Tools for working with Cidco Mailstations
Initial import of tools
There is no license on this code, but it was all posted to the
public mailstation Yahoo group, so I am naively assuming it is in
the public domain.
https://groups.yahoo.com/neo/groups/mailstation
Except for win32/inpout32.dll, obtained from
http://www.highrez.co.uk/downloads/inpout32/ which states:
"This product is released as open source (Freeware)."
+890
+117
loader.asm
+117
loader.asm
···
1
+
;
2
+
; This loader app is based around the Yahoo app model used in spew.asm, by Cyrano Jones.
3
+
; The original comments have been removed/replaced. The code itself of course is also
4
+
; replaced to change the functionality, which is to recieve a dynamically specified
5
+
; number of bytes. That's all it does. The screen doesn't even update, in order to
6
+
; make the binary as small as possible.
7
+
;
8
+
; The first two bytes sent from the host make up a 16-bit value of the total number of
9
+
; data bytes to follow. The first byte is the low byte, the second is the high. After
10
+
; those, the actual data is transferred into ram page 1 in slot8000. The total byte
11
+
; count is decremented, and when zero, it jumps to 0x8000 to run the transferred code.
12
+
;
13
+
; This was written to be assembled using AS80, which can be found at:
14
+
; http://www.kingswood-consulting.co.uk/assemblers/
15
+
;
16
+
;
17
+
; - FyberOptic (fyberoptic@gmail.com)
18
+
;
19
+
20
+
21
+
22
+
brecvbyte equ #8027 ; Firmware function in codeflash page 1. Attempts
23
+
; to receive a byte. Upon returning, if a = 0, it
24
+
; timed out or failed. Otherwise the l register
25
+
; holds the received byte.
26
+
27
+
28
+
org #4000 ; Apps always start at 0x4000 no matter what
29
+
; dataflash page they load from.
30
+
31
+
jp eventhandler ; Jump to the start of our code.
32
+
33
+
defw icon ; The following is data about the app
34
+
defw caption ; itself, most of which we won't even
35
+
defw dunno ; worry about.
36
+
37
+
dunno:
38
+
defb #00
39
+
zip:
40
+
defw #0000
41
+
zilch:
42
+
defw #0000
43
+
44
+
caption:
45
+
defw #0001
46
+
defw endcap-caption-6
47
+
defw #0006
48
+
defm "Loader" ; The app icon label.
49
+
endcap:
50
+
51
+
icon: ; Except no icon for us!
52
+
53
+
54
+
55
+
;----------------------------------------------------------
56
+
; Now for the actual code
57
+
;----------------------------------------------------------
58
+
59
+
getbyte:
60
+
push bc ; Preserve BC, HL
61
+
push hl
62
+
63
+
xor a ; Put codeflash page 1 into slot8000.
64
+
out (#08), a
65
+
inc a
66
+
out (#07), a
67
+
68
+
getbyte2:
69
+
call brecvbyte ; Try to fetch a byte.
70
+
or a ; If we didn't get one, try again.
71
+
jr z, getbyte2
72
+
73
+
ld a, l ; Load received byte into A register
74
+
75
+
pop hl ; Restore BC, HL
76
+
pop bc
77
+
ret
78
+
79
+
80
+
;------
81
+
82
+
eventhandler:
83
+
84
+
call getbyte ; Get low byte of total bytes to download
85
+
ld l, a
86
+
87
+
call getbyte ; Get high byte of total bytes to download
88
+
ld h, a
89
+
90
+
91
+
ld bc, #8000 ; Destination address
92
+
nextcodebyte:
93
+
call getbyte ; Fetch a byte of data
94
+
95
+
ld d, a ; Preserve A
96
+
97
+
ld a, #1 ; Put ram page 1 into slot8000
98
+
out (#08), a
99
+
out (#07), a
100
+
101
+
ld a, d ; Restore A
102
+
103
+
ld (bc), a ; Load incoming byte to ram.
104
+
inc bc ; Inc ram location.
105
+
106
+
dec hl ; Dec bytes to be received.
107
+
108
+
xor a ; Check if hl = 0; get another byte if not
109
+
or h
110
+
jr nz, nextcodebyte
111
+
xor a
112
+
or l
113
+
jr nz, nextcodebyte
114
+
115
+
116
+
jp #8000 ; When done, jump to code!
117
+
+427
loader.txt
+427
loader.txt
···
1
+
2
+
INTRO
3
+
-----
4
+
5
+
Loading code onto the Mailstation was once a lofty goal, but over time, some
6
+
smart folk have figured out just how to do that. And the ironic part, as it
7
+
turns out, is that the Mailstation itself includes the code which facilitates
8
+
doing so.
9
+
10
+
Mind you, we aren't going to reflash the Mailstation, we're merely going to
11
+
take advantage of some of its features to run arbitrary code. This lets you
12
+
keep the original firmware intact, without fear of bricking it, while still
13
+
inserting a bit of permanent code onto it, which allows us to then easily
14
+
transfer larger code via the parallel port into system memory. This not only
15
+
makes it easy for debugging, but it saves wear and tear on the flash memory.
