Hacking the Halot Mage S from Creality (Part 1)
Preface
Note: My printer originally came with firmware version 2.308.07. I upgraded to 2.311.04 and didn't encounter any issues, but I would advise against upgrading beyond that if you can avoid it, since future updates can make the approach I use here obsolete.
The Halot Mage S is, at the time of writing, one of Creality's latest and most premium UV resin printers. As with anything these days, "premium" should be understood as synonymous with "cloud-connected", and perhaps even "AI-enabled", though Creality is a little behind on that latter front as of yet. Not that I'm complaining.
For sun-loving deviants like myself, who could well go their entire lives without encountering a cloud and be happy, the solution seemed simple enough. I plugged in my shiny new printer, connected it to an internetless VLAN, et voila!
I was pleasantly surprised to discover that the printer did not have any major complaints about not being able to contact the mothership. You can also click through the network connection dialog when setting up the printer without connecting to any network altogether.
Nonetheless, some of the features in the UI remained locked without a cloud connection. Notably the timelapse feature of the optional camera accessory.
As the money was already spent, there was no going back. I decided I will make the camera work, clouds be damned!
Getting an RTSP stream
It turns out that getting the camera to work without a cloud connection wasn't all that hard after all. A simple nmap scan (nmap -p- -T5 <printer_IP>) revealed that the printer has an RTSP service listening on TCP/554. Connecting to it with any RTSP client will show you the camera livestream, as long as the camera is plugged in. Note that you may need to navigate to Settings > Print Settings > HALOT BOX in the printer's UI and enable camera monitoring.
After that, a timelapse can be generated with a wide variety of software. Hell, you could probably write your own.
Can we do more?
At this point, my interest was piqued and I craved more access. This is my machine after all, and I will not rest until it runs any code I desire!
Having done some internet research, I came across an excellent article (wayback link) about rooting the Halot One resin printer, likewise hailing from the Creality family. It seemed like, if the Mage S was anything like the Halot One, the task at hand should be easy.
Alas, even the wealth of information in the comments of the aforementioned could not help me. Either the OS of the Mage S was different, or the ADB and SSH functionality was removed at some point since the article was written. Only one solution from that page remained...
I acquired a cheap USB UART adapter (can you believe I didn't have one lying around?!) and got to work on connecting it up. The procedure was simple enough. Four screws, two either side of the printer's face plate came right out with the hex keys provided with the printer (genuinely thank you, Creality). The UART header was very easy to find too, right next to the reset button on the lower right side of the white PCB (looking "through" the screen). I connected Tx to Rx and Rx to Tx, then GND to GND and then plugged in the USB side into my Linux laptop.
dmesg showed:
usb 1-1: new full-speed USB device number 6 using xhci_hcd
usb 1-1: New USB device found, idVendor=067b, idProduct=2303, bcdDevice= 4.00
usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0
usb 1-1: Product: USB-Serial Controller D
usb 1-1: Manufacturer: Prolific Technology Inc.
usbcore: registered new interface driver usbserial_generic
usbserial: USB Serial support registered for generic
usbcore: registered new interface driver pl2303
usbserial: USB Serial support registered for pl2303
pl2303 1-1:1.0: pl2303 converter detected
usb 1-1: pl2303 converter now attached to ttyUSB0The last line there is significant, because it tells us how to access the serial terminal (via ttyUSB0 in my case). So I ran screen /dev/ttyUSB0 19200 but got no output. Unfortunately, at the time, I did not know the correct Baud rate. I've since found it to be 115200 but more on that later. With that information, the correct command would have been screen /dev/ttyUSB0 115200.
Unfortunately, even with the correct command, this approach is a dead end. The serial console on my firmware version does not present me with a login as I had expected based on the above article, but rather a logcat.
Still, the logcat did include some interesting information, so I will include all of it below. Note that to capture all of it, you need to be connected to the serial terminal, then use the reset button on the board. That way, you don't miss any of the earliest messages.
Without further ado, here is the logcat:
IPL g75a3331
D-1e
HW Reset
00000000 00000000
Resume? N, addr 00000000
miupll_266MHz
MIU0 zq=0x003b
miu_bw_set
utmi_1_init done
utmi_2_init done
utmi_3_init done
usbpll init done......
CPU=1000Mhz
cpupll init done
SPI 54M
clk_init done
P1 USB_rterm trim=0x000d
P1 USB_HS_TX_CURRENT trim=0x0002
P2 USB_rterm trim=0x000d
P2 USB_HS_TX_CURRENT trim=0x000d
P3 USB_rterm trim=0x000d
P3 USB_HS_TX_CURRENT trim=0x000d
PM_vol_bgap trim=0x0002
GCR_SAR_DATA trim=0x0192
ETH 10T output swing trim=0x0011
ETH 100T output swing trim=0x0011
ETH RX input impedance trim=0x0000
ETH TX output impedance trim=0x0000
MIPI_HS_RTERM trim=0x0001
MIPI_LP_RTERM trim=0x0000
128MB
BIST0_0001-OK
Enable MMU and CACHE
Load IPL_CUST from SPINAND
QUAD MODE ENABLE
Checksum OK
IPL_CUST gabf224a
runUBOOT()
runUBOOT()
[SPINAND]
SPI 54M
Load UBOOT from SPINAND
-Verify UBOOT CRC32 passed!
-Decompress UBOOT XZ
decomp_size=0x000aa24c
Disable MMU and D-cache before jump to UBOOT�
U-Boot 2015.01 (Jun 06 2024 - 13:50:06), Build: jenkins-PPL_100-PACKAGE-OS-CL103-772
Version: I2g17c3a1d
[WDT] Enalbe WATCHDOG 10s
Watchdog enabled
I2C: ready
DRAM:
WARNING: Caches not enabled
SPINAND: _MDrv_SPINAND_GET_INFO: Found SPINAND INFO
(0xC8) (0x1)
SPINAND: board_nand_init: CIS contains part info
128 MiB
MMC: MStar SD/MMC: 0
In: serial
Out: serial
Err: serial
Net: No ethernet found.
Saving Environment to NAND...
Erasing redundant NAND...
Erasing at 0x4a0000 -- 100% complete.
Writing to redundant NAND... OK
default off pad 4
default off pad 5
env_dispout = UE050WV_800x480
Saving Environment to NAND...
Erasing NAND...
Erasing at 0x460000 -- 100% complete.
Writing to NAND... OK
(Re)start USB 0...
Check USB port[0]:
[USB] usb_lowlevel_init++
[USB] USB EHCI LIB VER: 2018.01.12
[USB] Port 0 is Enabled
[USB] TV_usb_init (UTMI Init) ++
[USB] UTMI Base 1f284200
[USB] UHC Base 1f284800
[USB] USBC Base 1f284600
[USB] BC Base 1f284400
[USB] config miu select [70] [f8] [ef] ][ef]
[USB] enable miu lower bound address subtraction
[USB] init squelch level 0x2
[USB] TV_usb_init--
[USB] Usb_host_Init++
[USB] No USB is connecting
[USB] USB init failed
[USB] usb_lowlevel_init--
Error, couldn't init Lowlevel part
usb - USB sub-system
Usage:
usb start - start (scan) USB controller
usb reset - reset (rescan) USB controller
usb stop [f] - stop USB [f]=force stop
usb tree - show USB device tree
usb info [dev] - show available USB devices
usb test [dev] [port] [mode] - set USB 2.0 test mode
(specify port 0 to indicate the device's upstream port)
Available modes: J, K, S[E0_NAK], P[acket], F[orce_Enable]
usb storage - show details of USB storage devices
usb dev [dev] - show or set current USB storage device
usb part [dev] - print partition table of one or all USB storage devices
usb read addr blk# cnt - read `cnt' blocks starting at block `blk#'
to memory address `addr'
usb write addr blk# cnt - write `cnt' blocks starting at block `blk#'
from memory address `addr'
(Re)start USB 1...
Check USB port[1]:
[USB] usb_lowlevel_init++
[USB] USB EHCI LIB VER: 2018.01.12
[USB] Port 1 is Enabled
[USB] TV_usb_init (UTMI Init) ++
[USB] UTMI Base 1f284a00
[USB] UHC Base 1f285000
[USB] USBC Base 1f284e00
[USB] BC Base 1f284c00
[USB] config miu select [70] [f8] [ef] ][ef]
[USB] enable miu lower bound address subtraction
[USB] init squelch level 0x2
[USB] TV_usb_init--
[USB] Usb_host_Init++
[USB] Async base addr: 0x3eb9d80
[USB] Reg 0x28: 0x9d80 0x3eb
[USB] disable run
[USB] Host Speed:2
[USB] enable aynch
[USB] Usb_host_Init--
[USB] usb_lowlevel_init--
scanning bus for devices...
