starting code that sheds light on the likelihood that these machines can be reflashed is this. 004320 007CB5C92100007CB5C9202020202020202054686520736F6674776172652075 .|..!..|.. The software u 004340 70646174652070726F6365737320697320726561647920746F2073746172742C pdate process is ready to start, 004360 20706C6561736520776169742E2E2E0020202020202020202020202020202020 please wait.... 004380 20202020202020506C6561736520636F6E6E656374207468652061646170746F Please connect the adapto 0043A0 7220616E642074727920616761696E2E0020506C6561736520636865636B2074 r and try again.. Please check t 0043C0 6861742074686520706172616C6C656C206361626C652069732070726F706572 hat the parallel cable is proper 0043E0 6C7920636F6E6E656374656420616E642074727920616761696E2E0020202020 ly connected and try again.. 004400 202020202020202020202020202020202020202020202020536F667477617265 Software 004420 206973207570646174696E672C20706C6561736520776169742E2E2E00202020 is updating, please wait.... 004440 202020202020202020202020202020202020204E657720736F66747761726520 New software 004460 697320646F776E6C6F6164696E672C20706C6561736520776169742E2E2E0020 is downloading, please wait.... 004480 20202020202020202020202020202020202020202020202020202020436F6E74 Cont 0044A0 696E75696E6720646F776E6C6F61642C20706C6561736520776169742E2E2E00 inuing download, please wait.... 0044C0 2020202020202020202043616C63756C6174696E672074686520636865636B73 Calculating the checks 0044E0 756D206F66207570646174656420736F6674776172652C20706C656173652077 um of updated software, please w 004500 6169742E2E2E0020202020202020202020202020202020202020205468652063 ait.... The c 004520 6865636B73756D206F66207570646174656420736F6674776172652020697320 hecksum of updated software is 004540 0020202020202020202020202020202020202020202020202020202020202044 . D 004560 6F776E6C6F6164206572726F722C20706C656173652074727920616761696E2E ownload error, please try again. 11-22-2001 12:45:37

RE:Just Deals Mailstations (modified 0 times) hd1910c Profile Wildcard, please send it to mag1cal@yahoo.com. If I get any details on the software to flash these units, I'll post it here. In they meantime, I'll try burning the images you send the old fashioned way. Thank you for the help. 11-23-2001 14:04:54

RE:Just Deals Mailstations (modified 0 times) bourbaki Profile If also got one of these mailstations with 2.54Y firmware, having up to 5 users and been able configure smtp and pop3 server freely. But I've still got a problem with emails containing attachements, because the are either deleted from the server (so i can't read them later with my computer) or not deleted, which means that my mailstation will download the same mails everytime. Beeing interested anyway and programmed for the 6502 (once upon a time), I would also like to have a look in the firmware (which is Z80, I know). Maybe it's possible to send me the code too, or make it once again downloadable for everyone who's interested. thanks, bourbaki 11-25-2001 12:28:17

RE:Just Deals Mailstations (modified 0 times) wildcard Profile I am emailing the code to hd1910c. bourbaki, leave an email address to send it to. If there are several people, (hamilton?) involved it could set up on an account. 11-25-2001 13:07:46

RE:Just Deals Mailstations (modified 1 times) hd1910c Profile I can't add more users to my 2.54Y firmware. If I try to add more users, I get a dialog box telling me to call an 800 number (Cidco, I assume) to add more users. All I can do is clear it with via the flash test and start over with another user. I have seen an option to leave e-mails on the server in one of the config screens. I don't have my Mailstation in front of me right now, but if you're unable to find it, I'll look it up and post a more detailed follow up. One thing you can do is have your e-mail client (like Eudora or Outlook) delete messages older than x days. This is how I keep my e-mails in synch and home and work. The home PC is configured to leave messages on the server and the work PC deletes the messages 3 days after it downloads them. This works pretty well for me. 11-25-2001 19:48:18

