Hello sjachim,

Thank for your reply!

I tried on 4 different computers (3 laptops and a desktop) using the SD-USB adapter that came with the card and also the computer SD slot when it was available but unfortunately it is still the same, the card starts normally and then after a while it's gone. Tried as well on 2 different routers, same thing.

I will give a try with your recommendation.

By the way, is there a reason why when creating a file in the /mnt/sd folder through telnet, it is not shown after on the card on windows side and vice versa? The card need to reboot to show the new file.

There is a command a refresh command called "refresh_sd" but once I put a file on the windows side, it becomes unable to run the command which gives out a error message; "umount: can't umout /mnt/sd: Device or ressource busy". I am sure I am missing something here...

I'll keep looking...

Thank

(Last edited by ttytt on 22 Jan 2014, 22:35)

Files and directories that you create on cards side won't be seen in Windows Explorer due to Windows' cache.
Windows dumps it's write cache as soon as it can, but it doesn't do anything to reload data from sd card. Why would it change? Nothing else has access to it right? That's my understanding. Somebody please correct me, if I'm wrong.

About the other problem. Make sure your working directory (the one in which you are in your shell session, use "pwd" command) is not /mnt/sd. And before doing "refresh_sd" call "sync" to flush the cache on cards side.

I have something like this in my autorun.sh for diagnostic purposes (that way i can check modification time of works file to check if my card is not working or just wifi...):

echo works > /mnt/sd/works
sync
refresh_sd

Happy hacking!

Victory!

I have been using a different card reader and the card didn't crashed at all this evening. It's a first!.

Here is the link to the adapter that I am using;
http://www.dynexproducts.com/products/c … CR121.html

Obviously the USB adapter that came with the card doesn't work or is faulty.
I would be interested to know why it doesn't work properly. It doesn't make sense since the adapter comes with the card...

I tried also to connector the card reader to a USB Iphone charger to see if it would work alone but I got nothing.
The led is it on the reader adapter but the card doesn't seem to be working, I not why either.

I also found a way to refresh the content on the card display in windows when writing/changing a file on the card through a telnet connection. I am not sure if it is a clean way or not to do it but it works! Let say the card is like me mounted on G:. I am using Windows 8.

Command line ;
G:\>fsutil volume dismount g:

It takes few second to get back the prompt and the folder is refreshed.

Thank sjachim for your help.

(Last edited by ttytt on 23 Jan 2014, 04:49)

Hello everyone,

I have been playing with my own transcend card recently and was able to compile a couple kernels.  Using the GPL toolchain from transcend I was able to comple Dmitry's config with his patched module.c and a modified version optimized for size. With the size optimization you have a bit of room and  I attempted to add netfilter but ran into issues. I am under the 3MB limit but the firmware update does not complete. I have no debug output and wifi doesn't come back up until I flash with another kernel. I am using dankrause's buildroot setup and the bootloader never moves to .disabled.

I have included a link to the 3 compiled kernels, the kbuild config files for those,  the initramfs,  uboot, and a copy of the GPL release I am using. The module.c patch isn't in this source so you will need to grab that from dmitry and copy it over.
https://drive.google.com/file/d/0B3k-rY … sp=sharing

If anyone can even give me a boot log I would appreciate it, still putting off my own hardware mods until I can get a logic level shifter or new usb to serial adapter.

Thanks,
Jeff

I've been looking at sources of ka2000's uboot. One of the first things called is InitCard() function which in turn calls init_m2(). This guy is interesting in the fact that I couldn't find anywhere symbolic names for constants used.
Does anyone have any idea what these registers are for?

// GPL code of ka2000 uboot follows:
int init_m2(void)
{
    volatile int timeout = 100000;

    word_write(0xa000a01c, 0x8);
    while ((word_read(0xa000a000) & 0x1) == 0x1)
    {
        word_write(0xa000a01c, 0x8);
        word_write(0xa000a000, 0x0);

        if (timeout-- <= 0)
        {
            return -1;
        }
    }

    word_write(0xa000a004, 0x1);
    return 0;
}

Imho, 0xa0000000 is a register memory space before MMU remapping, check Linux_KA_2_6/arch/arm/mach-ka2000/include/mach/ka2000_define.h. Therefore, 0xa000a000 is a register of sd switch device.

