Snap 4100 BIOS dump, unlocking 137 limit [Archive]

blue72gem

03-21-2006, 11:34 AM

Just an idea:
has anyone tried to dump bios od Snap 4100 and try to edit it in one of those BIOS editors to patch the LBA 48 bit?

I can provide the dump if someone is interested to do some hacking.
I can also offer to be test rabbit since I can backup and restore the bios anytime (with universal off-board programmer).

Is here in forum anyone with a bit of assembler know-how who's interested to lift the 137 Giga limit of our 4100's?

Let me know, I'll try to be of any assistace as possible.

Regards,
blue72gem

P.S. I'm one of fresh 4100 owner with a 4x 200 Gigz WesternDigitals :hammer:

blue68f100

03-21-2006, 01:00 PM

If the 4100 is like the 2000, it has 2 flashram chips. 1 is removable, the other is soldered in. I currently have read the removable one, with my programmer. But have not unsoldered the second. The OS is stored in these chips, alone with the BIOS. The chips in the 2000 are 29F800BT TSOP. I found reference to pkzip, in the flashram. Indicating that it uncompress the OS, as it installs it to the drive.

If you look at the sup file that Snap uses to update the OS. You will find it is a Intel HEX format.

I was looking at what would be needed to backup a OS. The older 2000 v1 do not like 4.0.860. The installer will not allow you to install a older version.

esh

03-21-2006, 04:47 PM

I have been wanting to buy a universal programmer for this reason. (and other reasons of course)

I'd be very interested in hacking up the 4100 to accept 48bit LBA. Also I'm surprised a linux or bsd replacement OS hasn't emerged yet for the snap servers... I'm sick of this pansy web interface.

So you have already taken the dump?

blue68f100

03-21-2006, 05:12 PM

The hack you need, is one to make the 4100 boot like a standard boot loader. That would allow any OS to be loaded. The std boot loader is on these models: 1100, 2200, and 4200.

I have a Willem Programmer, the new design. Plus the TSOP socket to fit the flashram used in the 2000. I still wan't to un-solder the 2nd flashram and read it. Just havn't got around to it yet.

blue72gem

03-22-2006, 01:23 AM

Here's the dump of the PIC 16c505 that I've taken.
Unfortunately I tought that this was the eeprom with BIOS, but it looks like that it's keeping the BIOS along with the OS in Intel's flash chip.
I'm going to dump that aswell, but since it's TSOP it requires a little more handy workaround and precision. Especialy to solder it back.
Look forward to see the 4100 flash dump soon, meanwhile here's the PIC dump if anyone might know what snap is keeping inside here.

blue72gem

03-22-2006, 01:26 AM

Here's the PIC dump...

blue68f100

03-22-2006, 10:42 AM

This is a Intel Hex format file. That is un-usually small. in size. The 29F800 are 4 meg chips. Did you read the whole chip. If you want to look at these use Hex Workshop. You will see : followed with a address type and key related to the data. I have utilities for stripping the Address header and checksum at the end. But I have NO clue what the hex code means.

blue72gem

03-22-2006, 11:40 AM

This is PIC code and not flash code!
I haven't dump the flash yet. PIC dump is ASM code that can be disassembled with dev tools for microcontrolers (www.microchip.com).
But I haven't got a clue what's used for in 4100, maybe some coder here would tell us from its disassembly.
As I told I haven't dump the flash yet... I don't have the knowledge nor the tools to decompile it or make a proper patch. I can only provide assistence for testing if someone [with a bit of free brain capacity] would try to make the LBA48 patch.

Davesworld

04-03-2006, 05:57 AM

This issue has been discussed ad nauseum and it has nothing to do with the bios but rather the fact that SnapOS in all forms does not have the bsd driver necessary to allow lba48 on the promise chip. The reason it DOES work on the 4000 is because that platform uses the native intel ide controllers and those drivers do support lba48 although they are much slower controllers. The reason this has never been fixed is simply lack of resources while trying to update other aspects of SnapOS, mainly support for newer Windows versions took priority over trying to reach terabyte capability. I'm not sure if you can get a post 1999 promise driver to compile on that version of bsd they used here. Nothing is impossible though. If only we could put a more modern nas os in place of it.

blue72gem

04-03-2006, 06:13 AM

Thank you for enlightment.
I guess we should look more into FreeNAS OS port to 4100 hardware.

esh

04-03-2006, 08:29 AM

OpenFiler would be good :-D

re3dyb0y

04-03-2006, 09:44 AM

http://www.openfiler.com/

Openfiler is a powerful, intuitive browser-based network storage software distribution. Openfiler delivers file-based Network Attached Storage and block-based Storage Area Networking in a single framework.