RE:Just Deals Mailstations (modified 0 times) nobodycares Profile Thanks for the information on how to change to your own ISP. I'm using Mindspring and it works great. Here's the info to help you set up for Mindspring: User Name: Whatever you call yourself i.e. nobodycares Dial-Up No: Your local access number E-Mail Address: Your Mindspring e-mail address i.e. nobodycares@mindspring.com E-Mail Password: Your e-mail password for mindspring i.e lem0nade POP3 Server: mail.mindspring.com SMTP Server: smtp.mindspring.com ISP Account: Your mindspring account number i.e ms000000@mindspring.com. This is NOT your e-mail address but is the account number issued by Mindspring ISP Password: Usually the same as your e-mail password Primary DNS: 207.69.200.60 Reply-To: You can leave blank or fill in a name Save the info then verify it in the Extras - Edit User. If it's wrong you'll have to do the reset procedure and re-enter the correct info. Thanks again to hd1910c for posting his valuable discovery, after all, I didn't want to waste the $15 I paid for my mailstation at Off Depot. 11-26-2001 08:54:53

RE:Just Deals Mailstations (modified 0 times) bourbaki Profile wildcard: thanks for the offer, please send the code to jan-remmers@web.de . I think the file must have the size of some big jpeg, so truncation shouldn't be a problem (hope so). Thanks in advance, bourbaki. hd1910c : your mailstation differs from mine, even if they seem to have the same firmware version (2.54Y). This is curious because this either indicates that firmware version has nothing to say or it's possible to configure it in variably ways without the need to change the firmware - possibly through these special configuration emails I've written elsewhere on this site. I've bought my mailstation from a german seller - even if it has an us (or maybe uk) keyboard, it has none of the problems other users have written of. It allows 5 users and I'm able to configure smtp/pop3 freely. If you are interested I can email the seller's adress, but maybe somebody hack's this thing before... so long, bourbaki 11-28-2001 17:15:35

RE:Just Deals Mailstations (modified 0 times) rogblake7 Profile | Email Was the Freedrive code the 32K ROM dump? I've looked over that code and have made sense of a good portion of it. I just wonder why the rest of the ROM wasn't posted. Hint on the dump: It's not contiguous. The first half is 0000-3FFF. The second half is 8000-BFFF. It looks like the bulk of the second half is used for tables (strings, character definitions, masks, etc). There's a routine in the first half that accesses the reprogram routine in the second half, but I can't find anything that causes the earlier one to get called. It also looks like the self-test routines are located elsewhere, though the string definitions are stored in the 8000-BFFF chunk. 11-30-2001 09:40:48

RE:Just Deals Mailstations (modified 0 times) wildcard Profile rogblake7 the freedrive posting had a couple parts. First and most visible was the first ROM code. Sectond, there was also a large zip file, that when unziped becomes thirty two (32) files, named from page00.hex to page1f.hex. Third, there was a good collection of pdf files, that were techical reports about various chips in the machine. I've got saved the zip file, and I can forward it to email addresses. I didn't save most of the pdf technical reports. 11-30-2001 16:51:37

RE:Just Deals Mailstations (modified 0 times) rogblake7 Profile | Email Can you email the zip file to me at rogblake2000@yahoo.com? A little clarification on my previous post: I only have the first 32K of the image. There's a routine located in the first 16K that copies code starting at 0x4000 to 0x8000 in RAM before jumping to it. Most of the ICs in the mailstation are pretty common, but the processor appears to be custom. It seems to be a Z80, but Zilog doesn't make anything in that package. It also appears to have a 20 bit address bus (1 meg address space). Also, it appears the registers at I/O space 5 and 6 are part of a bank select/MMU scheme for addressing that space. 12-03-2001 08:39:17

RE:Just Deals Mailstations (modified 0 times) wildcard Profile How did you get the first 32 k Rom. Did physically pull chips off the mailstation? 12-03-2001 12:45:28