16
+
17
+
I'm not aware of the details on all the Mailstation models, but most of the
18
+
older ones should work with this process just fine. The only one that probably
19
+
wouldn't is the 350. Possibly the 300 as well. I don't know anything about
20
+
the latter, but I understand that the 350 uses an entirely different cpu.
21
+
22
+
In any case, I'll go ahead and say the normal mumbo jumbo, where if you screw
23
+
up and break your Mailstation, it's not my fault! This is all "try at your own
24
+
risk" sort of stuff.
25
+
26
+
27
+
LAPLINK
28
+
-------
29
+
30
+
Using a parallel laplink cable is required for the transfers. And
31
+
forunately, this is the only extra hardware you require, short of a PC. If you
32
+
don't have the cable, there's lots of resources for making it on the internet.
33
+
In fact, here's you a pinout that I had handy:
34
+
35
+
1-1
36
+
2-15
37
+
3-13
38
+
4-12
39
+
5-10
40
+
6-11
41
+
8-NC
42
+
9-NC
43
+
10-5
44
+
11-6
45
+
12-4
46
+
13-3
47
+
14-14
48
+
15-2
49
+
16-16
50
+
17-17
51
+
18-NC
52
+
19-NC
53
+
20-NC
54
+
21-NC
55
+
22-NC
56
+
24-NC
57
+
24-NC
58
+
25-25
59
+
60
+
There's question over whether 1, 15, 16, and 17 are necessary, but it couldn't
61
+
hurt to do them anyway in case something else wants them in the future that you
62
+
try to use the cable on.
63
+
64
+
65
+
HEX VIEWER
66
+
----------
67
+
68
+
Once you have a cable handy, the next question is "So how do I copy code from
69
+
my computer to the Mailstation?" Well we're not quite there yet. We still
70
+
have to put code onto the Mailstation to allow it to be able to copy your
71
+
own code over. We start by taking advantage of one of the Mailstation's
72
+
hidden features: the hex editor.
73
+
74
+
Accessing the hex editor seems to vary from model to model. The first step
75
+
is reaching the diagnostic screen. On my original black DET1 running v3.03a
76
+
firmware, the key combination is Function + Shift + T when powering the device
77
+
on. I got this information from the spew.txt on the Yahoo Mailstation group
78
+
(http://tech.groups.yahoo.com/group/mailstation/), written by Cyrano Jones
79
+
(who discovered much of what I will discuss here). You can find it in the
80
+
Files/Mailbug section. Quoted from his file:
81
+
82
+
"Enter test mode with vulcan nerve pinch while booting. <func><shift><t>, or
83
+
<func><size><t> or on the newer models, <func><q><a>, then "qa781206", without
84
+
the quotes, of course."
85
+
86
+
Hopefully one of those will work for you. Once you're into the diagnostic
87
+
screen, press Shift + F5 to get into the hex editor. The F keys are those gray
88
+
rectangular ones beneath the screen.
89
+
90
+
Keep in mind that this does not allow you to modify the codeflash on the
91
+
device. It's merely for the 512KB of dataflash, which is where the Mailstation
92
+
stores all your email and settings and such. Something else the Mailstation
93
+
stores here however are third-party applications, particularly ones that were
94
+
included from Yahoo, for getting weather and TV listings or whatever. These
95
+
weren't included with all Mailstations, but the functionality to use them
96
+
apparently was. This is what we're going to take advantage of to run code on
97
+
the device, since aforementioned smart folk figured out the structure to these
98
+
apps, allowing us to create our own.
99
+
100
+
We're not ready to do so yet, but at any time, you can hit the Back button to
101
+
exit the hex editor, and then press Q at the diagnostic menu to restart the
102
+
Mailstation. It prompts you at this point whether you want to clear the
103
+
dataflash (much like when you remove power while the device is on), but just
104
+
skip past that unless you really want to clear everything for some reason.
105
+
106
+
107
+
APP RECORDS
108
+
-----------
109
+
110
+
First of all, we need to find out how many apps are already installed on your
111
+
device, to know which area to place our own. So while in the hex editor, press
112
+
G to bring up the Goto prompt, and type in "020000", followed by pressing
113
+
Enter. This takes you to the location which stores info about how many
114
+
apps are installed/where their code is stored/etc. You may see nothing
115
+
but zeroes along the top row, but this just means you have no apps (much like
116
+
mine did). Then again, you might have some stuff listed, which means you
117
+
probably do have a couple. Here's the known structure of the data starting at
118
+
0x020000:
119
+
120
+
nn ?? ?? ?? <-- number of apps
121
+
xx 00 xx xx xx 18 <-- data for 1st app
122
+
xx 01 xx xx xx 19 <-- data for 2nd app
123
+
xx 02 xx xx xx 1a <-- data for 3rd app
124
+
xx 03 xx xx xx 1b <-- data for 4th app
125
+
xx 04 xx xx xx 1c <-- data for 5th app
126
+
127
+
The first four bytes are header info, with only the first byte being known. It
128
+
holds the number of apps you have. Immediately following that, you have
129
+
records of six bytes each for each app. It's believed that you can have five
130
+
apps at most. Most of these bytes are also unknown, but the second in each is
131
+
the dataflash page number it resides on (out of 32 pages, 16KB each = 512KB),
132
+
and the sixth byte is the app number. The values for each app must be left as-
133
+
is unless you know what you're doing. You'll mostly only be changing the
134
+
number of apps.
