Unlocking WindowsCE and switching to Linux
Background:
AMD's PIC is a nice little x86 box with somewhat laughable specs. With a 366mhz AMD Geode CPU, and 128MB of RAM, this machine is definately no workhorse. But it does have some positive qualities. Using something like 8W of power max (that is with the power-hungry internal Hard Drive) this is definately one of the greener boxes out there. It is almost totally silent too...except for the damn Hard Drive. But on to the biggest negative: WindowsCE. When I originally got my AMD PIC from a seller on eBay (for $75+shipping) it looked like a parting-gift from an AMD conference (WCIT 2006) where they were pushing that whole 50x15 thing. The PIC came with WindowsCE v5, a standard set of less-than-useful apps, and a whole-lot of locks thanks to AMD. The OS was locked down mainly because it was targeted towards "boot, browse, shut down" crowds. Less than useful and very frustrating if you want to actually put this thing to use.
WindowsCE is a pain in the ass all in itself, but AMD decided to take it a step further and completely lock out the end-user. You are not able to browse the Hard Drive. You can only see your "documents" and some other folders. Control Panel had nothing of use. One good thing is that you can plug in a USB FlashDrive and it shows up right away. Also, AMD provided some XP-extensions to the PIC so that some Windows XP apps could run on WindowsCE. I was able to confirm this by coding up a simple VB app (Visual Studio 2007) that ran both on XP and the PIC's WindowsCE OS. That was kind of neat. The lack of WindowsCE apps and lack of support for WindowsCE by manufacturers/coders was a let-down; but it wasn't a surprise.
I set out on getting more use out of my PIC since...well...I paid money for it and I didn't want it to go to waste. Using it as it was turned out to be a pain. Browsing the web via the PIC's IE browser was slow and painful. "Windows Media Player" would barely play vidoes and couldn't understand what I was asking when I wanted it to play a Shoutcast audio stream. One saving grace for this thing was that it was running a Web Server on port 80! I found that out by running a port-scan on the PIC. Going to the "web server" shows nothing but a blank page. The page source is stored here on the PIC's drive: \Windows\www\wwwpub\default.htm. That's pretty much where the fun stops. I have plenty other "computers" and that means that leaving this device stock was just as useful as me leaving it powered off. I had to figure out how to unlock it.
Fixing WindowsCE (Unlocking the OS):
AMD did some good by getting General Software, Inc to create their firmware. This baby is secure. It has some special boot sector on the HD, and thanks to it's custom BIOS Firmware, it won't let you boot anything but the drive the PIC came with. It would simply error out and stall. So swapping a drive and booting Linux was out of the question. I decided to go deeper into WindowsCE and see what I can find there. Like I said before, the system is locked down so much that you can't even browse into \Windows to see the goodies. So what do you do if you can't "browse" to something interesting? You fire up a Command Prompt! But...the PIC didn't come with a "shortcut" to a command prompt, and as far as I can remember, it had no "Run" box. So I went back to 1993 and dusted off my batch-scripting skillz.
I decided to play around with the system a bit. I had the option of enabling file extensions by unchecking View->Options->Hide File Extensions, after that I saw that in the root folder “\” Control Panel was a .lnk (link). I didn’t give it much thought at first. I ran some file (can't remember) that magically opened up a "Pocket CMD" app. But then the window closed. So I created a test.bat file on the USB flash drive and put in whatever I could think of at that time, it went something like this:
...and that last part did the trick! Surprisingly (for me; I dont "hack" Windows much) I now had a full command-line to the system thanks to the last line in that bat file. We have a full command prompt. I was able to browse everything on the Hard Drive, including the ever-useful \Windows\ directory. I went back to the Control Panel.lnk file in "\" and substituted "\Windows\control.exe” with “\Windows\cmd.exe” and then created a “CMD.lnk” file by first saving that file as a “CMD.txt” in TextMaker then renaming the extension to .lnk in the CMD prompt (TextMaker is a bitch, won’t let you enter your own extensions). I moved the CMD.lnk file to my "\USB Device" for easy access later on. Now I'm able to fire up a command prompt (Pocket CMD) any time I wish. This is getting more useful now. I browsed around the HD and found some interesting stuff but it was mostly standard junk. One file that stood out for me was "\Windows\FlashCE.exe" ....remember that for later.
