EDID

This post is about Extended Display Identification Data.
It's the information your monitor or TV sends to your PC or media player to let it know what video/audio formats are supported. Most of the time it's correct and everything works like you want it to. There are several reasons to modify or override the EDID data coming from your TV/monitor via the DDC2B protocol (I2C address 0x50 and 0x30).

• Get higher refreshrates than 60Hz.
• Solve ghosting or other quirks in 3D interlaced/checkerboard mode.
• Tell attached equipment to pass DTS audio. Your TV often does not know that your audio receiver can handle DTS.

First, some fiddling with OSX to retrieve EDID data from attached display:


IORegistryExplorer
ioreg -l | grep -5 IODisplayEDID
IOService:/AppleACPIPlatformExpert/PCI0@0/AppleACPIPCI/P0P2@1/IOPCI2PCIBridge/GFX0@0/ATY,Cattail@1/ATIFramebufferNI/display0/AppleDisplay

Returns some long number...
00ffffffffffff001e6d01000101010101150103801009780aee91a3544c99260f5054a10800714f8180010101010101010101010101023a801871382d40582c4500a05a0000001e1b2150a051001e3048883500a05a0000001c000000fd003a3e1e5310000a202020202020000000fc004c472054560a2020202020202001e2020337f14e101f8413051403021220212215012615075009570778030c001000b82d20c00e01400a3c08101810981058103810e3050301011d8018711c1620582c2500a05a0000009e011d007251d01e206e285500a05a0000001e023a801871382d40582c4500a05a0000001e00000000000000000000000000000000000031

Save that to EDID.txt or something and look at the details with edid-decode.
cat EDID.txt | xxd -r -p | ./edid-decode

Now we want to tinker with it! There are some options to do that.

Phoenix EDID Designer (Windows, yuck)This program accepts only files in a special format, so we need to convert it somehow.

cat EDID.txt | xxd -r -p | (echo 'EDID BYTES:';\
echo '0x   00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F';\
echo '    ------------------------------------------------';\
xxd -g 1 -c 16 | sed -E 's/00000(..): (.{47}).*/\1 | \2/g'\
) | tr abcdef ABCEDF | sed 's/$'"/`printf '\r'`/g" > conv.dat

Compare the exported raw data with original:

cat EDID.txt | xxd -r -p | ./edid-decode > left.txt
cat exported.raw | ./edid-decode > right.txt
diff left.txt right.txt

The new data will show:

EDID block does NOT conform to EDID 1.3!
Missing monitor ranges

That's too bad!

010 Editor

I made a template file for 010 Editor, which is a nifty binary editor.
Download the template here.
Somehow they did not put the CRC fixing script (.1sc extension) there, but it's quite short:

file.checksum = -Checksum(CHECKSUM_SUM8, startof(file), startof(file.checksum) - startof(file));
local int i;
for (i=0; exists(file.extensions[i]); i++) file.extensions[i].checksum = -Checksum(CHECKSUM_SUM8, startof(file.extensions[i]), 127);


That's pretty neat uh?

Create EDID override file for OS X (method 1)

Assuming you have saved the modified exported.raw, generate a hex dump like so:


xxd -ps exported.raw

Create a plist file (without extension) and open with XCode or Property List Editor.
/System/Library/Displays/Overrides/DisplayVendorID-1e6d/DisplayProductID-1
The VID/PID in the directory/filename are in unpadded lowercase hexadecimal format.

DisplayProductName String "My modified display name"
DisplayProductID Number 1 (displayed in decimal)
DisplayVendorID Number 7789 (displayed in decimal)
IODisplayEDID Data <00ffffff...> (paste the data between brackets)

Create EDID override file for OS X (method 2)

Paste the result of

(echo -n '<data>'; (cat exported.raw | base64 | tr -d '\n'); echo '</data>')

into the override file (see method 1) where you can use the following as a base:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>DisplayProductID</key>
    <integer>1</integer>
    <key>DisplayProductName</key>
    <string>My modified display name</string>
    <key>DisplayVendorID</key>
    <integer>7789</integer>
    <key>IODisplayEDID</key>
    <data>AP///////wAdbgEAAQEBAQEVAQOAEAl4Ct2Ro1RMmSYPUFShCABxT4GAAQEBAQEBAQEBAQEBAjqAGHE4LkBYLEUAoFoAAAAdAjqAGHE4LkBYLEUAoFoAAAA8AAAAEAA6PR1TEAAKICAgICAgAAAAEABMRyBUVgogICAgICAgAco=</data>
</dict>
</plist>

todo...

