At first, U-boot may seem like just a way to load a root file system on your Zipit Z2 but it is capable of so much more. If you type “help” at your U-boot prompt, you will get a HUGE list of commands. Some are self explanatory but others are coupled with vague descriptions. To delve deeper into some of these commands, I did a bit of poking around online. Before you proceed, please realize that attempting to fuzz memory locations like this could potential result in a brick or hardware damage. That being said, here is a short list of commands I’ve put together that I’ve found useful for exploring the Zipit at the bit level:
MD (Memory Display) – You can use this command with a couple of suffixes. For example md.b, md.w & md.l all change the way that the output is displayed. Experiment with those and see which one works best for your purpose.
md 0×40E00000
By default, md will show you several lines of memory starting at the address you type in. To see the exact contents 4 bytes of memory, you would type in something like:
md 0×40E00000 1
The “1″ is an offset value that tells the command to display one 4-byte block. You can change that to see however many locations you would like. After you use a value here, it will persist until you use a different value. In other words, next time you type “md 0×40E00000″ without the “1″, it will show you 4-bytes until you run the command again with a different offset.
MTEST (Memory Test) – Memory test will perform test passes on a specified range of memory using a specified pattern. For instance, if you want to see some interesting bits get flipped, type in:
mtest 40E0000C 40E0000D FFFFFFFF
This will fuzz the range of memory from 40E0000C-40E0000D with the specified test pattern. I believe the LCD or power saving features may live in this range because this command makes the screen flicker. I’m not entirely sure how the pattern value (“FFFFFFFF”) works but a bit of experimentation and you should be able to figure it out.
NM (Memory Modify) – This command allows you to selectively flip bits of any byte in memory. For instance, if you run:
nm 40E0000C
You will see something similar to:
40E0000C: 0000032a ?
That is a prompt that is showing you the existing contents of the 4-bytes. If you type in “FFFFFFFF”, that will set ALL of the 32-bits(4-bytes) to the “on” position. In this case, it makes the screen dimmer. The line will increment and ask you again what you would like to change to. This time, if you type “00000000″, it will turn ALL 32-bits off and the screen will go to full brightness. If it’s not already obvious, ALL of those bits and bytes don’t control the screen brightness. You can start to narrow it down by flipping the nibbles(half-bytes). Starting with “F0000000″, “0F000000″, “00F00000″ and so on will narrow down which byte the brightness lives in.
It appears to be in the “00000F00″ nibble. So now it’s time to start flipping the bits. The individual bits are at 1, 2, 4 & 8. So something like “00000100″, “00000200″, “00000400″ etc will track down the specific bit. Turns out that it’s the most significant bit of that specific nibble. So in binary, it looks like “1000″. That translates to 8 in hex. To sum it up, changing between “00000800″ and “00000000″ with toggle the LCD backlight between bright and dim.
If any of this is confusing, you should read my post on binary to hex number conversion. Many people seem to think that computers somehow don’t operate on binary logic anymore but an exercise such as this proves quite the opposite to be true.
On the Zipit Z2, you probably don’t NEED to probe around like this since you can download a manual for the CPU and find most of the memory locations in there but if you just want to experiment or if you have another similar undocumented device that you want to reverse engineer, then this is a good way to go.
for the purpose of parting out the 445nm Nichia laser diodes(24 of them!). He has sold some of these on eBay to others who don’t want to tear into an $800 projector but recently he hooked one up to an LM317 regulator to see what it can do. What you see in the pictures is the result of roughly 1.2 watts of output. The visible blue light is totally dangerous and even the reflections could cause permanent eye damage but I’m SURE he locked away his kitties and wore protective goggles(yeah right).
So you have 
I see another few advantages to this hardware already. For one, this thing has a boot loader with a command prompt and console access. Already that blows away the WRT54G hardware. On top of that, if you flash a bad firmware, you probably won’t brick the device. I imagine you can just reflash it with the correct image and continue on your path.
in stock so I bought it and popped it in. Good as new and the battery door closes properly again.
would use up a AAA battery in 6-8 hours. Many days he was happy listening to his music all day so that could get fairly expensive. I started shopping around for batteries and purchased some random LaCrosse batteries and some high capacity Sanyo AA batteries rated at around 2900MAh but soon I noticed some of the same traits of self discharging again. These NiMH cells weren’t nearly as bad as the old NiCds were but I still couldn’t depend on them if they had been sitting for any amount of time.
. These batteries have a much lower capacity rating than some of the others but the almost always exceed the specified capacity when taking a charge. The Eneloop AA’s are rated for 2,000MAh and the 
are rated for 800MAh. According to Sanyo’s marketing material, these batteries can sit on the shelf for a year and still have 85% of their charge. They further claim that a normal rechargeable would be completely dead if it sat for a year. That sounds reasonable to me based on my experience.
with Eneloops. The baby monitor started out running a full day on stock cells and degraded to the point where it would only run 3 hours before the red light came on. With the Eneloops, the baby monitor ran for 3 days even when checking the screen a few times during the day when I first built the pack and a year later(after a very abusive charging cycle) it still runs a good day and a half or so.
