AMD
PIC

Unlocking WindowsCE and switching to Linux

Background:

AMD's PIC is a nice little x86 box with somewhat laughable specs. With
a 366mhz AMD Geode CPU, and 128MB of RAM, this machine is definately no
workhorse. But it does have some positive qualities. Using something
like 8W of power max (that is with the power-hungry internal Hard
Drive) this is definately one of the greener boxes out there. It is
almost totally silent too...except for the damn Hard Drive. But on to
the biggest negative: WindowsCE. When I originally got my AMD PIC
from a seller on eBay (for $75+shipping) it looked like a parting-gift
from an AMD conference (WCIT 2006) where they were pushing that whole
50x15 thing. The PIC came with WindowsCE v5, a standard set of
less-than-useful apps, and a whole-lot of locks thanks to AMD. The OS
was locked down mainly because it was targeted towards "boot, browse,
shut down" crowds. Less than useful and very frustrating if you want to
actually put this thing to use.

WindowsCE is a pain in the ass all in itself, but
AMD decided to take it a step further and completely lock out the
end-user. You are not able to browse the Hard Drive. You can only see
your "documents" and some other folders. Control Panel had nothing of
use. One good thing is that you can plug in a USB FlashDrive and it
shows up right away. Also, AMD provided some XP-extensions to the PIC
so that some Windows XP apps could run on WindowsCE. I was able to
confirm this by coding up a simple VB app (Visual Studio 2007) that ran
both on XP and the PIC's WindowsCE OS. That was kind of neat. The lack
of WindowsCE apps and lack of support for WindowsCE by
manufacturers/coders was a let-down; but it wasn't a surprise.

I set out on getting more use out of my PIC
since...well...I paid money for it and I didn't want it to go to waste.
Using it as it was turned out to be a pain. Browsing the web via the
PIC's IE browser was slow and painful. "Windows Media Player" would
barely play vidoes and couldn't understand what I was asking when I
wanted it to play a Shoutcast audio stream. One saving grace for this
thing was that it was running a Web Server on port 80! I found that out
by running a port-scan on the PIC. Going to the "web server" shows
nothing but a blank page. The page source is stored here on the PIC's
drive: \Windows\www\wwwpub\default.htm. That's pretty much where the
fun stops. I have plenty other "computers" and that means that leaving
this device stock was just as useful as me leaving it powered
off.  I had to figure out how to unlock it.

Fixing WindowsCE
(Unlocking the OS):

AMD did some good by getting General Software,
Inc to create their firmware. This baby is secure. It has some special
boot sector on the HD, and thanks to it's custom BIOS Firmware, it
won't let you boot anything but the drive the PIC came with. It would
simply error out and stall. So swapping a drive and booting Linux was
out of the question. I decided to go deeper into WindowsCE and see what
I can find there. Like I said before, the system is locked down so much
that you can't even browse into \Windows to see the goodies. So what do
you do if you can't "browse" to something interesting? You fire up a
Command Prompt! But...the PIC didn't come with a "shortcut" to a
command prompt, and as far as I can remember, it had no "Run" box. So I
went back to 1993 and dusted off my batch-scripting skillz.

I decided to play around with the system a bit. I
had the option of enabling file extensions by unchecking
View->Options->Hide File Extensions, after that I saw that in the
root folder “\” Control Panel was a .lnk (link). I didn’t give it much
thought at first. I ran some file (can't remember) that magically
opened up a "Pocket CMD" app. But then the window closed. So I created
a test.bat file on the USB flash drive and put in whatever I could
think of at that time,
it went something like this:

rem ----

rem test

echo TESTING

path

pause

\Windows\console.exe

pause

console.exe

pause

CEShell.exe

pause

CEShell

pause

\Windows\CEShell

pause

\Windows\CEShell.exe

pause

cmd.exe

pause

\Windows\cmd.exe

pause

...and that last part did the trick! Surprisingly (for me; I dont
"hack" Windows
much) I now had a full command-line to the system thanks to the last
line in that bat file. We have a full command prompt. I was able to
browse everything on the Hard Drive, including the ever-useful
\Windows\ directory. I went back to the Control Panel.lnk file in "\"
and substituted "\Windows\control.exe” with “\Windows\cmd.exe” and then
created a “CMD.lnk” file by first saving that file as a “CMD.txt” in
TextMaker then renaming the extension to .lnk in the CMD prompt
(TextMaker is a bitch, won’t let you enter your own extensions). I
moved
the CMD.lnk file to my "\USB Device" for easy access later on. Now I'm
able to fire up a command prompt (Pocket CMD) any time I wish. This is
getting more useful now. I browsed around the HD and found some
interesting stuff but it was mostly standard junk. One file that stood
out for
me was "\Windows\FlashCE.exe" ....remember that for later.

Here's the Output of "FlashCE":

\Windows> flashce

CE Bios Flash Utility v1.01.03

Usage: FlashCE <256|512> <filename> <checksum>
[noreboot]

256 for 256k or 512 for 512k BIOS image

checksum is the 8 hex digit BIOS file checksum in the form
0xNNNNNNNN

Specify "noreboot" for no rebooting after flashing the BIOS

The default is to reboot after flashing
the BIOS

\Windows>

What's all this now? Looks interesting! Bios? Flash? Utility?
v.1.01.03?!?!?! Yeah, nevermind that last one. But seriously, this is
interesting. Looks like AMD left one goodie slip for us! Can we flash
our own
BIOS onto the PIC and possibly boot another OS? Odds are with us. But
the biggest problem is actually finding a compatible BIOS. I did
contact General Software, Inc for more info and they basically told me
to suck a
lemon and contact the "OEM supplier". Thanks guys! They got their damn
money, what's the big deal? Whatever, there's always a way.

So now that I have a command prompt on the system,
what about about checking out the Registry? This IS Windows after all.
I searched around for a free WindowsCE Registry Editor (Visual Studio
2007 comes with some remote-registry editors and such, but I'm not
going to into that, lets just say the PIC doesn't have the necessary
software running). I did stumble upon a Registry editor for WindowsCE
(I think
it was here but
I'm not sure. Registration required). If you just want the EXE grab it here (make sure you virus-scan it, I'm just
passing on what I found, not my code).  This is a full-featured
Registry viewer and editor. It is your window to everything behind the
scenes in the PIC's WindowsCE OS. I went though pretty much every
registry entry (took a while) and here's what I found:

"HKCU\software\microsoft\shell\DirectoryLockFilter
"

Remove everything in there and this will let you use CE's Windows
Explorer to go through all the files/folders on the HD. Here's the
current data in it: \Windows\Desktop;\;\Hard
Disk;\Hard Disk\My Documents;\Hard Disk\My Documents\Pictures;\Hard
Disk\My Documents\My Downloads;\Hard Disk\My Documents\Music and
Video;\Hard Disk\My Documents\Documents;\Hard Disk\Application
Data;\NK.BIN

This pretty much unlocks the system; as you can see a ton of
stuff is "filtered" out and this is the best fix you can currently do
for your
PIC.

Also search for "PathFilterEnabled" and set it to 0. That's it for the
registry fun. Your PIC is now "unlocked" enough for you to
browse/modify the entire file system. Be careful.

Killing
WindowsCE 5:

As you may know, AMD designed this PIC to lock the
user into a limited WindowsCE OS. When AMD'S PIC 50x15 "initiative"
died off,
everyone thought the PIC was dead. Then a company called "DEC" (Data
Evolution Corporation) bought off AMD's PIC hardware and announced they
would let Linux run on this box. Obviously DEC didn't do much....they
either had General Software code up a new BIOS Firmware or there was
already one such revision out there already. It would not surprise me
if AMD had the "other-OS-ready" BIOS coded up for the PIC. Sadly, they
decided to lock the PIC into WindowsCE right away.

So DEC announces and shows off PICs (now called
decTOP) to the world with the ability to boot Linux (and other x86
OS's). Then they open up their store and start selling decTOP devices
for $99+shipping. Then all of a sudden they add an "unlocking" service
to their store for AMD PIC's! To unlock your PIC you have to send it to
DEC (shipping cost #1) pay them $30 to "fix" it and then have it
shipped back (shipping cost #2). So for about $60 (if you can wait a
while for slow shipping) you can have your CURRENT AMD PIC unlocked and
ready to boot something other than WindowsCE. So what is this
"unlocking" all about? Nothing more than wiping the HD (remember that
special boot sector...) and re-flashing the PIC BIOS from within
WindowsCE itself. FlashCE ring a bell? Yep, thats what you pay $30 for.
DEC did buy the "rights" to re-sell the AMD PIC and they are trying to
make some more money off of unsuspecting current PIC owners. AMD
screwed PIC owners over, and DEC is trying to continue the tradition by
charging for something that should have been available from the get-go.
Thank you, AMD. Thank you for targeting "small, undeveloped countries"
and in turn crippling the AMD PIC to near absolute uselessness.

So lets see what happens after your PIC gets shipped
to DEC. They take the PIC out of the pricey shipping box you paid for,
hook up a mouse, keyboard, and monitor. Then they hook up a USB key
that has the unlocked AMD PIC/decTOP BIOS firmware and what I can only
assume is a .BAT (batch) file with nothing more than one simple command
that calls FlashCE.exe. Why do I say this?

Well, look here:

\windows> flashce 256
"\USB Device\UNLOCK.ROM" 0x01DFD81A noreboot

CE Bios Flash Utility v1.01.03

Command line checksum: 01DFD81A

Calculated file checksum: 01DFD81A

The actual FLASH size on the board is 256K

FLASH Attempt 1...

FLASH WRITE Successful & Verified!

File checksum: 01DFD81A  FLASH checksum: 01DFD81A

Done!

\windows>

And that's it. The PIC can now boot any x86 OS of your choice. No, I'm
not kidding. Thats all it takes. 1 file, 1 command, and there's the
reason you paid $30 for "unlocking" and probably $20 for shipping.
There are a few revisions of the PIC so the output above may look
slightly different for some,

Don't e-mail me and ask me how I know this or how I got this
information, and most of all don't ask me for the BIOS image as I DO
NOT have it.

So thats it, the PIC is WindowsCE5-free and we move on to Linux.

Booting Linux.
Yes,
Linux:

After the machine is modified with the unlocked
BIOS, you can't boot WindowsCE5 anymore. Nothing happens when you turn
on the PIC except an 'Insert system disk" error. So I had to get an OS
on this thing. I decided to go with a lightweight Linux OS as I wasn't
in the mood to do a full-install. And I don't want to run the OS off of
the HD as it is loud and hot. The first thing that came to my mind is a
very feature-packed lightweight OS that can run off of a USB stick:
Damn Small Linux (.org). I went to their install site and made a
bootable USB stick with the DSL OS on it.

Booting DSL for the
first time on the AMD PIC.

Booting DSL didn't take long, about 2
minutes tops. Everything looked good and there were no critical errors
or kernel panics. Booted straight into a shell because X wasn't working
right yet.

Just a quick
glance at the CPU info, recognized by Linux.

After the OS booted to the shell, I had to run
xsetup.sh to change some settings and then everything worked great.
Unfortunately, I can't remember what I changed...but it was simple
stuff like resolution and BPP settings.

And here we
are in X using OpenWM. Firefox as the browser, and an Xterm window.

After getting X running everything looked good.
Surprisingly, with the limited CPU and RAM specs, the machine actually
runs QUITE well! I was very surprised at how useable it is. Of course
you won't be watching movies or graphics editing, but for simple "unix"
type of work (e.g. code/network stuff) this is great. I forgot to test
the sound and as I am writing this I am pretty far away from the PIC
so...maybe an update later.

One problem came up after I booted; I attached USB net adapter and it
wouldn't grab an IP address. The device was recognized right away but I
think I should have just booted with it plugged in. I brought the
network interface down and back up but still no luck so I had to
manually add IP/route info ("ipconfig eth0 x.x.x.x 255.255.255.0" and
"route add default gw x.x.x.x"). After that the PIC was online and
working like a champ.

Well thats it. WindowsCE5 is gone (thankfully) and
Linux is in. I'm by no means "anti-MS" but there is just SO much more
software and so much more you can do with Linux on this little box than
WindowsCE. So far so good, I played around with the OS a bit and it has
a good amount of use. This can be a little web server or even a
system/network monitoring solution. The PIC is extremely quiet and once
I take out the Hard Drive (not even used right now, because I booted
from a USB flash drive) then it will be completely silent (passive
cooling).

One last note; "shutdown -h now" from the shell doesn't shut down the
system system, it goes into some "sleep" mode that keeps the HD
spinning, I can hear it if I come close. No big deal though, one more
thing to figure out and fix. Thats it, thanks for reading.

Created by roto - August 5th, 2007