fh_xz 发表于 2014-5-21 21:16
驱动需要自己编译，附上我编译的吧
学习了，谢谢分享。建议分享文件以后可以百度盘共享，不然，一点瓜瓜一巴掌，呵呵。
本帖最后由 eric1234 于 2014-5-22 17:31 编辑
运行 ./hackfw.sh /dev/sdc 后
Interactive script to hack the firmware of your keychain photo
player.
Message written.
Ok, first off all, we're going to backup the firmware and memory of your
device to fwimage.bak and memimage.bak. Please save fwimage.bak, you
need it to flash a newer version into your unit.
..
..............................................................
Making a working copy...
Looking for a known device profile...
hack/m_coby_dp151 ...
...nope.
hack/m_coby_dp151_v8 ...
...nope.
hack/m_coby_dp152 ...
...nope.
hack/m_dealextreme_sku5218 ...
...nope.
hack/m_dealextreme_sku5218_new ...
...nope.
hack/m_dig-291 ...
...nope.
hack/m_ebuyer ...
We have a match!
Requirements OK, we can try to hack the device. Proceed? (yes/no)
yes
Patching fw...
Uploading fw
Firmware update! If unsure, press ctrl-C NOW!
Too late. Commencing firmware update...
..
Firmware upgraded. Un- and replug USB connection to restart device.
All done. To test, disconnect the device and when it has rebooted, connect
it again, go into 'update mode' and press enter. To quit, use ctrl-c.
!
过程很顺畅,但是最后这里显示需要重启的时候LCD是黑屏,然后拔了USB重启后
Ok, just a sec...
Unable to get parm_block
Open failed!
显示打开失败,不知道到底是那里不行,替换前面的 libst2205.zip 后现象也是一样,希望懂得朋友能指导一下
eric1234 发表于 2014-5-22 17:30
运行 ./hackfw.sh /dev/sdc 后
Interactive script to hack the firmware of your keychain photo
上面不是都说了么
具体打开方法是载入驱动hack（/dev/sdx） 而不是使用USB口（/dev/usb0）
他这个脚本没有使用/dev/sdx去测试，你要自己使用setpic去测试，这个在hack里面你可以看到setpic文件夹，进去使用make setpic 就可以编译了
本帖最后由 fh_xz 于 2014-5-22 18:58 编辑
再付一张破解后的图吧
看样子还不错。。。。
本帖最后由剑剑 于 2014-5-22 20:47 编辑
fh_xz 发表于 2014-5-22 18:52
再付一张破解后的图吧
谢谢分享，做得不错呀，有空写个详细的教程吧，坛子上买了这款相框的在等着你的大作呢。
另请教下，用了./hackfw.sh /edv/sdb 之后重启了相框变黑屏和白屏了有什么办法恢复吗？我刷的两个一个变黑屏，一个变白屏，其他兄弟不知碰到过没有？呵呵，我就真的倒霉透了。看来，还是用我原来的2.4寸的实际些。
这个是我原来买东北人清仓那款来的，呵呵，看着爽多了。
不过这款2块的真的折腾人呀，都说了一入LCD深似海！唉。。。。。。。。。。
fh_xz 发表于 2014-5-22 18:52
再付一张破解后的图吧
怎么破解的，能发个教程吗？
剑剑 发表于 2014-5-22 20:42
谢谢分享，做得不错呀，有空写个详细的教程吧，坛子上买了这款相框的在等着你的大作呢。
另请教下，用了. ...
想把空气质量的PM2.5 10等模块去掉，换上显示CPU和主板温度，这样就完美了
怎么都玩相框啦，跟不上节奏。
剑剑 发表于 2014-5-22 20:42
谢谢分享，做得不错呀，有空写个详细的教程吧，坛子上买了这款相框的在等着你的大作呢。
另请教下，用了. ...
fh_xz
不要吝啬了，赶紧把破解步骤发上来啊！或者打包把破解的文件夹一起发上来。
你说的那个sdx 和usb0是后续了，肯定是先破解，再在lcd4linux用驱动调入。
如果先不破解，怎么可能载入呢？
还有setpic肯定是/dev/sdb这样的，哪来的usb0啊？
nonzhe 发表于 2014-5-26 17:33
fh_xz
不要吝啬了，赶紧把破解步骤发上来啊！或者打包把破解的文件夹一起发上来。
你说的那个sdx 和usb0 ...
我试了一下圆形的1.5寸的，和那个方形的有所不同，固件肯定更新过了，用原始的hack是找不到匹配的。
其实需要自己去把下载来的固件打开，重新编辑的。
具体看：
So you've got an unsupported ST2205U-device and want to create support for it?
I hope you understand 65C02 assembly, or at least are willing to learn a little
of it. Disclaimer: if you end up with a bricked device, I'm not responsible!
This is what's needed:
- Dump the firmware.
./phack -df fwimage.bin /dev/sda
- Break up the firmware in segments. Each segment is 16K:
for x in `seq 0 3`; do dd if=fwimage.bin of=fwimage-seg$x.bin bs=16384 skip=$x count=1; done
- Disassemble segment 1 using a 68c02 disassembler. You can use the symbols.def
file in this directory. Segment should be loaded at address 0x4000.
- Open up the disassembly file and look for a shitload of consecutive writes to
the addresses 0x8000 and 0xc000. If these are there, the firmware uses an
external LCD-controller. If you can't find these writes anywhere (not even
in the other 3 segments), it uses the internal one and you'll have to figure
out the code to modify my assembly yourself.