Also, I found out, that kcard_app applet from original busybox (and /dev/ka-main dev-node) is needed to trigger some actions in sd-switch mode, otherwise remained dormant. And also, I haven't found few strings from busybox binary to be present in busybox sources (I haven't compiled it though, maybe I'm missing something, need to recheck).

Afterwards, it seems possible to sometimes send CMD48 with response from arm, but that's not stable though. I'll clean up things and post a code later.

Are different KeyASIC cards' firmwares interchangeable? Can I flash i.e. Aircard firmware in my Trascend one?

(Last edited by acaN on 28 Jan 2014, 19:22)

Do you mean that with your drivers I we can get a the card to boot without  real host? With just a simple power supply?

In principle yes, however I haven't found the time to continue working on that lately... *sigh*

I suspect that you could also modify the stock firmware to boot without the host:
Likely all you need to do is to change the boot sequence so that before the proprietary driver bits (which wait for the host initalizing the card) you initialize the card from within the embedded Linux instead using a custom kernel module (toggle the switch, do SD initialization, continue boot normally).

OK I'm gonna try doing this. Is there an quick way to test kernel level (ring-0) code without recompiling kernel?

Ideally I'd like to write several lines of C, compile for ARM and run on kernel level (so that it would be able to access the switch.
Any pointers appreciated.

Sorry. It's bit off topic...

EDIT: OK. I got my knowledge refreshed with this: http://tldp.org/LDP/lkmpg/2.6/html/x121.html and compiled my first kernel module. Gotta setup cross compilation toolkit this week and get hello world module for ARM working...

(Last edited by sjachim on 29 Jan 2014, 02:08)

I spent some more time having fun with my Transcend card.
Once I got cross compilation working, I created a small kernel module that dumps values of all ka2000 registers (including SDSW switch registers). I'm going to send various commands to the card using microcontroller and look what's going on in cards' SDSW registers.

One particularly promising thing is that ka2000 switch saves in registers last commands that were going from the host to flash memory. By sending illegal commands from the host and listening for changes in registers we can transfer data to cards OS.   

If anybody is interested this is a link to a static dump of register values when card is connected to a laptop with a USB reader: https://gist.github.com/sjachim/8756124

Other thing I did. I got a binary of strace for ARM5 arch and used it on kcard_startup and kcard_app.
You can see how these two send values to driver of /dev/ka-main device using ioctl(). For example kcard_app tells the driver  it's pid so that later the driver can notify the application using signals... https://gist.github.com/sjachim/8756391

(Last edited by sjachim on 1 Feb 2014, 19:32)

I've did some more research of ka2000_sdhc.ko disassembly and I've made proof-of-concept modules (device and host) that communicates with each other over CMD 48 and CMD 49, source here. There are still many unknown stuff.

Few more things:
1. SDSW_M1_CMD_FLAG_INTEN_REG* registers are bitfields, where each bit enables/disables use IRQs per corresponding command. Few commands are unavailable for IRQ (their bit are always zero), also CMD48/CMD49 uses another bitmask.
2. SDSW_M1_CMD_FLG_REG* register are also bitfields, where each bit shows what command was triggered. Unsupported commands doesn't trigger bit changes. You need to clear them to acknowledge interrupt. Caveat here, it seems CMD7 uses bitmask 0x800 instead of 0x80.

What still have to be done:
1. if we stick to CMD48/CMD49 transfers, than host need support them in kernel, possibly somewhere around mmc_block module
2. on device side, we need to decide, how to use them. SD/MMC spec dictates strict rules for command arguments and make provisions for PnP

Hope it helps.

P.S. I use spec named "SD Specifications, Part 1, Physical Layer Simplified Specification, Version 4.10, January 22, 2013", CMD48/CMD49 is in section "5.7 Function Extension Specification".