Somehow, the resolution went back to 960x540 (HiDPI) whenever I change the EDID and replug my video connector.
Also, I have to find out how to reprogram my LG TV with new EDID data. There is some option in the service menu, but haven't looked how to do it yet.
It's nice that I can override EDID data in OS X, but I cannot override it on my PS3 for example. Thus, I need the optical audio output if I want DTS.

Links:
Video timing calculator
EDID 1.3 data format

PocketStation Google Authenticator

Do you have a Google account and want to be more secure? Own a Sony PocketStation? Now you can use this device as a security token to login with 2-factor authentication on the Google site and even use it for logging into your linux machine using a PAM module.
It supports one key using the 30-second Time-based One-time Password algorithm. It's hashing up a secret key together with the current time to come to a 6 digit number. The small program takes up one memory block.

I used to collect handheld game devices and other gadgets. The PocketStation once caught my eye but could not easily find it here. It's a PlayStation-memory-card device with a small display that can run mini-games. It was supposed to be better than the Dreamcast VMU, which I owned already. The PocketStation has infrared, better CPU, better battery life, better software support, bettter looks.
When I went to Japan for holiday some year or two ago, I finally bought a 2nd hand PocketStation. I'm not playing so many games anymore, so it was just waiting for me to get a good idea and get the tools set up.
The idea was to use this device instead of my iPhone doing the authenticator part. Of course, malware on a phone would not be good anyway, but getting the key out of the authenticator app is a lot easier than hijacking a browser session. Also, switching between the authenticator and browser can take some while and has a risk of apps being closed when running out of memory. That sums up the risks of jailbroken iPhone I guess.
Anyways, with one small PocketStation app made, I could try to find other applications. One idea I just came up with is using the infrared as a replacement for an Apple remote and lock my MacBook using the iAlertU application.

Anyways, what I currently have for you:
Emulator screenshot.

YouTube video of real device.
Pre-compiled zip. (only need to add your key.)
Source-only zip.
More info in the readme contained in the zip files.

For programming the PocketStation,
1) I used an official Sony PS3 memory adapter. It's normally used to transfer old savegames into the PS3. For this, I used a program called MCRWwin.
There are other ways to do it but I have not investigated them yet:
2) Using and old hacked PlayStation and some save game editor homebrew application.
3) Use a different interface device, such as a parallel port. Check out the PSXGameEdit or PSX Memory Card Manager pages for more information.

edit, created sf project: https://sourceforge.net/p/pkauth

Tomato firmware configuration

I have the Tomato firmware loaded into my Linksys router (WRT54GL 1.1). I acquired a second router of the same type and thought it'd be nice to duplicate the configuration. (if it breaks down or for whatever reason)
When I tried restoring the configuration, I got the error: "You cannot restore settings to a different router".
So I first needed to check what I had to change in the cfg file...

Source device:

gunzip -c tomato_v128_mDA3159.cfg | tr "\0" "\n" | grep "addr=00:1"
et0macaddr=00:16:B6:DA:31:59
lan_hwaddr=00:16:B6:DA:31:59
wan_hwaddr=00:16:B6:DA:31:5A
wl0_hwaddr=00:16:B6:DA:31:5B

Target device (to be overwritten):

gunzip -c tomato_v128_m4AF795.cfg | tr "\0" "\n" | grep "addr=00:1"
et0macaddr=00:1D:7E:4A:F7:95
lan_hwaddr=00:1D:7E:4A:F7:95
wan_hwaddr=00:1D:7E:4A:F7:96
wl0_hwaddr=00:1D:7E:4A:F7:97

Ah! It might check the MAC address! Let's try changing that...

gunzip -c tomato_v128_mDA3159.cfg | perl -pi -e \
's/addr=00:16:B6:DA:31:59/addr=00:1D:7E:4A:F7:95/g;'\
's/addr=00:16:B6:DA:31:5A/addr=00:1D:7E:4A:F7:96/g;'\
's/addr=00:16:B6:DA:31:5B/addr=00:1D:7E:4A:F7:97/g;'\
| gzip -9 > tomato_v128_copy.cfg

(NB: OS X didn't have a sed command that worked nicely with binary files.)

It restored the modified configuration file!
After resetting the modem and other connections that have the old MAC address in memory, I could connect to the internet again.

Update

When upgrading to a different model router, the configuration files will not match. (it checks
boardtype, boardnum, boardflags and other settings).
In that case, you could also SSH to old router and export the configuration in an easier format:

nvram export --dump > 1.txt
scp 1.txt darkfader@192.168.2.103:~

On the new router, you can them import the edited file.