[USB] interface[0] conf:1 value 9:
Wait for hub reset....
checking hub ports...
usb_get_configuration_no: failed to get descriptor - too long: 1469
usb_new_device: Cannot read configuration, skipping device a108:2231
[USB] interface[0] conf:1 value ff:
3 USB Device(s) found
scanning usb for storage devices... 0 Storage Device(s) found
NAND read: device 0 offset 0x4e0000, size 0x60000
Time:35630 us, speed:11036 KB/s
393216 bytes read: OK
NAND read: device 0 offset 0x540000, size 0x1d7b70
Time:163271 us, speed:11833 KB/s
1932144 bytes read: OK
## Booting kernel from Legacy Image at 22000000 ...
Image Name: MVX4##I2M#g17c3a1d48KL_LX409##[B
Image Type: ARM Linux Kernel Image (lzma compressed)
Data Size: 1932080 Bytes = 1.8 MiB
Load Address: 20008000
Entry Point: 20008000
Verifying Checksum ... OK
-usb_stop(USB_PORT0)
-usb_stop(USB_PORT1)
-usb_stop(USB_PORT2)
Uncompressing Kernel Image ...
[XZ] !!!reserved 0x21000000 length=0x 1000000 for xz!!
XZ: uncompressed size=0x3de000, ret=7
OK
atags:0x20000000
Starting kernel ...
Booting Linux on physical CPU 0x0
Linux version 4.9.84 (root@VHS-SZL-0041) (gcc version 8.2.1 20180802 (GNU Toolchain for the A-profile Architecture 8.2-2018-08 (arm-rel-8.23)) ) #393 SMP PREEMPT Thu Jun 6 13:52:02 CST 2024
CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=50c5387d
CPU: div instructions available: patching division code
CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
early_atags_to_fdt() success
OF: fdt:Machine model: INFINITY2M SSC011A-S01A-S
LXmem is 0x7f00000 PHYS_OFFSET is 0x20000000
Add mem start 0x20000000 size 0x7f00000!!!!
LX_MEM = 0x20000000, 0x7f00000
LX_MEM2 = 0x0, 0x0
LX_MEM3 = 0x0, 0x0
EMAC_LEN= 0x0
DRAM_LEN= 0x0
deal_with_reserved_mmap memblock_reserve success mmap_reserved_config[0].reserved_start=
0x27c00000
deal_with_reserve_mma_heap memblock_reserve success mma_config[0].reserved_start=
0x27700000
cma: Reserved 2 MiB at 0x27400000
Memory policy: Data cache writealloc
percpu: Embedded 14 pages/cpu @c76be000 s25880 r8192 d23272 u57344
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 30978
Kernel command line: console=ttyS0,115200 ubi.mtd=UBI,2048 root=ubi:rootfs ro rootfstype=ubifs init=/linuxrc rootwait=1 LX_MEM=0x7f00000 mma_heap=mma_heap_name0,miu=0,sz=0x500000 mma_memblock_remove=1 highres=on mmap_reserved=fb,miu=0,sz=0x300000,max_start_off=0x7C00000,max_end_off=0x7F00000 mtdparts=nand0:384k@1280k(IPL0),384k(IPL1),384k(IPL_CUST0),384k(IPL_CUST1),768k(UBOOT0),768k(UBOOT1),256k(ENV),256k(ENV1),0x20000(KEY_CUST),0x60000(LOGO),0x500000(KERNEL),0x500000(RECOVERY),-(UBI)
PID hash table entries: 512 (order: -1, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 114304K/124928K available (2292K kernel code, 193K rwdata, 1168K rodata, 164K init, 176K bss, 8576K reserved, 2048K cma-reserved)
Virtual kernel memory layout:
vector : 0xffff0000 - 0xffff1000 ( 4 kB)
fixmap : 0xffc00000 - 0xfff00000 (3072 kB)
vmalloc : 0xc8000000 - 0xff800000 ( 888 MB)
lowmem : 0xc0000000 - 0xc7f00000 ( 127 MB)
modules : 0xbf800000 - 0xc0000000 ( 8 MB)
.text : 0xc0008000 - 0xc024537c (2293 kB)
.init : 0xc038b000 - 0xc03b4000 ( 164 kB)
.data : 0xc03b4000 - 0xc03e4568 ( 194 kB)
.bss : 0xc03e6000 - 0xc0412378 ( 177 kB)
SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
Preemptible hierarchical RCU implementation.
Build-time adjustment of leaf fanout to 32.
RCU restricting CPUs from NR_CPUS=4 to nr_cpu_ids=2.
RCU: Adjusting geometry for rcu_fanout_leaf=32, nr_cpu_ids=2
NR_IRQS:16 nr_irqs:16 16
ms_init_main_intc: np->name=ms_main_intc, parent=gic
ms_init_pm_intc: np->name=ms_pm_intc, parent=ms_main_intc
ss_init_gpi_intc: np->name=ms_gpi_intc, parent=ms_main_intc
Find CLK_cpupll_clk, hook ms_cpuclk_ops
<CLK_hemcu_216m> no mux-width, set to default 2 bits
<CLK_miu_xd2miu> no mux-width, set to default 2 bits
arm_arch_timer: Architected cp15 timer(s) running at 6.00MHz (virt).
clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x1623fa770, max_idle_ns: 440795202238 ns
sched_clock: 56 bits at 6MHz, resolution 166ns, wraps every 4398046511055ns
Switching to timer-based delay loop, resolution 166ns
console [ttyS0] enabled
Calibrating delay loop (skipped), value calculated using timer frequency.. 12.00 BogoMIPS (lpj=6000)
pid_max: default: 4096 minimum: 301
Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
CPU: Testing write buffer coherency: ok
CPU0: update cpu_capacity 1024
CPU0: thread -1, cpu 0, socket 0, mpidr 80000000
Setting up static identity map for 0x20008240 - 0x2000828c
CPU1: update cpu_capacity 1024
CPU1: thread -1, cpu 1, socket 0, mpidr 80000001
Brought up 2 CPUs
SMP: Total of 2 processors activated (24.00 BogoMIPS).
CPU: All CPU(s) started in SVC mode.
devtmpfs: initialized
VFP support v0.3: implementor 41 architecture 2 part 30 variant 7 rev 5
clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 1911260446275000 ns
futex hash table entries: 16 (order: -2, 1024 bytes)
NET: Registered protocol family 16
DMA: preallocated 256 KiB pool for atomic coherent allocations
Version : MVX4##I2M#g17c3a1d48KL_LX409##[BR:cl103]#XVM
GPIO: probe end[Padmux]reset Pad_87(reg 0x101e09; mask0x7) to GPIO(org: I2C0_MODE_1)
[Padmux]reset Pad_2(reg 0x101e09; mask0x70) to GPIO(org: I2C1_MODE_1)
[Padmux]reset Pad_47(reg 0x101e03; mask0x70) to GPIO(org: UART0_MODE_1)
hw-breakpoint: found 5 (+1 reserved) breakpoint and 4 watchpoint registers.
hw-breakpoint: maximum watchpoint size is 8 bytes.
SCSI subsystem initialized
clocksource: Switched to clocksource arch_sys_counter
NET: Registered protocol family 2
TCP established hash table entries: 1024 (order: 0, 4096 bytes)
TCP bind hash table entries: 1024 (order: 2, 20480 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
UDP hash table entries: 128 (order: 0, 6144 bytes)
UDP-Lite hash table entries: 128 (order: 0, 6144 bytes)
NET: Registered protocol family 1
hw perfevents: enabled with armv7_cortex_a7 PMU driver, 5 counters available
workingset: timestamp_bits=30 max_order=15 bucket_order=0
squashfs: version 4.0 (2009/01/31) Phillip Lougher
exFAT: Version 1.2.9
io scheduler noop registered
io scheduler deadline registered (default)
i2c /dev entries driver
1f221000.uart0: ttyS0 at MMIO 0x0 (irq = 30, base_baud = 10800000) is a unknown
1f221200.uart1: ttyS1 at MMIO 0x0 (irq = 31, base_baud = 10800000) is a unknown
1f220400.uart2: ttyS2 at MMIO 0x0 (irq = 32, base_baud = 10800000) is a unknown
1f221400.uart2: ttyS3 at MMIO 0x0 (irq = 34, base_baud = 10800000) is a unknown
[ mstar_mci_init() ]
eMMC: no SD 1006
>> [emmc] get dts [bus-width]: 4
>> [emmc] get dts [max-clks]: 0
>> [emmc] get dts [clk-driving]: 0
>> [emmc] get dts [cmd-driving]: 0
>> [emmc] get dts [data-driving]: 0
[ms_cpufreq_init] Current clk=1005326304
mstar_spinand_probe: mstar_spinand enableClock
MSYS: DMEM request: [BDMA]:0x00000840
MSYS: DMEM request: [BDMA]:0x00000840 success, CPU phy:@0x27442000, virt:@0xC7442000
MDrv_SPINAND_Init: Detected ID: MID =c8, DID =1
_dumpNandInformation:warning, Bytes / Page : 2048
_dumpNandInformation:warning, Pages / Block: 64
_dumpNandInformation:warning, Sector/ Page : 512
_dumpNandInformation:warning, Spare / Page : 64
_dumpNandInformation:warning, Current config r:4 w:4 drv:1
mstar_spinand_probe: Magic memcmp pass
mstar_spinand_probe: Get partition (Block 0 : page 1)
mstar_spinand_probe: CIS contains part info
mstar_spinand_probe: Before nand_scan()...
