Mistel Boroco MD600 Support/Unbricking #25
Comments
|
Ah, so now I have the firmware for another keyboard. Goood... So, that all looks good, just about what I'd expect. It looks like the updater package uses the same format as the Pok3r RGB, and they all use the same XOR key (lol). Here's the snag you hit: most of the different bootloaders check for a specific word in the downloaded firmware, and the CRC routine returns 0 when it isn't there. The Pok3r RGB bootloader expects: And the MD600 firmware has: This is located at Don't mess with the size of the firmware file, the CRC will always be wrong. The flash in these chips is also spotty, so if the CRC fails the first time you try to write it, try a few more times. Out of curiosity, did you figure this out from the HT32 Unlocking wiki page? Did you use openocd-ht32? You got pretty far on your own! |
|
Thanks a lot! It worked and now the keyboard is alive again! You saved me a hefty ~200 USD as Mistel refused to fix it. For some reason, the mini USB port on my left side split does not work and thus I can't confirm that it works on the left split a swell. |
|
That's great, glad you got it working. Cool you were able to replace the SPI flash too. I'm not very familiar with split keyboards, are you supposed to be able to connect the host to the mini USB on either half? But that doesn't work on your left half? You said the PID is different on the left half, do you know what it is? That's odd, because there's only firmware for the right half (PID 0143) in the updater. I expect what happened with your keyboard is the main firmware image was corrupted, but for some reason the updater enabled the firmware anyway (it writes a header before the image, the bootloader won't boot without it). The bootloader is dumb, it will happily jump into corrupted firmware if the header is present. This sucks because it will never enter IAP mode again, and the keyboard is effectively bricked. Don't worry about the bootloader, I don't think there was any way to get it. My bootloader exploit requires cracked firmware to be downloaded by the bootloader, so it doesn't work on a bricked board. (Which is why I have a KBP V80 using a KBP V60 bootloader. Sound familiar?) Also, fun fact: turns out the Vortex Numpad / Switch Tester I've been trying to crack forever is actually just an MD200 in a different case. So now I have the firmware for it! Thanks for pointing me towards Mistel. |
|
Unfortunately I did not note the PID on the left side before bricking, it seems that the left side has the exact MCU as the right, without SPI flash, its probably slave only as it behaved very basic as master (Left side behavior connection results in a basic keyboard without backlight, no macro nothing) but even that does not seem to work for some reason after this fix, not sure if its the bootloader, maybe right side starts at different flash location address when the left side powers up and work as master? Either way I'm not sure why mistel even bothered adding that port considering that all functions do not work (nor backlight) That makes a lot of sense about the bricked firmware behavior. Haha glad it worked out for you! Interesting fact about the MD200, glad I helped in someway :) Quote from updated manual:
|
|
Skimming through the documentation, it looks like you're right about the left side, which is disappointing. But looking at some pictures in this review, it looks like there is a SPI flash IC on the left side? Maybe they planned for a dual-master setup, and couldn't get it working in firmware? Just as a tip, you don't need an oscilloscope to analyze digital signals, for that you'd usually use a logic analyzer, which you can get for <$100. In this case, we have the master firmware, so I'd probably go about disassembling that first. I've added support for the MD200 and MD600 to pok3rtool, and your keyboard seems to be up and running, so I'll close this issue. Cheers! |
|
I think you meant the left side? (As I mentioned that it doesn't have one) Yes there is not any, maybe early version? Mine has the pads though. I'm surprised the review has one. Thanks for the help, glad its supported now :) |
|
Yes, I meant left side. Okay, so yours is depopulated. Makes sense if they didn't use it. |
|
Left Side USB description: (only works when the bridging cable is disconnected, probably different bootloader caused this) Right side USB desc: |
|
Has there been any further progress on support for MD600, or is no progress expected? |
Hi,
Long story short, my USB port got disconnected while updating which left the kb unusable for a year.
After opening it up, I found that it has the same MCU and SPI flash as the Pok3r RGB, so I went ahead, used OpenOCD on rpi and flashed pok3r rgb bootloader, and now pok3r tool recognize it.
Flashing pok3r rgb firmware works, but of coarse layout messed, no rgb leds on, second split isn't working so the next step was to extract the firmware from the original updater (which i failed to find where vid/pid is stored before flashing p3rrgb bootloader).
I modified the pok3r-rgb installer checsum in the decoder function of pok3rtool, and was able to decode succesfully(?)
When I flash it, I get Checksum Error:
I'm not very experienced or knowledgeable, so I tried trimming the bin exactly as the pok3r-rgb size (both had a difference of ~50 bytes only) just to see if it's sizing issue but the issue remained, I'm completely lost now.
Thank you for your effort on this project.
The text was updated successfully, but these errors were encountered: