LimHD200i

DISCLAIMER! This is not supported by Tomacro, and CAN brick/destroy your expensive equipment and I can not be held responsible for any damage. This guide should not be read by anyone.

If you get the latest firmware file from Tomacro, for example [[1]] and unrar it. You should see something like:

-rw-rw-r-- 1 lundman lundman   861184 Jul  4 20:28 bak.bin
-rw-rw-r-- 1 lundman lundman    58128 Jul  3 10:18 boot.bin
-rw-rw-r-- 1 lundman lundman 13542400 Sep  6 10:49 update.bin
-rw-rw-r-- 1 lundman lundman    65536 Jun 28 10:28 userpref.bin

The most interesting file is update.bin. If you do a quick hexdump -C on it you will soon notice that it is in romfs format.

# hexdump -C update.bin |head -3
00000000  2d 72 6f 6d 31 66 73 2d  00 ce a3 c0 a2 f9 ad e0  |-rom1fs-........|
00000010  6d 61 6d 62 6f 00 00 00  00 00 00 00 00 00 00 00  |mambo...........|
00000020  00 00 00 49 00 00 00 20  00 00 00 00 d1 ff ff 97  |...I... ........|

If you have access to a Linux box you can mount it. (I do not, but colleague created a virtual-node for me).

# mount -o loop -t romfs update/bin /mnt
# ls -l /mnt/
drwxr-xr-x 1 root root      32 Jan  1  1970 bin
-rw-r--r-- 1 root root 1385048 Jan  1  1970 bitmap.bin
drwxr-xr-x 1 root root      32 Jan  1  1970 curacao
drwxr-xr-x 1 root root      32 Jan  1  1970 dev
-rw-r--r-- 1 root root 2018068 Jan  1  1970 em8xxx.o
drwxr-xr-x 1 root root      32 Jan  1  1970 etc
-rw-r--r-- 1 root root    5288 Jan  1  1970 gpio_int.o
drwxr-xr-x 1 root root      32 Jan  1  1970 home
-rw-r--r-- 1 root root  177728 Jan  1  1970 irqhandler.bin
drwxr-xr-x 1 root root      32 Jan  1  1970 lib
-rwxr-xr-x 1 root root 1112711 Jan  1  1970 linux.bin.gz
-rw-r--r-- 1 root root   33986 Jan  1  1970 llad.o
drwxr-xr-x 1 root root      32 Jan  1  1970 mnt
drwxr-xr-x 1 root root      32 Jan  1  1970 opt
drwxr-xr-x 1 root root      32 Jan  1  1970 proc
drwxr-xr-x 1 root root      32 Jan  1  1970 root
drwxr-xr-x 1 root root      32 Jan  1  1970 sbin
drwxr-xr-x 1 root root      32 Jan  1  1970 tmp
drwxr-xr-x 1 root root      32 Jan  1  1970 usr
drwxr-xr-x 1 root root      32 Jan  1  1970 var
-rw-r--r-- 1 root root   31156 Jan  1  1970 vsyncparam.bin

romfs is always mounted read-only, so you can not edit /mnt. Simply rsync it somewhere else and start your chances.

# rsync -arv /mnt ~/limtest/

I compiled dropbear [[2]] SSH server for arm-elf, but unfortunately it does not start. Most likely due to the very poorly populated /dev/ directory. (There are no tty*/pty* etc).

So I wrote my own very raw program that listens for connections, and spawns requested program, like /bin/sh. [[3]] Without terminal support. At least then I can find out why dropbear does not start.

Re-creating the firmware. You need to get genromfs and issue a command like:

# ~/genromfs-0.5.2/genromfs -f ~/test.bin -d ~/limtest/mnt/ -V mambo
# ls -l test.bin
-rw-rw-r-- 1 lundman lundman 13542400 Sep  6 10:49 test.bin

Rename it to update.bin, copy it to your LimHD200i's HD1, or USB, in a subdirectory called update and try it out. Setup menu, Update App item.

Will it work, I'll find out tonight...