13 cmdlinepart partitions found on MTD device nand0
mstar_spinand_probe: Mtd parts parse
Creating 13 MTD partitions on "nand0":
0x000000140000-0x0000001a0000 : "IPL0"
0x0000001a0000-0x000000200000 : "IPL1"
0x000000200000-0x000000260000 : "IPL_CUST0"
0x000000260000-0x0000002c0000 : "IPL_CUST1"
0x0000002c0000-0x000000380000 : "UBOOT0"
0x000000380000-0x000000440000 : "UBOOT1"
0x000000440000-0x000000480000 : "ENV"
0x000000480000-0x0000004c0000 : "ENV1"
0x0000004c0000-0x0000004e0000 : "KEY_CUST"
0x0000004e0000-0x000000540000 : "LOGO"
0x000000540000-0x000000a40000 : "KERNEL"
0x000000a40000-0x000000f40000 : "RECOVERY"
0x000000f40000-0x000008000000 : "UBI"
mmc0: new high speed MMC card at address 0001
mmcblk0: mmc0:0001 8GTF4R 7.28 GiB
mmcblk0boot0: mmc0:0001 8GTF4R partition 1 4.00 MiB
mmcblk0boot1: mmc0:0001 8GTF4R partition 2 4.00 MiB
mmcblk0rpmb: mmc0:0001 8GTF4R partition 3 512 KiB
mmcblk0: p1 p2 p3
NET: Registered protocol family 17
[mstar_pm_init] resume_pbase=0x20011455, suspend_imi_vbase=0xC800D000
ThumbEE CPU extension supported.
Registering SWP/SWPB emulation handler
ubi0: attaching mtd12
ubi0: scanning is finished
ubi0: attached mtd12 (name "UBI", size 112 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 902, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 4, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 0
ubi0: available PEBs: 33, total reserved PEBs: 869, PEBs reserved for bad PEB handling: 20
hctosys: unable to open rtc device (rtc0)
ubi0: background thread "ubi_bgt0d" started, PID 435
OF: fdt:not creating '/sys/firUBIFS (ubi0:0): UBIFS: mounted UBI device 0, volume 0, name "rootfs", R/O mode
UBIFS (ubi0:0): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
UBIFS (ubi0:0): FS size: 43552768 bytes (41 MiB, 343 LEBs), journal size 5967872 bytes (5 MiB, 47 LEBs)
UBIFS (ubi0:0): reserved for root: 0 bytes (0 KiB)
UBIFS (ubi0:0): media format: w4/r0 (latest is w4/r0), UUID CEB492CB-EAD4-4CF3-8E3C-63C823FD0CA1, small LPT model
VFS: Mounted root (ubifs filesystem) readonly on device 0:13.
devtmpfs: mounted
This architecture does not have kernel memory protection.
hostname: can't open '/etc/hostname': No such file or directory
Starting syslogd: /etc/init.d/S01syslogd: line 16: start-stop-daemon: not found
FAIL
Starting klogd: /etc/init.d/S02klogd: line 16: start-stop-daemon: not found
FAIL
Running sysctl: OK
Starting mdev... /etc/init.d/S10mdev: line 12: start-stop-daemon: not found
ERROR
modprobe: can't change directory to '4.9.84': No such file or directory
Saving random seed: SKIP (read-only file system detected)
UBIFS (ubi0:1): background thread "ubifs_bgt0_1" started, PID 469
UBIFS (ubi0:1): recovery needed
UBIFS (ubi0:1): recovery completed
UBIFS (ubi0:1): UBIFS: mounted UBI device 0, volume 1, name "miservice"
UBIFS (ubi0:1): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
UBIFS (ubi0:1): FS size: 9269248 bytes (8 MiB, 73 LEBs), journal size 1650688 bytes (1 MiB, 13 LEBs)
UBIFS (ubi0:1): reserved for root: 0 bytes (0 KiB)
UBIFS (ubi0:1): media format: w4/r0 (latest is w4/r0), UUID E8E2EA8C-440D-4DA8-8889-1D74FC65FD7D, small LPT model
UBIFS (ubi0:2): background thread "ubifs_bgt0_2" started, PID 472
UBIFS (ubi0:2): recovery needed
UBIFS (ubi0:2): recovery completed
UBIFS (ubi0:2): UBIFS: mounted UBI device 0, volume 2, name "customer"
UBIFS (ubi0:2): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
UBIFS (ubi0:2): FS size: 43552768 bytes (41 MiB, 343 LEBs), journal size 5967872 bytes (5 MiB, 47 LEBs)
UBIFS (ubi0:2): reserved for root: 0 bytes (0 KiB)
UBIFS (ubi0:2): media format: w4/r0 (latest is w4/r0), UUID B69642BA-3B0D-4EDB-B6AE-82FADC90F674, small LPT model
UBIFS (ubi0:3): background thread "ubifs_bgt0_3" started, PID 475
UBIFS (ubi0:3): recovery needed
UBIFS (ubi0:3): recovery completed
UBIFS (ubi0:3): UBIFS: mounted UBI device 0, volume 3, name "appconfigs"
UBIFS (ubi0:3): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
UBIFS (ubi0:3): FS size: 3047424 bytes (2 MiB, 24 LEBs), journal size 1142785 bytes (1 MiB, 8 LEBs)
UBIFS (ubi0:3): reserved for root: 0 bytes (0 KiB)
UBIFS (ubi0:3): media format: w4/r0 (latest is w4/r0), UUID 79046494-C959-4822-BE77-F3C5466E004C, small LPT model
mhal: loading out-of-tree module taints kernel.
mhal: module license 'PROPRIETARY' taints kernel.
Disabling lock debugging due to kernel taint
mhal driver init
jpe driver probed
DivpProcInit 515
module [sys] init
MI_SYSCFG_SetupMmapLoader default_config_path:/config/config_tool, argv1:/config/load_mmap,argv2:/config/mmap.ini
Function = init_glob_miu_kranges, Line = 640, Insert KProtect for LX @ MIU: 0
Function = init_glob_miu_kranges, Line = 649, [INIT] for LX0 kprotect: from 0x20000000 to 0x27F00000, using block 0
config...... strPath:/config/config_tool, argv0:/config/load_config
function:parese_Cmdline,pCmd_Section:0x7f00000
mm
a_
he
ap
_n
am
e0
miu=0,sz=500000 reserved_start=27700000
r_front->miuBlockIndex:0,r_front->start_cpu_bus_pa:0x20000000,r_front->start_cpu_bus_pa+r_front->length:0x27700000
r_back->miuBlockIndex:1,r_back->start_cpu_bus_pa:0x27c00000,r_back->start_cpu_bus_pa+r_back->length:0x27f00000
mi_sys_mma_allocator_create success, heap_base_addr=27700000 length=500000
Kernel CONFIG_HZ = 1000
Sigmastar Module version: project_commit.aa96c08 sdk_commit.050b243 /home/causer/swnas/workspace/ALL--ALKAID--ReleaseBuild/alka
module [gfx] init
module [disp] init
module [panel] init
[ss_gpi_intc_domain_alloc] hw:3 -> v:56
----------gsl_ts_init----------
[hr2046]:hr2046_init
Goodix-TS 1-005d: ID 911, version: 1060
Goodix-TS 1-005d: Direct firmware load for goodix_911_cfg.bin failed with error -2
input: Goodix Capacitive TouchScreen as /devices/soc0/soc/1f223200.i2c1/i2c-1/1-005d/input/input0
RPC: Registered named UNIX socket transport module.
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
ntfs: driver 2.1.32 [Flags: R/O MODULE].
insmod: can't insert '/config/modules/4.9.84/exfat.ko': No such file or directory
fuse init (API version 7.26)
MSYS: DMEM request: [AESDMA_ENG]:0x00001000
MSYS: DMEM request: [AESDMA_ENG]:0x00001000 success, CPU phy:@0x27443000, virt:@0xC7443000
MSYS: DMEM request: [AESDMA_ENG1]:0x00001000
MSYS: DMEM request: [AESDMA_ENG1]:0x00001000 success, CPU phy:@0x27444000, virt:@0xC7444000
cryptodev: driver 1.10(a1e738a) loaded.
