Contents
ZipIt wireless IM device
Discussion of ZipIt modification http://groups.yahoo.com/group/zipitwireless
Details on how to flash new firmware into ZipIt http://aibohack.com/zipit/
large scan of main board
really large scan of main board
directory listing Upload new attachment "ls-lR.txt" [slightly out of date]
/bin/busybox appears static linked to uClibc
/sbin/iwconfig is static linked to uClibc
/usr/bin/Zipit is the main binary, static linked to glibc and likely more
Made by Aeronix and imported
- GPL/LGPL sources are available or documented
- Note: object file for Zipit binary is not available for re-linking so they are in violation of the LGPL license for glibc
Hardware
- 2M flash - MX 29LV160ATxBC-70
- 16M SDRAM - Hynix HY5V26D
- 320x240x4 LCD (grayscale)
Agere WiFi chip - WL600114LY (basically "WL60011", a Wavelan Hermes-II)
Wolfson Micro WM8751L Stereo DAC
http://www.elkgrovewireless.com/zipit/
Source Code
- Zipit Wireless Messenger Release 1.00-1.12
http://kernel.org/pub/linux/kernel/v2.4/linux-2.4.21.tar.bz2
http://www.agere.com/mobility/docs/wl_lkm_722_abg.tar.gz - Agere Wireless Driver
http://www.zipitwireless.com/linux/patch-wl_lkm_abg_alfa2-zipit.gz - Aeronix Patch
http://busybox.net/downloads/legacy/busybox-1.00-pre1.tar.bz2
http://uclibc.org/downloads/old-releases/uClibc-0.9.15.tar.bz2
http://www.hpl.hp.com/personal/Jean_Tourrilhes/Linux/wireless_tools.26.tar.gz
Note: as stated above the LGPL license requires that the object file for the Zipit binary be made available for re-linking with glibc and this has not happened.
Serial Port Access
- ground on GND
- debug on DBG
RxD1 on left side of R121
RxD2 on right side of R122
TxD2 on unlabeled point near midpoint from R42 and R53
TxD1 is not available
you will need a level shifter circuit with something like the MAX233A or MAX233 to convert to to rs232 signal levels.
How to find the Firmware Version
<to be supplied>
What's in ROM
From ZipitPet's post on the subscriber only Yahoo group: http://groups.yahoo.com/group/zipitwireless
Updated to 1.16 version
The ZipIt device has 2MB or Flash ROM and 16MB of RAM
The Flash ROM contains a small boot loader, a zImage compressed Linux kernel and gzip compressed ramdisk. These get expanded to RAM when the device boots. At the end of the Flash ROM is a small area where settings are saved (eg: passwords, SSIDs etc).
FlashROM Memory Map: (version 1.16)
00000000 |
boot loader (no GPL source) |
00002000 |
start of kernel zImage compressed bootloader |
000045B0+- |
start of gzipped Linux data (inside zImage) |
00090000 |
start of gzipped Linux ramdisk image (over 4MB expanded) |
001F0000 |
Flash stored properties -- "AerMedia Properties" |
001FFFFF |
end of FlashROM (2MB) |
Linux
The linux kernel build string is:
Linux version 2.4.21-rmk1 (root@sambaman) (gcc version 3.2) #15 Wed Apr 21 16:01:33 UTC 2004
Most components were built a long time ago (2002 or 2003). Not customized for the ZipIt.
in /lib/modules are a few dynamic loaded modules:
- audiodrv.o [audio, not GPL],
wlags49_h25_cs.o [WiFi, GPL]
init script
The brief init script, /sbin/init
[a bunch of echo statements] /bin/mount /proc /sbin/ifconfig lo 127.0.0.1 insmod /lib/modules/audiodrv.o cd /usr/bin /bin/ash & ./Zipit /bin/ash
ramdisk - custom app "Zipit"
The /usr/bin/Zipit app is ~1.6MB program that has all the goodies in it. It uses a number of support files for the user interface
- Sounds are in standard WAV format (/usr/bin/Sounds)
- Images are in standard BMP format (/usr/bin/GUI)
- The user interface is stored in .SDF data files for the different pages (/usr/bin/SDFs) Looks like a proprietary format
- The string "insmod /lib/modules/wlags49_h25.o" is buried inside /usr/bin/Zipit
Release history
A URL for a checking/getting a release looks like:
http://www.zipitwireless.net/~zippy/90300089.txt <- with different numbers on the end.
TimRiker only has partial info, but wishes we kept track so here's a start:
version |
filename |
date |
md5 |
comments |
1.99 |
bootrom.9IU7Y6TDK.bin |
20041015 |
4776E21028E8BF6B6817D8CACC8FA360 |
00000000.txt |
1.99 |
bootrom.4D02IZ8E.bin |
20050214 |
934A1B789ACE66F6B24116964C3C604B |
00000000.txt |
t2.1.0 |
bootrom.t2.1.0.bin |
? |
? |
? |
t2.1.01 |
bootrom.t2.1.01.bin |
? |
? |
? |
t2.1.04 |
bootrom.t2.1.04.bin |
? |
? |
? |
t2.1.05 |
bootrom.t2.1.05.bin |
? |
? |
? |
t2.1.06 |
bootrom.t2.1.06.bin |
? |
? |
? |
t2.1.08 |
bootrom.t2.1.08.bin |
? |
? |
? |
1.0 |
bootrom.t3.1.0.bin |
? |
? |
? |
1.03 |
bootrom.t3.1.03.bin |
? |
? |
? |
1.04 |
bootrom.t3.1.04.bin |
? |
? |
? |
1.05 |
bootrom.t3.1.05.bin |
? |
? |
? |
1.06 |
bootrom.t3.1.06.bin |
? |
? |
? |
1.08 |
bootrom.t3.1.08.bin |
20041224 |
AB2178653406C18908E20FA40E15B391 |
? |
1.12 |
bootrom.P4A85DK4.bin |
20050111 |
7AFF3A1AD8B036C95FAFCD07E64F6171 |
? |
1.16 |
bootrom.4D02IZ8E.bin |
20050214 |
934A1B789ACE66F6B24116964C3C604B |
Yahoo messenger, shoutout |
1.21 |
bootrom.4KD8G8NA.bin |
20050321 |
609BDD07C8169305A2550A3010D658F2 |
more Yahoo fixes |
1.22 |
bootrom.S73HS0O1.bin |
20050825 |
9146A4C0D370EB0524838E7B06AED343 |
? |