Openschemes

As we mentioned in our first article, one of the great “easter eggs” of the REB1200 firmware is a mode called EJFM.   EJFM is part test mode, part setup, part rescue console – one of the nicest looking, and best outfitted management routines we’ve found.

This article will give a little overview of the features and whatever explanations and notes we may have written down on those features as they were explored way back when.
First things first – the ebook’s keys.   When the REB is in EJFM mode, pressing the Menu key launches the “execute command” routine with a few more choices of interesting things to do.   We’ll get to that later, as we consider it somewhat of a second page of choices and we’d like to address the first page first.

Back to buttons: Pressing the Shortcut key (Called Book key in EJFM) fires the BabyFinder, a sort of shell terminal that you can use to access the device with a little more flexibility than the standard page of menu choices.   Or for those folks with the proper authorization – some real gems await.   But that’s the topic of another story, so let’s get back to the program.

Sorry for the crummy pic, but we’ll do our best to list and describe the commands in human-friendly HTML.   Starting from the top, moving from left to right:

Xmodem – Sets up acceptance of an Xmodem transfer of a firmware image.   Selecting Xmodem gives you the additional choice of where to place the firmware: ROM, FlashDisk, Expansion, Emerg, or RES.

• Not sure if the device can Xmodem over ethernet, never tried.   And we never used the actual modem on this beast so this downloading has been unexplored so far.   But the choices seem very clear:

1. ROM – Download firmware into flash.
2. FlashDisk – the internal storage, called B:\ IIRC.
3. Expansion – The CF card, called C:\.
4. Emerg – intriguing, but untested – an emergency loader, perhaps?
5. RES – Download to current directory, as described by the menu

Continued on Next Page…

In our first article on the REB1200 we discussed some of the options available for modifying the device.   In the second, we provided a little more information on the most straightforward method of getting firmware into the device.

But what will we do once we’re “inside”?   Let’s find out.

We understand that some of our readers won’t be assembly nuts, or really even that versed in machine language.   Well let’s get you up to speed: The coldfire processor in the REB is running Motorola 68k compatible code.   One good guide to the 68k instruction set is found on the 68k page at ticalc.org (originally written for hacking TI calculators – cool!).

The processor is big-endian so disassembly is pretty easy to read.   For example, moving the value $F1234567 into address pointer a0 so you can fetch memory from this location consists of:

20BC F123 4567                                         move.l   #$F1234567,(a0)

Let’s dissect it.   On the left, you can see the opcodes – 20BC: move.l from literal to a0 pointer.   In 68k, you the instruction reads from left to right – take number, put into (a0) – this is opposite of intel x86.   So we are taking a literal value (actual value, literals denoted by #), and putting it directly into the a0 register.   Putting something into the address register itself requires the parentheses – normally you use the a registers as a pointer, where you want to put some data AT the memory location held in a0.

Example: To set a0 to the ram location F12345678, and then store the value BAADF00D into the ram location F2345678 you may see..

move.l #$F1234567, (a0)

move.l #BAADF00D, a0

Now F1234567 holds the value BAADF00D.   The l in move.l denotes a long move – move 4 bytes.   You can also do byte move (b) or word move (w).   the b/w/l notation works with move and most of the mathematical add, subtract, etc, instructions so you will see it a lot.

Now you know the tiniest fraction of addressing and data manipulation.   You will also run into quite a few branch instructions, that start with B’s.   These instructions jump, or conditionally jump, the program execution to a new routine address.   You may see BRA – unconditional branch, or BCC – branch if not carry, or BNE – branch if the two values compared previously are not equal…   Or about 12 other types of branches.   These are used to implement conditional jumps such as IF statements.

Now I don’t intend this to be a tutorial on 68k – just a peek so unfamiliar readers can at least decide if they’d like to read up and jump into the machine code.   Delve deeper with your Pikmin squad?

Continued on next page €¦

Howdy REB-lovers!   Welcome back for another article on the REB1200.   We know that the first article was filled with teasers and grandiose claims, so now it’s our chance to start backing it up..

The essential tool of the day is RebLibrarian.   This tool is a Windows-based proxy server that emulates (exceptionally well, I may add) the now defunct Gemstar servers.

NOTE: This is a great example of why people hack consumer electronics.   Because jackasses like Gemstar set up layers of oppressive security to protect their $9.99 ebook sales and then go out of business, screwing all the customers who didn’t leech the raw data via a proxy such as RebLibrarian.

OK, soapbox done.   As you may have guessed, RebLib acted as an interposer between your 1200 and the Gemstar server.   By setting your 1200 to point to your own PC running RebLib, you could browse and fetch your Gemstar-hosted books which would then be backed up on your local PC for when the vendor inevitably goes out of business for spending all their money on DRM instead of content.

Continued on next page…