Snow Leopard theme for Windows 7 (by sagorpirbd)

Download and installation instructions here: Snow Leopard for Windows 7 theme by sagorpirbd
If you run into problems with the free-activator (just click the advertisement) or just want to see what's in there beforehand, you can extract the files yourself.
Extract "Snow Leopard for Win7 Setup.exe" using a RAR-extractor. The password is snhgqzsdhbktin7
Here's a batch file (put in "System Files") to help replacing the system files:

@echo off
SETLOCAL ENABLEEXTENSIONS
if exist backup goto :SKIPBACKUP

:BACKUP
mkdir backup
copy "%windir%\Explorer.exe" backup
copy "%windir%\System32\Shell32.dll" backup
copy "%windir%\System32\ExplorerFrame.dll" backup
copy "%windir%\System32\OobeFldr.dll" backup
pause

:SKIPBACKUP
call :REPLACE "explorer\64 BIT\explorer.exe" "%windir%\Explorer.exe"
call :REPLACE "shell32.dll\64 BIT\shell32.dll" "%windir%\System32\Shell32.dll"
call :REPLACE "ExplorerFrame.dll\64 BIT\ExplorerFrame.dll" "%windir%\System32\ExplorerFrame.dll"
call :REPLACE "Welcome Center\64 BIT\OobeFldr.dll" "%windir%\System32\OobeFldr.dll"
pause
goto :EOF

:REPLACE
echo --- From %~1 to %~2 ---
if not exist "%~1" goto :ERROR
takeown /F "%~2"
Icacls "%~2" /grant Administrators:F
rename "%~2" "%~nx2.old"
copy "%~1" "%~2"
sleep 5
fc /B "%~1" "%~2" || echo ------------- %~2 mismatch ---------------
exit /B

:ERROR
echo Could not find source file!
pause 

There is also a program called "leftsider" which puts the control icons of a window on the left side, just like on a real Mac.

DataGridView virtual mode with custom control race condition fix

This is for when you have a DataGridView in virtual mode in which you have both unbound and bound columns which depend on each other. It went wrong when editing the cells.
I found out that I got a race condition. I then checked the stacktrace:

- MyGridView.OnCellValueNeeded(System.Windows.Forms.DataGridViewCellValueEventArgs e)
- System.Windows.Forms.DataGridView.OnCellValueNeeded(int columnIndex, int rowIndex)
- System.Windows.Forms.DataGridViewCell.GetValue(int rowIndex)
- DataGridViewControlCell.GetValue(int rowIndex)
- System.Windows.Forms.DataGridView.OnCellValidating(ref System.Windows.Forms.DataGridViewCell dataGridViewCell, int columnIndex, int rowIndex, System.Windows.Forms.DataGridViewDataErrorContexts context)
- System.Windows.Forms.DataGridView.CommitEdit(ref System.Windows.Forms.DataGridViewCell dataGridViewCurrentCell, System.Windows.Forms.DataGridViewDataErrorContexts context, System.Windows.Forms.DataGridView.DataGridViewValidateCellInternal validateCell, bool fireCellLeave, bool fireCellEnter, bool fireRowLeave, bool fireRowEnter, bool fireLeave)
- System.Windows.Forms.DataGridView.CommitEdit(System.Windows.Forms.DataGridViewDataErrorContexts context, bool forCurrentCellChange, bool forCurrentRowChange)


So it tried getting the value for the cell that was currently being edited !
I fixed it in MyGridView (called with base.OnCellValueNeeded):

        protected override void OnCellValueNeeded(DataGridViewCellValueEventArgs e)
        {
            if (Columns[e.ColumnIndex] is DataGridViewControlColumn)
            {
                /*
                 * Special check to prevent race condition. Call this method first like this:
                 *    base.OnCellValueNeeded(e);
                 *    if (e.Value != null) return;
                 */
                if (Rows[e.RowIndex].Cells[e.ColumnIndex].IsInEditMode)        // editing control present?
                {
                    if ((EditingControl as TControl).EditingControlRowIndex == e.RowIndex)        // make sure it's the correct row
                    {
                        if ((EditingControl as TControl).EditingControlValueChanged)    // prevent re-use of old editing control
                        {
                            e.Value = (EditingControl as TControl).EditingControlFormattedValue;    // use value from editing control
                            return;
                        }
                    }
                }
            }
             base.OnCellValueNeeded(e);
        }

