strange outcome after flashing the RB bootloader

[Lanchon]

hi!

I had this in my sansa e280:

-sandisk BL
-RB BL v6.0 (a preview that boots to RB even if a USB host is detected)
-RB v3.3

I wanted to mod the RB BL, so I downloaded the VMware devel environment, checked out from the svn, configured e200 BL and made; all went fine.

now, building produces an output PP5022.mi4 file. I flashed the file using recovery mode (I don't know how to use sansapatcher), and then...

-found the expected boot sequence: sandisk splash, followed by RB BL, and then RB; booting to RB works fine as before.

-apparently the RB BL was updated: before the RB BL said Boot Ver 6.0, now it says Boot Ver 22xxxx.xxxxxx.

-but here's the strange thing: when the HOLD switch is on, it says "Key LOCKED\nSystem shutdown" like it always used to. but when I look at the code I'm convinced it should say "Hold switch on\nShutting down..."! (see bootloader/main-pp.c line 485)

can anybody explain this behavior?

more info:

-I installed the new BL twice; same outcome.

-I grepped the "Key LOCKED" string an it's nowhere to be found: not on the sources and not on the binaries.

-I grepped the expected "Hold switch on" string an naturally I found it on the sources and on the binaries.

I don't want to start touching the BL until I understand what's happening here...

thank you very much for your help!

-----------------

noobie question: could someone point to the sansapatcher documentation? sorry for not STFWing enough!

[saratoga]

I think the help screen in sansapatcher is the only documentation.  I don't know about that string.

[Lanchon]

thanks saratoga,

I can think of 3 possibilities...

-the RB BL wasn't updated; unlikely, because of the displayed version change.
-some software before the RB BL is printing the Key LOCKED message, such as sandisk's BL; unlikely, because I don't think such a hardcoded message would be the standard way to handle the HOLD switch by the sansa; at least I would expect an icon; apparently it's not even localized text.
-two RB BLs are running in sequence???

when I have the time I'll start instrumenting the BL and see if it ever executes, and see if it executes with the HOLD switch on. I'll post the results.

--------------

how awkward this double post banning thing! anyway, I tested and it's confirmed: the RB BL never gets control when the HOLD switch is on. apparently sansa's BL is printing the Key LOCKED message and powering off; one more reason to evict that piece of software ASAP!

I don't want to forgo recovery mode, so two possibilities come to mind:

-patch the original BL so that it doesn't display the crappy animation and boots fast (and now also patch it so that it doesn't detect the HOLD switch!)

-or build a combined first stage bootloader with sandisk's BL at it's current address and RB BL afterward, hack the reset vector so that it points to RB BL, and test the REC button at RB BL start: if pressed, get back to sansa's BL. the problem is the rest of the exception vectors. does RB BL use the exceptions? I gather it does. if not, it's trivial; just hack the reset vector only. if RB BL does use exceptions, the original sansa BL vector table has to be copied to ram (but where is it safe?) and the exception base register pointed there before running sansa's BL. or much, much better: build RB BL vectors somewhere else (in flash or ram) and switch to those before starting RB BL in case REC is not pressed.

in any case, all this belongs to another thread, and I'm sure it's all being discussed somewhere; I'll try to find where...