Here's the Output of "FlashCE":
What's all this now? Looks interesting! Bios? Flash? Utility? v.1.01.03?!?!?! Yeah, nevermind that last one. But seriously, this is interesting. Looks like AMD left one goodie slip for us! Can we flash our own BIOS onto the PIC and possibly boot another OS? Odds are with us. But the biggest problem is actually finding a compatible BIOS. I did contact General Software, Inc for more info and they basically told me to suck a lemon and contact the "OEM supplier". Thanks guys! They got their damn money, what's the big deal? Whatever, there's always a way.
So now that I have a command prompt on the system, what about about checking out the Registry? This IS Windows after all. I searched around for a free WindowsCE Registry Editor (Visual Studio 2007 comes with some remote-registry editors and such, but I'm not going to into that, lets just say the PIC doesn't have the necessary software running). I did stumble upon a Registry editor for WindowsCE (I think it was here but I'm not sure. Registration required). If you just want the EXE grab it here (make sure you virus-scan it, I'm just passing on what I found, not my code). This is a full-featured Registry viewer and editor. It is your window to everything behind the scenes in the PIC's WindowsCE OS. I went though pretty much every registry entry (took a while) and here's what I found:
"HKCU\software\microsoft\shell\DirectoryLockFilter "
Remove everything in there and this will let you use CE's Windows Explorer to go through all the files/folders on the HD. Here's the current data in it: \Windows\Desktop;\;\Hard Disk;\Hard Disk\My Documents;\Hard Disk\My Documents\Pictures;\Hard Disk\My Documents\My Downloads;\Hard Disk\My Documents\Music and Video;\Hard Disk\My Documents\Documents;\Hard Disk\Application Data;\NK.BIN
This pretty much unlocks the system; as you can see a ton of stuff is "filtered" out and this is the best fix you can currently do for your PIC.
Also search for "PathFilterEnabled" and set it to 0. That's it for the registry fun. Your PIC is now "unlocked" enough for you to browse/modify the entire file system. Be careful.
Killing WindowsCE 5:
As you may know, AMD designed this PIC to lock the user into a limited WindowsCE OS. When AMD'S PIC 50x15 "initiative" died off, everyone thought the PIC was dead. Then a company called "DEC" (Data Evolution Corporation) bought off AMD's PIC hardware and announced they would let Linux run on this box. Obviously DEC didn't do much....they either had General Software code up a new BIOS Firmware or there was already one such revision out there already. It would not surprise me if AMD had the "other-OS-ready" BIOS coded up for the PIC. Sadly, they decided to lock the PIC into WindowsCE right away.
So DEC announces and shows off PICs (now called decTOP) to the world with the ability to boot Linux (and other x86 OS's). Then they open up their store and start selling decTOP devices for $99+shipping. Then all of a sudden they add an "unlocking" service to their store for AMD PIC's! To unlock your PIC you have to send it to DEC (shipping cost #1) pay them $30 to "fix" it and then have it shipped back (shipping cost #2). So for about $60 (if you can wait a while for slow shipping) you can have your CURRENT AMD PIC unlocked and ready to boot something other than WindowsCE. So what is this "unlocking" all about? Nothing more than wiping the HD (remember that special boot sector...) and re-flashing the PIC BIOS from within WindowsCE itself. FlashCE ring a bell? Yep, thats what you pay $30 for. DEC did buy the "rights" to re-sell the AMD PIC and they are trying to make some more money off of unsuspecting current PIC owners. AMD screwed PIC owners over, and DEC is trying to continue the tradition by charging for something that should have been available from the get-go. Thank you, AMD. Thank you for targeting "small, undeveloped countries" and in turn crippling the AMD PIC to near absolute uselessness.
So lets see what happens after your PIC gets shipped to DEC. They take the PIC out of the pricey shipping box you paid for, hook up a mouse, keyboard, and monitor. Then they hook up a USB key that has the unlocked AMD PIC/decTOP BIOS firmware and what I can only assume is a .BAT (batch) file with nothing more than one simple command that calls FlashCE.exe. Why do I say this?
Well, look here:
And that's it. The PIC can now boot any x86 OS of your choice. No, I'm not kidding. Thats all it takes. 1 file, 1 command, and there's the reason you paid $30 for "unlocking" and probably $20 for shipping. There are a few revisions of the PIC so the output above may look slightly different for some,
Don't e-mail me and ask me how I know this or how I got this information, and most of all don't ask me for the BIOS image as I DO NOT have it.
So thats it, the PIC is WindowsCE5-free and we move on to Linux.