 Hopefully, you find this a bit useful.

iPhone native internet tethering (4.0.1)

When I was on 3.1.2 I had native internet tethering working without much problems. Just use ultrasn0w or other unlock hack and install any carrier profile to make the switch visible.
There was no real need to patch the CommCenter executable.
The CommCenter patches were initially released as plain patchfiles that required entering shell commands, but later appeared in Cydia repositories too.
With 4.0.1, it is required to do it this way. So you don't need an unlock hack installed per say. The CommCenter patch can be found in some shady repository you might need to add. (Try searching on myrepospace.com)
The CommCenter patch makes it accept any non-matching signature in the carrier bundle.
Anyway, it is not that difficult and can be read about on other sites. I got all the handy tools on my iPhone already (ssh with changed passwords, vim), so here's what I did... (you should use FTP if you don't want to mess with SSH)

ssh root@yourphone
cd /var/mobile/Library/Carrier\ Bundle.bundle
plutil -convert xml1 carrier.plist
vim carrier.plist


Under <key>apn</key><string>mms</string>
I changed
<key>type-mask</key><integer>53</integer>

Google for typemask.png to see what bits to toggle.
Don't forget to make a backup of the file if you are unsure.
Then, for some reason you need to reset the network settings. Perhaps it just updates /var/mobile/Library/Preferences/com.apple.carrier.plist I don't know exactly yet)
Perhaps you could try killall CommCenter SpringBoard too.
Btw, The directory is actually a symbolic link and the files in it gets updated occasionally by Apple. It will ask you however before doing that.
To recreate, use something like: ln -s /System/Library/Carrier Bundles/TMobile_nl.bundle /var/mobile/Library/Carrier\ Bundle.bundle

While MyWi (in Cydia) offers internet tethering too, it got it's limitations (but is being worked on). e.g. it cannot connect via bluetooth to a laptop. Also, it costs a bit of money.

NOTE: Your mobile provider probably does not accept free internet tethering.

sshdo, an alternative to sudo

With sudo, you can execute any or custom command as the root user, optionally asking for your password. That poses some risk if someone knows your password (e.g. by logging/tapping).
But you could replace sudo with something that can login locally via other means like SSH. You need to use SSH(-agent) forwarding to pass down your identity so you won't have to type in any password. You then can decide with -A or -a option for ssh whether to enable or disable SSH forwarding (and thus root access).
It's not very fine grained though and it won't ask for a password each time you 'sshdo' but you could probably set something up with PAM settings (multi-factor). I'll look into that later.
Anyway, for root: /root/.ssh/authorized_keys should contain the allowed key. You'll want root access only locally and only via passwordless-authentication. For that, add to /etc/sshd_config

PermitRootLogin no
Match Address 127.0.0.1
        PermitRootLogin without-password

In your normal user directory, you can add an easy-to-use alias similar to sudo to ~/.bashrc or ~/.bash_profile

alias sshdo='ssh -q -t root@localhost -- cd $PWD \&\& sudo'

Test it and then disable sudo.
Hopefully this gives some good ideas.

Static ARP script for OSX

For security reasons, you may wish to set a static ARP entry for your gateway. This script automates this step. Note that this doesn't prevent DHCP or MAC spoofing however.
The script runs whenever a network connection is made or broken by using the launchd feature to check a path for changes. In this case, I used resolv.conf.
The scripts determines the default gateway IP address and then keep trying to find the corresponding MAC address in the ARP table. Then it sets up the static ARP entry.
Two files are needed: one launchd configuration file and a shell script file. You need to give execute rights on the shell script with chmod +x. Copy the files in place and rename/edit the filenames. You need to restart to make the configuration active.

The contents of /Users/darkfader/static-arp.sh:

#!/bin/bash
# if the resolv.conf file was deleted, create an empty one to enable file watch again
touch /var/run/resolv.conf
while true; do
        IP=$(netstat -rn | grep -m 1 default | tr -s ' ' | cut -d' ' -f 2)
        if [ "$IP" == "" ]; then
                exit 0
        fi
        MAC=$(arp -an | grep -m 1 $IP | tr -s ' ' | cut -d' ' -f 4)
        if [ "$MAC" == "" ]; then
                sleep 1
                continue
        fi
        arp -S $IP $MAC
        exit 0
done

The contents of /Library/LaunchDaemons/net.darkfader.static-arp.plist:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
        <key>Label</key>
        <string>net.darkfader.static-arp</string>
        <key>ProgramArguments</key>
        <array>
                <string>/Users/darkfader/static-arp.sh</string>
        </array>
        <key>QueueDirectories</key>
        <array/>
        <key>WatchPaths</key>
        <array>
                <string>/var/run/resolv.conf</string>
        </array>
</dict>
</plist>

Windows on Intel Mac and AHCI mode

My configuration:
single internal hard drive in iMac with a single NTFS partition. This is BIOS identifier (hd0,1). In linux, this will be SATA device /dev/sda. The SATA controller is from ICH8M and has PCI identifier 8086:2828. Please change these references to your system configuration.
Don't worry, I still have OS X on an external FW800 drive but that's not relevant here.

First of all, I tried loading Windows 7 on my Intel Mac and then came to a few conclusions:

• BIOS mode boot has the negative side-effect that it disables AHCI mode in the SATA controller. This leads to degraded performance of hard drive access.
• EFI mode boot of Windows 7 requires EFI 2.0 which isn't included in the firmware.
• Macs don't like to boot from external devices. Windows doesn't like to be installed on external drives.

So I swapped my OS X drive with Windows drive in the process of undusting my iMac. It now can boot both OSes.
This post is all about getting the SATA controller back into AHCI mode after the compatibility layer in the intel Mac changed it. AHCI gives NCQ and might be somewhat faster so I really wanted to try that after my younger brother nagged me about it during our dayly Mac-vs-PC argues.

I can talk about what I did wrong during those attempts but I will try to keep it short:

• Start regedit and locate the following key: HKLM\System\CurrentControlSet\Services\msahci
  Change the "Start" value to "0". This will make Windows attempt to load the AHCI driver stack when it boots.
• Download a Linux live-CD with GRUB 1.98. (others might indicate 0.xx as grub and 1.xx as grub2). I decided on the latest Ubuntu live-CD. Older versions just won't do unless you want ugly patches. You want to have the setpci grub module.
• Download the "Rapid Storage Technology" manager software (includes the driver) and the "RST Driver Files for F6 Install" from the Intel website.
  In my case the latest version for x64 Windows was iata96enu.exe and f6flpy96x64.zip
  The manager software will not install yet but you have to install at least the driver by unpacking it and force a device installation:
  Go to Device Manager, select Serial ATA Storage Controller, Update driver software, Browse, Pick from list, Have disk, Ignore the warning. This should be ok since the next time you'll boot Windows, the device will be different anyway.
  
• Boot the Linux CD :-)
  Hold option key when booting the Mac to see it as a boot option. Load the System until you can start a terminal. Get root access:
  sudo -i
  
• Because it booted from CD, it doesn't know much about the hard drive. Therefore create a device map file that maps (hd0) to /dev/sda.
  vi /boot/grub/device.map
  i(hd0)[tab]/dev/sda[esc]:wq
  If you know some linux, you know what I mean.
• Mount your Windows partition in Linux.
  mkdir /mnt/win
  ntfs-3g /dev/sda1 /mnt/win
• Install grub to the MBR and copy the data files too.
  grub-install --no-floppy --modules=ntfs --root-directory=/mnt/win /dev/sda
  This should report no error.
• If you already had a Boot directory on your Windows partition (most likely), you'll now have two boot directories (-.-); Fix it by moving the contents.
  mv /mnt/win/boot/grub /mnt/win/Boot
  rmdir /mnt/win/boot
• reboot
  reboot (duh)
• At the grub prompt you should now be able to try some commands.
  lspci
  setpci -d 8086:2828 90.b=40
  lspci (should now show 2829 instead of 2828)
  root (hd0,1)
  chainloader +1
  boot
• If Windows now boots, it should be in AHCI mode and hopefully go ask for the drivers.
  You can install the RST manager or just check the Device Manager to see if it's working as intended.
  
• You can create a C:\Boot\grub\grub.cfg file to automate the booting process. (Note: 'Manual editing of /boot/grub/grub.cfg is not encouraged')
  set timeout=10
  set default=0
  menuentry "Windows 7 with AHCI" {
  setpci -d 8086:2828 90.b=40
  set root=(hd0,1)
  chainloader +1
  }
• PS: If somehow Windows booting was not working in the first place or you don't want any of this anymore, you can use the Windows 7 DVD. Some recovery commands you then can use:
  bootrec /FixBoot
  bootrec /RebuildBcd
  bootrec /FixMbr (should erase grub again but I don't know why you would want that)
  

I this I have all my notes into this post and hope that besides me remembering how to do it, also will help you and other Mac fans :P

Atmel production file

Atmel has implemented a so called 'production file' in its programmer software. It's a simple ELF file containing sections for Flash, EEprom and fuses. You can create these sections from your C code too.
The board I developed for contains an Atmega128 attached to an ethernet controller. Also, it contains a bootloader that can program and dump the flash and eeprom memory.
What I wanted is a complete snapshot of a working board for production use (special bootloader/firmware version without final encryption keys). It will also have the default MAC and IP address and checksum information in EEprom.

