Lucent silver to gold - Page 11

Corvette_Lee · 04-26-2004

Quote:

Originally Posted by McHale

hey... where's the AGERE firmware at?

I upgraded my drivers using the Agere client manager and card drivers.

it reports my 7.82 FW card as 9.42 variant 2.

wierd...

My firmware updater from Proxim (die! die! die! die!) no longer runs (as I'm no longer using the drivers for it).

So... where's the latest Agere FW for these cards? I can't find it on their website.

-Mc

the firmware of agere stay with driver, in agere client manager have additional access point mode.

no more work WSU.

Lee

Corvette_Lee · 04-26-2004

Quote:

Originally Posted by lincomatic

Yes, but you're assuming that the f/w is different between gold and silver cards. Since the silvers can act like golds w/ just a simple PDA change, and since the WSU tool can update both gold & silver, I'm assuming that the f/w will be identical between them, and that a PDA hack is the only way to do it.

Can someone pls dump the PDA of a silver card that's been unlocked via the Airport method? I used to have one but I accidentally upgraded it w/ the WSU too, and thus, it's back to silver functionality, so I can't check if the Airport changed the PDA.

I have a RG-1000, how change for Apple Airport ? I can change and test it.

Lee

McHale · 04-26-2004

no. The PDA identifies key things about your card such as channels, serial number, MAC, vendor ID, etc.

When you do a FW upgrade with the official firmware updater, it gets that info from the PDA and feeds it into the FW file then writes it.

If you yanked your FW from your gold card and I flashed it onto mine, I would have your MAC and serial number.

SO...

regardless of PDA, you can have 14 channels and 128 bit WEP even though the PDA says otherwise. This is how the Apple Airport works. If grabs your serial and MAC but ignores the rest and merely updates the firmware.

If you took the 10872.HEX file (your cards' actual station firmware) and made changes to it and wrote it back, you would get 14 channels and 128 bit wep. If you decided to use the windows updater after that, you would lose those changes and it would use your PDA to determine everything.

If someone wouldn't mind putting your old PDA on your card and flashing with the latest FW than adding 128 bit WEP and 14 channels and flashing with the same FW, we will know what the changes are we need to make.

-Mc

Quote:

Originally Posted by lincomatic

Yes, but you're assuming that the f/w is different between gold and silver cards. Since the silvers can act like golds w/ just a simple PDA change, and since the WSU tool can update both gold & silver, I'm assuming that the f/w will be identical between them, and that a PDA hack is the only way to do it.

Can someone pls dump the PDA of a silver card that's been unlocked via the Airport method? I used to have one but I accidentally upgraded it w/ the WSU too, and thus, it's back to silver functionality, so I can't check if the Airport changed the PDA.

lincomatic · 04-26-2004

Quote:

Originally Posted by Corvette_Lee

I have a RG-1000, how change for Apple Airport ? I can change and test it.

Lee

here is how to upgrade to 128-bit WEP using an apple.

Orinoco Silver upgrade to WEP 128

you use an apple computer, not AP.

Corvette_Lee · 04-26-2004

Quote:

Originally Posted by lincomatic

here is how to upgrade to 128-bit WEP using an apple.

Orinoco Silver upgrade to WEP 128

you use an apple computer, not AP.

ah ok, I not have apple computer.. and if only work with this WSU not good.. best change PDA..

my problem is how change primary firmware for 4.02 or 4.04.. I have more of 300 cards.. and 90% have primary firmware 3.00 and 4.00.

I write orinoco.pda for a card enterasys.. in client manager continued how Enterasys. I need change CIS..

Lee

McHale · 04-26-2004

OK, here's the latest.

I ripped the firmware from my real 13 channel gold card. Using the flash.exe util, I attempted to write it to my bronze card (all my cards are 4.00 primary) and it wouldn't take.

So it appears that for some reason, flash.exe can't write the PDA or FW to a 4.00 card.

THEY STILL CAN BE WRITTEN, just not by this utility.

so, for 4.00, it looks as if the only solution is to hack the Proxim (die! die! die! die!) FW update utility.

Anyone good at disassembling?

-Mc

dda · 04-26-2004

Quote:

Originally Posted by lincomatic

Can someone pls dump the PDA of a silver card that's been unlocked via the Airport method? I used to have one but I accidentally upgraded it w/ the WSU too, and thus, it's back to silver functionality, so I can't check if the Airport changed the PDA.