Booting Linux. Yes, Linux:
After the machine is modified with the unlocked BIOS, you can't boot WindowsCE5 anymore. Nothing happens when you turn on the PIC except an 'Insert system disk" error. So I had to get an OS on this thing. I decided to go with a lightweight Linux OS as I wasn't in the mood to do a full-install. And I don't want to run the OS off of the HD as it is loud and hot. The first thing that came to my mind is a very feature-packed lightweight OS that can run off of a USB stick: Damn Small Linux (.org). I went to their install site and made a bootable USB stick with the DSL OS on it.
And here we are in X using OpenWM. Firefox as the browser, and an Xterm window.
After getting X running everything looked good.
Surprisingly, with the limited CPU and RAM specs, the machine actually
runs QUITE well! I was very surprised at how useable it is. Of course
you won't be watching movies or graphics editing, but for simple "unix"
type of work (e.g. code/network stuff) this is great. I forgot to test
the sound and as I am writing this I am pretty far away from the PIC
so...maybe an update later.
One problem came up after I booted; I attached USB net adapter and it wouldn't grab an IP address. The device was recognized right away but I think I should have just booted with it plugged in. I brought the network interface down and back up but still no luck so I had to manually add IP/route info ("ipconfig eth0 x.x.x.x 255.255.255.0" and "route add default gw x.x.x.x"). After that the PIC was online and working like a champ.
Well thats it. WindowsCE5 is gone (thankfully) and Linux is in. I'm by no means "anti-MS" but there is just SO much more software and so much more you can do with Linux on this little box than WindowsCE. So far so good, I played around with the OS a bit and it has a good amount of use. This can be a little web server or even a system/network monitoring solution. The PIC is extremely quiet and once I take out the Hard Drive (not even used right now, because I booted from a USB flash drive) then it will be completely silent (passive cooling).
One last note; "shutdown -h now" from the shell doesn't shut down the system system, it goes into some "sleep" mode that keeps the HD spinning, I can hear it if I come close. No big deal though, one more thing to figure out and fix. Thats it, thanks for reading.
AMD's PIC is a nice little x86 box with somewhat laughable specs. With a 366mhz AMD Geode CPU, and 128MB of RAM, this machine is definately no workhorse. But it does have some positive qualities. Using something like 8W of power max (that is with the power-hungry internal Hard Drive) this is definately one of the greener boxes out there. It is almost totally silent too...except for the damn Hard Drive. But on to the biggest negative: WindowsCE. When I originally got my AMD PIC from a seller on eBay (for $75+shipping) it looked like a parting-gift from an AMD conference (WCIT 2006) where they were pushing that whole 50x15 thing. The PIC came with WindowsCE v5, a standard set of less-than-useful apps, and a whole-lot of locks thanks to AMD. The OS was locked down mainly because it was targeted towards "boot, browse, shut down" crowds. Less than useful and very frustrating if you want to actually put this thing to use.
WindowsCE is a pain in the ass all in itself, but AMD decided to take it a step further and completely lock out the end-user. You are not able to browse the Hard Drive. You can only see your "documents" and some other folders. Control Panel had nothing of use. One good thing is that you can plug in a USB FlashDrive and it shows up right away. Also, AMD provided some XP-extensions to the PIC so that some Windows XP apps could run on WindowsCE. I was able to confirm this by coding up a simple VB app (Visual Studio 2007) that ran both on XP and the PIC's WindowsCE OS. That was kind of neat. The lack of WindowsCE apps and lack of support for WindowsCE by manufacturers/coders was a let-down; but it wasn't a surprise.
I set out on getting more use out of my PIC since...well...I paid money for it and I didn't want it to go to waste. Using it as it was turned out to be a pain. Browsing the web via the PIC's IE browser was slow and painful. "Windows Media Player" would barely play vidoes and couldn't understand what I was asking when I wanted it to play a Shoutcast audio stream. One saving grace for this thing was that it was running a Web Server on port 80! I found that out by running a port-scan on the PIC. Going to the "web server" shows nothing but a blank page. The page source is stored here on the PIC's drive: \Windows\www\wwwpub\default.htm. That's pretty much where the fun stops. I have plenty other "computers" and that means that leaving this device stock was just as useful as me leaving it powered off. I had to figure out how to unlock it.
