I-Appliance BBS The Official Source for Internet Appliance Upgrades and Mods Click Here! BBS Main List | Sign In | Sign Up | Search | Help | Linux-Hacker.net Reply to Thread | Printer |

Home / WebSurfer Areas / WebSurfer General Posts Original Websurfer hacks? Original Websurfer hacks?

Original Websurfer hacks? (modified 0 times) Cowboy Beebop Profile | Email Ok, I just got myself a used original websurfer. I cracked it open and it has what appears to be an IDE header and an intel 496DX4-100 processor. I'd love to hack it to use it as a router, but I can't get the blasted little thing to boot off of it's IDE header or get past the configuration password. If I press ALT+M during the inital setup screen asking me to register the unit via websurfer's now disconnected toll free number, I'm presented with a password. Now, this'd be a great little cheap router, add a serial port to it and use an external 56k modem, parallel port ethernet, etc, see if I can flash the flash roms with my own os, linux or something. I imagine someone's already hacked one of these, and if people still use this BBS, I'm hoping you will /please/ email me as I have a lot of questions to ask someone who's successfully hacked one of these. Thanks, 01-07-2003 03:04:01

RE:Original Websurfer hacks? (modified 0 times) VivianC Profile Did you remove the Disk On Chip? Pull that first and then try to boot with the hard drive. VivC 01-09-2003 14:42:08

RE:Original Websurfer hacks? (modified 0 times) Cowboy Beebop Profile | Email Well, the websurfer I have the the original websurfer, /not/ the websurfer pro, which has the DOC. This is the version that was before the DOC. One board, no daughter board, no PCI, no ISA slots, no USB, no DOC socket. It does have a 72pin ram socket with 8mb, 4mb flash on the mboard, an IDE header, and in integrated 33.6 modem. I have a websurfer pro as well, so I know the difference. 01-12-2003 17:46:34

RE:Original Websurfer hacks? (modified 0 times) NarShadda Profile Where did you find the info about using ALT-M on this thing? I'm also playing around with one of these and the ALT-M trick worked, but I'm unable to get past that. I stepped through the actual registration process on it and was able to change the number that it dials to do the actual registration, so I'm thinking I might be able to have it dial up a computer that I control and then see where it wants to go. I've also tried several things. I hooked up a keyboard and mouse and a VGA monitor. When you first plug the thing in, it "boots" and then goes into hibernate mode. I can get a mouse cursor to come up on the VGA monitor just prior to it hibernating, but I was unable to get into the BIOS or even get any kind of text display during the "boot" process. I'd really like to at least get this thing working as designed if possible. Someone else in another thread pointed out that this http://www.neontech.com/products_ntv500.shtml appears to be virtually the same box. I don't know if this is a currently shipping product and if it might be of any help in getting into this thing or not. 03-22-2003 04:24:30

RE:Original Websurfer hacks? (modified 0 times) NarShadda Profile Ok, I managed to get the original WebSurfer to bypass the registration process and connect. I'm typing on it right now. I'd forgotten how slow 33.6k is. :) The browser is fairly decent. It seems to be more stable than the WebPal's built-in one. The keyboard also seems to have less "bounce". When I typed quickly on the WebPal, I'd often get double letters. I do see that it has a problem with contrast when text appears on a background color. I can't read the text of messages on this page. I see the red Hint above, but the black text appears on a black background. Anyway, I'm going to post another message in a minute from my "real" computer detailing how I got this to connect and some additional info. Maybe we can get somewhere with this box as well. :) Standby! NarShadda 03-22-2003 14:20:12