If the WSU changed it back to a Silver card, then the PDA wasn't updated; read through this thread for a better explanation, but in summary, the PDA is copied into the firmware that is written to the card; if the hack fixed up the PDA, it would always be seen as a Gold card thereafter.

I believe that internally, the cards are identical; the only difference is the PDA data that tells the card what limitations it has; my card now uses 14 channels and does 128bit encryption.

Agere drivers are at http://www.agere.com/support/drivers along with the CM to go with them. If you have Windows XP, I'm told the card will now do WPA-PSK which kind of makes the whole WEP thing obsolete.

McHale · 04-26-2004

he used an Apple to update it. It doesn't change the PDA, just the FW.

With the 4.00 primary, as of now it looks like there is no way to change the PDA.

The only solution for us is to modify the FW Update utility. The driver loads a FW into memory from the card. After that it is strictly in memory. So if we can load the FW from a file instead of the card, we're in.

Otherwise, we need to change the executable of the updater itself. I've been working on that for a couple days now and nothing.

I found the key differences in the hex files of the FW but have no way to write that back to the card as only Intersil works with hex files directly...

-Mc

Corvette_Lee · 04-26-2004

Quote:

Originally Posted by McHale

he used an Apple to update it. It doesn't change the PDA, just the FW.

With the 4.00 primary, as of now it looks like there is no way to change the PDA.

The only solution for us is to modify the FW Update utility. The driver loads a FW into memory from the card. After that it is strictly in memory. So if we can load the FW from a file instead of the card, we're in.

Otherwise, we need to change the executable of the updater itself. I've been working on that for a couple days now and nothing.

I found the key differences in the hex files of the FW but have no way to write that back to the card as only Intersil works with hex files directly...

-Mc

shell this card and buy enterasys.. this card Enterasys come primary firmware 4.02 or 4.04.. in ebay $20 + S&H... and use agere driver..

Lee

lincomatic · 04-26-2004

Quote:

Originally Posted by Corvette_Lee

You can check in Client Manager -> Help -> Version Info -> Primary Funtions firmware Variant x, Version x.xx

Primary firmware 4.00 can't write PDA
Primary firmware 4.02 OK
Primary firmware 4.04 OK

Hardware Version 5.0 can't read PDA

Lee

My silver card whose PDA is unwritable has Primary FW 4.04 and Card 4.00.
On the other hand, my gold card, whose PDA is writable has Primary FW 4.04 and Card 4.02.
So I think the problem is Card version 4.00, not Primary FW 4.00.
Does anyone else see what I'm seeing?

McHale · 04-26-2004

you may be right. BOTH of mine are 4.0 so I can at least say I have the same problem...

But I'll be damned if I'm going to buy ANOTHER card just for the novelty of having 14 channels! If you're using this card for stumbling, you don't need WEP. If you're connecting to AP's illegally, you can only do it if they don't have WEP enabled. What's the point?

It's easier to modify an Intersil card. Proxim is evil! evil! evil!

There's a way, someone will find it... It's just a simple hack. It's been done before...

-Mc

lincomatic · 04-26-2004

some more info: I ran flash -5v -s on my silver w/ 8.10 firmware and it says the firmware is S1081000.HEX. My gold card, which also has 8.10 firmware loaded also says S1081000.HEX. Looking into WSU810, it has the following strings: P104000.HEX and S10810000.HEX. Therefore, I'm still not convinced that the firmware is different between silver and gold. My guess is that the firmware is identical, and that there are other bits, either in the PDA (as we've seen) or alternatively in some unknown flash mem address which enable the 128-bit WEP behavior (this would explain why cards updated via Apple would have 128-bit support w/o PDA changes).

gwang · 04-26-2004

I've attached my version information, note that BOTH my Card version AND Primary Firmware version is 4.00. I have the MIDDLE Lucent Orinoco card with the blue label.... I am starting to think all of these middle cards (of the 3) are all version 4.00 and hence currently not upgradable... I can read the PDA info, but all attempts to WRITE to it will fail with an error, both intersel's flash version 0.3 and 0.5b do this.... I have heard back from Andy Hakman and he is looking into this right now....
-----

Quote:

Originally Posted by dda

Of the three cards pictured earlier, I have the right-most one (the purple card) and was able to upgrade it to Gold. I have the Primary Firmware of 4.04, here is a screen shot of the Versions. Note that I am using the latest drivers from Agere as I was trying, unsuccessfully, to get WPA-PSK to work.

