Difference between revisions of "Modes"

From freemyipod.org
Jump to: navigation, search
(Crafting a DFU util for the Nanos)
(Crafting a DFU util for the Nanos)
Line 39: Line 39:
  
 
===Crafting a DFU util for the Nanos===
 
===Crafting a DFU util for the Nanos===
While in DFU mode, you should be able to read and write the iPod's firmware. The most promising DFU utility out there is the modified dfu-util by planetbeing in the xpwn repositiory. This is a modified version of OpenMoko's original. It can be used with the iPod Touch and the iPhone. Those and the iPod Nanos most likely use similar protocols, so it might work right away or with little modification. This is probably most compatible with the 4G Nano. As stated by [https://mail.gna.org/public/linux4nano-dev/2009-04/msg00010.html this] mailing list post, there is also another DFU utility for the Meizu player in the Rockbox SVN repo. The Meizu uses a 8700 series processor, just like the older Nanos do. We could use a USB sniffer on a Windows machine and examine the protocol. Using our knowledge of the iPod Nano's DFU protocol, we could make any necessary changes to the Meizu DFU util and be able to use it with the Nanos.
+
While in DFU mode, you should be able to read and write the iPod's firmware. The most promising DFU utility out there is the [http://github.com/planetbeing/xpwn/tree/master modified dfu-util] by planetbeing in the xpwn repositiory. This is a modified version of OpenMoko's original. It can be used with the iPod Touch and the iPhone. Those and the iPod Nanos most likely use similar protocols, so it might work right away or with little modification. This is probably most compatible with the 4G Nano. As stated by [https://mail.gna.org/public/linux4nano-dev/2009-04/msg00010.html this] mailing list post, there is also another DFU utility for the Meizu player in the Rockbox SVN repo. The Meizu uses a 8700 series processor, just like the older Nanos do. We could use a USB sniffer on a Windows machine and examine the protocol. Using our knowledge of the iPod Nano's DFU protocol, we could make any necessary changes to the Meizu DFU util and be able to use it with the Nanos.
 +
 
 
Cmwslw has already set up a Windows virtual box and gotten a sniffer up an running, but he has not yet tried running iTunes with an iPod in DFU mode.
 
Cmwslw has already set up a Windows virtual box and gotten a sniffer up an running, but he has not yet tried running iTunes with an iPod in DFU mode.
  

Revision as of 14:30, 6 May 2009

Nanos have special modes that they can boot into called disk mode, DFU mode, and debug mode.

Disk mode

Disk mode has existed ever since the iPod has existed. Disk mode is stored in the 1MB NOR auxillary flash (along with the bootloader), so this is pretty much always there, no matter what sort of tampering you have done. Disk mode basically makes the iPod behave as a massive storage device, allowing the computer to directly read and write the data flash chip. For more information on how to enter Disk mode (or Reboot), refer to the Key Combination page from iPodLinux Wiki.

Diskmode.jpg

(iPodLinux project)

DFU mode

DFU (Device Firmware Upgrade) mode is a relatively new standard for upgrading firmware that is used in many devices like the OpenMoko and the newer iPods. DFU mode (since nano 3G) is probably contained in the on-processor's bootrom. Newer iPods have both DFU mode and disk mode, while iPod Touch and iPhones have exclusively DFU mode. It is worth noting that DFU mode was implemented at the exact time that Apple switched from PortalPlayer to Samsung processors, and also exactly when the firmware was encrypted. There could be a relationship.

The nano 2G also has a DFU mode, but that one is probably booted of the NOR flash instead of mask ROM, and doesn't seem to have anything in common with the newer DFU modes. It is not yet found out how to communicate with a Nano 2G in DFU mode, not even iTunes can do that.

Getting DFU mode on 3G/4G

  1. Make sure your iPod is turned on and connected to your computer.
    N4G DFU.png
  2. Press the menu button and select (central) button simultaneously.
  3. The iPod's screen will go black, and the Apple logo will shortly appear.
  4. Keep on pressing till the Apple logo turns into a black screen. This is about 10 seconds.
  5. Release the menu and select buttons.

You should see this device on you usb listing (lsusb):

Bus XXX Device YYY: ID 05ac:1224 Apple, Inc.  (for 3G)
Bus XXX Device YYY: ID 05ac:1225 Apple, Inc.  (for 4G)

The product ID depends on whether the iPod is in DFU mode or not. For example, when a 4G Nano is not in DFU mode, lsusb returns:

Bus XXX Device YYY: ID 05ac:1263 Apple, Inc.
*example for 3G needed*

05ac is the vendor ID (apple), and the number after the colon is the Product ID. It might be worth finding out whether different firmwares return different product IDs in DFU or normal mode.

To the right is an image of the 4G's DFU specifications. The DFU seems to be version 1.1 based on USB's spec documents (see below links). We need more devices! Email on mailing list if you can help!

The 4G Nano's .ipsw file has a file named N58s.bootloader.release.rb3, and it is possible that this file is used for DFU mode.

Crafting a DFU util for the Nanos

While in DFU mode, you should be able to read and write the iPod's firmware. The most promising DFU utility out there is the modified dfu-util by planetbeing in the xpwn repositiory. This is a modified version of OpenMoko's original. It can be used with the iPod Touch and the iPhone. Those and the iPod Nanos most likely use similar protocols, so it might work right away or with little modification. This is probably most compatible with the 4G Nano. As stated by this mailing list post, there is also another DFU utility for the Meizu player in the Rockbox SVN repo. The Meizu uses a 8700 series processor, just like the older Nanos do. We could use a USB sniffer on a Windows machine and examine the protocol. Using our knowledge of the iPod Nano's DFU protocol, we could make any necessary changes to the Meizu DFU util and be able to use it with the Nanos.

Cmwslw has already set up a Windows virtual box and gotten a sniffer up an running, but he has not yet tried running iTunes with an iPod in DFU mode.

Debug (diagnostics) mode

This mode will give quite a lot of info about your iPod. Except for the very first iPods, it can be accessed by holding center and rewind when the apple logo appears during reboot.

Helpful pages

http://www.ipodlinux.org/wiki/Key_Combinations

http://daniel.haxx.se/blog/2008/09/03/dfu-mode-on-2nd-gen-nanos/

http://www.usb.org/developers/devclass_docs/DFU_1.1.pdf

http://www.usb.org/developers/devclass_docs/usbdfu10.pdf