RE:Original Websurfer hacks? (modified 0 times) NarShadda Profile As promised, here is additional info I have figured out on this thing. As you mentioned, pressing Alt-M on the initial registration screen takes you to a screen that looks like the connect screen which prompts you for a password. I've tried several of the passwords from previous threads with no success. I also discovered that pressing Shift-Ctrl-Alt-E on the initial registration screen brings up a prompt on that same screen asking for a password. I've tried several passwords, but everytime I enter a password it seems to lock the thing up. Not sure what it's trying to do. Hitting the power button seems to be the only way out of that screen. Now... the most useful key combo I've discovered: pressing Shift-Ctrl-Alt-Home on the initial registration screen brings up a screen that sounds like it's the same as the Control Panel on the Websurfer Pro. It has the following fields and info: User Name: SFRE000074@SFREE.SPRYNET.COM Proxy IP: 0.0.0.0 Password: let7turn Gateway IP: 0.0.0.0 Dial Prefix: DNS: 165.121.1.2 Phone: 980-1044 Home Page: http://www.websurfer.com Dial Script: E-Mail Page: http://www.websurfer.com/email/index.HTML Favorite Page: http://www.planetoasis.com Search Page: http://www.metacrawler.com User Page: http://133.133.133.133/user.htm Preference Page: http://133.133.133.133/userprof.htm [ ]Dial Pulse <-Checkbox Help Page: http://133.133.133.133/help.htm [Dial] <-Button Error Page: http://133.133.133.133/error.htm [0] Version 1.6 Beta 2 I filled my username, password, dial prefix (for caller id), phone number, and DNS for my isp and was able to connect. When I shut the power off and come back in, it keeps prompting me to register. I'm not sure how to bypass that process. After getting it to connect successfully, I went back in and changed the home page, e-mail page, and search pages to ones that work and they seem to stick. I'm not sure how the favorite page, user page, preference page, help page, and error page worked when this thing was live, so I left them alone for now. I may set them to a web server I have control over and see what requests it sends. Also, there is an unlabeled field containing a 0 just before the version number. I'm not sure what it does, yet. I'm going to keep playing with it, though. Also, does the little mousepad on your keyboard work? I can't get mine working. The little mousepad on the handheld remote works, and the select buttons on the keyboard work, but not the mousepad on the keyboard. :( I'd like to know what version yours says if you can duplicate this and see if there are different versions out there. I don't know if you've opened yours up or not (I'm sure you have since you're on this BBS... ;) ), but this has a slot on it for a flash SIMM kind of like that found on the WebPal. It might even be the same type. I'd like to get some kind of dump of the OS to see if there's any useful info there. The BIOS in this is on a flash chip similar to the I-Opener's, and it appears to be an AMI BIOS, but blast if I can get into the thing. This thing has the same SMC super I/O chip found on the WebPal. It supports floppy, 2 ide channels, isa slots, serial and parallel ports and a slew of other items, so if it could be hacked, you might could add in an ISA card, etc. by adding the appropriate components. Good luck on your hacking and let me know if you discover anything else useful. NarShadda 03-22-2003 14:59:46

RE:Original Websurfer hacks? (modified 0 times) NarShadda Profile BTW, some interesting information from DSL Reports' WHOIS tool regarding the user and preferences page: Result for 133.133.133.133 OrgName: Japan Network Information Center OrgID: JNIC Address: Kokusai-kougyou-Kanda Bldg 6F Address: 2-3-4 Uchikanda City: Chiyoda-ku StateProv: Tokyo PostalCode: 101-0047 Country: JP NetRange: 133.0.0.0 - 133.255.255.255 CIDR: 133.0.0.0/8 NetName: JAPAN-INET NetHandle: NET-133-0-0-0-1 Parent: NetType: Direct Allocation NameServer: NS0.NIC.AD.JP NameServer: NS.WIDE.AD.JP NameServer: NS0.IIJ.AD.JP NameServer: DNS0.SPIN.AD.JP NameServer: NS-JP.SINET.AD.JP NameServer: NS-JP.NIC.AD.JP Comment: RegDate: Updated: 2003-02-24 TechHandle: JN-ORG-ARIN TechName: Japan Network Information Center TechPhone: +81-3-5297-2311 TechEmail: hostmaster@nic.ad.jp OrgTechHandle: JN-ORG-ARIN OrgTechName: Japan Network Information Center OrgTechPhone: +81-3-5297-2311 OrgTechEmail: hostmaster@nic.ad.jp # ARIN WHOIS database, last updated 2003-03-21 20:00 # Enter ? for additional hints on searching ARIN's WHOIS database. I don't know if this was the same back when the WebSurfer was new, but I tried a traceroute and I can't seem to get even close to that IP... Here's something else that I turned up in a search the other day that might prove helpful to hacking the registration process. Cecilia Farell was one of the technical writers for WebSurfer's ISP documentation. Like all good technical writers, she has posted copies of her work on her website. This just happens to include: WebSurfer Service Provider Registration Kit WebSurfer Service Provider Frequently Asked Questions WebSurfer Email Solution: A White Paper and Evaluation Guide From what I've skimmed thus far, it's likely that the technical details of the registration process are in there and it might be able to be tricked out. I'll let you know what I find. NarShadda 03-22-2003 17:41:44