135
+
136
+
137
+
HEX VIEWER TO HEX EDITOR
138
+
------------------------
139
+
140
+
Changing anything requires using the hex editor to actually edit, which,
141
+
believe it or not, it can't do by default! It's actually more of just a hex
142
+
viewer upon startup. But luckily they included a back door of sorts, which
143
+
turns it into a true hex editor.
144
+
145
+
To get into actual hex editor mode, press G for the Goto command, then type in
146
+
this address: "710304x", minus quotes of course. And don't forget the x at the
147
+
end, even though you won't see it being typed. Once you put this in, you don't
148
+
have to press enter. If you do, you'll lose your place. Hit the Back button
149
+
on the keyboard instead to return the editor, and you should still be at the
150
+
0x020000 location. And now you'll be in actual hex editor mode.
151
+
152
+
To edit the current screen of data, you hit the "s" key on your keyboard. The
153
+
original instructions say control-s, or function-s, but just "s" worked for me.
154
+
You can use the arrow keys to move around in the data, and type in new values
155
+
in hex. Pressing the "s" key again will save the current changes back to the
156
+
dataflash. You must do this before leaving the current screen of data, or
157
+
you'll lose any changes. Hitting the Back button will also result in losing
158
+
changes.
159
+
160
+
161
+
So now I'll break the instructions up:
162
+
163
+
- Method A will be if you have Yahoo apps installed but wish to just overwrite
164
+
one of them.
165
+
166
+
- Method B will be if you have Yahoo apps but want to add a new one.
167
+
168
+
- Method C will be if you have no apps at all and want to add one.
169
+
170
+
171
+
METHOD A
172
+
--------
173
+
So you already have some apps installed, but don't care about those, and just
174
+
want to take the easy route and overwrite one of them. That's probably the
175
+
easiest method. It means you don't have to edit anything here at 0x020000, as
176
+
long as you see data to at least indiciate one or more apps. I expect you
177
+
wouldn't have chosen method A if not. But if this is your method, we'll
178
+
replace the first app, so for future reference, you need to remember that
179
+
you'll be using dataflash page 0 to put your actual app in. All you need to do
180
+
now is go to the LOADER APP section.
181
+
182
+
If you plan to add more apps in the future though, I suggest reading METHOD B
183
+
as well.
184
+
185
+
186
+
METHOD B
187
+
--------
188
+
This section will be slightly tricky, but mostly just because it might mean
189
+
some counting. You probably already have two apps installed (which is what
190
+
will be assumed for most of this section), and while you might think it's a
191
+
simple matter of changing that "2" to a "3" at the beginning of the apps
192
+
header, it's not quite. If you did think that though, you were partially
193
+
right, because you certainly will need to increment that first value at
194
+
0x020000. Go ahead and do so. Use the instructions from earlier to make sure
195
+
you're in actual hex editor mode if necessary, then just type over that value
196
+
with your new one. If you had two apps, it should now show that you have
197
+
three.
198
+
199
+
In fact, at this point, if you saved the data (pressing "s") and went back and
200
+
looked in the Extras section on the Mailstation, you'd likely see a third extra
201
+
app over on the second page of apps, just minus an icon or name. It would be
202
+
selectable though, which would indiciate what you've done so far worked. If
203
+
you do go check this out though, make sure you follow all the previous
204
+
instructions again to make it back to this point in the hex editor at 0x020000.
205
+
206
+
Now is the counting part I mentioned. The problem with preinstalled apps is
207
+
that there's only an app record for just the apps installed. That means we
208
+
need to add a new one at the end of that, so that it'll know what page of
209
+
dataflash the code is in and such when you run the third app. If you run the
210
+
third app without this data specified, it'll almost always run the first Yahoo
211
+
app (or whatever app you have in that location).
212
+
213
+
So we're going to assume you have two apps already installed, and are wanting
214
+
to add a third. This means counting over past the six-byte app records for the
215
+
two apps already installed in order to add the bytes for the third. Remember
216
+
that the app info area is formatted like this:
217
+
218
+
[4 bytes header][6 bytes of app record 1][6 bytes of app record 2]
219
+
220
+
The very first byte in the first four of course being the number of apps
221
+
installed, which you should have already changed. We need to add another six
222
+
bytes at the end of all of this. If you only had one app installed, you'd have
223
+
to count over until past the last byte of the first app record, but luckily,
224
+
having two apps installed means 16 bytes total (4 + 6 + 6). The hex editor
225
+
shows 16 bytes per line. This means that instead of counting, you can simply
226
+
go to the second line on the screen, aka address 0x020010. If you only had one
227
+
app already, you'd have to count over to 0x02000A.