RE:Just Deals Mailstations (modified 0 times) rogblake7 Profile | Email The 32K block I had was apparently from the freedrive stuff. More clues: The block of code at 1BC0h copies to code at 4000h-4F42h in ROM to 8000h-8F42h in RAM, then jumps to it. The 4000/8000 block is the flash reprogramming stuff. I haven't located a jump to 1BC0 yet. ; Index into $8000 block routines 8000 C38185 JP $8581 ; Reprogram device 8003 C30189 JP $8901 8006 C36380 JP $8063 8009 C33581 JP $8135 800C C3B881 JP $81B8 800F C35C81 JP $815C 8012 C3D481 JP $81D4 8015 C3F081 JP $81F0 ; Program bytes 8018 C35C82 JP $825C ; Erase sectors 801B C3CB82 JP $82CB ; Calculate checksum 801E C3C886 JP $86C8 8021 C38487 JP $8784 8024 C30188 JP $8801 8027 C31788 JP $8817 802A C34388 JP $8843 802D C37D88 JP $887D 8030 C38788 JP $8887 8033 C3A288 JP $88A2 8036 C3D688 JP $88D6 8039 C30E83 JP $830E ; Test P9.5 (return 2 if set) and P9.6 (return 1 if set) 803C C3FC82 JP $82FC ; Test P9.7 803F C3B089 JP $89B0 ; Print text? 8042 C36D8A JP $8A6D 8045 C39A8A JP $8A9A ; Copy 128x20 blocks to C010 & CA10 8048 C3B78A JP $8AB7 ; Copy 128x20 block? 804B C3DE8A JP $8ADE ; Clear 5K at $C010 804E C3ED8A JP $8AED ; Print char 8051 C34789 JP $8947 ; Convert 4 bytes to ASCII string (hex 0-F) for checksum 8054 C31789 JP $8917 ; Copy string from HL to DE 8057 C32289 JP $8922 ; Go to next string? 805A C33689 JP $8936 ; STRLEN (HL) 805D C3F488 JP $88F4 ; Delay 8060 C38789 JP $8987 ; Print string Also: 8B22: Table with something to do with character display 8B82: 16 bit offsets for each of the printable chars (20h-80h) 8C42: Bitmap definitions for the characters Chars are stored 8 bytes/char, top to bottom, LSB on left 12-04-2001 17:56:06

RE:Just Deals Mailstations (modified 0 times) hamilton Profile Hi all, I am so happy to see my work is being used. Please review the thread "Real Z80 hackers only" about what was on Freedrive. If I can find another free drive site I would repost my work. The FLASH chip used in the Mailstation is 1Mbyte. Thats 16-32k byte segments. I build a simple 8032 board with an adapter for the FLASH chip from my board. I have not touched my Mailstation in months. hamilton 12-04-2001 19:04:18

RE:Just Deals Mailstations (modified 0 times) wildcard Profile Yes, Rogblake7 insteresting posts. Keep us informed. If different code could replace whats in the mailstation, what would you change? Me, What I want is improved, text editing in the email writing program especially better cursor movement. I find the schedule program hopelessly bad, so I wouldn't mind losing it. 12-07-2001 10:08:15

RE:Just Deals Mailstations (modified 0 times) abcMIVO100 Profile Just wanted to say thanks. I read your posts and they helped me configure my MIVO100 to a new mindspring account using my "free" Dialup time provided by earthlink with my DSL account. They give you 20 hours/week of dialup time when you have a DSL account. That should be more then enough. I would have never figured out the Function-Shift-T. Thanks again. 12-09-2001 19:48:42

RE:Just Deals Mailstations (modified 0 times) rogblake7 Profile | Email I uncovered lots of other code, but still haven't figured out how to get the thing into reprogramming mode. Looks like I'll have to do a lot more work to figure out the banking scheme on it. One interesting bit: In all the text (except in page 00 of the ROM dump), the ASCII strings are scrambled. There's a pattern to it. All bytes landing on (address & 0x07) == 2 are substituted with the character found two bytes previous. All bytes landing on (address & 0x07) == 5 are substituted with the character found two bytes forward. Example (for a string starting at a location where the lowest three bits of the address = 0): hehE-iail lercice e susy yr anavavlaele "[T]he E-Mail service is busy or unavailable" I don't have a clue where the correct letters are located (yet). 12-11-2001 08:51:55