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
ehci monitor start running
Mstar_ehc_init version:20180309
Sstar-ehci-2 H.W init
Titania3_series_start_ehc start
[USB] config miu select [70] [e8] [ef] [ef]
[USB] enable miu lower bound address subtraction
[USB] init squelch level 0x2
[USB] no platform_data, device tree coming
[USB][EHC] dma coherent_mask 0xffffffffffffffff mask 0xffffffffffffffff
BC disable
[USB] soc:Sstar-ehci-2 irq --> 39
Sstar-ehci-2 soc:Sstar-ehci-2: EHCI Host Controller
Sstar-ehci-2 soc:Sstar-ehci-2: new USB bus registered, assigned bus number 1
Sstar-ehci-2 soc:Sstar-ehci-2: irq 39, io mem 0xfd285000
usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb1: Product: EHCI Host Controller
usb usb1: Manufacturer: Linux 4.9.84 ehci_hcd
usb usb1: SerialNumber: mstar
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
Sstar-ehci-1 H.W init
Titania3_series_start_ehc start
[USB] config miu select [70] [e8] [ef] [ef]
[USB] enable miu lower bound address subtraction
[USB] init squelch level 0x2
[USB] no platform_data, device tree coming
[USB][EHC] dma coherent_mask 0xffffffffffffffff mask 0xffffffffffffffff
BC disable
[USB] soc:Sstar-ehci-1 irq --> 38
Sstar-ehci-1 soc:Sstar-ehci-1: EHCI Host Controller
Sstar-ehci-1 soc:Sstar-ehci-1: new USB bus registered, assigned bus number 2
Sstar-ehci-1 soc:Sstar-ehci-1: irq 38, io mem 0xfd284800
usb usb2: New USB device found, idVendor=1d6b, idProduct=0002
usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb2: Product: EHCI Host Controller
usb usb2: Manufacturer: Linux 4.9.84 ehci_hcd
usb usb2: SerialNumber: mstar
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
usbcore: registered new interface driver usb-storage
usbcore: registered new interface driver usbhid
usbhid: USB HID core driver
usbcore: registered new interface driver usbserial
usbcore: registered new interface driver ch341
usbserial: USB Serial support registered for ch341-uart
==20180309==> hub_port_init 1 #0
Plug in USB Port2
usbcore: registered new interface driver pl2303
usbserial: USB Serial support registered for pl2303
usbcore: registered new interface driver cdc_acm
cdc_acm: USB Abstract Control Model driver for USB modems and ISDN adapters
libphy: Fixed MDIO Bus: probed
usb 1-1: new high-speed USB device number 2 using Sstar-ehci-2
MSYS: DMEM request: [emac0_buff]:0x00000812
MSYS: DMEM request: [emac0_buff]:0x00000812 success, CPU phy:@0x2744B000, virt:@0xC744B000
libphy: mdio: probed
mdio_bus mdio-bus@emac0: /soc/emac0/mdio-bus@emac0/ethernet-phy@0 has invalid PHY address
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 0
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 1
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 2
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 3
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 4
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 5
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 6
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 7
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 8
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 9
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 10
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 11
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 12
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 13
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 14
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 15
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 16
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 17
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 18
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 19
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 20
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 21
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 22
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 23
usb 1-1: New USB device found, idVendor=1a40, idProduct=0801
usb 1-1: New USB device strings: Mfr=0, Product=1, SerialNumber=0
usb 1-1: Product: USB 2.0 Hub
hub 1-1:1.0: USB hub found
hub 1-1:1.0: 4 ports detected
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 24
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 25
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 26
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 27
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 28
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 29
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 30
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 31
[emac_phy_connect][3287] connected mac emac0 to PHY at mdio-bus@emac0:00 [uid=11112222, driver=SStar 10/100 Ethernet Phy]
env name CurrentVersion vrandom: fast init done
alue 0.0.0
env name EMMCUpgradeEnable value 0
env name Mstarbin value 20150709
env name UpgradeDev value usb
env name UpgradeDone value 1
env name UpgradeImage value ChituUpgrade.bin
env name UpgradeStatus value 0
env name autoestart value 0
env name beep_pwm_channel value 3
env name beep_pwm_pad value 12
env name bootargs value console=ttyS0,115200 ubi.mtd=UBI,2048 root=ubi:rootfs ro rootfstype=ubifs init=/linuxrc rootwait=1 LX_MEM=0x7f00000 mma_heap=mma_heap_name0,miu=0,sz=0x500000 mma_memblock_remove=1 highres=on mmap_reserved=fb,miu=0,sz=0x300000,max_start_off=0x7C00000,max_end_off=0x7F00000 mtdparts=nand0:384k@1280k(IPL0),384k(IPL1),384k(IPL_CUST0),384k(IPL_CUST1),768k(UBOOT0),768k(UBOOT1),256k(ENV),256k(ENV1),0x20000(KEY_CUST),0x60000(LOGO),0x500000(KERNEL),0x500000(RECOVERY),FAT-fs (mmcblk0p1): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive!
-(UBI)
env name bootcmd value nand read.e 0x22000000 KERNEL 0x1d7b70; ; bootm 0x22000000; nand read.e 0x220FAT-fs (mmcblk0p1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck.
00000 RECOVERY 0x1d7b70; bootm 0x22000000;
env name bootdelay value 1
env name chitu_factory_mode value 2
env name default_off_pad value 4,5
env name dispout value UE050WV_800x480
env name dnsip value 0.0.0.0
env name ethact value sstar_emac
env name ethaddr value 66:66:68:dd:1e:13
env name fileaddr value 23a024f8
env name filesize value 193008
env name gatewayip value 0.0.0.0
env name ipa==20180309==> hub_port_init 1 #0
ddr value 192.168.0.80
env name lcd_backlight_inversion value 0
env name lcd_backlight_pad value 90
env name lcd_reset_inversion value 0
env name lcd_reset_pad value 89
env name mtddevname value IPL0
env name mtddevnum value 0
env name Linux video capture interface: v2.00
mtdids value nand0=nand0
env name mtdparts value mtdparts=nand0:384k@1280k(IPL0),384k(IPL1),384k(IPL_CUST0),384k(IPL_CUST1),768k(UBOOT0),768k(UBOOT1),256k(ENV),256k(ENV1),0x20000(KEY_CUST),0x60000(LOGO),0x500000(KERNEL),0x500000(RECOVERY),-(UBI)
env name netmask value 255.255.255.0
env name partition value nand0,0
env name partition_reset value 0
env name rotate_enable value 2
env name serverip value 192.168.0.2
env namusb 1-1.1: new high-speed USB device number 3 using Sstar-ehci-2
e stderr value serial
env name stdin value serial
env name stdout value serial
env name usb_folder value images
umount: can't unmount /media/mmcblk0p1: Invalid argument
NTFS signature is missing.
Failed to mount '/dev/mmcblk0p1': Invalid argument
The device '/dev/mmcblk0p1' doesn't have a valid NTFS.
Maybe you selected the wrong device? Or the whole disk instead of a
partition (e.g. /dev/hda, not /dev/hda1)? Or the other way around?
umount: can't unmount /media/mmcblk0p2: Invalid argument
usbcore: registered new interface driver uvcvideo
USB Video Class driver (1.1.1)
NTFS signature is missing.
Failed to mount '/dev/mmcblk0p2': Invalid argument
The device '/dev/mmcblk0p2' doesn't have a valid NTFS.
Maybe you selected the wrong device? Or the whole disk instead of a
partition (e.g. /dev/hda, not /dev/hda1)? Or the other way around?
[sspi]:cs 8 sck 9 miso 11 mosi 10 config 14 status 73 done 13
FAT-fs (mmcblk0p2): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive!
[EXFAT] trying to mount...
[EXFAT] mounted successfully
usb 1-1.1: New USB device found, idVendor=a108, idProduct=2231
usb 1-1.1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[EXFAT] trying to unmount...
[EXFAT] unmounted successfully
[gpiospi]:sck 1 miso 3 mosi 2
usb 1-1.1: Product: CCX2F3298
usb 1-1.1: Manufacturer: UnionImage Co.,Ltd
usb 1-1.1: SerialNumber: 1234567890
uvcvideo: Found UVC 1.00 device CCX2F3298 (a108:2231)
input: CCX2F3298 as /devices/soc0/soc/soc:Sstar-ehci-2/usb1/1-1/1-1.1/1-1.1:1.0/input/input1
==20180309==> hub_port_init 2 #0
umount: can't unmount /media/mmcblk0p3: Invalid argument
NTFS signature is missing.
Failed to mount '/dev/mmcblk0p3': Invalid argument
The device '/dev/mmcblk0p3' doesn't have a valid NTFS.
Maybe you selected the wrong devicFAT-fs (mmcblk0p3): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive!
usb 1-1.2: new high-speed USB device number 4 using Sstar-ehci-2
[EXFAT] trying to mount...
e? Or the whole disk instead of a
partition (e.g. [EXFAT] mounted successfully
/dev/hda, not /dev/hda1)? Or the other way around?
