Modifying VxWorks bottom.sys file

[Photoman]

Hi,

Not sure if this is the best place to post this or Embedded would be better.

I have a printer running a VxWorks system v5.3.1 (early 2ks vintage I think) that I need to change the IP address on.
Its currently seeking the firmware from an FTP server at 90.0.0.5.  I would really like to change that to a 192.xxx.xxx.xxx address.

I tried changing the IP address and net mask in a HEX editor but it didn’t work.  The bootrom.sys file wouldn’t load, just hung the system.
Im wondering if there is a checksum or some other bit that im not seeing.

I have attached the original bootrom.sys and the Test bootrom.sys that I modified (sys changed to txt so it would upload).
I did rename it before transferring back to the floppy (and also tried it on a Gotek).

If anyone has any ideas?

Thanks!!

[eutectique]

The first observation -- your files have different sizes:

Code: [Select]

> ls -las
total 816
404 -rw-rw-r--   409998 Sep 29 15:19  bootrom.txt
404 -rw-rw-r--   410004 Sep 29 15:15 'Test bootrom.txt'


[Photoman]

The first observation -- your files have different sizes:

Code: [Select]

> ls -las
total 816
404 -rw-rw-r--   409998 Sep 29 15:19  bootrom.txt
404 -rw-rw-r--   410004 Sep 29 15:15 'Test bootrom.txt'


Thanks for the reply, I checked and that’s the difference in the IP addresses.  Not an addition to the file (extra characters).
192.168.1.8 vs 90.0.0.50.
If I revert the ip addresses to the 90.x the fie size is the same as the original.

[DC1MC]

Well, you see, there is a shitload of stuff in a compiled program and the aforementioned shitload has defined binary addresses that go to hell if you move half of the binary away with let's say six bytes.
In unfortunate cases one needs to decompile the binary and find the reference to the string address and move it somewhere else, in your case the string at offset 0x2DFC needs to remain of the EXACT same length as initially (this means no file length change and no shifting of the addresses. The only place where you can "steal" some chars is the user name (u=), password (p=) and eventually the file name (tn=). I really recommend to have a SHORT 192. address, like 192.168.0.1, or else if the (e=) needs modification it will not fit, if the e= doesn't matter for your purpose, then is OK also with a long IP.

Example:
fei(0,0) :pci\vxWorks h=90.0.0.5 e=90.0.0.50:ff000000 u=down pw=down tn=phobos
fei(0,0) :pci\vxWorks h=192.168.123.123 e=90.0.0.50:ff000000 u=d pw=d tn=phobo

Cheers,
DC1MC

[cruff]

As DC1MC has said, you won't be able to add to the length of the IP address string without disrupting the locations of the following bytes, and since bootrom.sys files are binary executables that will break things. The job of bootrom.sys is (usually) to load the actual VxWorks kernel that will be run.

This printer is relying on an external server to get the actual kernel to run? Can you not just add a secondary IP address to a server you already have with the address the printer is looking for?

[redkitedesign]

If you cannot change the length of the IP address, use an address in the 10.0.0.x range. That range is, like the 192.168.x.x. range dedicated for local addresses and can be the same length as the 90.0.0.5 you are using now.

[Photoman]

Well, you see, there is a shitload of stuff in a compiled program and the aforementioned shitload has defined binary addresses that go to hell if you move half of the binary away with let's say six bytes.
In unfortunate cases one needs to decompile the binary and find the reference to the string address and move it somewhere else, in your case the string at offset 0x2DFC needs to remain of the EXACT same length as initially (this means no file length change and no shifting of the addresses. The only place where you can "steal" some chars is the user name (u=), password (p=) and eventually the file name (tn=). I really recommend to have a SHORT 192. address, like 192.168.0.1, or else if the (e=) needs modification it will not fit, if the e= doesn't matter for your purpose, then is OK also with a long IP.

Example:
fei(0,0) :pci\vxWorks h=90.0.0.5 e=90.0.0.50:ff000000 u=down pw=down tn=phobos
fei(0,0) :pci\vxWorks h=192.168.123.123 e=90.0.0.50:ff000000 u=d pw=d tn=phobo

Cheers,
DC1MC

Thanks!  I didn’t know it was a compiled binary.  Shows how much I know about VxWorks.
I will give it a shot this weekend.
The e= address is the printers IP address that the gui on a pc uses to communicate and transfer files.
There shouldn't be a problem stealing from the user and pwd.  Its just an internal lite FTP server running on a PC so I can set it to anything I want.