(Last edited by generatorglukoff on 5 Feb 2014, 01:54)

Hello. I've been hacking around with my 32GB Transcend for a while now, successfully built and booted my own kernel (by Dmitry's instructions), unsuccessfully tried to update the SDIO driver inside initramfs (initramfs updates themselves work fine so there must be something wrong with the driver).

Next I tried to build my own uboot - but it didn't boot.

I definitely need my own serial connection; but the plan is to hack uboot so I don't need it (I want uboot to dump the log to flash) ... so if someone with a serial connection could try my program.bin and tell me what's going on there I'd be grateful.

http://flexo.sipsik.net/program.bin

(No risk involved here - reflashing with the old one works fine, but AFAIK you can't break stuff this way anyway ...)

If someone has some information on how to build a new u-boot for transcend (or any of the other cards) I'd be grateful for that too.

(Update: How I tried to built u-boot: I took the released GPL sources from Transcend, removed the hardcoded CROSS_COMPILE from Makefile, took ARCH and CROSS_COMPILE env-vars I used for my kernel compilation (using the toolchain provided by Transcend) and just did a "make clean" and "make" - and got a boot.bin which - in my opinion - should just work (although the binary is quite a bit smaller than the official program.bin...))

Cheers,
Felix

(Last edited by fnawothnig on 5 Feb 2014, 14:55)

Nice.

Another vector for playing around... I'll never get the stuff done I'm supposed to be doing. :-)

Could we maybe wrap around ka2000_sdhc.ko to restore normal SD functionality? (This would also make debugging easier if the wrapper could simply dump what the module is doing...)

I spent some time yesterday evening fiddling with Ez Share card's firmware.
What I was able to find on their website was a Windows software (all in Chinease).
The real firmware was just one file. Looked briefly at it and it wasn't in any format known to me.
Moved the file to Linux for closer inspection. "hexdump" revealed that there was a stream of 0xFF's close to start of the file.
Negated zeros? I applied quick script in Python to invert all bytes in the file and then run "strings", "binwalk" etc. on it.

Some of the strings I could find:

ictest.bin
ishare.bin
lZEal eZ-sHAre<>wIFi SD Card
athwlan.bin.z77
Where are U man?
Copyright (c) 1993-2000 ATI - Nucleus PLUS - Version ARM 7/9  1.11.19
B:\DCIM\127___02\
and lots of html and javascript...

OK. It seems like this card is also ARM based and it also has Atheros WiFi chip, but unfortunately power by Nucelus PLUS RTOS, not Linux.

(Last edited by sjachim on 8 Feb 2014, 23:29)

That's awesome! But does the WiFi work? Probably not, because of that closed-source ar6000 module, right?

Could you please backport this to the 2.6 kernel?
I really want to use 3.10 on that card, but without WiFi and SD access it makes no sense. And the 2.6 kernel heats up the card after a few seconds. So the best solution would probably a backport of that idle-driver to 2.6. I already tried it myself and failed horribly.
Thanks a lot!

The atheros 6000 driver is part of the kernel from the 3.2 release. According to wireless kernel and probably we can use a backport driver

Have anyone done this successfully? Moroboshi, could you post sources for what you've already done, so others could work on?

I've found modified uBoot sources on github that allow booting card without external initialization.

But to use it for anything useful we need what's mentioned above (a small sd card initializer kernel module). I want to work on this next, but will be on holidays for three weeks. I will hopefully get it done in second half of March.

Once you have working cross compilation toolkit making a small kernel module that reads/writes some values to/from registers is trivial.

I wlll most probably copy CNLohr's initialization sequence or read SD card specs.

EDIT: I don't mean that getting everything working properly is trivial.

(Last edited by sjachim on 18 Feb 2014, 19:18)

Yesterday I cracked-open my Transcend card and connected serial terminals to my computer
Now i am able to boot up the card without host device by altering boot sequence

And disabling /etc/init.d/rcS script (just put exit 0 as the second line). To do it you must build new ramdisk ( http://dmitry.gr/index.php?r=05.Project … d%20WiFiSD )

To enable wifi just do (in console or in /etc/init.d/rcS)

mount -t jffs2 /dev/mtdblock0 /mnt/mtd
insmod /lib/ka2000-sdhc.ko max_sd_blk=8
cp /mnt/mtd/config/wsd.conf /etc
cp /mnt/mtd/config/cimgconf /etc
w3

Now you have card working standalone, except for access to 16GB SD memory.