[EXFAT] trying to unmount...
[EXFAT] unmounted successfully
hl_tpool_create_thread 0x8d798
hl_tpool_create_thread 0x84a2c
echo to syspath /sys/class/block/mmcblk0p2/uevent
echo to syspath /sys/class/block/mmcblk0p3/uevent
echo to syspath /sys/class/block/mmcblk0p1/uevent
echo to syspath /sys/class/block/mmcblk0/uevent
(none) login: usb 1-1.2: New USB device found, idVendor=0bda, idProduct=f179
usb 1-1.2: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 1-1.2: Product: 802.11n
usb 1-1.2: Manufacturer: Realtek
usb 1-1.2: SerialNumber: 34A6EF5FE2C2
umount: can't unmount /media/mmcblk0p2: Invalid argument
NTFS signature is missing.
Failed to mount '/dev/mmcblk0p2': Invalid argument
The device '/dev/mmcblk0p2' doesn't have a valid NTFS.
Maybe you selected the wrong device? Or the whole disk instead of a
parFAT-fs (mmcblk0p2): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive!
[EXFAT] trying to mount...
tition (e.g. /dev/hd[EXFAT] mounted successfully
a, not /dev/hda1)? Or the other way around?
umount: can't unmount /media/mmcblk0p3: Invalid argument
NTFS signature is missing.
Failed to mount '/dev/mmcblk0p3': Invalid argument
The device '/dev/mmcblk0p3' doesn't have a valid NTFS.
Maybe you selected the wrong device?FAT-fs (mmcblk0p3): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive!
[EXFAT] trying to mount...
Or the whole disk instead of a
partition (e.g. /d[EXFAT] mounted successfully
ev/hda, not /dev/hda1)? Or the other way around?
umount: can't unmount /media/mmcblk0p1: Invalid argument
NTFS signature is missing.
Failed to mount '/dev/mmcblk0p1': Invalid argument
The device '/dev/mmcblk0p1' doesn't have a valid NTFS.
Maybe you selected the wrong deviceFAT-fs (mmcblk0p1): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive!
? Or FAT-fs (mmcblk0p1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck.
the whole disk instead of a
partition (e.g. /dev/hda, not /dev/hda1)? Or the other way around?
hl_tpool_create_thread 0x7fd90
umount: can't unmount /media/mmcblk0: Invalid argument
NTFS signature is missing.
Failed to mount '/dev/mmcblk0': Invalid argument
The device '/dev/mmcblk0' doesn't have a valid NTFS.
Maybe you selected the wrong device? Or the whole disk instead of a
partition (e.g. /dev/hda, not /dev/hda1)? Or the other way around?
mount: mounting /dev/mmcblk0 on /media/mmcblk0 failed: Device or resource busy
[GOP]HalGopUpdateGwinParam 720: GOP_id=011 not support
[GOP]HalGopSetArgb1555Alpha 1208: GOPId=0x11 not support
[GOP]HalGopSetArgb1555Alpha 1208: GOPId=0x11 not support
sstar_FB_SetBlending 402 u8GOP=1,u8win=0 aType=1 u8constAlpha=255
[emac_phy_link_adjust] EMAC Link Down
Freeing fb memory: 3072K
total face_number = 8
face_index 0 family_name Roboto + Cairo + Noto Sans CJK JP Bold style_name Bold
face_index 1 family_name Roboto + Cairo + Noto Sans CJK JP Regular style_name Regular
face_index 2 family_name Roboto + Cairo + Noto Sans CJK KR Bold style_name Bold
face_index 3 family_name Roboto + Cairo + Noto Sans CJK KR Regular style_name Regular
face_index 4 family_name Roboto + Cairo + Noto Sans CJK SC Bold style_name Bold
face_index 5 family_name Roboto + Cairo + Noto Sans CJK SC Regular style_name Regular
face_index 6 family_name Roboto + Cairo + Noto Sans CJK TC Bold style_name Bold
face_index 7 family_name Roboto + Cairo + Noto Sans CJK TC Regular style_name Regular
width 800, height 480
hsc32c1_init start
##########################HSC32C1 VERSION 0326#####################[ss_gpi_intc_domain_alloc] hw:58 -> v:57
#####
fpga_lattic[ss_gpi_intc_domain_alloc] hw:42 -> v:58
e_init ok
ERROR: Bus[0] in ms_i2c_xfer_write: Slave dev NAK, Addr: 0x82, Data: 0xff 0x80
Unable to send data: Connection timed out
ERROR: Bus[0] in ms_i2c_xfer_write: Slave dev NAK, Addr: 0x82, Data: 0xee 0x1
Unable to send data: Connection timed out
ERROR: Bus[0] in ms_i2c_xfer_write: Slave dev NAK, Addr: 0x82, Data: 0xff 0x81
Unable to send data: Connection timed out
ERROR: Bus[0] in ms_i2c_xfer_write: Slave dev NAK, Addr: 0x82, Data: 0x0
Unable to send data: Connection timed out
[fpreg=0x1F003410 clk=12000000, period=0xea5f
reg=0x1F003408 clk=12000000, u32Duty=0x0
reg=0x1F003490 clk=12000000, period=0xea5f
reg=0x1F003488 clk=12000000, u32Duty=0x0
reg=0x1F003590 clk=12000000, period=0xbb7
reg=0x1F003588 clk=12000000, u32Duty=0x0
[ss_gpi_intc_domain_alloc] hw:43 -> v:59
ga][Info][7627]:#########[fpga]: real_x:13320 real_y:5120 x:13320 y:5120 version:43.3########
[axis][Info][7654]:v0 1.000000 accleration 50.000000 dt 0.010000
[fpga_extend][Info][7656]:In: f0 = 1600 accleration = 80000 df = 800 dt = 0.010000
hl_tpool_create_thread 0x5989c
[barcode_scanner][Info][7795]:enter scanner_routine !
usbcore: registered new interface driver rtl8188fu
#1#verify digest:bc b9 62 5 a2 4d 86 64 4f ad 88 f e6 cd 76 4
#2#verify digest:bc b9 62 5 a2 4d 86 64 4f ad 88 f e6 cd 76 4
hl_tpool_create_thread 0x8c348
hl_tpool_create_thread 0x85a18
hl_tpool_create_thread 0x88380
hl_tpool_create_thread 0x86c88
hl_tpool_create_thread 0x89868
[hl_net][Info][9255]:eth_callback
hl_tpool_create_thread 0x8407c
[hl_net][Info][9256]:#########thread msg eth0 event 1 status 0#########
hl_tpool_create_thread 0x5c370
hl_tpool_create_thread 0x5b850
hl_tpool_create_thread 0x12777c
[h264][Debug][9259]:rsa loop
[h264][Debug][9259]:new one
[h264][Debug][9261]:BN_set_word ret = 1
[h264][Debug][9262]:BN_new success
[creality_app][Info][9302]:mac FCEE32020BCD --- sn R0060012024052700000478 --- dn 92781532020BCD
ERR: FUNC utils_get_suffix LINE 195 COND (strlen(filereg=0x1F003490 clk=12000000, period=0x257
reg=0x1F003488 clk=12000000, u32Duty=0x0
path) > 1)
ERR: FUNC utils_greg=0x1F003410 clk=12000000, period=0x257
reg=0x1F003408 clk=12000000, u32Duty=0x0
et_suffix LINE 195 COND (strlen(filepath) > 1)
[creality_app][Info][9303]:lapse_file_list_count 2
ERR: FUNC utils_get_suffix LINE 195 COND (strlen(filepath) > 1)
[creality_app][Info][9306]:creality_app_init_lapse_file done
hl_tpool_create_thread 0x6e788
hl_tpool_create_thread 0x69a0c
hl_tpool_create_thread 0x6780c
hl_tpool_create_thread 0x69ddc
hl_tpool_create_thread 0x5a168
[devices][Info][9341]:last_mainboard_fan_state -1 mainboard_fan_state 0
hl_tpool_create_thread 0x66044
[tlp][Debug][9403]:disk_path : /media/mmcblk0p2
[rtsp_server][Info][9404]:rtp sock : 28
[rtsp_server][Info][9404]:rtcp sock : 29
[rtsp_server][Info][9410]:socket success[704774146
, fd_socket [rtsp_server][Info][9410]:bind success
[rtsp_server][Info][9410]:listen success
[tlp][Debug][9411]:fp open
[tlp][Debug][9411]:fp != NULL
get file size : -1272059300
get file name :
2953483 local_21980263.mp4
get file size : 2953483
get file name : local_21980263.mp4
size : 2953483
size M : 2 MB
2651176 local_24284.mp4
get file size : 2651176
get file name : local_24284.mp4
size : 5604659
size M : 5 MB
21 log
get file size : 21
get file name : log
4193739 log2
get file size : 4193739
