View source for Innovage-shift3

Another photo keychain made by Innovage: [http://www.imagebam.com/gallery/64d08ebc36d5c57c77e94ed3e0e7e11a/ shift<sup>3</sup> Digital Photo Album with Keychain]

Purchased at [http://www.benix.ca/ Benix] (oddly enough, a housewares retailer) at a mall in Ontario, Canada for $15 CAD. Available online in vast quantities. eBay and other second hand sites. Also available at Shoppers Drug Mart in Ontario for $15, most stores have the newer model but some still have the old one also. 

Appears that there may be two hardware versions of this product. Unknown if they are still identical on the inside.

The confirmed hackable version has a color front and a silver back half shell. Walgreens sells a "[http://www.walgreens.com/store/c/shift3-digital-photo-keychain-slim-/ID=prod6044915-product slim]" version for $20. Untested. (No listings anywhere indicate that the slim comes with a CD, only eBay listing that say "Software preloaded". May be the unhackable two partition revision)

If you want a certain to be hacked version and can get a Shift3, make sure it's NOT the Slim. (Make sure it has a silver back.)


==Packaging:==

Copyright date is 2008 MerchSource, LLC. UPC Codes: 1613066 (12193) Above and 6 94202 10288 6 Below the barcode.

Blisterpack on the rear clearly shows a CD with cable, has words "PC/MAC SOFTWARE DISC AND USB CABLE INCLUDED". "60 Photo Capacity" yellow circle on front of package. Sometimes also comes in a cardboard box style packaging. As long as it has a silver back half on the keychain itself and includes a CD, it should be safe.


'''Confirmed Hackable''' (Fat Model) Packaging:

* Note how all photos show silver back on keychain. When in doubt, get the blister packed version.
* http://i.imgur.com/xlyop.jpg
* http://i.imgur.com/uJuwG.jpg
* http://i.imgur.com/oDriQ.jpg

'''Unconfirmed, Untested''' and likely Unhackable Slim Model:

* Note "New Extra Slim Design!" inset
* http://i.imgur.com/72z9G.jpg
* http://i.imgur.com/YfPZa.jpg
* http://i.imgur.com/kAWhn.jpg


==Device Info:==

The memory chip is [http://www.spansion.com/products/pdf/S29AL008D_overview.pdf S29AL008D]

The device reports the same USB ID as the [[Innovage-generic]] (1403:0001 Sitronix Digital Photo Frame) and the board markings are reportedly the same.

'''DMESG:'''

 [431274.460401] scsi 9:0:0:0: Direct-Access SITRONIX MULTIMEDIA 0.09 PQ: 0 ANSI: 0 CCS
 [431274.461481] sd 9:0:0:0: Attached scsi generic sg1 type 0
 [431274.471341] sd 9:0:0:0: [sdb] 4096 512-byte logical blocks: (2.09 MB/2.00 MiB)
 [431274.474302] sd 9:0:0:0: [sdb] Write Protect is off
 [431274.474312] sd 9:0:0:0: [sdb] Mode Sense: 0b 00 00 08
 [431274.474318] sd 9:0:0:0: [sdb] Assuming drive cache: write through
 [431274.486299] sd 9:0:0:0: [sdb] Assuming drive cache: write through
 [431274.486339] sdb: unknown partition table
 [431274.522343] sd 9:0:0:0: [sdb] Assuming drive cache: write through
 [431274.522385] sd 9:0:0:0: [sdb] Attached SCSI removable disk 

'''LSUSB:'''

 Bus 004 Device 007: ID 1403:0001 Sitronix Digital Photo Frame 


==Hacking:==

The script ''hackfw.sh'' does not recognize the device as m_innovage or m_innovage2 so it won't modify the firmware, but is able to back it up and display the message "baks r ok" on the LCD.

''phack -m'' does send text successfully. 

Hack successful using ''newhack.sh''.

Hack also successful using ''generate-hack.pl''.


==Firmware:==

Here is the relevant file: [http://www.droprecord.com/VRLLLFVR m_shift3.tgz] (Link is dead)

Here is the dump generated using ''generate-hack.pl'' [http://www.filedropper.com/mshift3 m_shift3.zip] (Link is active as of Nov 27 2010)

Mirror of the above m_shift3.zip attached to [http://forum.doozan.com/read.php?2,2435,2711#msg-2711 this post] over at the debian.doozan.com dockstar hacking forums.


==Flashing:==

You '''must''' run as superuser for all of the steps!

Unzip contents of m_shift3.zip to ''hack'' directory.

Run ''./hackfw.sh /dev/sdX'' in the ''st2205tools'' directory.

It should find a match in ''m_shift3'' and prompt you to flash.


==Result:==

An example of the screen in action after the hack was applied, running LCD4Linux: http://i.imgur.com/AOBt8.jpg

IMPORTANT USABILITY NOTE:  The device overlays a battery indicator icon (12x24 pixels) in the lower left corner (about 5 px up & left) over anything that's displayed on the screen whenever connected via USB. In LCD4Linux, this eliminates the first 5 characters of the last 2 rows of text in the default size. (For layout, just use Row15.Col06 and Row16.Col06 to clear the battery icon for both lines)

After the custom hack was generated, the offset needed to be changed by 4 pixels for both X and Y in the spec file to remove the blue background right and bottom edges. This change does not need to be done with the firmware hack linked above called ''m_shift3.zip'' as I already edited the file myself before uploading the archive.  [[User:Rat|Rat]] 22:20, 27 November 2010 (CET)