NetStumbler.org Forums

Go Back   NetStumbler.org Forums > WiFi Forums > Hardware
Register Search Today's Posts Mark Forums Read

Reply
 
LinkBack Thread Tools Display Modes
Old 04-26-2004   #166 (permalink)
Corvette_Lee
Registered Member
 
Corvette_Lee's Avatar
 
Join Date: Oct 2003
Location: Paraguay
Posts: 26
hack silver to gold -14 channels - domain

before change domain and after change domain

in my AP-2000 and Client Manager
Attached Images
File Type: gif Hack-14-canais-e-Gold.gif (63.8 KB, 84 views)
File Type: gif Hack-14-canais-Japan.gif (29.0 KB, 63 views)
Corvette_Lee is offline   Reply With Quote
Old 04-26-2004   #167 (permalink)
McHale
approved for all ages...
 
McHale's Avatar
 
Join Date: Apr 2002
Location: BFE Illinois
Posts: 262
no no no no...

The PDA contains specific info about your card:

MAC

SERIAL

VENDOR ID

64 or 128 bit wep

other useless info...

When you run the utility to update your firmware, it yanks all that info from the PDA, plugs it in to the blank/generic FW and flashes it to the card MADLIBS style. Ever notice how the same FW upgrade utility works on any card regardless of country of origin? My 11 channel cards and 13 channel cards use the same utility and end up being the same when they are done. That's because of generic FW and filling in the info from the PDA.

When your driver loads your card, it reads from the FW and not the PDA then loads it into memory. You can load a different FW into memory and bypass reading from the card at all if you want to. You just need to get a valid FW file into memory. It doesn't matter where it comes from.

You can change just the FW and not the PDA and get the same results. This is how the Apple does it.

I have already changed a card from 11 to 14 channels, changed the MAC and serial by editing only the FW and flashing it back. I didn't touch the PDA.

The FW between silver/gold/bronze are all identical except specifics about each card that makes them unique.

Lincomatic isn't correct. The FW between the cards are not identical for the reasons I explained above. And it's irrelevant anyway. All we need to do is change the FW and not the PDA to get 14 channels and 128 bit WEP. Forget the PDA on the 4.00 cards for now. We're trying to use a tool designed for a completely different chipset. Of course it's not going to work all the time.

-Mc
McHale is offline   Reply With Quote
Old 04-26-2004   #168 (permalink)
lincomatic
Squaaawk! WiFi! WiFi!
 
lincomatic's Avatar
 
Join Date: Apr 2002
Location: Tinsel Town
Posts: 1,682
Quote:
Originally Posted by Corvette_Lee
Lucent Orinoco Silver card
hardware 4.0
Primary firmware 4.04
ok this card is identical to mine. i followed your instructions and still got error 322. can you tell me what PCMCIA controller you used (including [VID,PID])?
thanks.
__________________
~lincomatic
lincomatic is offline   Reply With Quote
Old 04-26-2004   #169 (permalink)
lincomatic
Squaaawk! WiFi! WiFi!
 
lincomatic's Avatar
 
Join Date: Apr 2002
Location: Tinsel Town
Posts: 1,682
ok, i'm assuming that you got this info from doc's or someone who knows the inside scoop. so... i have some more questions

1) can't we just dump the f/w from a gold card and then write it to a silver card instead of doing before/after on the silver card? (i know this is currently moot since the firmware writing fails)
2) when you do flash -5v -fd, it dumps the whole flash, doesn't it? what is the address range of the bytes for the station f/w?
3) since the wllucxx.sys windows driver contains station and tertiary firmware, do you think maybe we could try to jam the f/w into the driver instead?

Quote:
Originally Posted by McHale
no no no no...

The PDA contains specific info about your card:

MAC

SERIAL

VENDOR ID

64 or 128 bit wep

other useless info...

When you run the utility to update your firmware, it yanks all that info from the PDA, plugs it in to the blank/generic FW and flashes it to the card MADLIBS style. Ever notice how the same FW upgrade utility works on any card regardless of country of origin? My 11 channel cards and 13 channel cards use the same utility and end up being the same when they are done. That's because of generic FW and filling in the info from the PDA.

When your driver loads your card, it reads from the FW and not the PDA then loads it into memory. You can load a different FW into memory and bypass reading from the card at all if you want to. You just need to get a valid FW file into memory. It doesn't matter where it comes from.