- Copy hack/m_coby_dp151 to hack/m_. For the patch to
work, you'll need to create a correct spec-file. Use the existing one as
a template.
- Disassemble segment 0 using a 68c02 disassembler. You can use the symbols.def
file in this directory. Segment should be loaded at address 0x4000.
- Open the disassembly file and look for something like this:
LDA D037c
CMP #$31
BNE L73c1
LDA D037d
CMP #$00
BNE L73c1
BRA L73d3
The important thing here is that two subsequent memory locations (here
037C:037D) get compared to 0x3100,and later (not shown) to 0x3300.
Modify the CMP_VAR1 and CMP_VAR2 in the specs-file to reflect these
memory locations.
- A few lines later, you should see something like this:
LDA #$ff
LDX #$ff
STA D037c
STX D037d
RTS
The location of the LDA-instruction, minus 0x4000, should go into the
specs-file as PATCH_AT.
- Locate some free space. We require a location in the first segment that has
about 240 consecutive FFs in it. Load up fwimage-seg0.bin in your favourite
hexeditor andgo look for a location like that. Hint: there's usually one
at the end of the file. This should go into the specs-file as EMPTY_AT.
If the space is very small (<500 bytes), please make a note of it in the
spec-file.
- Locate a routine starting with
PHA
LDA #$55 ; 85 U
STA D0240
LDA #$53 ; 83 S
STA D0241
LDA #$42 ; 66 B
STA D0242
LDA #$53 ; 83 S
Make a note of the location of the start of the routine and enter this in the
specs-file, minus 0x4000, as SEND_CSW.
- Locate a piece of code looking like this. (The refs to adresses 2xx will be
the same, the ones to 37x may differ):
STZ D0370
STZ D0371
LDA D0216
STZ D0370
LDA D0217
STA D036f
ASL D036f
ROL D0370
ROL D0371
- Fill LEN1 to LEN3 with the ASL/ROLled adresses, fill LEN0 with LEN1-1. In this
example, LEN0=$36E, LEN1=$36F, LEN2=$370, LEN3=$371
- Check the kind of controller you have: if you find this in your disassembly
code (mostly in segment 1), your controller most likely is an PCF8833 and you
should leave your CTRTYPE at 0:
LDA #$2a ; 42 *
STA X8000
(Snip! 2 or 4 stores to C000)
LDA #$2b ; 43 +
STA X8000
(Snip! 2 or 4 stores to C000)
On the other hand, if your code looks more like this:
LDA #$f4 ; 244 .
STA X8000
(Snip! one aditional store to 8000)
LDA #$f6 ; 244 .
STA X8000
(Snip! one aditional store to 8000)
LDA #$f5 ; 244 .
STA X8000
(Snip! one aditional store to 8000)
LDA #$f7 ; 244 .
STA X8000
(Snip! one aditional store to 8000)
you've got a UC1697V on your hands and CTRTYPE should be 1.
- Fill out CONF_XRES, CONF_YRES with the horizontal and vertical resolution of
your device.
Leave CONF_PROTO at 0, which is the PCF8833-protocol.
- Regenerate the binaries using the 'assembleme'-script. You'll need to have
crasm installed for this.
- Try the hackfw script. If the script finds your device profile and asks if
you really want to flash the hacked firmware, !disconnect your device! and
enter 'yes'.
- The hacked firmware now is in the 'fwimage.bin'-file. Please revise the
patched areas around PATCH_AT and EMPTY_AT: a mistake here could in theory
brick your device.
- If you're sure it'll work, you can try the hackfw.sh script for real.
- Rejoice if you see the 'It Works!' image :)
- If you see a garbled mess or if the image is offset, your OFFX, OFFY or
CONF_BPP-settings are wrong. Go to the setpic-dir and run
./setpic /dev/sdX -test test.png
and fiddle with the keys. As soon as your image is correct, you can copy
the displayed settings to the spec-file.
- Zip up the m_yourmachine directory and mail it to
me <picframe@spritesmods.com>, if you like.
本帖最后由剑剑 于 2014-5-26 19:32 编辑
fh_xz 发表于 2014-5-22 18:52
再付一张破解后的图吧
fh_xz
首先对你的辛勤劳动表示感谢！辛苦了！
不知你看不看够坛子上的近期LCD的贴子，你这贴N大神都出声了，你能再详细些分享你破解的过程吗，你要知道大多坛子的兄弟在Linux方面是不太擅长的，大家都是在看N大和S大神们的教程中慢慢学习消化后才折腾起来的，现在好不容易发现这款成本更低，性价比更高的相框，就是想折腾好些，看到你能破解成了，真的都想学习并成功应用在自己的NAS中，而N大和S大神们提供的确实成熟很多，如果这款没有人能为坛子的兄弟们提供更好的教程，大家可能真的要放弃了，折腾这款太费时间和精力了，呵呵，我已经两个黑屏，一个白屏，没办法恢复了。当然，这是我个人看法，你认为是不是呢，欢迎批评指正。
fh_xz 发表于 2014-5-22 18:52
再付一张破解后的图吧
怎么在win7下面破解呢？有win7下面的bin文件吗？
剑剑 发表于 2014-5-22 20:42
谢谢分享，做得不错呀，有空写个详细的教程吧，坛子上买了这款相框的在等着你的大作呢。
另请教下，用了. ...
2.4的还有吗1.5的实在太小了...
看着质量还行。。。