228
+
229
+
Now, what you put at this location is dependant on the app number you're about
230
+
to install. From earlier, this is the known structure of the app records:
231
+
232
+
xx 00 xx xx xx 18 <-- data for 1st app
233
+
xx 01 xx xx xx 19 <-- data for 2nd app
234
+
xx 02 xx xx xx 1a <-- data for 3rd app
235
+
xx 03 xx xx xx 1b <-- data for 4th app
236
+
xx 04 xx xx xx 1c <-- data for 5th app
237
+
238
+
If you have two apps installed already, then it's the data for the third app
239
+
you need to put in. Since we don't know what the "xx" values are for, use
240
+
"00". It works fine for me. So, for example, if you're adding in app three,
241
+
you'd go to the second line on the screen when at 0x020000(aka address
242
+
0x020010 now), and put in the following bytes: "00 02 00 00 00 1a". These
243
+
bytes tell it to go to dataflash page 2 to run the app, and that the internal
244
+
app number is 1a. The latter isn't important to us (but is important to
245
+
include).
246
+
247
+
What is important though is that you remember the dataflash page number from
248
+
the line you add. This is because you have to know which page your app will
249
+
run in, in order to know which page to put the code, later in the LOADER APP
250
+
section. If you put it in the wrong page, it naturally won't run.
251
+
252
+
While you're here, you might want to go ahead and add in the remaining bytes
253
+
necessary to identify the rest of the five total apps. This will be useful if
254
+
you want to add in more apps in the future, and would later require you to only
255
+
change the first byte in this area, aka the number of apps, when adding
256
+
another. So for example, if you just added in app three using the previous
257
+
instructions, then all you need to do is type in the data for apps four and
258
+
five right afterward.
259
+
260
+
Don't forget to press "s" again to save your changes! Now, with your proper
261
+
dataflash page number in mind, go on to the LOADER APP section.
262
+
263
+
264
+
METHOD C
265
+
--------
266
+
This method is probably the second easiest aside from A, because it just means
267
+
typing in bytes. You're probably here if you have no apps installed, or if you
268
+
just don't care enough about the Yahoo apps to worry about them being there at
269
+
all.
270
+
271
+
So, make sure you're in actual hex editor mode, and that you're at location
272
+
0x020000. We're going to add in the app header, and all five app records.
273
+
This means that if you decide to add more apps in the future, all you have
274
+
to do is increment the first byte, since all the proper app records will
275
+
already be in place.
276
+
277
+
So, at 0x20000, we want to put in the following bytes:
278
+
279
+
01 00 00 00 00 00 00 00 00 18 00 00 00 00 00 18
280
+
00 01 00 00 00 19 00 02 00 00 00 1a 00 03 00 00
281
+
00 1b 00 04 00 00 00 1c
282
+
283
+
The first byte obviously indicates we should now have one app. Make sure to
284
+
hit "s" to save all this! It couldn't hurt to verify you typed in the proper
285
+
bytes, as well. If you want to see if it worked, exit out of the hex editor,
286
+
and go to the Extras area on your Mailstation. On the right, you should now
287
+
have a new app, with no icon or label, but it should be selectable. Running it
288
+
at the moment will probably crash your Mailstation though.
289
+
290
+
Since this will be your first app, you'll be installing the code into dataflash
291
+
page 0. Remember this value, then head on to the next section, LOADER APP.
292
+
293
+
294
+
LOADER APP
295
+
----------
296
+
297
+
Okay, if you used methods B or C, you should have modified the apps header to
298
+
specify the new number of apps, and added any necessary app records to be able
299
+
to have your own apps.
300
+
301
+
And no matter what method you used, you should know your dataflash page number to
302
+
put the actual app at.
303
+
304
+
This is where we're going to put the actual code! It also holds icon and icon
305
+
label data, but we're not going to put an icon, just for the sake of typing
306
+
less bytes in. Yes, you have to type in every byte of code for this manually,
307
+
like in the old days. This is why the code is going to be as brief and to the
308
+
point as possible. Its sole purpose will be loading code from your PC to the
309
+
Mailstation, and running it. In fact, it won't even display anything on the
310
+
screen while it's doing it! But we'll know it if it's loading, because the
311
+
host loader app on the PC side will show us.
312
+
313
+
In any case, let's put in some code. The first step is determining the
314
+
location in the hex editor to go in order to do it. See, when you launch the
315
+
app via the Mailstation, it looks in the app record and determines the
316
+
dataflash page to load into slot4000 (16KB from 0x4000-0x7FFF in the
317
+
Mailstation address space). As mentioned earlier, the dataflash is 512KB,
318
+
resulting in 32 "pages" of flash that can be put into slot4000 (or slot8000 for
319
+
that matter). Some of the later pages though are used for storing email and
320
+
all that, so we wouldn't want to mess with those. You've already told
321
+
it what page numbers each app uses anyway when you put in the app records
322
+
earlier, and the Mailstation knows not to store anything important in those
323
+
pages apparently.