gwang · 04-26-2004

Well if what lincomatic is saying is true... and it seems like it, then since this is not a "firmware" that can't be changed and is inherent to the hardware version of the card, we can't use the theory that if someone could figure out how to "upgrade" to version 4.02 or 4.04... Because I would think the "Card Version" will always stay fixed at version 4.00

I have to agree that the key to all this LIES IN the FLASH EPROM area (PDA or elsewhere) AND NOT THE ACTUAL FIRMWARE... I know I read somewhere else on the internet that there was yet ANOTHER way to upgrade the cards by plugging the silvers into some Orinoco AP series access point which would cause a BIT to be changed thereby enabling 128bit encryption... It said nothing about the firmware being changed, but rather a flag/bit in the flash area being changed... I think that's what we are seeing here with this flash hack that's posted here... HOWEVER the problem is WHY Card version 4.00 is giving the error 322....

Here's a thought... Have you guys heard about the XBOX IDE hard drives that are also compatible for use with PCs but ONLY if they are "unlocked" using a special password unlock procedure that must be done on the original XBOX that the drive comes out of. If you dont have access to the original XBOX there is no way to unlock it because there is a unique password/key associated with the drive, its actually part of the ATA IDE spec... I dont think these cards are using this kind of "password" protection but is it a possible analogy?

Quote:

Originally Posted by lincomatic

My silver card whose PDA is unwritable has Primary FW 4.04 and Card 4.00.
On the other hand, my gold card, whose PDA is writable has Primary FW 4.04 and Card 4.02.
So I think the problem is Card version 4.00, not Primary FW 4.00.
Does anyone else see what I'm seeing?

Corvette_Lee · 04-26-2004

Lucent Orinoco Silver card
hardware 4.0
Primary firmware 4.04

04-26-2004	#162 (permalink)
lincomatic Squaaawk! WiFi! WiFi! Join Date: Apr 2002 Location: Tinsel Town Posts: 1,682	some more info: I ran flash -5v -s on my silver w/ 8.10 firmware and it says the firmware is S1081000.HEX. My gold card, which also has 8.10 firmware loaded also says S1081000.HEX. Looking into WSU810, it has the following strings: P104000.HEX and S10810000.HEX. Therefore, I'm still not convinced that the firmware is different between silver and gold. My guess is that the firmware is identical, and that there are other bits, either in the PDA (as we've seen) or alternatively in some unknown flash mem address which enable the 128-bit WEP behavior (this would explain why cards updated via Apple would have 128-bit support w/o PDA changes). __________________ ~lincomatic

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

04-26-2004	#156 (permalink)
McHale approved for all ages... Join Date: Apr 2002 Location: BFE Illinois Posts: 262	OK, here's the latest. I ripped the firmware from my real 13 channel gold card. Using the flash.exe util, I attempted to write it to my bronze card (all my cards are 4.00 primary) and it wouldn't take. So it appears that for some reason, flash.exe can't write the PDA or FW to a 4.00 card. THEY STILL CAN BE WRITTEN, just not by this utility. so, for 4.00, it looks as if the only solution is to hack the Proxim (die! die! die! die!) FW update utility. Anyone good at disassembling? -Mc

04-26-2004	#158 (permalink)
McHale approved for all ages... Join Date: Apr 2002 Location: BFE Illinois Posts: 262	he used an Apple to update it. It doesn't change the PDA, just the FW. With the 4.00 primary, as of now it looks like there is no way to change the PDA. The only solution for us is to modify the FW Update utility. The driver loads a FW into memory from the card. After that it is strictly in memory. So if we can load the FW from a file instead of the card, we're in. Otherwise, we need to change the executable of the updater itself. I've been working on that for a couple days now and nothing. I found the key differences in the hex files of the FW but have no way to write that back to the card as only Intersil works with hex files directly... -Mc

04-26-2004	#161 (permalink)
McHale approved for all ages... Join Date: Apr 2002 Location: BFE Illinois Posts: 262	you may be right. BOTH of mine are 4.0 so I can at least say I have the same problem... But I'll be damned if I'm going to buy ANOTHER card just for the novelty of having 14 channels! If you're using this card for stumbling, you don't need WEP. If you're connecting to AP's illegally, you can only do it if they don't have WEP enabled. What's the point? It's easier to modify an Intersil card. Proxim is evil! evil! evil! There's a way, someone will find it... It's just a simple hack. It's been done before... -Mc