You can change just the FW and not the PDA and get the same results. This is how the Apple does it.

I have already changed a card from 11 to 14 channels, changed the MAC and serial by editing only the FW and flashing it back. I didn't touch the PDA.

The FW between silver/gold/bronze are all identical except specifics about each card that makes them unique.

Lincomatic isn't correct. The FW between the cards are not identical for the reasons I explained above. And it's irrelevant anyway. All we need to do is change the FW and not the PDA to get 14 channels and 128 bit WEP. Forget the PDA on the 4.00 cards for now. We're trying to use a tool designed for a completely different chipset. Of course it's not going to work all the time.

-Mc
__________________
~lincomatic
lincomatic is offline   Reply With Quote
Old 04-26-2004   #170 (permalink)
Corvette_Lee
Registered Member
 
Corvette_Lee's Avatar
 
Join Date: Oct 2003
Location: Paraguay
Posts: 26
Thumbs up

Quote:
Originally Posted by lincomatic
ok this card is identical to mine. i followed your instructions and still got error 322. can you tell me what PCMCIA controller you used (including [VID,PID])?
thanks.
the secret not stay in adapter... I use diverse adapter pci and isa..

the secret is in command

flash -5v -pd card.pda
edit card.pda
flash -5v -on
flash -5v -g -p card.pda

or in the adapters that do not recognize

flash -5v -legacy -pd card.pda
edit card.pda
flash -5v -legacy -on
flash -5v -legacy -g -p card.pda

good luck
Lee
Corvette_Lee is offline   Reply With Quote
Old 04-27-2004   #171 (permalink)
lincomatic
Squaaawk! WiFi! WiFi!
 
lincomatic's Avatar
 
Join Date: Apr 2002
Location: Tinsel Town
Posts: 1,682
thanks, but it didn't work for me
i'm using flash 0.5e

Quote:
Originally Posted by Corvette_Lee
the secret not stay in adapter... I use diverse adapter pci and isa..

the secret is in command

flash -5v -pd card.pda
edit card.pda
flash -5v -on
flash -5v -g -p card.pda

or in the adapters that do not recognize

flash -5v -legacy -pd card.pda
edit card.pda
flash -5v -legacy -on
flash -5v -legacy -g -p card.pda

good luck
Lee
__________________
~lincomatic
lincomatic is offline   Reply With Quote
Old 04-27-2004   #172 (permalink)
lincomatic
Squaaawk! WiFi! WiFi!
 
lincomatic's Avatar
 
Join Date: Apr 2002
Location: Tinsel Town
Posts: 1,682
Quote:
Originally Posted by lincomatic
thanks, but it didn't work for me
i'm using flash 0.5e
my controller seems ok because i can write the PDA to my orinoco gold and ibm gold...just not the %#$# orinoco silver

mchale: how did you attempt to write the firmware back to the card? i tried
"flash -5v -d silver.hex" (silver.hex was created using "flash -5v -fd silver.hex") but it complains the 1st character of the file is invalid.
__________________
~lincomatic
lincomatic is offline   Reply With Quote
Old 04-27-2004   #173 (permalink)
Corvette_Lee
Registered Member
 
Corvette_Lee's Avatar
 
Join Date: Oct 2003
Location: Paraguay
Posts: 26
Quote:
Originally Posted by McHale
no no no no...

The PDA contains specific info about your card:

MAC

SERIAL

VENDOR ID

64 or 128 bit wep

other useless info...

When you run the utility to update your firmware, it yanks all that info from the PDA, plugs it in to the blank/generic FW and flashes it to the card MADLIBS style. Ever notice how the same FW upgrade utility works on any card regardless of country of origin? My 11 channel cards and 13 channel cards use the same utility and end up being the same when they are done. That's because of generic FW and filling in the info from the PDA.

When your driver loads your card, it reads from the FW and not the PDA then loads it into memory. You can load a different FW into memory and bypass reading from the card at all if you want to. You just need to get a valid FW file into memory. It doesn't matter where it comes from.

You can change just the FW and not the PDA and get the same results. This is how the Apple does it.

I have already changed a card from 11 to 14 channels, changed the MAC and serial by editing only the FW and flashing it back. I didn't touch the PDA.

The FW between silver/gold/bronze are all identical except specifics about each card that makes them unique.

Lincomatic isn't correct. The FW between the cards are not identical for the reasons I explained above. And it's irrelevant anyway. All we need to do is change the FW and not the PDA to get 14 channels and 128 bit WEP. Forget the PDA on the 4.00 cards for now. We're trying to use a tool designed for a completely different chipset. Of course it's not going to work all the time.

-Mc
in you mode the problem is if I use in Access Point with the cards.. why in Access Point read PDA and upload tertiary firmware in card RAM ..

Lee
Corvette_Lee is offline   Reply With Quote
Old 04-27-2004   #174 (permalink)
cyberdiamond
Registered Member
 
Join Date: Sep 2003
Location: South Australia
Posts: 24
Quote:
Originally Posted by Corvette_Lee
in you mode the problem is if I use in Access Point with the cards.. why in Access Point read PDA and upload tertiary firmware in card RAM ..

Lee
I have the same problem I need to use the cards in an Avaya RG-1
cyberdiamond is offline   Reply With Quote
Old 04-27-2004   #175 (permalink)
lincomatic
Squaaawk! WiFi! WiFi!
 
lincomatic's Avatar
 
Join Date: Apr 2002
Location: Tinsel Town
Posts: 1,682
just some more info. i decided to do something really crazy. i downloaded the winupdate utility as described here:

http://linux.junsun.net/intersil-prism/

then installed linksys wpc11 v2.5 drivers and used winupdate to dump the pda and firmware to disk. when i tried to use winupdate to write the pda/firmware back all it did was completely hang my XP system.

luckily, the card is still ok.
__________________
~lincomatic
lincomatic is offline   Reply With Quote
Old 04-27-2004   #176 (permalink)
McHale
approved for all ages...
 
McHale's Avatar
 
Join Date: Apr 2002
Location: BFE Illinois
Posts: 262
1. yes. That's what I attempted. Will it work. Yes... if we can find a way to write it.

2. no idea...

3. yes. that's what I'm working on now. Instead of having it query the card for the FW, just force it from a file or a loader... You would then only have to change the values in the file vefore you inserted the card and change the file when you change the card.

I got the same error as you when trying to load the FW back. I blame the fact we are using an intersil util on a hermes card.

I'm working on the driver now. I'm still not certain about that old hack we read about where you load the changed driver and load a FW. That's what I'm attempting to do on my own but haven't gotten that far yet. It's a shame that nobody got that thing to work.

-Mc

Quote:
Originally Posted by lincomatic
1) can't we just dump the f/w from a gold card and then write it to a silver card instead of doing before/after on the silver card? (i know this is currently moot since the firmware writing fails)
2) when you do flash -5v -fd, it dumps the whole flash, doesn't it? what is the address range of the bytes for the station f/w?
3) since the wlluecxx.sys windows driver contains station and tertiary firmware, do you think maybe we could try to jam the f/w into the driver instead?

how did you attempt to write the firmware back to the card? i tried
"flash -5v -d silver.hex" (silver.hex was created using "flash -5v -fd silver.hex") but it complains the 1st character of the file is invalid.
McHale is offline   Reply With Quote
Old 04-27-2004   #177 (permalink)
McHale
approved for all ages...
 
McHale's Avatar
 
Join Date: Apr 2002
Location: BFE Illinois
Posts: 262
Hey Linc, because I love to beat a dead horse...

What version of this did you check? I tried the XP version and it didn't work. I'm assuming you did the same. Did you check or try the 98 version?

Also, is anyone using the OLD drivers that allow promiscuous mode? If so, lemme know so I don't have to install them just to get a file out of it... If we are going to have to patch the drivers, let's at least add this back...

-Mc

Quote:
Originally Posted by lincomatic
OK, let's put this one to bed now. I've communicated with several others who say it hasn't worked for them either.
I've done some analysis, and contrary to the claims, the windows-based hack DOES NOT contain modified drivers. I diffed the files w/ the originals from ORiNOCO, and here is what i found:

drivers (winter 2002 7.4 release):
all the files are identical except for the INF's. the INF in the "hacked" version merely removes all references to cards other than the ORiNOCO silver (Lucent_Technologies-WaveLAN/IEEE-C908)

firmware updater (8.10 f/w):
again, the only difference is that references to the non-silver cards have been removed. The silver card's string has been moved to the front of the list, and the others are all filled w/ zeros.

I seriously doubt that this hack works at all. The only thing they've done is make the drivers & firmware updater work only w/ the silver card.

