Category Archives: Hardware

Sapphire HD6670 on OS X 10.7.5 – Enabling the HDMI port

Posted on by
Reply

One of the problems using the Apple drivers drivers is that they are produced for a very small subset of cards that Apple support. My particualr card has three ports, HDMI, DVI and VGA. While it’s possible to get this particular Sapphire HD6670 card mostly supported by setting it’s personality to Pithecia in the boot plist, there will be no output from the HDMI port, as the Pithecia personality is for a card with DisplayPort, DVI and VGA.

So….some hacking is required……..

1. Dump the personality out of the kext.

To get a list of the supported personalities, you will need to dump them out of the kext. Download ati-personality.pl (Google it), and run it against /System/Library/Extensions/ATI6000Controller.kext/Contents/MacOS/ATI6000Controller – the bit I’m interested in is as follows:

Kext /System/Library/Extensions/ATI6000Controller.kext/Contents/MacOS/ATI6000Controller
Personality: Pithecia
ConnectorInfo count in decimal: 3
Disk offset in decimal 181984
0000000    00  04  00  00  04  03  00  00  00  01  00  00  21  03  02  04
0000010    04  00  00  00  14  02  00  00  00  01  00  00  00  00  04  03
0000020    10  00  00  00  10  00  00  00  00  01  00  00  00  00  00  01
0000030

The three lines of hex detail the configuration of each port. Taking the first line, it can be broken down as follows::

Connector                00  04  00  00
ATY, Control Flags    04  03  00  00
Features                   00  01
Unknown                  00  00
Transmitter               21
Encoder                   03
Hotplug ID               02
Sense ID                  04

2. Dump the card BIOS

You will need a dos boot USB drive (Google it), and atiflash.exe (Google it). boot off the dos drive, and run

atiflash -s o atirom.rom 20000

3. Get the card details out of the BIOS

Boot back into OS X, and run redsock_bios_decoder agains the BIOS (Google it). The output of mine looks like this:

198X14A5.S23:

AMD HD6770 2G

Subsystem Vendor ID: 174b
 Subsystem ID: e198
Object Header Structure Size: 203
Connector Object Table Offset: 34
Router Object Table Offset: 0
Encoder Object Table Offset: 9d
Display Path Table Offset: 12
Connector Object Id [12] which is [HDMI_TYPE_A]
 encoder obj id [0x21] which is [INTERNAL_UNIPHY2 (osx txmit 0x12 [duallink 0x2] enc 0x4)] linkb: false
Connector Object Id [4] which is [DVI_D]
 encoder obj id [0x1e] which is [INTERNAL_UNIPHY (osx txmit 0x10 [duallink 0x0] enc 0x0)] linkb: false
Connector Object Id [5] which is [VGA]
 encoder obj id [0x15] which is [INTERNAL_KLDSCP_DAC1 (osx txmit 0x00 enc 0x10?)] linkb: false

Run radion_bios_decode against the BIOS. The output of mine looks like this:

ATOM BIOS Rom: 
    SubsystemVendorID: 0x174b SubsystemID: 0xe198
    IOBaseAddress: 0x0000
    Filename: 198X14A5.S23
    BIOS Bootup Message: 
AMD HD6770 2G                                                               

PCI ID: 1002:6758
Connector at index 0
    Type [@offset 44274]: HDMI-A (11)
    Encoder [@offset 44278]: INTERNAL_UNIPHY2 (0x21)
    i2cid [@offset 44348]: 0x94, OSX senseid: 0x5
Connector at index 1
    Type [@offset 44284]: DVI-D (3)
    Encoder [@offset 44288]: INTERNAL_UNIPHY (0x1e)
    i2cid [@offset 44375]: 0x92, OSX senseid: 0x3
Connector at index 2
    Type [@offset 44294]: VGA (1)
    Encoder [@offset 44298]: INTERNAL_KLDSCP_DAC1 (0x15)
    i2cid [@offset 44402]: 0x90, OSX senseid: 0x1

We now have all of the information we need.

4. The Connector

OK, so both BIOS decodes tell us that connector 0 is the HDMI connector. Looking at the Pithecia dump, we can see this is set to 00 04 00 00

But what does this mean?