So, first I prepare a complete working board and start dumping the program memory in encrypted format by using a special bootloader function. The tool automatically writes out a special format complete with checksums etc.
bootload -m 00-01-23-45-67-89 -d -i dump.img -b 172.16.0.0
Then I call the encryption/decryption tool to turn it into a plain binary.
imgtool -d -b dump.bin -i dump.img

I do the same with the bootloader that is located at 0x1E000.
bootload -m 00-01-23-45-67-89 -d -i bldump.img -s 0x1E000 -b 172.16.0.0
And decrypt that as well:
imgtool -d -b bldump.bin -i bldump.img -s 0x1E000

Then comes the EEprom dump which is already in plain binary form:
bootload -m 00-01-23-45-67-89 -e -b 172.16.0.0
You might want to crop it down to a reasonable working size since programming the EEprom is terribly slow.
srec_cat eeprom.bin -binary -crop 0x0 0x80 -o eeprom.bin -binary

We also need small files containing the (lock-)fuses and the CPU signature that needs to match before programming. The order of bytes need to be reversed.
You could also compile this data with your project.
signature.bin (3 bytes): 02 97 1E for atmega128.
fuse.bin (3 bytes): BF D8 FF
lock.bin (1 byte): DC blocks programming cable and user-mode reads of bootloader area. The lock is written last and will activate the bootloader boot process.

There are various ways to combine it all together. I chose to combined the flash sections first:
srec_cat dump.bin -binary bldump.bin -binary -offset 0x1E000 -o combined_dump.hex -intel
and then add the extra sections:
avr-objcopy -O elf32-avr -I ihex combined_dump.hex --gap-fill 0xFF --add-section .eeprom=eeprom.bin --add-section .fuse=fuse.bin --add-section .lock=lock.bin --add-section .signature=signature.bin --rename-section .sec1=.text --rename-section .sec2=.text --set-section-flags=.eeprom="alloc,load" --set-section-flags=.fuse="alloc,load" --set-section-flags=.lock="alloc,load" --set-section-flags=.signature="alloc,load" temp.elf
The final step is assigning the section addresses and turning the file into executable ELF format.
avr-ld -s -mavr5 -o ProductionFile.elf temp.elf --section-start .eeprom=0x810000 --section-start .fuse=0x820000 --section-start .lock=0x830000 --section-start .signature=0x840000
The section offsets don't mean very much but the programming tool might check for them.
After this, you can delete all other intermediate files.

Ready to test to production file...
Stk500 -cUSB -datmega128 -ipProductionFile.elf -e -pafeb
And there you have it.
I hope you stumbled upon this post and found it useful.

iPhone OS upgrade to 3.1

Since I have my (3GS) 3.0 ECID SHSH on file with Cydia, I decided a while ago to update to 3.1. So I Pwnagetool-ed a ipfw and installed. Now, I wanted to try out the new modem firmware too and updated to official 3.1 firmware, only to come to conclusion it makes things more difficult and fixes nothing. Anyways, I went back to 3.0 and had to redsn0w it because it doesn't work with the new modem firmware. Then I installed the pwned 3.1 again and it works again.
Again, AptBackup gave an error but was easily fixed by duping the list files, press backup, restore list files, restore.

Security tips:
vim /Library/LaunchDaemons/com.openssh.sshd.plist
Remove <key>Bonjour</key><array>...</array> to hide from bonjour (local net).
If you want to change the portnumber from 22 to 443 or so, you can change SockServiceName from ssh to https or perhaps some number.
Connect with -p option: ssh root@your-iPhone.local -p 443
After changing, toggle SSH off and on and then connect with a 2nd terminal to try it out before closing the 1st.
And as always, don't forget to change password for mobile and root.