[Photoman]

As DC1MC has said, you won't be able to add to the length of the IP address string without disrupting the locations of the following bytes, and since bootrom.sys files are binary executables that will break things. The job of bootrom.sys is (usually) to load the actual VxWorks kernel that will be run.

This printer is relying on an external server to get the actual kernel to run? Can you not just add a secondary IP address to a server you already have with the address the printer is looking for?

Yes, it gets the kernel and symbol file from an external FTP server.  Once the server is setup it works great.
In its current form, I have it running on an old win2k laptop in to a switch that’s connected to the printer.
The laptop is on its last legs and I would rather have it pulling the files from a more modern (win7 2010s) box.

Im not 100% sure why they chose this way of doing it.  They sold it with a PC with 2 NIC's, one for the printer and one for local network.
From what I can put together from rumors, it was a rushed project and they just ran out of time to polish it.
Its also possible they didn’t know how or that FTP might have been an easier lift in 1999.

Im running the printer application off of a win7 32bit box.  Ill look in to adding a second IP address to it.
I haven't done that before.  I was hoping that modifying the bootrom would be easier...ha!

[Zoli]

Hi,

Not sure if this is the best place to post this or Embedded would be better.

I have a printer running a VxWorks system v5.3.1 (early 2ks vintage I think) that I need to change the IP address on.
Its currently seeking the firmware from an FTP server at 90.0.0.5.  I would really like to change that to a 192.xxx.xxx.xxx address.
...
Thanks!!

If you have access/control on the router, you can add a redirect/static route for 90.0.0.5->192.xxx.xxx.xxx.
I do apologize to the network experts for the used terminology, but I hope the idea get thru.

[Photoman]

If you have access/control on the router, you can add a redirect/static route for 90.0.0.5->192.xxx.xxx.xxx.
I do apologize to the network experts for the used terminology, but I hope the idea get thru.

Good idea.  That would probably have worked too.

I was able to get the modified bootrom working today!
Thank you DC1MC.  I reduced the user and password and it worked first go.

The big thing now is to solve some cryptic error crashing the system.
Looks like a network error that wasn’t trapped so it just crashes after it tries to send packets back to the host.
Might be the cabling or network switch.  More things to pay with!

Also how to duplicate the old PATA hd to a SATA SSD with a SATA to PATA adapter.
Turns out there is some definition file on the drive that it needs to boot.  I thought it was just a buffer drive.
I have to figure out how to dupe that without altering the contents.
The entire machine is undocumented so its one interesting choice after another.

[macboy]

The new network problem may be due to another hard coded IP address in the printer and or in the PC based software. The string that you successfully changed is a boot configuration for the bootloader, but the actual vxworks image can and will apply its own network config when it boots up and takes over control of the ethernet port from the bootloader.

As for copying the PATA hard drive, I'd try a byte for byte copy. This is easy in Linux, just determine the device ID for each drive and use dd to copy (make sure to get it right so you don't copy garbage onto the original drive!).

[DC1MC]

After the booting, if the OS is  fully loaded, most likely the network setting for operational mode are in some plain text file. Here you have the possibility to do the in-place editing, as in the bootloader, or mount the image in Linux and edit the file with a text editor. If the drive is using VxWorks filesystem is a pain, because while the horny Linux mounts almost everything  , for the  vxWorks miserable FAT bastardization there is a separate kernel module that needs to be compiled individually. I suffered with this while trying to restore and update the storage of Tektronix AWG that is documented somewhere else on the forum.

But, all in all, it may be simpler and easier to  add other IP to the PC that is used to control the printer to fit with whatever address it needs.

 Cheers,
 DC1MC

[Photoman]

After the booting, if the OS is  fully loaded, most likely the network setting for operational mode are in some plain text file. Here you have the possibility to do the in-place editing, as in the bootloader, or mount the image in Linux and edit the file with a text editor. If the drive is using VxWorks filesystem is a pain, because while the horny Linux mounts almost everything  , for the  vxWorks miserable FAT bastardization there is a separate kernel module that needs to be compiled individually. I suffered with this while trying to restore and update the storage of Tektronix AWG that is documented somewhere else on the forum.

But, all in all, it may be simpler and easier to  add other IP to the PC that is used to control the printer to fit with whatever address it needs.

 Cheers,
 DC1MC

Its weirder then that.  It wasn't the network or the printer, Vx or any settings...it was the PC!
I spent hours trying to get it to work on my windows 7 32 bit computer, it just kept causing the Vx on my printer to crash.
Loaded up the software on a win2k laptop (which after a fall is less than happy to be alive) and it just works.
No crashes at all, even with the new bootrom.  It has to just be that computer.
The printing application while designed for NT and 2000, usually works fine on win7 32 bit.
But this is a strange implementation of the printer.  The previous models used a DEC AXP vme board (running Vx) and not a 486.
I was given some contact details of the developer and I will reach out and see if he still remembers and maybe has the source.