Well, the connector type is defined as follows:

LVDS            02 00 00 00
DVI_DUAL    04 00 00 00
VGA             10 00 00 00
SVIDEO        80 00 00 00
DVI               00 02 00 00
DP               00 04 00 00
HDMI           00 08 00 00

So we can see that it’s set to Display Port. We want HDMI, so were going to use 00 08 00 00

5. The ATY and Control Flags

Again, looking at the Pithecia dump, we see that the control flags for connector 0 are set to 04 03 00 00.

What does this mean?

The ATY and control flags are defined as follows:

LVDS           40 00 00 00 or 00 01 00 00
DVI_DUAL    16 00 00 00 or 14 00 00 00 or 14 02 00 00
VGA             10 00 00 00
S-Video        02 00 00 00
DVI-?            14 00 00 00 or 14 02 00 00 or 04 02 00 00 or 16 00 00 00
DisplayPort   00 01 00 00 or 04 01 00 00 or 04 03 00 00 or 06 04 00 00 or 00 04 00 00
HDMI            00 02 00 00 or 04 02 00 00

Again, we can see that it’s set to Display Port. We want HDMI, so were going to use 04 02 00 00 as this is the option that enable HDMI audio

6. The Features

Again, looking at the Pithecia dump, we see that the features for connector 0 are set to 00 01.

What does this mean?

The features are defined as follows:

FIRST NUMBER

FEATURE_USE_INTERNAL                 01
FEATURE_USE_RGB_ON_YUV          04
FEATURE_USE_BACKLIGHT              08
FEATURE_BACKLIGHT_INVERTED    10
FEATURE_USE_CLAMSHELL             20

SECOND NUMBER

LVDS            09
DVI_DUAL    00
VGA             00
SVIDEO        04
DVI               00
DP               00
HDMI           00

As none of the options for the first number are relevant, we’ll use 00 for that, and )) for the second, as we’re setting it for HDMI, so we will use 00 00

7. Unknown.

It’s unknown. Who cares? leave it at 00 00

8. Transmitter.

Now we look at the decodes, and see this for connector 0:

encoder obj id [0x21] which is [INTERNAL_UNIPHY2 (osx txmit 0x12 [duallink 0x2] enc 0x4)] linkb: false

Look at the bold text.

So we’ll use 12

9. Encoder

Again, we look at the decodes, and see this for connector 0:

encoder obj id [0x21] which is [INTERNAL_UNIPHY2 (osx txmit 0x12 [duallink 0x2] enc 0x4)] linkb: false

Look at the bold text.

So we’ll use 04

10. Hotplug ID.

This must be a unique value for each connector. Leave it as it, 02

11. Sense ID.

Again, we look at the decodes, and see this for connector 0:

i2cid [@offset 44348]: 0x94, OSX senseid: 0x5

Look at the bold text.

So we’ll use 05

12. Putting it all together

So what we have is this:

Connector                00  08  00  00
ATY, Control Flags    04  02  00  00
Features                   00  01
Unknown                  00  00
Transmitter               02
Encoder                   04
Hotplug ID               02
Sense ID                  05

to give us:

00  08  00  00  04  02  00  00  00  01  00  00  02  04  02  05

13. So how do I get this working exactly?

Download HexEdit (Google it).

Backup /System/Library/Extensions/ATI6000Controller.kext

Open /System/Library/Extensions/ATI6000Controller.kext/Contents/MacOS/ATI6000Controller with HexEdit

replace all instances of:

00  04  00  00  04  03  00  00  00  01  00  00  21  03  02  04

with:

00  08  00  00  04  02  00  00  00  01  00  00  02  04  02  05

Save your edited ATI6000Controller in a location that your are able to, as you won’t be able to save it in /System/Library/Extensions/ATI6000Controller.kext/Contents/MacOS/

Open a terminal, and copy your saved ATI6000Controller to /System/Library/Extensions/ATI6000Controller.kext/Contents/MacOS/ using sudo

touch /System/Library/Extensions

Reboot.