324
+
325
+
So this just takes a little math to determine the actual starting address in
326
+
the dataflash that you need to put your code in. You basically just multiply
327
+
your page number by 0x4000. So page 0 would be address 0x0000, page 1 would be
328
+
0x4000, page 2 would be 0x8000, etc.
329
+
330
+
I'll make it easy for you actually. If you're using method A or C, your
331
+
address will be 0x0000. If you're using Method B, it's PROBABLY going to be
332
+
0x8000, if you already had two apps installed. If you had some odd amount of
333
+
apps installed, calculate accordingly.
334
+
335
+
Now that you know your starting address in the dataflash, that's where we need
336
+
to go. Using the Goto command in the hex editor, just punch in your address.
337
+
Make sure you add enough zeroes into the blank, since it holds six characters.
338
+
0x4000 would be "004000", for example.
339
+
340
+
Now you're at the starting address of where your app should be! It's probably
341
+
a bunch of zeroes. If you're overwriting a pre-existing Yahoo app, then it's
342
+
probably a bunch of gibberish. Either way, we're overwriting it at this point.
343
+
Make sure you put in the backdoor code mentioned earlier, hit "s" to enter edit
344
+
mode, and type in these bytes:
345
+
346
+
C3 2D 40 1A 40 0E 40 09 40 00 00 00 00 00 01 00
347
+
06 00 06 00 4C 6F 61 64 65 72 C5 E5 AF D3 08 3C
348
+
D3 07 CD 27 80 B7 CA 22 40 7D E1 C1 C9 CD 1A 40
349
+
6F CD 1A 40 67 01 00 80 CD 1A 40 57 3E 01 D3 08
350
+
D3 07 7A 02 03 2B AF B4 C2 38 40 AF B5 C2 38 40
351
+
C3 00 80
352
+
353
+
This is the code from loaderapp.bin, if you're curious. If you want to see the
354
+
source to have some idea what it's doing, look at loaderapp.asm.
355
+
356
+
You might want to visually verify your bytes, because it's extremely easy to
357
+
make a mistake. One wrong letter or number could mess up the entire program.
358
+
359
+
That's it! If you haven't already, hit "s" to save. Now you can go back out
360
+
of the hex editor and into the Mailstation, look in the Extras area, and you
361
+
should see the "Loader" app. If this is your first app, it'll be on the first
362
+
page. If you already had some apps, it'll be on the second page.
363
+
364
+
Keep in mind that running this won't do anything until you actually try to send
365
+
code to it. It'll actually seem like it's frozen up (since it's constantly
366
+
waiting for a byte from the parallel port). And if something ever goes wrong
367
+
during a transfer (which can happen occasionally), you'll have to reset the
368
+
Mailstation either with the reset button on back, or cycling the power.
369
+
370
+
Now to send your own code to it!
371
+
372
+
373
+
MAILSEND
374
+
--------
375
+
Mailsend is the other side of the transfer process that I wrote, which you run
376
+
on your PC. It's a command-line Windows app.
377
+
378
+
That said, open up a command prompt window, and navigate to where you put all
379
+
the files. Sometimes it's easiest to just put it all in c:\mailstation, which
380
+
is what I do.
381
+
382
+
Mailsend assumes your PC's parallel port runs on the fairly standard port
383
+
0x378. If not, you're going to have some problems. I have no idea if this is
384
+
compatible with those USB->Parallel dongles out there, either. But almost
385
+
every computer still made has a parallel port built into it, which should work
386
+
with this just fine.
387
+
388
+
To try it out, run "mailsend fyos_bin.bin" on the PC. It'll prompt you to
389
+
press enter to continue. At this point, you need to run Loader on the
390
+
Mailstation. Doing so won't give you any sort of visual indication, but you'll
391
+
know it's working here in a second. Once Loader is running, hit return on the
392
+
PC. You should start to see a byte counter as it transfers data to the
393
+
Mailstation. When it's done, it'll return to the command prompt, and your
394
+
Mailstation should be running whatever you just send to it. In this case,
395
+
FyOS. If so, then congratulations, you can now transfer any binary file to the
396
+
Mailstation!
397
+
398
+
399
+
THE END?
400
+
--------
401
+
402
+
It's important to remember that your code is loaded into slot8000 (16KB from
403
+
0x8000 to 0xBFFF), in ram page 1. 0xC000 to 0xFFFF is ram page 0, which is
404
+
fixed and can't be swapped (as far as we know). The Mailstation uses page
405
+
0 to store variables and such for its own code. This means you should keep
406
+
the binaries you send less than 16KB, or you'll overwrite that stuff. If
407
+
that's your intention, then fine, but keep in mind that interrupts are not
408
+
disabled in the Loader app, meaning parts of the code you send that span
409
+
past 0xC000 could get overwritten before it even gets a chance to execute. You
410
+
could modify Loader to disable them however (then reassemble it, and type in
411
+
the bytes again of course), but you should know what you're doing in such a
412
+
case. No interrupts means no keyboard support via the firmware routines, for
413
+
example.
