INTEL DOT.

STATION 2300 (AOL)

Alias 'PAKITO'

Dot.Station.2300 Specifications Sheet

PROBLEMS AND SOLUTIONS

General Problem
The Dot.Stations come with a version of AOL BIOS, which does not allow booting the PC from
another device or with another hard drive.

General Solution
Change the BIOS version to the Intel one for those motherboards. With this, we can use others.
hard drives and booting from other devices or from the network.

Made by: Ing Dugar Agamez

August 2008
Specific Problems
To change the BIOS, we must run a program on the PC to flash the BIOS, but due to
the Pakitos bring an OS based on Linux and with many restrictions, this does not give us access to
a terminal.
The Pakitos have enabled write protection in their BIOS, preventing flashing the
BIOS.

Specific Solutions
The BIOS of the pakitos, the Intel N82802 chip, I was able to disable the protection through hardware.
against writing.
By owning the Pakitos, the Linux OS can be modified to enable a Terminal of
console to run our BIOS flashing program.

PREPARATION
to prepare the Pakito for the OS change. We proceed to dismantle it, separating the monitor from
the "tower", leaving only this last one.

Then it is uncovered to access the hard drive, video connection, and the BIOS chip.

Carried out by: Eng. Dugar Agamez

August 2008
IDENTIFICATION OF DEVICES

We identified the relevant devices

VGA Connector, IDE Connector (hard drive), ATX Connector, Chip N82802

Red: Video Connector

Green: BIOS Chip N82802
Blue: IDE Connector
Yellow: ATX Connector

Pins to light up the Pakito, connecting these two jumpers for a second using a cable.
we turn on the pakito. In this case, we use an external source to power the PC.

Made by: Engineer Dugar Agamez

August 2008
 LET'S GET TO WORK

Preliminary Tests
We turn on the pakito to see that we have everything connected properly, using an external power source and a
external monitor.

To make matters worse, it turns out that pakito is not activated, so it asks us for a key.
record.!!!!!

But that's not a problem..... we all want everything except to be left with that little abortion of Linux that I created.
AOL.

Prepared by: Ing Dugar Agamez

August 2008
HARD DRIVE PREPARATION OF PAKITO

We need to modify the OS so that it allows me to enter a Console terminal, characteristics of

linux.

For them, with Linux knowledge, we changed one of the files called by the OS.
when trying to check if it is registered to call a window manager and from
you have to open a terminal.

We boot Linux, this can be from USB, CD-ROM or the one we normally use Ubuntu. And
we put the hard drive of the slave pakito.

We look for the partition within Pakito's disk that is 2.9G in size and enable viewing.
hidden files.

We replace the .fvwm2rc file with the attached ,fvwm2rc files.

Then we enter the folder [blueriver] then into [bin], where we find two files (auth) and
(fvwm2), let's make a copy of fvwm2 and rename it to (auth) replacing the
auth file.

Remember that it is always good not to delete the file to be replaced, it is recommended to have a backup.

Made by: Ing Dugar Agamez

August-2008
With this, when we start Pakito, it will open the FVWM window manager with some buttons.
extras.
Flashing files
We copy the FlashPack folder that contains the BIOS file and the flashing programs to
the unit of 2.9G

From the console, we changed the owner and the group to root.
chown root:root -R FlashPack/

Then from the console we give all permissions to the folder and its contents.
chmod 777 -R FlashPack/

then we activate SetUID so that it runs with ROOT permissions, the folder and its contents
Change mode to setuid recursively on FlashPack/

Once this is done on Pakito's hard drive from another PC, we return it to Pakito.

Performed by: Ing Dugar Agamez

August-2008
When you turn on the machine, the Fvwm2 window manager should appear as shown in the
next image

With the mouse (which disappears except at the edges) we click on the New button. And it will appear.
a Terminal console

We follow the steps described in REDME inside the FlashPack folder,

The first step is to unprotect the Firmware Hub chip to allow for its programming.