RE:Just Deals Mailstations (modified 0 times) rogblake7 Profile | Email Now that I think about it, the 2/5 phenomenon is probably the result of a floating address line (A1) rather than an attempt to encrypt text. Guess I'll have to desolder the flash and read it in after all... 12-11-2001 09:55:05

RE:Just Deals Mailstations (modified 0 times) srblan Profile Please send me a copy of the ROM dump. senorblanco@NOSPAMhotmail.com. Obviously, remove the NOSPAM part... Thanks srblan 12-11-2001 16:36:52

RE:Just Deals Mailstations (modified 0 times) wildcard Profile Estimado Senor Blanco, The email of the ROM Code, (which is greater than 1 Meg in size) didn't go through. The response I got said, <<< 552 Requested mail action aborted: exceeded storage allocation 12-11-2001 23:04:41

RE:Just Deals Mailstations (modified 0 times) kevinvinv Profile | Email hd1019c How did you originally discover the Fcn-Shift-T sequence anyway? I would like to try and do the same for the Mivo 250 which doesn't respond to this key sequence... kv@blaze-tech.com 01-07-2002 13:33:56

RE:Just Deals Mailstations (modified 0 times) rogblake7 Profile | Email Looks like Just Deals sold their entire inventory of Mailstations. Too bad. I was thinking about picking up another. My Mailstation hacking efforts have been on hold for a few months now, but I will hopefully have some time soon to start it up again and discover what the mystery I/O addresses control. 03-21-2002 13:31:09

RE:Just Deals Mailstations (modified 0 times) OrangeTruckGuy Profile Anyone still have a copy of this that they could send me? trylow@bugjr.NOSPAM.com Thanks. 12-01-2003 16:20:16

Rom was available on the web (modified 0 times) dan4l Profile | Email The rom was available on the web at http://www.badcluster.com.ar/mailstation/ However that is yielding 404 right now. 12-13-2003 09:59:10

Reply to Thread | Printer | All times are PST Powered by UltraBoard v1.62

I-Appliance BBS General - NEWS, Breaking NEWS - linux-hacker.net BBS on CD Questions - User Groups in Your Town - E-Bay, Yahoo Auction LINKS ONLY (MODERATED) - Jokes & Humor - usdtv box I-Opener Areas - I-Opener General Posts - I-Opener Technical Stuff - I-Opener Technical Info Reference (MODERATED) WebSurfer Areas - WebSurfer General Posts - WebSurfer Technical Stuff - WebSurfer Technical Info Reference (MODERATED) Other I-Appliances - Virgin Webplayer - WebPal - MailStation - 3Com Audrey - ThinkNIC / Oracle NIC - Gateway/AOL Connected Touch Pad - Philips/AOL-TV - ACER NT-150 STB - MSN Companion - Compaq IA - Emachines IA - IBM NetVista IA - Intel dot.station - MSNTV2 Network Computers - Fujitsu-Siemens Scovery Linux Net Computers - GallantWeb Server Consoles - Dreamcast - xbox hacking Web Pads - Epods One General Post - Panasonic CF-01 - Fujitsu Stylistic 1200 - Cybiko Thin Clients - Thin Clients DigitalVideoRecorders - DTV Recorders, Replay, TiVo, Etc... - Tivo Hacks Linux - Midori Linux General Board - ITX MotherBoards Single Board Computers - Earth Computers mARMalade Elite Member Area MISC Areas - The Swap Meet WE TAKE NO RESPONSIBILITY FOR ANY TRANSACTION HERE AND NO COMMERCIAL POST PERIOD !!! - Wireless Net - Cameras - Robotics - Routers/Gateways - Mattel JuiceBox