get file name : log2
1407418 log1
get file size : 1407418
get file name : log1
file total : 5MB
client [522] connected, module:sys
ERROR: Bus[0] in ms_i2c_xfer_read: Slave dev NAK, Addr: 0xc9, Data: 0xe1 0x75 0xd2 0x9e 0x24 0x46 0xd8
Unable to send data: Connection timed out
[core][Info][9860]:verify auth ok
hl_tpool_create_thread 0x3f5e8
[core][Info][9860]:core_routine start
[widget][Info][9865]:widget_bin_header.window_numbers = 52
[feed][Debug][11016]:timeout
[hl_wlan][Info][11253]:wlan_interface_scan start
[hl_wlan][Info][11254]:wlan_interface_scan end
[hl_wlan][Info][11254]:wlan_interface_append
[hl_wlan][Info][11255]:wpa_supplicant don't exist
[hl_camera][Info][11266]:found camera 0
[hl_camera][Info][11266]:camera supported :V4L2_CAP_EXT_PIX_FORMAT
[hl_camera][Info][11266]:index 0 type 1 flags 1 description Motion-JPEG pixelformat 47504a4d
[hl_camera][Info][11266]:V4L2_FRMSIZE_TYPE_DISCRETE: cw 1920 ch 1080
[hl_camera][Info][11266]:V4L2_FRMSIZE_TYPE_DISCRETE: cw 1280 ch 960
[hl_camera][Info][11266]:V4L2_FRMSIZE_TYPE_DISCRETE: cw 1280 ch 720
[hl_camera][Info][11266]:V4L2_FRMSIZE_TYPE_DISCRETE: cw 800 ch 600
[hl_camera][Info][11266]:V4L2_FRMSIZE_TYPE_DISCRETE: cw 640 ch 480
[hl_camera][Info][11266]:V4L2_FRMSIZE_TYPE_DISCRETE: cw 640 ch 360
[hl_camera][Info][11266]:index 1 type 1 flags 0 description YUYV 4:2:2 pixelformat 56595559
[hl_camera][Info][11266]:V4L2_FRMSIZE_TYPE_DISCRETE: cw 1920 ch 1080
[hl_camera][Info][11266]:V4L2_FRMSIZE_TYPE_DISCRETE: cw 1280 ch 960
[hl_camera][Info][11266]:V4L2_FRMSIZE_TYPE_DISCRETE: cw 1280 ch 720
[hl_camera][Info][11266]:V4L2_FRMSIZE_TYPE_DISCRETE: cw 800 ch 600
[hl_camera][Info][11266]:V4L2_FRMSIZE_TYPE_DISCRETE: cw 640 ch 480
[hl_camera][Info][11266]:V4L2_FRMSIZE_TYPE_DISCRETE: cw 640 ch 360
[hl_camera][Info][11266]:index 2 type 1 flags 0 description Y/CbCr 4:2:0 pixelformat 3231564e
[hl_camera][Info][11266]:V4L2_FRMSIZE_TYPE_DISCRETE: cw 1920 ch 1080
[hl_camera][Info][11266]:V4L2_FRMSIZE_TYPE_DISCRETE: cw 1280 ch 960
[hl_camera][Info][11266]:V4L2_FRMSIZE_TYPE_DISCRETE: cw 1280 ch 720
[hl_camera][Info][11266]:V4L2_FRMSIZE_TYPE_DISCRETE: cw 800 ch 600
[hl_camera][Info][11267]:V4L2_FRMSIZE_TYPE_DISCRETE: cw 640 ch 480
[hl_camera][Info][11267]:V4L2_FRMSIZE_TYPE_DISCRETE: cw 640 ch 360
[hl_camera][Info][11267]:index 3 type 1 flags 1 description H.264 pixelformat 34363248
[hl_camera][Info][11267]:V4L2_FRMSIZE_TYPE_DISCRETE: cw 1920 ch 1080
[hl_camera][Info][11267]:V4L2_FRMSIZE_TYPE_DISCRETE: cw 1280 ch 960
[hl_camera][Info][11267]:V4L2_FRMSIZE_TYPE_DISCRETE: cw 1280 ch 720
[hl_camera][Info][11267]:V4L2_FRMSIZE_TYPE_DISCRETE: cw 800 ch 600
[hl_camera][Info][11267]:V4L2_FRMSIZE_TYPE_DISCRETE: cw 640 ch 480
[hl_camera][Info][11267]:V4L2_FRMSIZE_TYPE_DISCRETE: cw 640 ch 360
[hl_camera][Info][11268]:width 1280 height 720 pixelformat 34363248
[hl_camera][Info][11271]:mmap_buf_count 2
[hl_camera][Info][11271]:############################################camera init video0############################################
[hl_camera][Info][11271]:final found devname video0
Successfully initialized wpa_supplicant
rfkill: Cannot open RFKILL control device
[hl_wlan][Info][12143]:wlan init
[hl_net][Info][12147]:wlan_callback: id 0 interface wlan0
[hl_net][Info][12147]:wlan_callback: status 2
[hl_net][Info][12164]:#########thread msg wlan0 event 0 status 0#########
[hl_net][Info][12164]:net_init wlan0 enable 1
[hl_net][Info][12164]:hl_callback_call HL_NET_EVENT_STATUS_CHANGED
[hl_net][Info][12165]:net_enable sm received event_id -2
[hl_net][Info][12165]:net_enable sm received event_id 0
[creality_app][Info][12165]:net_event_callback: creality_halotbox_send_event CREALITY_APP_EVENT_LAN_CHANGED1
[creality_app][Info][12165]:net_event_callback: creality_halotbox_send_event CREALITY_APP_EVENT_LAN_CHANGED2
[creality_app][Info][12165]:net_event_callback: creality_halotbox_websocket_send_event CREALITY_APP_EVENT_LAN_CHANGED3
[creality_app][Info][12165]:net_event_callback: creality_halotbox_websocket_send_event CREALITY_APP_EVENT_LAN_CHANGED4
[creality_app][Info][12165]:net_event_callback: creality_app_send_event CREALITY_APP_EVENT_WAN_CHANGED1
[creality_app][Info][12165]:net_event_callback: creality_app_send_event CREALITY_APP_EVENT_WAN_CHANGED2
[creality_app][Info][12167]:creality_app_routine event.id = 3
[hl_wlan][Info][12168]:append ssid XXXXXXXXXXX psk XXXXXXXXXXX:
[creality_app][Info][12175]:creality_halotbox_websocket_routine event.id = 4
[creality_app][Info][12183]:creality_halotbox_routine event.id = 4
udhcpc: started, v1.34.1
udhcpc: broadcasting discover
[hl_net][Info][14308]:wlan_callback: id 2 interface wlan0
[hl_net][Info][15260]:wlan_callback: id 0 interface wlan0
[hl_net][Info][15261]:wlan_callback: status 3
[hl_wlan][Info][15261]:current ssid not request ssid
[hl_wlan][Info][15261]:wlan connected bssid 72:a7:41:36:7a:08 ssid XXXXXXXXXXX
udhcpc: broadcasting discover
udhcpc: broadcasting select for XXXXXXXXXXX, server XXXXXXXXXXX
udhcpc: lease of XXXXXXXXXXX obtained from XXXXXXXXXXX, lease time 86400
deleting routers
adding dns XXXXXXXXXXX
[hl_net][Info][15716]:#########thread msg wlan0 event 2 status 2#########
[hl_net][Info][15717]:net_enable sm received event_id 10
[hl_net][Info][15717]:net_enable hl_callback_call1
[creality_app][Info][15717]:net_event_callback: creality_halotbox_send_event CREALITY_APP_EVENT_LAN_CHANGED1
[creality_app][Info][15717]:net_event_callback: creality_halotbox_send_event CREALITY_APP_EVENT_LAN_CHANGED2
[creality_app][Info][15717]:net_event_callback: creality_halotbox_websocket_send_event CREALITY_APP_EVENT_LAN_CHANGED3
[creality_app][Info][15717]:net_event_callback: creality_halotbox_websocket_send_event CREALITY_APP_EVENT_LAN_CHANGED4
[hl_net][Info][15717]:net_enable hl_callback_call2
[hl_net][Info][15717]:net_enable hl_callback_call3
[creality_app][Info][15717]:net_event_callback: creality_app_send_event CREALITY_APP_EVENT_WAN_CHANGED1
[creality_app][Info][15717]:net_event_callback: creality_app_send_event CREALITY_APP_EVENT_WAN_CHANGED2
[hl_net][Info][15717]:net_enable hl_callback_call4
[hl_net][Info][15717]:net_enable hl_sm_send_event NET_SM_EVENT_ID_DHCP_DISABLE
[creality_app][Info][15721]:creality_app_routine event.id = 3
[creality_app][Info][15721]:creality_halotbox_websocket_routine event.id = 4
[creality_app][Info][15726]:creality_halotbox_routine event.id = 4
[hl_net][Info][15767]:#########thread msg wlan0 event 0 status 2#########
[hl_net][Info][15767]:net_enable sm received event_id 2
[hl_net][Info][15817]:#########thread msg wlan0 event 3 status 2#########
[hl_net][Info][15817]:net_enable sm received event_id 6
[hl_net][Info][15817]:dhcp success
[hl_net][Info][15818]:dns_addr XXXXXXXXXXX
[hl_net][Info][15818]:dns 0 XXXXXXXXXXX
[hl_net][Info][15868]:net_enable sm received event_id 1
[creality_app][Info][15868]:net_event_callback: creality_halotbox_send_event CREALITY_APP_EVENT_LAN_CHANGED1