RE:Original Websurfer hacks? (modified 0 times) NarShadda Profile Well, I haven't read all of the PDF's, but I don't think it's going to give enough details of the process to be useful. It seems to be more technical between WebSurfer and the ISP. I'm probably going to have to go through the process by dialing into a machine I control and watching where it tries to go and what it tries to send. BTW, looking in my web logs, I see that the WebSurfer browser is identifying itself with the User-Agent of: Mozilla/2.0 (compatible; QNX Voyager 1.0 ;Photon) Anyone know how the browser in the WebSurfer pro identifies itself? I know it's running QNX as well, but I thought it might be a newer release. NarShadda 03-23-2003 01:00:14

RE:Original Websurfer hacks? (modified 0 times) Cowboy Beebop Profile | Email Well, I tried the Ctrl-Alt-Shift-Home trick, and it didn't work, didn't do anything. Mine didn't come with a keyboard, just the remote. (that's why I got it for $1) I'm using a full PS/2 style keyboard plugged into Port B on the back to use keyboard operations. That may be why it's not working, or the fact it's a european model. I tried to find one of these in the USA, found nothing for months. Then one appeared on ebay from the UK, so I imported it. Then lots more happenned to appear on ebay within the USA. I haven't been able to get it to not display PAL on the s-video and composite outs, but the VGA out works. My educated guess is that the system boots off of the flash ram and treats it like an IDE drive. The IDE header on the inside is the secondary IDE controller. I'm hoping that I can take a boot device (I'll be using a CF to ide adapter and a 4mb CF card running ms-dos 6.22) and set the partition table to the hex value of a QNX partition. This will hopefully get it to boot off of the CF instead of the integrated flash. Now I just need to figure out what the partition table value is of a QNX partition and find a direct sector editor that'll let me edit the partition table directly. Then I can flash the bios or backup the existing bios. I haven't gotten very far other that tracing the 4mb of flash chips to the main IO controller chip on the mboard. No way I can hack it directly, easily. I hope to get it to boot off of an external IDE device so that I can re-partition and format the onboard flash to install my own OS. If I can do that I'll use it as a cheap dial-up router. Plug in a parallel port ethernet adapter and use the modem for dialup. Yes, 33.6 will be slow, but seeing as how I'm getting about 24-30k connections anyway, won't be much of a noticable difference. If that all goes well, since the modem chip is socketed, I'll see if that can be upgraded to a v.90 or v.92. Not worth my time exploring that though if I can't re-flash it. Oh, so much to explore with this little beastie. 03-25-2003 22:11:51

RE:Original Websurfer hacks? (modified 0 times) NarShadda Profile Yes, I noticed that several keys worked differently on the IR keyboard versus the PS/2 keyboard. I think the PS/2 keyboard is not fully supported by the OS. I think I turned on CAPS LOCK (or NUM LOCK) on the PS/2 keyboard and was unable to turn it back off. It certainly treats it differently than the IR one. There was a guy on e-Bay selling 2 complete, unopened WebSurfer's a couple of weeks ago. I bought one for $5. He relisted the other at $7.50 and it sold Monday. As far as the PAL/NTSC thing, look on the right side of the board (from the front) near the middle or back of the board and there are jumpers which set the PAL/NTSC settings. There is a setting for NTSC only, PAL only, and NTSC/PAL. Mine is set to NTSC/PAL. You might try putting that setting to NTSC only and see if it makes a difference. I have a Kodak DC-20 digital camera. It's not the greatest quality, but if you'd like me to send you some pics of specific areas on the board, I'd be happy to do so. Let me know if you have any luck getting anything to boot. I was thinking of checkinf with BadFlash to see if he might be willing to dump the contents of the BIOS chip if I sent it to him. That might give us some other ideas of how to proceed with this thing. My BIOS has Am. MegaTrends printed on it. Let me know if you have any luck with flashing the modem. I was thinking the same thing might be possible. 03-26-2003 18:05:31