Xcode 3.1.3

With the new OS installed on the iPhone, Xcode complains it needs an update. So it updated to 3.1.3.
Again, I applied the modifications to skip provisioning profile.
In terminal, type open /Developer/Platforms/iPhoneOS.platform/Info.plist (opens with Property List Editor)
Under defaultProperties add/edit rows:

PROVISIONING_PROFILE_ALLOWED = NO;
PROVISIONING_PROFILE_REQUIRED = NO;

This works however only with Xcode for iPhone OS 2.x.
But you can replace the iPhoneRemoteDevice executable with one one from the older Xcode.
After that, Xcode initially crashed and disconnected the cable and removed an invalid entry in the Organizer. I get some internal errors but it can be skipped by holding the return key.
I also had a problem with my project. product-pkg-utility reported that CFBundleIdentifier cannot have illegal characters (e.g. underscore).
Anyways, I can debug again.

Update: Copying the whole iPhoneRemoteDevice.xcodeplugin directory seems to work now too.
Update2: Still seems to crash, although after "Reset and relaunch" it does not crash. Weird...
Whoa... starting "/Developer/Applications/Xcode.app/Contents/MacOS/Xcode &" from Terminal seems to work in any case.

Other links: here, here here and here

iPhone OS upgrade to 3.0

Taking my chances to upgrade to the latest OS version 3.0 for iPhone.
So, first needed to backup some things: AptBackup, SpringBack and finally, a backup with iTunes.
Then create a custom ipsw with Pwnagetool. To install this ipsw, I put the iPhone into recovery mode (did not need the DFU mode, since it was already hacked) by holding both buttons on the iPhone and release the sleep button when screen goes black. Installation went fine, but...

AptBackup icon was hidden because I used the Categories app. No sweat on that, but after unhiding, AptBackup failed on me since it wasn't tested with 3.0 yet.
Solution: Installed OpenSSH and APT again and ran the following command:

for p in `cut -f 1 /User/Library/Preferences/aptbackup_dpkg-packages.txt`; do apt-get -y --force-yes install $p; done

Any packages not for 3.0 won't be installed (like mobileinstallation patch), so you need to find a newer version for them.

I seemed to have lost most settings of Cydia apps since iTunes only backs up managed settings. This includes categories, spbk files, whatever. The only items in /User where Applications, Documents, Library and Media.
So next time, I'll copy the other items manually. Also /Library/Themes for custom themes.
Tip: Get Macfusion/FUSE to mount the iPhone volume on your Mac. Or use Cyberduck.

Replace yellown0w with ultrasn0w if you updated the baseband firmware (Pwnagetool does that by default btw!). At the time of me writing it wasn't released yet though... oops.

UIProgressView custom draw method

Code snippet of a UIProgressView subclass that implements custom draw method.
This example uses four images for the left side, right side and ten sections that can be either on/off or partially filled.
My images included edge and shadow and named: pb_left.png (9x32), pb_right.png (9x32), pb_on.png (28x32). pb_off.png (28x32)

- (void)awakeFromNib
{
 [self setBackgroundColor:[UIColor clearColor]];
}

// allow non-clear background color in Interface Builder, but do not draw it
- (BOOL)getClearsContextBeforeDrawing
{
 return NO;
};

// draw left and right edge of progress bar with filled sections between
- (void)drawRect:(CGRect)rect
{
 const int numParts = 10;
 UIImage *pb_left = [UIImage imageNamed:@"pb_left.png"];  // "["
 UIImage *pb_right = [UIImage imageNamed:@"pb_right.png"]; // "]"
 UIImage *pb_on = [UIImage imageNamed:@"pb_on.png"];   // "X"
 UIImage *pb_off = [UIImage imageNamed:@"pb_off.png"];  // " "
 CGPoint p = {0,0};
 [pb_left drawAtPoint:p];
 p.x = pb_left.size.width;
 int q = (int)(self.progress * numParts);
 for (int i=0; i<numParts; i++)
 {
  if (i == q)  // partial on/off section. works with semi-transparent images too
  {
   float w = truncf(pb_on.size.width * fmodf(self.progress * numParts, 1.0f));
   [pb_on drawInRect:CGRectMake(p.x, p.y, w, pb_on.size.height)];
   [pb_off drawInRect:CGRectMake(p.x + w, p.y, pb_on.size.width - w, pb_on.size.height)];
  }
  else if (i < q)
  {
   [pb_on drawAtPoint:p];
  }
  else // (i > q)
  {
   [pb_off drawAtPoint:p];
  }
  p.x += pb_on.size.width;
 }
 [pb_right drawAtPoint:p];
}

Semi-transparent overlay for UIButton subclass

A little snippet for subclassed UIButton that adds an UIImageView overlay.
You can then animate the alpha property.