OS X on SSDs

Posted on by
2

I recently replaced the boot drives of my 17″ MacBook Pro, 15″ MacBook Pro and Hackintosh with SSDs. I have replaced the Superdrives on both MacBooks with cradles holding 750GB 7200RPM SATA HDDs, so I wasn’t too worried about having giant-capacity SSDs, I basically just needed enough to hold the OS and Applications. Consequently, a good balance of price and capacity at the time (Dec 2012) was 128GB Sandisk SATA 3 drives. Yes, the MacBooks are not SATA 3, but my Hackintosh is.

I am a great fan of partitioning, coming from a Solaris background (Back when Sun was good), and consequently, partitioned both the SSD boot drive and the HDD, as follows:

SSD:

Boot – 60GB
Applications – 50GB
FastAccess – 18GB

HDD:

Swap – 24GB (MacBook Pro) 72GB (Hackintosh) (3 X amount of RAM)
Users – Remainder of disk

The reason the swap partition is so high will become apparent later

So….

Build the OS in the usual way, onto the Boot partition on the SSD.

Move Applications.

There is no real need to move the applications, I just prefer to in order to compartmentalise things

When all is complete, and you have rebooted, move the applications to the Applications partition:

cd /Volumes/Applications
sudo ditto /Applications .

Next, make sure that the Applications partition mounts on /Applications at boot. First find the GUID of the Applications partition. Open Disk Utility, highlight the Applications partition, and click File -> Get info. Highlight the value of the Universal Unique Identifier parameter, and hit Command-c to copy it to the clipboard.

Add the following line to /etc/fstab (“sudo vifs” will open it for editing):

 UUID=<Universal Unique Identifier from above> /Applications hfs rw 0 2

Empty the /Applications directory, so that it works correctly as a mount point:

 cd /Applications
 sudo rm -rf *

Reboot. Run Software Update, and update everything. The first part is now complete.

In part 2, we move users, swapfile, sleepimage and tmp files off the SSD, add TRIM support and switch off access time recording for files on SSD partitions

Move Users.

Run the following command:

 sudo ditto /Users /Volumes/Users

Then open System Preferences, click on Users and Groups, Unlock to make changes, right click on each user to open Advanced Options, and change the Home Directory to the correct path

Reboot

Move Swapfile.

The swapfiles are usually located in /var/vm. Obviously, we want them off the SSD, so we’ll put them in the Swap partition we created on the spinny disk

Run the following commands:

 cd /System/Library/LaunchDaemons
 sudo cp com.apple.dynamic_pager.plist com.apple.dynamic_pager.plist.bak
 sudo plutil -convert xml1 com.apple.dynamic_pager.plist

Edit com.apple.dynamic_pager.plist. Replace

 <string>/sbin/dynamic_pager</string>
 <string>-F</string>
 <string>/private/var/vm/swapfile</string>

with

 <string>/bin/bash</string>
 <string>-c</string>
 <string>/bin/wait4path /Volumes/Swap/ &amp;&amp; /sbin/dynamic_pager -F /Volumes/Swap/swapfile</string>

Reboot

Move sleepimage

When the system hibernates, it saves the contents of memory to disk. The size of this file varies, but can be up to the the size of system RAM. This is why the Swap partition is so big – we’re going to put this file there (Usual location is /var/vm)

Run the following command:

sudo pmset -a hibernatefile /Volumes/Swap

Reboot

Move tmp files

tmp files live until reboot. we don’t really want them on the SSD, they can also go on the spinny drive.

Run the following commands:

 sudo ditto /private/tmp /Volumes/Users/tmp
 sudo rm -rf /private/tmp
 sudo ln -s /Volumes/Users/tmp /private/tmp

Reboot

Add TRIM Support

Download Trim Enabler

Install it

Switch it on.

Reboot

Switch off File Access Time Recording

In /Library/LaunchDaemons, create the following files:

com.apple.noatime1.plist

 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
 "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
   <dict>
     <key>Label</key>
     <string>com.apple.noatime1</string>
     <key>ProgramArguments</key>
     <array>
       <string>mount</string>
       <string>-vuwo</string>
       <string>noatime</string>
       <string>/</string>
     </array>
     <key>RunAtLoad</key>
    <true/>
   </dict>
 </plist>

com.apple.noatime2.plist

 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
 "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
   <dict>
     <key>Label</key>
     <string>com.apple.noatime2</string>
     <key>ProgramArguments</key>
     <array>
       <string>mount</string>
       <string>-vuwo</string>
       <string>noatime</string>
       <string>/Applications</string>
     </array>
     <key>RunAtLoad</key>
    <true/>
   </dict>
 </plist>

com.apple.noatime3.plist

 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
 "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
   <dict>
     <key>Label</key>
     <string>com.apple.noatime3</string>
     <key>ProgramArguments</key>
     <array>
       <string>mount</string>
       <string>-vuwo</string>
       <string>noatime</string>
       <string>/Volumes/FastAccess</string>
     </array>
     <key>RunAtLoad</key>
    <true/>
   </dict>
 </plist>

Reboot

DONE!

Securing the Telecom Italia Aladino WiFi (Samsung WIP-6000M) SIP Handset.

Posted on by
Reply

There’s no point in leaving an insecure WiFi network lying around, open for abuse by some toerag with too much time an no social life, even if it is a horrible little 802.11b one.

Fortunately by hacking the handset, we have allowed the phone to use WPA encryption (the Telecom Italia firmware is crippled, and only allows WEP). So lets begin……

In the WiFi settings (menu 5.12.11), enter the following values:

1. Wi-fi Flag: OFF
2. Auth Type: Open
3. Type WPA: WPA
4. EAP Type: None
5. EAP Sub-Type: None
6. Encrypt type: TKIP
7. GrpEnc Type: TKIP
8. EAP TLS PW: blank
9. EAP ID: empty
10. EAP PW: blank

Now, on your AP, set the security mode to WPA with PSK, the cipher type to TKIP, and set the passphrase to whatever you want – just make sure it’s exactly 24 characters. Ensure the authentication type is set to Open, reboot your AP. Reboot the phone, and it will ask for the passphrase. Enter it, the phone will connect, and you’re secure. Please don’t ask me how to do this for YOUR AP. Google it!

If you’re really paranoid, like me, you can also disable SSID broadcast, and enable MAC address filtering, ensuring that your phone MAC is in the ACL.

Hacking the Telecom Italia Aladino WiFi (AKA Samsung WIP-6000M) SIP phone

Posted on by
5

There’s no point to having an Asterisk server if there are no phones to go with it……….

I’ve got a Linksys SPA3102 which interfaces my old DECT Philips phones with my Asterisk server, but with only two handsets, it’s not really ideal.

Enter the Telecom Italia Aladino WiFi. This is a rebadged Samsung WIP-6000M, it’s a fairly old phone, around 2004 vintage, maybe even earlier, is only 802.11b, and worst of all, is locked to the Telecom Italia Alice service. However, it’s cheap (I picked up six of them for about EUR 9.00 each, excluding postage), it can be hacked, and it can have bog standard firmware flashed. Read on to find out how.

The first thing you need is the firmware, and it also helps to have some documentation. Here’s one I prepared earlier. Once you have the zip file, extract it, and then extract the firmware from aladino_fw.zip contained within it.

You will need an FTP server. Setting one up is beyond the scope of this post, please don’t ask me how, there’s just too many variables involved – Google is Your Friend! Once you have your FTP server set up, you will need to copy all of the firmware files to the root of the FTP server.

After you have your FTP server set up, you will need to prepare your WiFi router or access point. A better option is to go and buy a separate, cheap, 802.11b pure access point, that you can dedicate to phone service only. You will need to change some settings, don’t worry, you can set them back later. First, you will need to change the SSID of your access point to “Alice-12345678” (minus the quotes). Remove any encryption, and ensure any MAC filtering. You can add this back later.

Now on to the handset. You’re at a disadvantage here, if you’re not Italian, as it’s set (obviously!) to Italian. I’ve done the hard work for you, we’ll get it to a stage where we can change it to English. Switch it on buy pushing and holding down the on-hook button (the one with the red phone symbol). A spalsh screen will come up, it will play a cheesy tune, and eventually will give a display titled “Selezione Rete”, and allow you to select your “Alice-12345678” AP. Hit the OK button.when the sand timer has finished spinning, and it comes up with a display titled “Inserisci numero”, enter the number “0” and hit the OK button. More sand timer…..follwoed by an error message “Errore, riprovare”. Hit the exit button (top right smartkey), and you’ll have the display up and ready.