414
+
415
+
That's about it for this tutorial. If you have any questions/comments, feel
416
+
free to let me know at fyberoptic@gmail.com. As mentioned in the readme, I
417
+
also frequent the Yahoo group, where others might be able to help you as well:
418
+
419
+
http://tech.groups.yahoo.com/group/mailstation/
420
+
421
+
Have fun!
422
+
423
+
424
+
- FyberOptic
425
+
426
+
427
+
+199
spew.asm
+199
spew.asm
···
1
+
; NOTE: You can't dump the rom after mboot or sboot is flashed,
2
+
; because most of the rom is gone by then.
3
+
;
4
+
; This is code to be poked into dataflash on unit with yahoo
5
+
; features active.
6
+
; HEY, it seems to work on units *without* yahoo feature, too!!!!
7
+
; (4.05E for instance.)
8
+
; It's purpose is to dump the coderom out of the parallel port,
9
+
; using the tribble code in page #01.
10
+
;
11
+
; *** One catch to using this is that it requires mailbug
12
+
; *** version > 0.0.3, with the "inhale" function, to catch
13
+
; *** the data. And that version is not quite ready yet.
14
+
; *** But you do not need it to enter this app into your
15
+
; *** mailstation. In fact, if you want to dump your rom,
16
+
; *** you *have to* enter this in hex on the mailstation
17
+
; *** keyboard. That is because in order for mailbug to
18
+
; *** write anything to dataflash, mbug needs to be loaded,
19
+
; *** and loading mbug requires flashing sboot or mboot, and
20
+
; *** flashing anything (to codeflash) will erase your rom.
21
+
; *** You have to do this BEFORE INSTALLING SBOOT!
22
+
23
+
24
+
bsendbyte equ #802D ; raises busy & sends byte.
25
+
; We use the existing sendbyte from original update code.
26
+
; This means codeflash page #01 needs to be banked in to
27
+
; slot8000 before calling bsendbyte.
28
+
29
+
done equ #0000 ; Gotta go somewhere when done, we reboot.
30
+
; Mailstation will call eventhandler 3 or 4 times when you
31
+
; select the new application, and we only want to exec once,
32
+
; so we do not return at end, we reboot after first "event".
33
+
34
+
; STEP 1)
35
+
; This is data from dataflash page #08, sector #00 (which
36
+
; translates to a raw address of 020000), of a mailstation
37
+
; with two apps:
38
+
;
39
+
; 020000 02 00 02 00 01 00 01 5e 1c 18 01 01 01 20 a7 19
40
+
;
41
+
; This is the key to enabling added apps!!!
42
+
; At least first byte above is needed, it seems to be count
43
+
; of apps (2 in this case). You need to poke it into dataflash
44
+
; with hex editor at raw address 020000.
45
+
;
46
+
; Modify the first byte to match number of apps, including
47
+
; new one. If your mailstation already has app(s), and you
48
+
; want to overwite one of them, you can leave this data as is,
49
+
; and skip this step. I don't know what the rest are, but those
50
+
; 16 bytes are the only data in dataflash pg #08, sector #00.
51
+
;
52
+
; If you inc that first byte, without doing steps 2 or 3, you
53
+
; should enable blank (or giberish) icons in the menu (under
54
+
; yahoo, or extras).
55
+
;
56
+
; *** Enter Test mode with vulcan nerve pinch while booting:
57
+
; <func><shift><t>, or <func><size><t> or on the newer
58
+
; models, <func><q><a> followed by "qa781206" without
59
+
; the quotes, of course.
60
+
;
61
+
; *** Enter Hex Viewer mode with <shift><f5>.
62
+
;
63
+
; *** Enable Hex Edit mode by entering "G710304x<enter>" without
64
+
; quotes of course. This is a "go" to a nonexising sector,
65
+
; and it will leave viewer on last sector of dataflash.
66
+
;
67
+
; *** Edit dataflash page #08 as described above. G020000 will
68
+
; get you to the right sector. <ctrl><s> will enter edit mode
69
+
; for current sector. Edit the data. <ctrl><s> will leave
70
+
; edit mode and save to dataflash. You need to leave edit
71
+
; mode before moving to next sector.
72
+
73
+
74
+
; STEP 2}
75
+
; This is the start of our new app. If your mailstation has
76
+
; no existing "apps", then you would poke this into page #00
77
+
; of dataflash (raw address 000000).
78
+
;
79
+
; If you already have say 2 existing apps, they are probably
80
+
; in dataflash pages #00 & #01 respectively. In that case you
81
+
; would put this in page #02 of dataflash (008000).
82
+
;
83
+
; When using dataflash page #00, this goes at raw address 000000.