RE:Original Websurfer hacks? (modified 0 times) PlughPlover Profile Glad to see someone else is playing with one of these boxes. Has anyone figured out what "JP1" (the three post header beside the BIOS chips) does? Metering it out, the pin closest to the front is ground, middle pin appears to be high impedance input, and third pin is +5V. I thought it's proximity might imply some BIOS related option - like boot from ide disk - but so far I don't see any effect jumpering it either way. The other thing I noticed is the port 80 connector. Based on some internet searches I got the gist of what that might be (BIOS diagnostic codes), except that it has *way* to many pins. BTW Cowboy, Powerquest's partition table editor ftp://ftp.powerquest.com/pub/utilities/ptedit.zip will do what you want (and I think knows the QNX partition value). 05-03-2003 19:49:24

RE:Original Websurfer hacks? (modified 0 times) vwbug19 Profile if you can back up the original doc image by using m-sys's getimage.exe and posting the image on ftp or www? i'd appreciate it 05-03-2003 21:16:01

RE:Original Websurfer hacks? (modified 0 times) Plugh Plover Profile These units don't have a DOC - these are the original dx4/100 based Websurfer units, not the MediaGx based 'Pro' units. Code is contained in PCB mounted flash chips. Sorry. Another curious thing... socketed next to the BIOS chip (id MEGA-KB-H-Q) is a seperate AM29F002T-120JC chip. Any guesses/comments? 05-04-2003 07:43:07

RE:Original Websurfer hacks? (modified 0 times) Mitochondrie Profile This thread seems to have been dead for a while, but hey, nothing to lose :) Got my hands on 2 "early" original WebSurfers with serial numbers in the 600' and 2000'. They do not run the same software version and the boards are not the same revision. The registration process on the earliest one is on a single page; the ALT-M trick works to get to the control panel, and I can get it to log on to my ISP. On the other, the registration is done with a "wizard"-like interface, and ALT-M pops up a password input control (don't know the password). The interesting bit I found is that (with both of them) the VGA BIOS notice flashes briefly on the VGA output when the WebSurfer is initially plugged in; and when I type CTRL-S during initial bootup on the PS/2 keyboard (didn't test with the IR keyboard) I get a splash screen with a prompt on VGA out: Do you want flash your IMAGE (Y/n) [sic] If I type "n" it outputs Boot Image and boots up normally; if I type "y" it outputs Memory Test Passed Synchronizing machines ...... and pauses for ~5 minutes before outputting Timeout, unable to synchronize with remote ...... and booting normally. Anyone had any luck using the IDE header? I would like to set one up as an in-car MP3 player... 01-17-2004 17:43:31

Reply to Thread | Printer | All times are PST Powered by UltraBoard v1.62

I-Appliance BBS General - NEWS, Breaking NEWS - linux-hacker.net BBS on CD Questions - User Groups in Your Town - E-Bay, Yahoo Auction LINKS ONLY (MODERATED) - Jokes & Humor - usdtv box I-Opener Areas - I-Opener General Posts - I-Opener Technical Stuff - I-Opener Technical Info Reference (MODERATED) WebSurfer Areas - WebSurfer General Posts - WebSurfer Technical Stuff - WebSurfer Technical Info Reference (MODERATED) Other I-Appliances - Virgin Webplayer - WebPal - MailStation - 3Com Audrey - ThinkNIC / Oracle NIC - Gateway/AOL Connected Touch Pad - Philips/AOL-TV - ACER NT-150 STB - MSN Companion - Compaq IA - Emachines IA - IBM NetVista IA - Intel dot.station - MSNTV2 Network Computers - Fujitsu-Siemens Scovery Linux Net Computers - GallantWeb Server Consoles - Dreamcast - xbox hacking Web Pads - Epods One General Post - Panasonic CF-01 - Fujitsu Stylistic 1200 - Cybiko Thin Clients - Thin Clients DigitalVideoRecorders - DTV Recorders, Replay, TiVo, Etc... - Tivo Hacks Linux - Midori Linux General Board - ITX MotherBoards Single Board Computers - Earth Computers mARMalade Elite Member Area MISC Areas - The Swap Meet WE TAKE NO RESPONSIBILITY FOR ANY TRANSACTION HERE AND NO COMMERCIAL POST PERIOD !!! - Wireless Net - Cameras - Robotics - Routers/Gateways - Mattel JuiceBox