BTW, as has been discussed before in other threads, for anyone who wants to run the Lucent ORiNOCO f/w updater w/ non-Lucent branded cards, cards, all you have to do is:
1) via the device manager, override the driver you have installed w/ the ORiNOCO-branded drivers
2) use a binary editor and insert the proper string for your non-Lucent-branded card. Just search for the string
"Lucent_Technologies-WaveLAN/IEEE-911F" and replace it w/ the proper one for your card and terminate it with a NULL. Then run the updater. This will work w/ any version of the firmware updater.
McHale is offline   Reply With Quote
Old 04-27-2004   #178 (permalink)
lincomatic
Squaaawk! WiFi! WiFi!
 
lincomatic's Avatar
 
Join Date: Apr 2002
Location: Tinsel Town
Posts: 1,682
I tried XP again for just for the hell of it last nite. Don't remember if I tried 98 last year. Want to give it a shot?

I wonder if anyone's gotten the Linux version working. It's so time consuming to download/install/configure the drivers that I've been avoiding it so far.

Maybe I'll try winupdate on 98 tonite.

Man I don't know why I'm so obsessed w/ this. I don't even really need to do it anymore because i have a whole stack of Gold cards I bought cheap and only 1 Silver which I messed up after the Airport slot hack bec I ran the WSU on by mistake ... maybe it's just that I have an urge to do whatever I'm not supposed to do...

Quote:
Originally Posted by McHale
Hey Linc, because I love to beat a dead horse...

What version of this did you check? I tried the XP version and it didn't work. I'm assuming you did the same. Did you check or try the 98 version?

Also, is anyone using the OLD drivers that allow promiscuous mode? If so, lemme know so I don't have to install them just to get a file out of it... If we are going to have to patch the drivers, let's at least add this back...

-Mc
__________________
~lincomatic
lincomatic is offline   Reply With Quote
Old 04-27-2004   #179 (permalink)
peekitty
Macaca
 
peekitty's Avatar
 
Join Date: Sep 2002
Location: S. Florida
Posts: 1,056
Speaking of dead horses, I wonder if the results of the flashing process would be any different under various versions of DOS (Dr DOS, PC-DOS, etc.) As if there aren't enough varibles already...
peekitty is offline   Reply With Quote
Old 04-27-2004   #180 (permalink)
lincomatic
Squaaawk! WiFi! WiFi!
 
lincomatic's Avatar
 
Join Date: Apr 2002
Location: Tinsel Town
Posts: 1,682
i don't think the DOS version will matter since it's probably just doing direct port I/O instead of using DOScalls to talk to the controller

Quote:
Originally Posted by peekitty
Speaking of dead horses, I wonder if the results of the flashing process would be any different under various versions of DOS (Dr DOS, PC-DOS, etc.) As if there aren't enough varibles already...
__________________
~lincomatic
lincomatic is offline   Reply With Quote
Reply


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On



Google
 
Web NetStumbler.org

All times are GMT -7. The time now is 10:02 PM.


Powered by vBulletin® Version 3.6.8
Copyright ©2000 - 2009, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO 3.0.0 ©2007, Crawlability, Inc.


All messages express the views of the author and are for entertainment purposes only. Netstumbler.org cannot be held responsible for the authenticity of the content or the actions of its members. By using this site and its services, you warrant that you will not post any messages that are discriminating, obscene, hateful, threatening, or otherwise violates any laws and you release Netstumbler.org from any future claims of any kind whatsoever including, but not limited to, addiction and loss of productivity. All forum messages, private messages and any other content are properties of Netstumbler.org. Even if publicly available, personal or copyrighted information are not to be posted without the consent of the owner. Distribution of licensed and copyrighted materials in any way not endorsed by the copyright owner is strictly prohibited. You may not use this site and its resources to spam other sites or individuals or perform any action that violates any law. Items sold or bought in the For Sale forum are sold as is and no warranty or insurance of any kind is provided. Netstumbler.org cannot be held responsible for the outcome of any transactions and no warranty of any kind is provided, either express or implied. Vulgar words are not allowed in the subject lines ; they may be used in the message body in any forum. The Administrator, Super Moderators and Moderators of Netstumbler.org have the right to remove, edit, move or close any thread for any reason and to reveal your identity and other known information in the event of a complaint or legal action arising from any message posted by you.