Fixing WindowsCE (Unlocking the OS):
AMD did some good by getting General Software, Inc to create their firmware. This baby is secure. It has some special boot sector on the HD, and thanks to it's custom BIOS Firmware, it won't let you boot anything but the drive the PIC came with. It would simply error out and stall. So swapping a drive and booting Linux was out of the question. I decided to go deeper into WindowsCE and see what I can find there. Like I said before, the system is locked down so much that you can't even browse into \Windows to see the goodies. So what do you do if you can't "browse" to something interesting? You fire up a Command Prompt! But...the PIC didn't come with a "shortcut" to a command prompt, and as far as I can remember, it had no "Run" box. So I went back to 1993 and dusted off my batch-scripting skillz.
I decided to play around with the system a bit. I had the option of enabling file extensions by unchecking View->Options->Hide File Extensions, after that I saw that in the root folder “\” Control Panel was a .lnk (link). I didn’t give it much thought at first. I ran some file (can't remember) that magically opened up a "Pocket CMD" app. But then the window closed. So I created a test.bat file on the USB flash drive and put in whatever I could think of at that time, it went something like this:
rem ---- |
...and that last part did the trick! Surprisingly (for me; I dont "hack" Windows much) I now had a full command-line to the system thanks to the last line in that bat file. We have a full command prompt. I was able to browse everything on the Hard Drive, including the ever-useful \Windows\ directory. I went back to the Control Panel.lnk file in "\" and substituted "\Windows\control.exe” with “\Windows\cmd.exe” and then created a “CMD.lnk” file by first saving that file as a “CMD.txt” in TextMaker then renaming the extension to .lnk in the CMD prompt (TextMaker is a bitch, won’t let you enter your own extensions). I moved the CMD.lnk file to my "\USB Device" for easy access later on. Now I'm able to fire up a command prompt (Pocket CMD) any time I wish. This is getting more useful now. I browsed around the HD and found some interesting stuff but it was mostly standard junk. One file that stood out for me was "\Windows\FlashCE.exe" ....remember that for later.
Here's the Output of "FlashCE":
\Windows> flashce |
What's all this now? Looks interesting! Bios? Flash? Utility? v.1.01.03?!?!?! Yeah, nevermind that last one. But seriously, this is interesting. Looks like AMD left one goodie slip for us! Can we flash our own BIOS onto the PIC and possibly boot another OS? Odds are with us. But the biggest problem is actually finding a compatible BIOS. I did contact General Software, Inc for more info and they basically told me to suck a lemon and contact the "OEM supplier". Thanks guys! They got their damn money, what's the big deal? Whatever, there's always a way.
So now that I have a command prompt on the system, what about about checking out the Registry? This IS Windows after all. I searched around for a free WindowsCE Registry Editor (Visual Studio 2007 comes with some remote-registry editors and such, but I'm not going to into that, lets just say the PIC doesn't have the necessary software running). I did stumble upon a Registry editor for WindowsCE (I think it was here but I'm not sure. Registration required). If you just want the EXE grab it here (make sure you virus-scan it, I'm just passing on what I found, not my code). This is a full-featured Registry viewer and editor. It is your window to everything behind the scenes in the PIC's WindowsCE OS. I went though pretty much every registry entry (took a while) and here's what I found:
"HKCU\software\microsoft\shell\DirectoryLockFilter "
Remove everything in there and this will let you use CE's Windows Explorer to go through all the files/folders on the HD. Here's the current data in it: \Windows\Desktop;\;\Hard Disk;\Hard Disk\My Documents;\Hard Disk\My Documents\Pictures;\Hard Disk\My Documents\My Downloads;\Hard Disk\My Documents\Music and Video;\Hard Disk\My Documents\Documents;\Hard Disk\Application Data;\NK.BIN
This pretty much unlocks the system; as you can see a ton of stuff is "filtered" out and this is the best fix you can currently do for your PIC.
Also search for "PathFilterEnabled" and set it to 0. That's it for the registry fun. Your PIC is now "unlocked" enough for you to browse/modify the entire file system. Be careful.
Killing WindowsCE 5:
As you may know, AMD designed this PIC to lock the user into a limited WindowsCE OS. When AMD'S PIC 50x15 "initiative" died off, everyone thought the PIC was dead. Then a company called "DEC" (Data Evolution Corporation) bought off AMD's PIC hardware and announced they would let Linux run on this box. Obviously DEC didn't do much....they either had General Software code up a new BIOS Firmware or there was already one such revision out there already. It would not surprise me if AMD had the "other-OS-ready" BIOS coded up for the PIC. Sadly, they decided to lock the PIC into WindowsCE right away.
