Uploading firmware

The first problem we're facing is that the BIOS won't boot from anything else than the soldered-on flash. Luckily there's a firmware update mechanism, "NETXFER". The EVO T20 tries to flash itself when you hold down the "P" key when applying power to it (a power outlet with a power switch is a must when working on this). "NETXFER" will appear on the screen, then it will try to connect with a BOOTP server.

You can download the windows tool for updating the firmware from hp.com (combined BOOTP+TFTP server, it will need an ancient Java implementation running on the machine, search the web), or (very very much preferred), set up Linux to update the firmware:

• Configure a BOOTP server to run at port 10067 and serve out an IP address and a filename (to the firmware file). Easiest is to use the stock ISC DHCP with something like:

  range dynamic-bootp 192.168.0.100 192.168.0.140;

  in the file "/etc/dhcpd.conf" (the point was the dynamic-bootp), then start it with:

  dhcpd -p 10067 -cf custom-config-file-for-this-purpose

• Run a TFTP server at port 10069, handing out the firmware file specified by the filename in the file "dhcpd.conf". Register the port in the file "/etc/services", then copy the line in inetd.conf for the TFTP and put it on that port as well.

It might look easier to use a Windows box, but getting it to work in Linux takes max half an hour and is very well worth it!

Then we need the stock firmware for modifications, get it from hp.com. It should be about 48 MB, and comes packed in an EXE-file that should execute just fine with the program WINE.

In the firmware, the data for the flash chips is located at offset 834710. That was the short story, if you don't have the 48 MB version it most likely won't be that so here's how I found out:

The firmware is a concatenation of setup code and a package. Inside the package, the filesystem is in two files called "filesys0" and "filesys1" (at the end of the package).

First do a flash of the stock firmware. Note the files that are transferred and their sizes... the filesystems are in "filesys0" and "filesys1". Search for those names in the firmware using an hex editor (i.e. ghex2). Somewhere before "filesys0" the size of "filesys0" is as a DWORD (four bytes) (you found the size when transferring, right?). Now, the four bytes before this is the offset from the start of the package.

To find the start of the package (except by just figuring it out in the hex editor), basically find the size of the setup code before it, which is the sizes of the files "TFTP.dat" and "ulc_code.tmp" that can be found in the windows Netxfer download. Other Evo versions might have other setup code, so make a new firmware using the setup code bundled with the program NETXFER:

   mkutc.bat firmware-file
   

It will "reformat" firmware-file with the setup code we know and stick it in the file "bootp.bin".

Now, hopefully you've found the offset of the file "filesys0", you should find the Windows NT master boot record there (with strings referring to your lack of proper hard disk setup, etc.). Now mount it as a loop device:

   losetup -o 834198 /dev/loop0 firmware.bin
   

Now we can make any changes we want on the device "/dev/loop0", treating it like a hard drive, and it will immedeately be reflected in the firmware. You can even mount 512 bytes further on the device "/dev/loop1" and mount the NTFS file system the Evo uses:

   losetup -o 834710 /dev/loop1 firmware.bin
   mount /dev/loop1 /mnt
   

I like to zero out everything but the MBR at this stage:

   dd if=/dev/zero of=/dev/loop bs=512 seek=1
   

just to remove every trace of Windows NTe. Then we must install our own stuff, I picked GRUB (because it was the one I first got to the assembler level of in my efforts to make the bootloaders work on the Evo...).