5.1 crack [DONE]

[bitSync]

Thanks bitsync

I send you an email.

I wrote a program that converts all the hex stuff to the ADSP2181 instructions, so into a readable Assembler code. Additional the jumps are marked. So there is the possibility to find all the hardware based commands.

I had a breakthrough I guess.
today I found the Information in the code which character execute what code block. In other words, I found the communication commands.

It seems so that sending an "s" returns the ESN. So maybe I'm able to verify that stuff alone today in the evening.

sending a "?" to the console should return some board information or whatever. It seems so that 46 characters are transmitted then.

I also found out that there are a lot of more commands that I'm not aware at the moment.

I have a very good feeling that the hack I sent to you will succeed to
enable 5.1 again for all people that have lost their 5.1 Licenses.

Nice! All that sounds like fantastic news. I got your zip file and I'm looking forward to testing that out tonight. I've got my OS 5.1 on a compact flash (CF) card accessible from a CF card slot on the back of the CPU, so if the control.asc hack makes the machine unbootable I have a backup CF imaged with the working OS 5.1 that can be easily swapped in. I'll post my results here and in an email to you. Good luck with the ADSP-2181 code analysis!

[munkustrap]

CF --> great that means it is not too much effort for you to test that !

I just made a debug session with the hacked Firmware.

sending a "s" Returns now the ESN code "terminated with c" that I want and where I have the licenses.

so the hack does what it should, sending always the same ESN for all brainboards !!!

One Thing might be open:
The "?" command returns a 23 Byte hex number. I don't know at the moment if that is also data which is needed in the background for licenses. If yes, then I have to check that also.

[bitSync]

so the hack does what it should, sending always the same ESN for all brainboards !!!

I'd say you're well on your way to the d8b Medal of Honor! I'll report later on the control.asc swap.

[munkustrap]

hopefully thats the only stuff to hack

looking Forward to the real Experiment that you do for us.

[bitSync]

Just so I'm understanding correctly, you have found a way to edit the firmware that's uploaded to the console at boot time to change the Brain Board's command response behavior such that when the console receives the "Send-Me-Your-ESN" command ("s") from the OS 5.1, in it's reply the command processing firmware on the Brain Board now substitutes a hard-coded ESN for what would normally be the ESN read from the U16 DS2401, this substitute ESN being part of a known good ESN / unlock-code pair (the munkustrap magic hack golden authorization pair).

Is that correct? That is just so crazy cool...

[bitSync]

Lots of grooviness happening here.

I imaged my OS 5.1 CF before doing anything else so I'd have an image of the latest version.

I booted up the d8b OS 5.1 using my normal ESN and control.asc.

Once up and running I ftp'd into \system5\Firmware and deleted the normal control.asc, then binary ftp'd your hacked control.asc into the file system.

Shutdown the d8b.

Restarted the d8b. The system came up fine even remembering the fader positions from the last session.

Then a beautiful thing happened.

A dialog box came up from the OS 5.1 titled "Enter Authorization Code for Version 5.1", and in the lower left hand corner of the dialog box was a static text field labeled "d8b ESN:"

Want to know what was in that text field? Do ya?

In that field was your beautifully hacked ESN provided in the firmware to the Brain Board for overwriting onto the message field normally containing the real ESN from the U16 DS2401.

I went into the Setup | License menu and your hacked ESN was displayed in there as well.

At this point I ftp'd back into the d8b and replaced the hacked control.asc with the original one I had saved out of there and rebooted. My U16 ESN is back and everything is running normally.

Nice work!

I haven't tried authorizing the hacked ESN with its companion unlock-code but I can try that also if you think that would be of value to your 5.1 hack mission.

Let me know what you need and I'll help as best I can. RS232 sniffing is still on offer if of any value. Best regards.

[Bruce Graham]

You guys ROCK! WOW. How long have we been waiting to see if this could happen!! So close.

Does this hold any hope for the Plug-ins? It appears buying a un-lock code for them is out-of-the question!, or am I'm just being greedy? If so, SORRY.

Cheers and keep up the most excellent work!
Bruce

[Old School]

Wow! I cannot believe how quickly you solved this. Please advise price as soon as it is available. I want to be first in line. Thank you for all your hard work!

Have a blessed day in Christ,
Mike W.

[bitSync]

You guys ROCK! WOW. How long have we been waiting to see if this could happen!! So close.

To be clear, this is all Ralph. I am but a humble supporter for his brilliant OS 5.1 firmware crack.

Does this hold any hope for the Plug-ins? It appears buying a un-lock code for them is out-of-the question!, or am I'm just being greedy? If so, SORRY.

Cheers and keep up the most excellent work!
Bruce

I will report on the authorization of OS 5.1 with the unlock-code as soon as I test it. I think OS 5.1 should authorize just fine with this ESN / unlock-code pair. I'll take a look at the plugs once the unlock-code authorization test is successful.

[munkustrap]

Thanks bitsync for your test support!
I don't own a mackie cpu, so i cannot check that.

But after the first testing results i am pretty sure that this will work if the ESN and the licence code are the single
Point of authorization. If there is an additional snr check in the cpu then there is still work open.

Best regards
Munk, ralph