This is a manual process since it cannot be done through software.

Made by: Eng. Dugar Agamez

August 2008
1.- Position ourselves in the directory of our files and execute the command:
./flash_rom -r bios.fw

2.- Execute the command:

more bios.fw

Press Space repeatedly. At first there is content, but once

exceeding 15% disappears and everything is found in blank.

This means that those memory blocks could not be read because the
firmware is locked.

3.- Unlock the firmware.

Step described further ahead

4.- Execute the command:

./flash_rom -r bios.fw

5.- Execute the command:

more bios.fw

Keep pressing Space repeatedly. Notice that now upon exceeding 15%
and even until the end there is content other than white. If it weren't like that
repeat the unlocking process until there is data after 15%

Made by: Ing Dugar Agamez

August 2008
6.- Flash the firmware:
./flash_rom -w bios.bin

Wait patiently until the process concludes.

DO NOT RESTART!!!!!!!

7.- Extract the firmware content again:

./flash_rom -r bios.fw

8.- Compare bios.fw and bios.bin:

./comp bios.fw bios.bin

The result of executing that command should not return anything.

9.- If it didn't return anything the execution of the previous command then:

GENIUS, YOU'VE GOT IT.

10.- Restart

Created by: Eng. Dugar Agamez

August 2008
Upon restarting, a new image should appear when loading the BIOS.

DISABLE WRITE PROTECTION IN THE BIOS

to remove the protection, there are many posts that claim that by connecting pins 24 and 25 or
putting 5V on pin 24 as shown in the drawing in the FlashPack folder, but the datasheet of
Intel N82802 indicates something else

Reset
RST# or INIT# at VIL initiates a device reset. In the read mode, RST# or INIT# low
deselects the
memory, places output drivers in a high-impedance state, and turns off all internal circuits.
RST# or
INIT# must be held low for time tPLPH (A/A Mux and FWH operation). The Intel FWH
resets to read
array mode upon return from reset, and all blocks are set to default (locked) status (see
4.9.1), regardless
of their locked state prior to reset.
During block erase or program, driving RST# or INIT# low will abort the operation.
underway, in
addition to causing a reset latency. Memory contents being altered are no longer valid, since
the data may
be partially erased or programmed.
It is important to assert RST# or INIT# during system reset. When the system comes out of
reset, it will
expect to read from the memory array of the device. If a system reset occurs with no FWH
reset—this is
hardware dependent—it is possible that proper processor initialization will not occur.
Intel FWH
memory may be providing status information instead of memory array data.
*Intel N82802A/B datasheet page 17

Done by: Eng. Dugar Agamez

August-2008
The datasheet informs us that to remove the write protection, you need to place any
from both legs 2 to 24 at Low. (low pulse or logical 0)

For this, we improvise with some tools to inject the low pulse.

Performed by: Eng. Dugar Agamez

August 2008
A fine point is needed so as not to touch the other legs of the chip.

We need a point to take the 0V from, so we use either of the two central points.
of the connector that feeds the hard drive, black cables.

Then we connect everything and turn on the pakito, once it's on we proceed to inject the pulse.
low.

The pulse is 1 second, as it is impossible to calculate about 20 microseconds in this way. This is on pin 24.
And if it doesn't work, we can try with pin 2 of the chip.

Performed by: Eng Dugar Agamez

August 2008
Warning: Be very careful when touching another component as it could cause irreparable damage to
the motherboard, memory or the BIOS. One way to solve it is to use masking tape and
cover the vulnerable areas.

Once the pulse is injected without turning off the equipment, we can test if the BIOS is already unlocked.

1.- Position ourselves in the directory of our files and execute the command:
./flash_rom -r bios.fw

2.- Execute the command:

more bios.fw

Press Space repeatedly. At first there is content, but once

exceeding 15% disappears and everything is blank.

This means that those memory blocks could not be read because the
firmware is locked.

Done by: Eng. Dugar Agamez

August 2008