Im not sure what kind of file system is on that drive.  Im dreading it to be honest.
On the older machines (they're older by a few years), the drive is only used to store/buffer the image being printed (probably a tiff), an image config (probably txt) and the LUT (also txt).
In the event that those scsi drives fail and they do, just pop in another one, assuming you can find a drive that is in better shape.
It usually doesn’t even have to be formatted.  It just overwrites whatever what was on it.  An interesting way to do it but its worked for 25 years.
I switched the spinning rust out for SCSI2SD V6's and its amazing, no more high pitched whining or the sound of marbles rolling around.
But this one is an PATA and evidentially stores something important.

I will try to bring up a linux box and DD a clone.  Hopefully I don't mess that up 

[DC1MC]

It has to be an EXTREMELY special printer  , normally for such a hassle a one-way trip to a landfill will be the punishment. There are gadzillions of modern printers cheap and effective for almost anything, from plain paper to banner vinyl foil and everything in between.

[Zoli]

It has to be an EXTREMELY special printer  , normally for such a hassle a one-way trip to a landfill will be the punishment. There are gadzillions of modern printers cheap and effective for almost anything, from plain paper to banner vinyl foil and everything in between.

The only printer which I knew to had a SCSI+IDE HDD was in the 6 digit price range as new, ~25 years ago; to replace it now, I suppose one should look in the same price range.

[Halcyon]

You could just put a NAT redirection in at the firewall/router level. I do this with NTP and DNS servers. Some devices (think IoT) have hard-coded addresses for things like network time, but I want to force them to use my local time server.

To the device it thinks it's connecting to the address that is in its config but really, it's my local server replying.

[Photoman]

It has to be an EXTREMELY special printer  , normally for such a hassle a one-way trip to a landfill will be the punishment. There are gadzillions of modern printers cheap and effective for almost anything, from plain paper to banner vinyl foil and everything in between.

It definitely is a special printer.  Its an LVT Rhino +.  Basically a drum scanner in reverse.  It prints on to photographic film or paper pixel by pixel.
There were a number of models made, I have most of the models (I still have a couple on my want list).
This model was/is a the last they created before they folded.  The software and the internal Vx implementation wasn’t polished.
It works but not as seamless as the previous models.  I think they just ran out of time and shipped what they had.
For instance, status of the print job is only visible in a terminal window instead of in the app like the DEC version.
No compatibility with ICC profiles.  It cant process them and instead shows a black screen and prints that.
I heard it was supposed to have full ICC compatibility in the next version but that never happened.

In the 20 odd years since LVT closed, there hasn’t been another printer released that could compete.
Lighjet did have something similar but they sold comparatively few and they use gas lasers and it needs a ton of power.
It comes with its own power/cooling unit that’s as big and heavy as the printer part!
The LVTs use LED's and uses less power than a typical PC. 
The quality is close to each other but the real difference is the Lightjet had an auto loader and the LVTs are manual load.
But the Lightjets auto loader could be a pain and the rollers all turned back to its constituent components over time.
I do want one of those too, but I don't have the room or spare parts it would need.

[Photoman]

It has to be an EXTREMELY special printer  , normally for such a hassle a one-way trip to a landfill will be the punishment. There are gadzillions of modern printers cheap and effective for almost anything, from plain paper to banner vinyl foil and everything in between.

The only printer which I knew to had a SCSI+IDE HDD was in the 6 digit price range as new, ~25 years ago; to replace it now, I suppose one should look in the same price range.

I did find some pricing and the base for the ones I have was $35k + extras (there are always extras).
They would build you a pentium 400 for you for $9k, densitometer $3.5k and install was $2.5k.
Then extended warranties and RIPs could add up to another $20-30k if you wanted to do that.
An older model was between $67k and $96k!.  That was in 1998 money!

Ouch, I paid nowhere near that.

The printer only uses 1 type of hard drive at a time based on the model.
The + is the latest and uses an IDE PATA, the older DEC models used a 2 GB SCSI 50 pin drive.

[Zoli]

...
I did find some pricing and the base for the ones I have was $35k + extras (there are always extras).
They would build you a pentium 400 for you for $9k, densitometer $3.5k and install was $2.5k.
Then extended warranties and RIPs could add up to another $20-30k if you wanted to do that.
An older model was between $67k and $96k!.  That was in 1998 money!