------------------------------------------------------------
I have also working cross-compiler - download and install the toolchain http://www.mentor.com/embedded-software … e-edition/

Now I can compile kernel modules to access the flash controller etc.
Do you have any suggestion, what to do next? I think it will be possible to toggle the SDIO switch, initialize the controller and use original ka2000-sdhc & kcardapp to take care of SD storage (no need to provide custom driver). Can someone sum up what we already know about this? What is the initialisation sequence?

Everything I did was already done by someone else, but I hope this nicely sums it up and could help someone new to catch up.

CNLohr, has made a small AVR microcontroller host that has initialization sequence (4-bit SD) implemented.
Video here: http://www.youtube.com/watch?v=5Rr9kSqjX98
I think you can find links to his Github repo on previous pages of this thread.
I believe that switching SDSW and reusing the same sequence should give us mountable SD card. I think it has to be done before loading original kernel modules.
I'm planning to try doing it myself when I get back to home.

I'm unable to follow these instructions to connect to client Wifi. When I give the kill command for hostapd or udhcpd, the shell hangs & never comes back. Have to pull the card out.

@dankrause It would be great if ou could release 0.3 with client AP configuration file. Later on you can add to that and release future releases.

Thanks to the community and Dan, pixelb in particular.

Greetings...to all of you who have quit some experience meanwhile with these cards...
I have a Flucard on which I simply want to permanently change the images used in the admin-web-page.
How can I do this ? Can you provide me with some help and guidance ?
Thanks in advance, have a nice day...

I rebuilded to the internal web page the hidden option to upload a file. It's just a link to the page "uploadto.html" that already existed in the stock Trascend WIFISD. I only added the link to the start page, "frame1.html"(fragment):

</style>
</head>
<body >
<div id="navigation" border="0" width="100%">
<table cellpadding="0" cellspacing="0" width="100%" boder="0" >
<tbody>
<tr><td width="100%"><a href="/page.html" target="f3"> &#8226; Home Page</a></td></tr>
<tr><td width="100%"><a href="/cgi-bin/show_pic.cgi" target="f3">&#8226; Photos</a></td></tr>
<tr><td width="100%"><a href="/cgi-bin/show_video.cgi" target="f3">&#8226; Videos</a></td></tr>
<tr><td width="100%"><a href="/cgi-bin/file_list.pl" target="f3">&#8226; Files</a></td></tr>
<tr><td width="100%"><a href="/uploadto.html" target="f3">&#8226; Upload</a></td></tr>
<tr><td width="100%"><a href="/cgi-bin/kcard_edit_config_insup.pl" target="f3">&#8226; Settings</a></td></tr>
<tr><td width="100%"><a href="/cgi-bin/kcard_status.pl" target="f3">&#8226; Information</a></td></tr>
</tbody></table>
</div>

Then I placed the modified "frame1.html" in the root of the WIFISD and added some lines to the "autorun.sh" script:

cp /mnt/sd/frame1.html /www/frame1.html
chmod a+x /www/frame1.html

That commands copy every boot the modified file to his place inside the card's system and give it privileges.

Then you need to reboot, as the current web page is read at run time from some sort of cache, charged at the boot time(copying the modified file by ftp directly to the /www directory doesn't work for immediate test...).

I think this method can also be used to change the graphics of the website or make a totally new one.

(Last edited by gflorez on 6 Apr 2014, 18:33)

I`ve found an old(1-June-2013) perl script from Sven that allows "Shoot&View Receiver" on Windows or Linux: http://sourceforge.net/p/transsvr/wiki/Home/ 

Sven disects the ports  and protocols involved in the process.

But simultaneously I also found some jpeg images on the /www directory of the WIFISD card on update >1.7.

It seems Transcend gives a complement to the Chrome browser and, that serie of pictures are the instructions to install it.

The extension is named.... wifisd.crx, and is located in the same directory.

(Last edited by gflorez on 13 Apr 2014, 21:48)