- (void)awakeFromNib
{
 UIImage *img = [self imageForState:UIControlStateSelected];
 overlayImage = [[UIImageView alloc] initWithImage:img];
 overlayImage.alpha = 0.0f;
 [self addSubview:overlayImage];
 // [self addTarget:self action:@selector(buttonClicked:) forControlEvents:UIControlEventTouchDown];
 // you could call custom highlight handler
}

- (void)setHighlightedByAlpha:(BOOL)highlighted
{
 [UIView beginAnimations:nil context:@"hmm"];
 [UIView setAnimationCurve: UIViewAnimationCurveLinear];
 [UIView setAnimationDuration:0.2f];
 overlayImage.alpha = highlighted ? 1.0f : 0.0f;
 [UIView commitAnimations];
}

Gbit card, modem, HDD

Ok, I had it for now with this r8169 kernel driver. I even tried a suggested newer kernel version but even that didn't help. I put in a new Intel card and it seems to work fine.

Because I switched ISP, I have to return my modem (not my property; Sagem BASE F@ST 3202). I still wanted to know if I could get access to superuser account again. It is still accessible by serial port for which there is no connector unfortunately. An phone data cable with some soldering helps in these cases.
Well.. I just cleaned up the pads I probed and screwing it back together.
Since I can't remember what cables it came with, I just put in the ones in worst condition :)

I also bought a WD MyBook 1TB disk.

My network

New SSH keys generated to login without password on my server, macbook, imac and website. Works nicely. I have set MacFusion to mount automatically.

I've put back the r8169 network card in my server and it now appears to be running stable. Perhaps it's also because I upgraded the kernel version again to 2.6.24-gentoo-r3. Oh and I soldered 3 capacitors on it. They always leave out some to make it cheaper.
[edit]Shit.. still problematic[/edit]

After fiddling with MAC address in Time Machine to backup over firewire target disk mode, I found out that Apple added a hidden feature that enables network disks. With this gigabit network, that should go speedy although it still could be buggy or cause system hiccups. I wouldn't try backing up with my disk or imac turned/turning off though.
This method does not use the filesystem feature with hardlinks etc. but creates one big file: "{machine name}_{MAC address}.sparsebundle". It's probably more optimal for network links.

Btw, my macbook is named Diana and my imac Morte. From Noir-et-Blanc, which I have not seen yet but do have the Morte figurine. The internal HDDs are also called like that to prevent confusion when mounting them over the network.

link down

Since updating my kernel of my linux server, the 1Gbit card (r8169) gave troubles. Occasionally, the link went down.
dmesg shows some PCI quirks and IRQ routing conflicts but afaik it's been like that before.
Although I also had enabled the onboard USB ports and added USB to the kernel.
I then tried loading back the old kernel version only to find out that the problem persisted.
Could the card have gone bad? Sure it's a coicidence. Or perhaps the driver is just buggy somehow. I will test the card in another PC.
Back with the old and slow r8139, it seems to work just fine.
I hate this kind of crap. It takes too much time to figure out.

[iMac] samba vs sshfs

I tried moving some files from my linux server to the external firewire drive on my iMac. It just did not work and my iMac would not see the UTF-8 encoded filenames. Then I learned about the utf-8-mac encoding and though wtf. My gentoo linux installation doesn't know about that. (NT_STATUS_OBJECT_NAME_NOT_FOUND)
I tried muCommander and bash in the hope that Finder was just screwing up. But nope...
ls: 耳をすませば サウンドトラック « Whisper of the Heart/: No such file or directory
So, after fiddling around, I used MacFUSE and MacFusion user-interface to mount my homedirectory via ssh. That works.
I guess that's another -1 point for OS X.

Also, I could not overwrite files starting with a dot (normally invisible in Finder). It gives "Error code -43". Oh well, that's just a feature.

Encryption, Input, Matrix, Devastation

Yesterday, I stumbled upon a few SRL files that are stored in some romdumps. These are WMB programs, but yet contained encryption information which is only intended for card use. It is kind of odd they would left that in. (7 out of 52 SRL files)

I found an unconnected button input on the mainboard named "R03" close to the SL1 contacts. It is mapped to bit 3 of the I/O register which also contains X & Y buttons. The purpose is still unknown.

Since a while, Nintendo started using Matrix Memory ROM chips for their cards. These seem to require a bigger latency setting. This also gave thought to making a CompactFlash (or SD) converter. This way you can connect two media cards and copy stuff from one to another for example.

I also had an idea of connecting mainboard signals to an FPGA and USB port to turn it into a real developer's system. This will include video and both card/tridge slots. I will call it Dev-a-Station :)