Openfiler sits atop of CentOS Linux (which is derived from sources freely provided to the public by a prominent North American Enterprise Linux vendor). It is distributed as a stand-alone Linux distribution. The entire software stack interfaces with third-party software that is all open source.

File-based networking protocols supported by Openfiler include: NFS, SMB/CIFS, HTTP/WebDAV and FTP. Network directories supported by Openfiler include NIS, LDAP (with support for SMB/CIFS encrypted passwords), Active Directory (in native and mixed modes) and Hesiod. Authentication protocols include Kerberos 5.

Openfiler includes support for volume-based partitioning, iSCSI (target and initiator), scheduled snapshots, resource quota, and a single unified interface for share management which makes allocating shares for various network file-system protocols a breeze.

Someone gonna buy me and david a 4100 to play with each?

Nah, im joking

Hmm, Cent OS based.....

Its gonna really have to be a unit we can have a screen on, i suppose, but then again, it doesnt..... But it would be easier

esh

04-03-2006, 10:03 AM

http://www.openfiler.com/

Someone gonna buy me and david a 4100 to play with each?

Nah, im joking

Hmm, Cent OS based.....

Its gonna really have to be a unit we can have a screen on, i suppose, but then again, it doesnt..... But it would be easier
If I had the money I would buy you one if you could do it. :drool:

I'd even loan my 4100 out if you wanted to screw with it.... Eventually I'll be building an openfiler box, would just be nice if the snap server could run it... but that may be asking too much from this little box.

Davesworld

04-03-2006, 06:32 PM

Anyone figured out what that ide style header is for next to the flash drive on a Snap4100?

blue68f100

04-03-2006, 08:28 PM

You got the same header on a 1000v1 & 1100. I know it you connect a IDE drive to it the 1100 will not boot. But it could be a SCSI port and not a IDE like I tried. But it may be like a snap tech told me on the 2000. They took some single board computer and customized them for there need. Killing off un necessary parts. Look for a SCSI controller???? Or send me a componet list and will will google them.

esh

04-03-2006, 10:06 PM

my guess is it is for some sort of daughter-board... which snap never had a need for.

Davesworld

04-08-2006, 06:00 PM

If an IDE drive keeps it from booting, I would guess that it overrides the bootable flash image. If this is true, one could install FreeNAS on a drive and see if it will allow the snap to boot up off of it. Too bad there isn't at least a serial port on these. It definitely is NOT scsi since that would be a 50 pin or 68 pin connector and a scsi controller chip would would be obvious on the mobo as are the promise controllers. It's probably a direct connection to the piix controller which likely also runs the Intel flash chip where SnapOS resides. BTW, I dl'ed the FreeNAS VMWare player image and set it up. The update notification page is sweet. I've already updated it twice from the gui after I installed it from the slightly older VMWare image. At version 0.65, it's already way ahead of SnapOS. The development cycle seems to be moving fast and there is no hardware on a snapserver that FreeNAS won't drive. It only uses about 16MB once installed so it will definitely fit on the flash image. Now, if only there was an easy way to get it to replace SnapOS. Sure, it's easier just to get a newer platform but why not get some new life out of these devices? They are plenty powerful enough to run large capacity raid volumes for just a small network. Newer drives may actually have less load on the cpu since IDE devices have become more cpu friendly with time, not less.

esh

04-08-2006, 09:27 PM

It only uses about 16MB once installed so it will definitely fit on the flash image. Now, if only there was an easy way to get it to replace SnapOS. Sure, it's easier just to get a newer platform but why not get some new life out of these devices? They are plenty powerful enough to run large capacity raid volumes for just a small network. Newer drives may actually have less load on the cpu since IDE devices have become more cpu friendly with time, not less.
That would be ideal, I'm really hoping for a replacement like that... and @ 16MB there would be a bit of room left over as well for future upgrades to the OS or custom apps to run.

Sure you can build your own platform for it, but I already have one of these... they are a nice form-factor and they are relatively cheap to come by (compared to building a new 1U box). I think there would be even more potential with something like freenas.

re3dyb0y

04-09-2006, 01:58 AM

We really need like one of the original design team so that we can find out how it was done

Or at least be able to read the drive in something to find out how its setup, becuse altering the bootloader could work... As it could quite easily be a special one

jontz

04-09-2006, 05:30 PM

Davesworld

04-10-2006, 06:59 PM

I just "offer" to take peoples old computers from them so they don't have to recycle them. It is amazing what people think is an old computer these days. Someone gave me an Athlon XP 1700+ the other day. Too "old" for them :) Sure makes for some nice computers laying around to put FreeNAS on though...