Ouch, I paid nowhere near that.

The printer only uses 1 type of hard drive at a time based on the model.
The + is the latest and uses an IDE PATA, the older DEC models used a 2 GB SCSI 50 pin drive.

The printer I referenced was in a mass print shop(newspapers, ~1997); SCSI to hold the jobs, PC(IDE) to control the unit. No memories of make or model, since it was a short "change this SCSI disk and get out the way" type of job. The price(~$150,000) I found out later; the type(reverse drum scanner/illuminator) sounds about right.

[Photoman]

The printer I referenced was in a mass print shop(newspapers, ~1997); SCSI to hold the jobs, PC(IDE) to control the unit. No memories of make or model, since it was a short "change this SCSI disk and get out the way" type of job. The price(~$150,000) I found out later; the type(reverse drum scanner/illuminator) sounds about right.

It could have been a platesetter or imagesetter.  Creo, Scitex (Scitex was bought by Creo), Agfa, Heidelberg...I know I missing some of them.
A lot of them had an internal computer of sorts for the buffer and the host was either a PC or Mac.
Often the communication was over a direct fiber link probably because it was immune to noise and for any speed.
The larger ones were north of $150k, add special things like punches, on line processor and waste sheet removal...not to mention the RIP.
Big bucks.  Imagesetters are fun to play with though.  I thin I still have a roll of imagesetting film somewhere.

So I think I finally found out why it keeps crashing.  It only happens when I have it plugged in to my network.
Some packet must reach it and it cant decode or handle it so it crashes.
Im starting to think that’s one of the reasons why they recommend having 2 network cards on different subnets

[Halcyon]

So I think I finally found out why it keeps crashing.  It only happens when I have it plugged in to my network.
Some packet must reach it and it cant decode or handle it so it crashes.

Check to see if your switch is sending jumbo frames. Old gear might not handle frame sizes over 1500 bytes.

[Photoman]

So I think I finally found out why it keeps crashing.  It only happens when I have it plugged in to my network.
Some packet must reach it and it cant decode or handle it so it crashes.

Check to see if your switch is sending jumbo frames. Old gear might not handle frame sizes over 1500 bytes.

Oooh, good call, ill check.....
Edit: I checked all of my switches, router, firewall etc and none of them seem to have an option for Jumbo frames.
Only the PCs and Macs have a jumbo frame option.  I will check all of them as well.
I do wonder if any of the iot and smart speakers are to blame.  They are very talkative on the network.

[Halcyon]

So I think I finally found out why it keeps crashing.  It only happens when I have it plugged in to my network.
Some packet must reach it and it cant decode or handle it so it crashes.

Check to see if your switch is sending jumbo frames. Old gear might not handle frame sizes over 1500 bytes.

Oooh, good call, ill check.....
Edit: I checked all of my switches, router, firewall etc and none of them seem to have an option for Jumbo frames.
Only the PCs and Macs have a jumbo frame option.  I will check all of them as well.
I do wonder if any of the iot and smart speakers are to blame.  They are very talkative on the network.

Seems a bit odd, I guess maybe some packet capturing is needed, or maybe time to set up VLANs?

[Zoli]

...
Creo, Scitex (Scitex was bought by Creo), Agfa, Heidelberg...I know I missing some of them.
...

Creo sounded familiar from the neighbourhood; now is called Eastman Kodak:
https://www.google.com/maps/@49.2506734,-123.0107181,19z

[Photoman]

...
Creo, Scitex (Scitex was bought by Creo), Agfa, Heidelberg...I know I missing some of them.
...

Creo sounded familiar from the neighbourhood; now is called Eastman Kodak:
https://www.google.com/maps/@49.2506734,-123.0107181,19z

Kodak bought Creo (who bought Scitex) and few other printing and pre press companies.
Creo or Scitex bought iRiS graphics at one point.  I used to have an iRiS 4 Print and 3024.
Wonderful printers that would drive you up the wall on a daily basis.  For the time it was great for press proofing and general printing.
The 4print had an autoloader and ejector for paper that actually worked really well.
Though they were messy and expensive to run, it would suck and entire ink set dry in a month just for purging.
They were continuous InkJets with high voltage deflection and high pressure ink pumps.
Lots of fun to troubleshoot.  I found a lot of designed to break parts in them.
The high pressure pumps used plastic gears so those all snapped at the same point on the shaft.
Could have gone with a shear pin but no, plastic gear and core swap out for a refurb module ($1k module if I remember).