[creality_app][Info][15868]:net_event_callback: creality_halotbox_send_event CREALITY_APP_EVENT_LAN_CHANGED2
[creality_app][Info][15868]:net_event_callback: creality_halotbox_websocket_send_event CREALITY_APP_EVENT_LAN_CHANGED3
[creality_app][Info][15868]:net_event_callback: creality_halotbox_websocket_send_event CREALITY_APP_EVENT_LAN_CHANGED4
[creality_app][Info][15868]:net_event_callback: creality_app_send_event CREALITY_APP_EVENT_WAN_CHANGED1
[creality_app][Info][15868]:net_event_callback: creality_app_send_event CREALITY_APP_EVENT_WAN_CHANGED2
[creality_app][Info][15878]:creality_halotbox_websocket_routine event.id = 4
[creality_app][Info][15881]:creality_app_routine event.id = 3
[creality_app][Info][15882]:creality_halotbox_routine event.id = 4
[hl_net][Info][15966]:net_enable sm received event_id 9
[hl_net][Info][16016]:net_enable sm received event_id 0
[creality_app][Info][16016]:net_event_callback: creality_halotbox_send_event CREALITY_APP_EVENT_LAN_CHANGED1
[creality_app][Info][16016]:net_event_callback: creality_halotbox_send_event CREALITY_APP_EVENT_LAN_CHANGED2
[creality_app][Info][16016]:net_event_callback: creality_halotbox_websocket_send_event CREALITY_APP_EVENT_LAN_CHANGED3
[creality_app][Info][16016]:net_event_callback: creality_halotbox_websocket_send_event CREALITY_APP_EVENT_LAN_CHANGED4
[creality_app][Info][16016]:net_event_callback: creality_app_send_event CREALITY_APP_EVENT_WAN_CHANGED1
[creality_app][Info][16016]:net_event_callback: creality_app_send_event CREALITY_APP_EVENT_WAN_CHANGED2
[creality_app][Info][16025]:creality_halotbox_routine event.id = 4
[creality_app][Info][16030]:creality_halotbox_websocket_routine event.id = 4
udhcpc: started, v1.34.1
[creality_app][Info][16046]:creality_app_routine event.id = 3
udhcpc: broadcasting discover
udhcpc: broadcasting select for XXXXXXXXXXX, server XXXXXXXXXXX
udhcpc: lease of XXXXXXXXXXX obtained from XXXXXXXXXXX, lease time 86400
deleting routers
[hl_net][Info][16264]:wlan0 lan connected
[creality_app][Info][16265]:net_event_callback: creality_halotbox_send_event CREALITY_APP_EVENT_LAN_CHANGED1
[creality_app][Info][16265]:net_event_callback: creality_halotbox_send_event CREALITY_APP_EVENT_LAN_CHANGED2
[creality_app][Info][16265]:creality_halotbox_routine event.id = 4
[creality_app][Info][16265]:net_event_callback: creality_halotbox_websocket_send_event CREALITY_APP_EVENT_LAN_CHANGED3
[creality_app][Info][16265]:net_event_callback: creality_halotbox_websocket_send_event CREALITY_APP_EVENT_LAN_CHANGED4
[creality_app][Info][16269]:creality_halotbox_websocket_routine event.id = 4
[creality_app][Info][16269]:creality_halotbox_websocket_init
adding dns XXXXXXXXXXX
[hl_net][Info][16381]:net_enable sm received event_id 2
[hl_net][Info][16431]:net_enable sm received event_id 6
[hl_net][Info][16431]:dhcp success
[hl_net][Info][16432]:dns_addr XXXXXXXXXXX
[hl_net][Info][16432]:dns 0 XXXXXXXXXXX
[h264][Debug][18967]:RSA_generate_key_ex ret = 1
[h264][Debug][18968]:new one
[h264][Debug][18968]:BN_set_word ret = 1
[h264][Debug][18968]:BN_new success
[feed][Debug][21026]:timeout
[hl_net][Info][26538]:wlan0 wan connected
[creality_app][Info][26538]:net_event_callback: creality_app_send_event CREALITY_APP_EVENT_WAN_CHANGED1
[creality_app][Info][26538]:net_event_callback: creality_app_send_event CREALITY_APP_EVENT_WAN_CHANGED2
[devices][Info][26539]:ntpd start
[creality_app][Info][26547]:creality_app_routine event.id = 3
[creality_app][Info][26547]:mqtt_deinit:wan_status == 1 && mqtt_status == 0 mqtt_config.valid 0
[creality_app][Info][26548]:http_register
[barcode_scanner][Info][26573]:get SN value from eeprom: 10000732060G124GHDZ
[h264][Debug][27256]:RSA_generate_key_ex ret = 1
[h264][Debug][27256]:new one
[h264][Debug][27256]:BN_set_word ret = 1
[h264][Debug][27256]:BN_new success
[feed][Debug][31036]:timeout
[h264][Debug][36784]:RSA_generate_key_ex ret = 1
[h264][Debug][36784]:new one
[h264][Debug][36784]:BN_set_word ret = 1
[h264][Debug][36784]:BN_new success
[creality_app][Info][39316]:timeout valid 0 region_valid 1
[creality_app][Info][39316]:http_register
[barcode_scanner][Info][39316]:current sn is normal : 10000732060G124GHDZ
[feed][Debug][41045]:timeout
[h264][Debug][48905]:RSA_generate_key_ex ret = 1
[feed][Debug][51053]:timeout
[feed][Debug][61055]:timeout
[creality_app][Info][69672]:timeout valid 0 region_valid 1
[creality_app][Info][69672]:http_register
[barcode_scanner][Info][69673]:current sn is normal : 10000732060G124GHDZ
[feed][Debug][71058]:timeout
[feed][Debug][81058]:timeout
[feed][Debug][91064]:timeout
[creality_app][Info][100080]:timeout valid 0 region_valid 1
[creality_app][Info][100080]:http_register
[barcode_scanner][Info][100080]:current sn is normal : 10000732060G124GHDZ
[feed][Debug][101066]:timeout
[feed][Debug][111071]:timeout
random: crng init done
[feed][Debug][121076]:timeout
[creality_app][Info][130446]:timeout valid 0 region_valid 1
[creality_app][Info][130446]:http_register
[barcode_scanner][Info][130446]:current sn is normal : 10000732060G124GHDZ
[feed][Debug][131077]:timeout
[feed][Debug][141087]:timeout
[feed][Debug][151098]:timeout
[feed][Debug][161102]:timeout
[creality_app][Info][161996]:timeout valid 0 region_valid 1
[creality_app][Info][161996]:http_register
[barcode_scanner][Info][161996]:current sn is normal : 10000732060G124GHDZ
[feed][Debug][171103]:timeout
[feed][Debug][181108]:timeout
[feed][Debug][191109]:timeout
[creality_app][Info][192289]:timeout valid 0 region_valid 1
[creality_app][Info][192289]:http_register
[barcode_scanner][Info][192289]:current sn is normal : 10000732060G124GHDZ
[feed][Debug][201118]:timeout
[feed][Debug][211120]:timeout
[feed][Debug][221128]:timeout
[creality_app][Info][222874]:timeout valid 0 region_valid 1
[creality_app][Info][222874]:http_register
[barcode_scanner][Info][222874]:current sn is normal : 10000732060G124GHDZ
[feed][Debug][231130]:timeout
[feed][Debug][241132]:timeout
[feed][Debug][251134]:timeout
[creality_app][Info][253339]:timeout valid 0 region_valid 1
[creality_app][Info][253339]:http_register
[barcode_scanner][Info][253339]:current sn is normal : 10000732060G124GHDZ
[feed][Debug][261135]:timeout
[feed][Debug][271137]:timeout
[feed][Debug][281144]:timeout
[creality_app][Info][283838]:timeout valid 0 region_valid 1
[creality_app][Info][283838]:http_register
[barcode_scanner][Info][283838]:current sn is normal : 10000732060G124GHDZ
[feed][Debug][291154]:timeout
[feed][Debug][301159]:timeout
[feed][Debug][311167]:timeout
[creality_app][Info][314430]:timeout valid 0 region_valid 1
[creality_app][Info][314430]:http_register
[barcode_scanner][Info][314430]:current sn is normal : 10000732060G124GHDZLooks like our Mage S is sporting a dual-core ARMv7 CPU. It also logs a lot of errors and WiFi passwords apparently. But it's nice to see some familiar faces, like U-boot and Linux.
Though the hope of shell access over serial fell through, I think I can work with this.
Dissecting the update package
With limited options left, I elected to turn my attention to the update package. It was a bit of a pain to find initially and I even resorted to intercepting the printer's network traffic (including allowing it internet access briefly) to find the endpoint it contacted for update checks, but to no avail. As it turned out though, this was wholly unnecessary because update packages are available to download at https://www.crealitycloud.com/software-firmware/firmware/halot-series (not Creality's main site as I had thought).
The download comes as a .tar.gz file with only one file inside - a ChituUpgrade.bin. Looks like the Chitu prefix does indeed stand for none other than Chitu Systems of CHITUBOX fame. Seems as though they make firmware for a lot of 3D printer manufacturers.
With that out of the way, let's look at the ChituUpgrade.bin file itself. I like to start with the file command as it can save a lot of time when dealing with unhelpful file extensions like .bin. Unfortunately, this time it wasn't particularly helpful either:
> file ChituUpgrade.bin
ChituUpgrade.bin: dataOn to hexedit to take a closer look, and bingo! The file appears to have an ASCII header which helpfully discloses more information yet. For update package version 2.311.04 the command head -c 3256 ChituUpgrade.bin will print out the whole header and nothing else. For your convenience, I include it below:
# <- this is for comment / total file size must be less than 4KB
#upgrade_bin_version=2.311.04
#upgrade_force=1
# File Partition: cis.es
fatload usb 0 0x21000000 $(UpgradeImage) 0x5608 0x4000
crccheck 0x21000000 0x5608
fatload usb 0 0x21800000 $(UpgradeImage) 0x208 0xa000
crccheck 0x21800000 0x208
writecis 0x21000000 0x21800000 10 0 0 5
# File Partition: set_partition.es
mtdparts del CIS
setenv mtdparts $(mtdparts),0x20000(KEY_CUST),0x60000(LOGO),0x500000(KERNEL),0x500000(RECOVERY),-(UBI)
saveenv
nand erase.part UBI
ubi part UBI
ubi create rootfs 0x2C00000
ubi create miservice 0xA00000
ubi create customer 0x2C00000
ubi create appconfigs 0x400000
# File Partition: ipl.es
fatload usb 0 0x21000000 $(UpgradeImage) 0x5be8 0xb000
crccheck 0x21000000 0x5be8
nand erase.part IPL0
nand write.e 0x21000000 IPL0 0x5BE0
nand erase.part IPL1
nand write.e 0x21000000 IPL1 0x5BE0
# File Partition: ipl_cust.es
fatload usb 0 0x21000000 $(UpgradeImage) 0x5368 0x11000
crccheck 0x21000000 0x5368
nand erase.part IPL_CUST0
nand write.e 0x21000000 IPL_CUST0 0x5360
nand erase.part IPL_CUST1
nand write.e 0x21000000 IPL_CUST1 0x5360
# File Partition: uboot.es
fatload usb 0 0x21000000 $(UpgradeImage) 0x3cedc 0x17000
crccheck 0x21000000 0x3cedc
nand erase.part UBOOT0
nand write.e 0x21000000 UBOOT0 0x3CED4
nand erase.part UBOOT1
nand write.e 0x21000000 UBOOT1 0x3CED4
# File Partition: logo.es
fatload usb 0 0x21000000 $(UpgradeImage) 0x18c6c 0x54000
crccheck 0x21000000 0x18c6c
nand erase.part LOGO
nand write.e 0x21000000 LOGO 0x18C64
# File Partition: kernel.es
fatload usb 0 0x21000000 $(UpgradeImage) 0x1d7b78 0x6d000
crccheck 0x21000000 0x1d7b78
nand erase.part KERNEL
nand write.e 0x21000000 KERNEL 0x1D7B70
nand erase.part RECOVERY
nand write.e 0x21000000 RECOVERY 0x1D7B70
# File Partition: rootfs.es
ubi part UBI
fatload usb 0 0x21000000 $(UpgradeImage) 0x1e65008 0x245000
crccheck 0x21000000 0x1e65008
ubi write 0x21000000 rootfs 0x1E65000
# File Partition: miservice.es
ubi part UBI
fatload usb 0 0x21000000 $(UpgradeImage) 0x899008 0x20ab000
crccheck 0x21000000 0x899008
ubi write 0x21000000 miservice 0x899000
# File Partition: customer.es
ubi part UBI
fatload usb 0 0x21000000 $(UpgradeImage) 0x1c56008 0x2945000
crccheck 0x21000000 0x1c56008
ubi write 0x21000000 customer 0x1C56000
# File Partition: appconfigs.es
ubi part UBI
fatload usb 0 0x21000000 $(UpgradeImage) 0x193008 0x459c000
crccheck 0x21000000 0x193008
ubi write 0x21000000 appconfigs 0x193000
# File Partition: set_config
setenv bootargs console=ttyS0,115200 ubi.mtd=UBI,2048 root=ubi:rootfs ro rootfstype=ubifs init=/linuxrc rootwait=1 LX_MEM=0x7f00000 mma_heap=mma_heap_name0,miu=0,sz=0x500000 mma_memblock_remove=1 highres=on mmap_reserved=fb,miu=0,sz=0x300000,max_start_off=0x7C00000,max_end_off=0x7F00000 $(mtdparts)
setenv bootcmd 'nand read.e 0x22000000 KERNEL 0x1d7b70; ; bootm 0x22000000; nand read.e 0x22000000 RECOVERY 0x1d7b70; bootm 0x22000000;
setenv dispout UE050WV_800x480
setenv lcd_backlight_pad 90
setenv lcd_reset_pad 89
setenv lcd_backlight_inversion 0
setenv lcd_reset_inversion 0
setenv rotate_enable 2
setenv beep_pwm_channel 3
setenv beep_pwm_pad 12
setenv default_off_pad 4,5
setenv autoestart 0
saveenv
saveenv
% <- this is end of script symbolFor those familiar with U-boot, the text above will be obvious. For those less so, like myself, it can take a little digging. I found the following resources helpful: https://docs.u-boot.org/en/latest/usage/environment.html (wayback link), https://hub.digi.com/dp/path=/support/asset/u-boot-reference-manual/ (wayback link).
In short, the above script tells U-boot how to apply the update. As far as I can tell, the ChituUpgrade.bin file is first extracted and copied to an internal storage by the running system. It then queues up this script (denoted by the helpfully commented start and end symbols) to be executed by U-boot on next boot. Finally, the system reboots.
Those eagle-eyed of you will also have spotted the line:
setenv bootargs console=ttyS0,115200 ubi.mtd=UBI,2048 root=ubi:rootfs ro rootfstype=ubifs init=/linuxrc rootwait=1 LX_MEM=0x7f00000 mma_heap=mma_heap_name0,miu=0,sz=0x500000 mma_memblock_remove=1 highres=on mmap_reserved=fb,miu=0,sz=0x300000,max_start_off=0x7C00000,max_end_off=0x7F00000 $(mtdparts)Or more specifically, console=ttyS0,115200. This is how I figured out the correct Baud rate earlier.
The next step is only natural. I edited the version number at the top of the script using hexedit and also further down in the file (the search function is very helpful in finding the other instance). I bumped the most minor version by one (be careful, read on before you try this), then compressed the whole binary file again, named the archive in the same format as the original, copied it to a USB drive, and ran to my printer to try it out.
The feeling of excitement when I saw my handmade update package appear on the printer screen was incredible. Doubly so when I was able to select the update to be applied, and it reached its peak when the printer successfully rebooted and showed the new version number on the screen. Of course the change is minor, but it proves one important fact: update packages are not signed.
But heed my warning before you try this yourself. It looks like the printer has rollback protection enabled. As such, if you increment the version number too high, you may not be able to install a genuine software update once it comes out. At least not without significantly modifying the system, which is a lot harder and more risky than changing the version number.
One thing I have yet to confirm, is whether the upgrade_force flag at the top of the script can be used to disable rollback protection. I'm not sure what else it could possibly mean, but I've not been able to confirm one way or the other at the moment.
Conclusion
This is not the end. It's anything but. Unsigned updates are an open door to limitless modding, and I'm currently working on a second write-up on decoding the remainder of the ChituUpgrade.bin file. Eventually, I plan to publish an update package which will automatically root the printer and grant shell access to those who want it. All for a printing experience that's truly yours, without any clouds; just that sweet, sweet UV.
Stay tuned!