84
+
; When using dataflash page #01, this goes at raw address 004000.
85
+
; When using dataflash page #02, this goes at raw address 008000.
86
+
;
87
+
; (iow, in raw addresses, first app is at 000000, second at 004000,
88
+
; and third at 008000.)
89
+
;
90
+
; The JP instruction is the only thing in this part that is
91
+
; absolutely necessary, if you can live with a captionless
92
+
; menu entry. The icon is gonna be blank anyways.
93
+
;
94
+
; *** Use hex editor to "go" to your address (G000000 or G004000
95
+
; or G008000). This address corresponds to #4000 in the
96
+
; following app, no matter what page you are using.
97
+
;
98
+
; *** Enter edit mode, enter at least the bytes for the JP of
99
+
; the following code, and save the sector. Goto step 3.
100
+
101
+
org #4000 ; This is *always* #4000, regardless of
102
+
; what page you use.
103
+
104
+
jp eventhandler
105
+
106
+
defw icon ; icon location (in this page)
107
+
defw caption
108
+
defw dunno
109
+
110
+
dunno:
111
+
defb #00
112
+
zip:
113
+
defw #0000
114
+
zilch:
115
+
defw #0000
116
+
117
+
caption:
118
+
defw #0001 ; ?????
119
+
defw endcap-caption-6 ; num of chars
120
+
defw #0006 ; offset to first char
121
+
defm "Spew" ; the caption string
122
+
endcap:
123
+
124
+
icon:
125
+
; I haven't figured out the icon format yet, but it's not needed.
126
+
; Icon data would go here, followed by app data (news, weather,
127
+
; or tv).
128
+
; Just leave this data as it is, and we will skip ahead to the last
129
+
; sector in this same page.
130
+
131
+
132
+
; STEP 3)
133
+
; I don't think it matters exactly where this next part
134
+
; sits in dataflash, as long as the JP in step two above can
135
+
; find it. We will put it at the end of the page, 'coz that's
136
+
; where the mailstation apps put it.
137
+
;
138
+
; If using dataflash page #00, this goes at raw address 003f00.
139
+
; If using dataflash page #01, this goes at raw address 007f00.
140
+
; If using dataflash page #02, this goes at raw address 00bf00.
141
+
;
142
+
; *** Use "go" command with appropriate address matching address
143
+
; used in step 2.
144
+
;
145
+
; *** Edit mode, enter the following 37 bytes of code, save.
146
+
;
147
+
; *** Quit Hex Editor with <back> key.
148
+
;
149
+
; *** Leave Test mode with <q> key.
150
+
;
151
+
; *** The mailstation will reboot, pick "no clear", and then
152
+
; check if you have a new app listed in your menu under
153
+
; "yahoo" or in "extras".
154
+
155
+
156
+
eventhandler:
157
+
; This is the "event handler" for our new app. It doesn't
158
+
; really handle any events, it just spews the rom contents
159
+
; over the laplink.
160
+
161
+
xor a ; Set slot8000device = codeflash
162
+
out (8),a
163
+
164
+
ld bc,#4000 ; b=count=64 pages, c=currentpage=0
165
+
166
+
pgloop:
167
+
; for count = 64 downto 1 do
168
+
169
+
ld hl,#8000 ; start at begining of each pg
170
+
171
+
byteloop:
172
+
; for i=#8000 to #BFFF do
173
+
174
+
ld a,c ; bank currentpage into slot8000
175
+
out (7),a
176
+
177
+
ld a,(hl) ; get byte[i]
178
+
179
+
push hl
180
+
push bc
181
+
182
+
ld h,a ; h is byte
183
+
184
+
ld a,#01 ; bank bsendbyte into slot8000
185
+
out (7),a
186
+
call bsendbyte ; send byte(H)
187
+
188
+
pop bc
189
+
pop hl
190
+
191
+
inc hl ; i++ (next byte)
192
+
ld a,h
193
+
cp #C0
194
+
jr nz,byteloop ; jump if i < #C000
195
+
196
+
inc c ; currentpage++ (next page)
197
+
djnz pgloop
198
+
199
+
jp done
win32/inpout32.dll
win32/inpout32.dll
This is a binary file and will not be displayed.
+147
win32/maildump.cpp
+147
win32/maildump.cpp
···
1
+
/*
2
+
* Maildump.cpp
3
+
* ------------
4
+
*
5
+
* This should dump your Mailstation's codeflash, in combination
6
+
* with Cyrano Jones' "spew.txt" app for the Mailstation, and
7
+
* a laplink cable of course.
8
+
*
9
+
* Basic use would be as follows:
10
+
* 1.) connect laplink cable to MS and PC
11
+
* 2.) turn on MS
12
+
* 3.) run maildump on PC
13
+
* 4.) run spew on MS
14
+
*
15
+
* The MS should be on first to ensure parallel port signals are
16
+
* reset, otherwise your dump could be bad. If you think you
17
+
* did get a bad dump, it wouldn't hurt to turn the MS off and
18
+
* on again, waiting for the main menu to show up, just to make
19
+
* sure it resets itself before you start listening for data.
20
+
*
21
+
* The dump should be 1,048,576 bytes (1MB), and named "ms.bin",
22
+
* which is automatically overwritten everytime you run the
23
+
* program.
24
+
*
25
+
* This is based around Cyrano Jones' unit_tribbles in Pascal,
26
+
* but written to work under Windows (tested under XP) thanks
27
+
* to inpout32.dll, which doesn't require a separate driver
28
+
* to interface with I/O ports. It's pretty useful!
29
+
*
30
+
* Spew.txt can be gotten from the Yahoo Mailstation group's file
31
+
* section:
32
+
* http://tech.groups.yahoo.com/group/mailstation/files/Mailbug/
33
+
*
34
+
*
35
+
* - FyberOptic (fyberoptic@...)
36
+
*
37
+
*/
38
+
39
+
#include <windows.h>
40
+
#include <stdio.h>
41
+
#include <math.h>
42
+
43
+
#define PORTADDRESS 0x378
44
+
45
+
#define DATA PORTADDRESS+0
46
+
#define STATUS PORTADDRESS+1
47
+
#define CONTROL PORTADDRESS+2
48
+
49
+
#define bsyin 0x40
50
+
#define bsyout 0x08
51
+
#define stbin 0x80
52
+
#define stbout 0x10
53
+
#define tribmask 0x07
54
+
#define dibmask 0x03
55
+
56
+
typedef short (_stdcall *inpfuncPtr)(short portaddr);
57
+
typedef void (_stdcall *oupfuncPtr)(short portaddr, short datum);
58
+
59
+
inpfuncPtr inp32fp;
60
+
oupfuncPtr oup32fp;
61
+
62
+
short Inp32 (short portaddr)
63
+
{
64
+
return (inp32fp)(portaddr);
65
+
}
66
+
67
+
void Out32 (short portaddr, short datum)
68
+
{
69
+
(oup32fp)(portaddr,datum);
70
+
}
71
+
72
+
73
+
int InitIOLibrary()
74
+
{
75
+
HINSTANCE hLib;
76
+
77
+
hLib = LoadLibrary("inpout32.dll");
78
+
79
+
if (hLib == NULL) {
80
+
fprintf(stderr,"LoadLibrary Failed.\n");
81
+
return -1;
82
+
}
83
+
84
+
inp32fp = (inpfuncPtr) GetProcAddress(hLib, "Inp32");
85
+
86
+
if (inp32fp == NULL) {
87
+
fprintf(stderr,"GetProcAddress for Inp32 Failed.\n");
88
+
return -1;
89
+
}
90
+
91
+
oup32fp = (oupfuncPtr) GetProcAddress(hLib, "Out32");
92
+
93
+
if (oup32fp == NULL) {
94
+
fprintf(stderr,"GetProcAddress for Oup32 Failed.\n");
95
+
return -1;
96
+
}
97
+
}
98
+
99
+
100
+
101
+
unsigned char recvtribble()
102
+
{
103
+
Out32(DATA,0); // drop busy/ack
104
+
while ((Inp32(STATUS) & stbin) != 0) {} // wait for (inverted) strobe
105
+
unsigned char mytribble = (Inp32(STATUS) >> 3) & tribmask; // grab tribble
106
+
Out32(DATA,bsyout); // raise busy/ack
107
+
while ((Inp32(STATUS) & stbin) == 0) {} // wait for (inverted) UNstrobe
108
+
109
+
return mytribble;
110
+
}
111
+
112
+
113
+
114
+
int main(int ARGC, void **ARGV)
115
+
{
116
+
117
+
if (!InitIOLibrary()) { printf("Failed to initialize port I/O library\n"); return -1; }
118
+
119
+
FILE * pFile;
120
+
121
+
pFile = fopen ("ms.bin" , "wb");
122
+
if (!pFile)
123
+
{
124
+
printf("Couldn't open file\n");
125
+
return -1;
126
+
}
127
+
128
+
unsigned char bytereceived;
129
+
int totalbytesreceived = 0;
130
+
131
+
printf("Waiting...");
132
+
133
+
while (totalbytesreceived < (1024*1024)) // Fetch 1MB
134
+
{
135
+
bytereceived = recvtribble() + (recvtribble() << 3) + ((recvtribble() & dibmask) << 6);
136
+
fputc ( bytereceived, pFile );
137
+
totalbytesreceived++;
138
+
printf("\rReceived: %d bytes (%d%%) ",
139
+
totalbytesreceived, (int)floor(((float)totalbytesreceived / (1024*1024))*100));
140
+
}
141
+
fclose (pFile);
142
+
143
+
printf("\n");
144
+
return 0;
145
+
146
+
}
147
+
win32/maildump.exe
win32/maildump.exe
This is a binary file and will not be displayed.
win32/mailsend.exe
win32/mailsend.exe
This is a binary file and will not be displayed.