Now to change the language. Hit the menu smartkey, and use the cursor ring to scroll across to menu 5, “Impostazioni”. You can scroll down to item 5.6, “Lingua”, or just hit the 6 key. Hit OK, and OK again. select “English, and hit OK. You will go back to menu item 5.6.1. Hit the 2 button (Or scroll), and change the Input Mode to English as well. exit out of the menus (you will need to hit the exit key a few times).

Before we can do anything useful, we have to turn access control ON. You do this by entering the following key sequence: *#0214*1004#

Yeah, the sounds are really cheesy, aren’t they?

Now we need to enter the test menu. you do this by entering the following key sequence: *#8999*8378#

You will need to turn provisioning and firmware signing off. These settings are found in Test Mode 4.3 (Env Settings -> PROV) and 4.4 (Env Settings -> DSIGN)

Now set up the IP settings in Test Mode 6. If you are running a DHCP server, you only need to worry about setting the FTP server IP address in 6.6, otherwise also set 6.1 and 6.2.

In the upgrade menus in Test Mode 7, set the protocol in 7.3 to FTP Auto, the CNF file in 7.4 to “Upgrade.cnf” (note the uppercase “U”), your FTP server login and password in 7.7 and 7.7, and either “/” for the path in 7.8, otherwise set this to the path under your FTP root where you saved the firmware files. Now you can start the main upgrade, option 7.1. This takes a while. Go and make yourself a cup of coffee.

Once the phone has rebooted into a fresh new firmware, you will find that the Test Mode is now exposed in menu item 5.12. Set your Asterisk server IP address in 5.12.5.1 and 5.12.5.4. Set the phone number in 5.12.5.12. Set the auth username and password in 5.12.5.13 and 5.12.5.14. Exit out of the menus, and reboot the phone by removing and reinstalling the battery, and switching it on.

Congratulations. You now have a WiFi SIP handset that works with your Asterisk server.

Interesting little DJ device I found

Posted on by
Reply

Popped into JB HiFi while I was in Sydney last week. Was drooling over the DJ equipment, when I saw a little device from Numark called the DJ2GO. It’s a midi controller, plugs into a USB port, and with appropriate software, you can DJ. Seeing as it was a whole $99, I thought, “I’ll have that”.

So I’ve been playing around with it this evening, and I can still mix those 80s tunes like I did back in the days when I was a real DJ.

Here it is, simple little device, but can do everything I ask of it

The Wyse 9450 WinTerm – More than just a WinTerm

Posted on by
Reply

I recently had the opportunity to obtain a couple of Wyse 9450 WinTerms, including their PSUs, for the princely sum of NZD45.00 each. Now these are not some crappy WinTerm, they’re highly hackable beasts. Take off the covers, and inside you’ll find a Via EPIA mini-ITX motherboard, with Disk-on-Module(DOM).

Let’s have a look:

As you can see, it has a single PCI slot and two SDRAM slots. Now, see the jumpers just below and to the left of the memory? Those are the FSB jumpers, and as shipped, the board is set up for an FSB speed of 100MHz. Change the jumpers to the selection shown in the photo, and you up the FSB speed to 133MHz, and consequently, you up the speed of the CPU too. Don’t worry, it can handle it.

It can handle a maximum of 1GB RAM (2 X 512MB), but it’s very finicky over exactly what will work. Hi-densisty RAM will only read half the capacity. So will some lo-density RAM.

Another nice little trick this box has up its sleeve is the 44 conductor cable. This usually goes to the pin header you see on the right(Which is actually the base of the machine), and it has the requisite 5V supply on it, so you can plug in a 2.5 inch HDD, or a 44 pin to CF adapter.

So far, what I have done with one of these is made myself an Asterisk server, instaling the Astlinux C3 image on to a CF MicroDrive. I added an X100P PCI telephony card to handle inbound and call hand-off to PSTN for local calls, the rest of my calls going outbound via SIP. Next project is a Smoothwall firewall, using a four port NIC.