That's probably powerful enough to make a pvr out of with KnoppMyth. There's always something to be tested where you don't want to alter your current running workstation and having something extra, even as slow as 450mhz is useful to try things out such as an os you want to try. I may just grab an extra 4100 or 705N to play with. The worst case scenario is having to desolder the flash drive and set up a jig to allow you to write to it on a desktop pc. Hmm, wonder if that ide header is to hook to an ide controller on another computer and reflash it that way? They had to have made a way so they could easily get the boards from mfr, flash the os into them and have someone fire it up after the entire box was assembled. I'm also wondering if the 10/100 realtek chip is pin compatible with their faster stuff.

Davesworld

04-10-2006, 07:02 PM

jontz

04-10-2006, 08:39 PM

That's probably powerful enough to make a pvr out of with KnoppMyth. There's always something to be tested where you don't want to alter your current running workstation and having something extra, even as slow as 450mhz is useful to try things out such as an os you want to try. I may just grab an extra 4100 or 705N to play with. The worst case scenario is having to desolder the flash drive and set up a jig to allow you to write to it on a desktop pc. Hmm, wonder if that ide header is to hook to an ide controller on another computer and reflash it that way? They had to have made a way so they could easily get the boards from mfr, flash the os into them and have someone fire it up after the entire box was assembled. I'm also wondering if the 10/100 realtek chip is pin compatible with their faster stuff.

I've been wondering about the mysterious header myself. Perhaps it is a combination of your two suggestions. Maybe they had a drive that had a seperate OS on it, from which they could flash the OS onto the board. They plug the drive in, the machine boots from it, installs the OS, and bam...all done. I don't really want to torch my current 4100 either, but I am on the lookout for a secondary "experiment" 4100 as well. I would LOVE to get gigabit ethernet out of this machine...If I come up with anything I'll keep you all posted.

re3dyb0y

04-11-2006, 02:47 PM

Wow! You've been De-Poogled! Didn't know that was you.

Lol, it would confuse people

Hence why having it in my signature!

Eric Kirk

04-22-2006, 05:10 PM

esh

04-22-2006, 06:02 PM

so i have a Dell 705 which is really a snap 4100, i am trying to flash it with the new snap os 4.0.860 and i down load the software package but the Assist says that all 3 files in that package are not the corrcect files to patch this server, but i can use the release from dell and that will patch it. and i thought that this new patch allowoed 48 bit drives
o well i just found this thing in the rack last week and got it up and running. but i am trying to get it to do XP and 2k3 user/pass procteting and that is why i am trying to flash the thing
I doubt it will allow you to flash to the SnapOS... probably has checking to see if it is Dell's version or not.

Also you cannot get 48bit drives to run in the 4100.

blue68f100

04-22-2006, 06:32 PM

4.0.860 (patch) adds MS AD support ONLY. If you are moving up from v3 you need to install the full version 4.0.830 first.

LB48bit IS NOT SUPPORTED on the 4100. It has a hardware problem with the promise controllers. There is no way around this, believe me we have tried.

v4 requires slighly more overhead than v3. It is recomended that you have a minimum of 128 meg for better performance.

Davesworld

04-27-2006, 02:16 PM

so i have a Dell 705 which is really a snap 4100, i am trying to flash it with the new snap os 4.0.860 and i down load the software package but the Assist says that all 3 files in that package are not the corrcect files to patch this server, but i can use the release from dell and that will patch it. and i thought that this new patch allowoed 48 bit drives
o well i just found this thing in the rack last week and got it up and running. but i am trying to get it to do XP and 2k3 user/pass procteting and that is why i am trying to flash the thing

All you have to do is use the debug menu and unlock the bios and change it from oem mode, and lock the bios again after you put it in normal mode and it will take the snapos and for all intents and purposes is now a snap 4100 with a dell badge on it.

blue68f100

04-27-2006, 09:58 PM

Sounds interesting, BUT

What are you going to do to correct the bug in the promise controllers????? The original reason they were locked out. Now I agree that some of the newer models should have an updated chip without the problem. And Snap may have decided to keep it messed up to sell the newer models.

Another thing to consider. If you have a HD failure, and need to replace a drive. You may/will need to have a spare pre formatted drive from a 2200.

Davesworld

04-28-2006, 01:57 PM

The Promise controllers were not locked out, Snap simply didn't want to spend the extra man hours needed to upgrade the driver. The reason why it works in the 4000 is because those use the native Intel chipset ide controllers although the throughput is slower. The drivers for lba48 on promise chips came late and snapos is not exactly using a bleeding edge bsd kernel. As soon as I get a spare 4100, I'm going to see if I can get FreeNas onto the flash chip. Meanwhile, I can probe the 40 pin header to see what it is. I'm thinking that it connects to the flash drive from another computer and looks like a drive to it so a direct image write would make it easy for the mfrs to get it up and running since it is headless and has no terminal com port either.

re3dyb0y

04-29-2006, 03:27 AM

If you got FREENAS on it, it would open up a whole new world

blue68f100

04-29-2006, 07:39 AM

I have a programmer with the TSOP socket and flashram, if I can be of any help.