So DEC announces and shows off PICs (now called decTOP) to the world with the ability to boot Linux (and other x86 OS's). Then they open up their store and start selling decTOP devices for $99+shipping. Then all of a sudden they add an "unlocking" service to their store for AMD PIC's! To unlock your PIC you have to send it to DEC (shipping cost #1) pay them $30 to "fix" it and then have it shipped back (shipping cost #2). So for about $60 (if you can wait a while for slow shipping) you can have your CURRENT AMD PIC unlocked and ready to boot something other than WindowsCE. So what is this "unlocking" all about? Nothing more than wiping the HD (remember that special boot sector...) and re-flashing the PIC BIOS from within WindowsCE itself. FlashCE ring a bell? Yep, thats what you pay $30 for. DEC did buy the "rights" to re-sell the AMD PIC and they are trying to make some more money off of unsuspecting current PIC owners. AMD screwed PIC owners over, and DEC is trying to continue the tradition by charging for something that should have been available from the get-go. Thank you, AMD. Thank you for targeting "small, undeveloped countries" and in turn crippling the AMD PIC to near absolute uselessness.
So lets see what happens after your PIC gets shipped to DEC. They take the PIC out of the pricey shipping box you paid for, hook up a mouse, keyboard, and monitor. Then they hook up a USB key that has the unlocked AMD PIC/decTOP BIOS firmware and what I can only assume is a .BAT (batch) file with nothing more than one simple command that calls FlashCE.exe. Why do I say this?
Well, look here:
\windows> flashce 256
"\USB Device\UNLOCK.ROM" 0x01DFD81A noreboot |
And that's it. The PIC can now boot any x86 OS of your choice. No, I'm not kidding. Thats all it takes. 1 file, 1 command, and there's the reason you paid $30 for "unlocking" and probably $20 for shipping. There are a few revisions of the PIC so the output above may look slightly different for some,
Don't e-mail me and ask me how I know this or how I got this information, and most of all don't ask me for the BIOS image as I DO NOT have it.
So thats it, the PIC is WindowsCE5-free and we move on to Linux.
Booting Linux. Yes, Linux:
After the machine is modified with the unlocked BIOS, you can't boot WindowsCE5 anymore. Nothing happens when you turn on the PIC except an 'Insert system disk" error. So I had to get an OS on this thing. I decided to go with a lightweight Linux OS as I wasn't in the mood to do a full-install. And I don't want to run the OS off of the HD as it is loud and hot. The first thing that came to my mind is a very feature-packed lightweight OS that can run off of a USB stick: Damn Small Linux (.org). I went to their install site and made a bootable USB stick with the DSL OS on it.
Booting DSL for the
first time on the AMD PIC.
Booting DSL didn't take long, about 2 minutes tops. Everything looked good and there were no critical errors or kernel panics. Booted straight into a shell because X wasn't working right yet.
Just a quick glance at the CPU info, recognized by Linux.
After the OS booted to the shell, I had to run
xsetup.sh to change some settings and then everything worked great.
Unfortunately, I can't remember what I changed...but it was simple
stuff like resolution and BPP settings. Booting DSL didn't take long, about 2 minutes tops. Everything looked good and there were no critical errors or kernel panics. Booted straight into a shell because X wasn't working right yet.
Just a quick glance at the CPU info, recognized by Linux.
And here we are in X using OpenWM. Firefox as the browser, and an Xterm window.
One problem came up after I booted; I attached USB net adapter and it wouldn't grab an IP address. The device was recognized right away but I think I should have just booted with it plugged in. I brought the network interface down and back up but still no luck so I had to manually add IP/route info ("ipconfig eth0 x.x.x.x 255.255.255.0" and "route add default gw x.x.x.x"). After that the PIC was online and working like a champ.
Well thats it. WindowsCE5 is gone (thankfully) and Linux is in. I'm by no means "anti-MS" but there is just SO much more software and so much more you can do with Linux on this little box than WindowsCE. So far so good, I played around with the OS a bit and it has a good amount of use. This can be a little web server or even a system/network monitoring solution. The PIC is extremely quiet and once I take out the Hard Drive (not even used right now, because I booted from a USB flash drive) then it will be completely silent (passive cooling).
One last note; "shutdown -h now" from the shell doesn't shut down the system system, it goes into some "sleep" mode that keeps the HD spinning, I can hear it if I come close. No big deal though, one more thing to figure out and fix. Thats it, thanks for reading.
Created by roto - August 5th, 2007