Man it would be nice to see FreeNAS, Or any other kernel in these units. FreeNas is about 1-2 betas off to getting the auto mounts working on reboot.

re3dyb0y

04-29-2006, 11:08 AM

Yeah, anything would really do

Especially if we can then port it to other Snap OS Units

As long as it is able to be configured externally, and then moved over, or be able to have a IP assigned by DHCP after copy, it doesn't really matter!

jsrudkin

05-02-2006, 04:31 AM

Hi, do you have another copy of the PIC dump file i am trying to unzip ip but it says it is corrupt, Thanks.

blue68f100

05-02-2006, 07:50 AM

I downloaded it again and didn't have any problem unziping it with winrar.

jsrudkin

05-02-2006, 07:57 AM

I downloaded it again and didn't have any problem unziping it with winrar.
Thanks for that it unzipped with no problems, Do you have a dump for the second chip yet?

re3dyb0y

05-03-2006, 04:41 AM

The currently dumped code is just the PIC code

Not the code from the flash chip

We are still waiting for someone to dump it for us!

Hence the Post

This is PIC code and not flash code!
I haven't dump the flash yet. PIC dump is ASM code that can be disassembled with dev tools for microcontrolers (www.microchip.com).
But I haven't got a clue what's used for in 4100, maybe some coder here would tell us from its disassembly.
As I told I haven't dump the flash yet... I don't have the knowledge nor the tools to decompile it or make a proper patch. I can only provide assistence for testing if someone [with a bit of free brain capacity] would try to make the LBA48 patch.

blue68f100

05-03-2006, 08:03 AM

I thought he mentioned that the flashram was soldered in.

jontz

05-04-2006, 09:51 AM

It is soldered in...makes things a little tougher.

Terry Kennedy

05-08-2006, 01:03 AM

The Promise controllers were not locked out, Snap simply didn't want to spend the extra man hours needed to upgrade the driver.Exactly. When I was negotiating with Snap Appliance to have them add LBA48 to the 4100, they first said that the Promise chips couldn't do LBA48. When I sent them the appnote, they said they'd discuss the project internally and get back to me. Ultimately, they decided to not quote it as they were concentrating on the newer GuardianOS models. Also, I suspect they didn't want to let the 4100 compete with the larger models. They had to do LBA48 for devices like the 1100 - who would buy a 120GB NAS these days?

flatchmo

05-17-2006, 01:20 AM

The Header on the circuit board of my 2000 there is what looks like and IDE header but is labeled ISP, usually refered to as In System Programing.
Right next to that header is a blank spot that looks like it might be used as a socket for a DOC, Disckonchip.

blue68f100

05-17-2006, 08:00 AM

The v1 board does not have the ISP header. But it has space for a SCSI controller and header. The ISP header is on the 1100 board though.

jaylweb

02-28-2007, 05:52 PM

My 4100 has the IDE header. It shows pin 1 and pin 2 and doesn't say ISP anywhere near it. It does look as though some of the tracings lead from the flash to this header. I tried to use a USB/IDE adapter but my laptop never recognized anything. I did the hard drive bit too, but like an earlier post stated, the system just wouldn't boot.

I do wonder if an IDE Flash Module would work.
http://ec.transcendusa.com/product/product_memory.asp?chtype=IDE%20Flash%20Modules&Cid=59&indexnum=9

Phoenix32

02-28-2007, 07:52 PM

Harbinger

05-07-2007, 09:57 AM

Anyone want to try this to dump the flash chip?

http://www.uchobby.com/index.php/2007/05/05/read-embedded-flash-chips/

According to the article, all you'd need is a smartmedia reader, not a fancy chip programmer.

meister_sd

01-06-2008, 09:17 AM

Are people still needing this flash dumped? There is only one chip to work with on this board.

blue68f100

01-06-2008, 10:22 AM

NO, It's a dead OS, so we have started moving to Guardian OS units.

I had done some research and found out that there is not enough room to enable LBA48bit. The only way it could work would to convert it to a std boot loader. Too much work, and I know of no one who has the knowledge to reverse engineer the OS.

jaylweb

01-10-2008, 08:38 AM

Too bad GuardianOS won't run on these 4100 units. Any ideas on the size of the flash?

I have a 160Gb 4100 that I plan on upgrading with some new 160Gb drives. I just wish it would see past the 137Gb limit, but oh well.....it's still a heck of an upgrade. :D Once I do this, I can use S2S to fully mirror my 480GB 4100 to this one. :drool: