fun hacking on casio's vodafone messagecam!

well, i found a casio mc20b aka vodafone messagecam NIB locally. it was cheap and i heard it has ce 2.12 so thought why not have a look at it.

specs here: http://www.compuseum.de/mc-20b.html - but it runs CE 2.12, not 2.11!
also has a very nice screen, i cannot believe it is dstn, maybe it is not? sure looks like a tft to me

to my surprise it had basically no trace left from the normal CE looks / shell. if i hadn't been told i wouldn't have realized it was a CE device. i found traces of the CE looks only in about two programs and they must have been accidentally left there. even worse, no file explorer or even a decent fileopen dialog or anything of course. naturally some programs have to have an open dialog but those were really limited again, they wouldn't even see stuff in other folders than the default (hardcoded) ones. or if i copied my own files they wouldn't see those either!! just the files that had been created on the device or downloaded to it (in the case of html page saving). by the way it has worldtalk for a browser, not IE. and even though i found an uninstall dialog in the modified "control panel" (very much modified, it isn't even made out of the real CE control panel), there was no way to install apps, the manual told me about the uninstall, but didn't mention installing, lol.. so, this absolutely looked like there was no way out of the proprietary casio shell

but then i talked to TFGBD and it turned out in the end that the trick was the same as on the BE300 just create a CE/R4100 path on the mmc card and put some program there renamed to Autorun.exe - then insert card & do a soft reset (BE300 doesn't need it, this one does ) if it is a file explorer well then you've got everything to start!

a few more tricks and a lot more got achieved... biggest problem was that for a while i had to work without a virtual keyboard or any other input method as the default SIP (real SIP but modified) would not come up manually only automatically and only in the proprietary casio apps. so nothing outside the proprietary apps! also, no sync program or method or cable is available, so no remote hacking / debugging.

what's more, no explorer.exe was present in rom (!), epods hack package helped there i first tried to find programs to create a taskbar to switch between apps as that was not possible by default (special version of SQ for casio pocketpostpet, a similar ce 2.12 device) and get a software keyboard (PQBox again a special build), on japanese pages but the links are broken.. so we got explorer.exe hacked on it (which is a much cleaner solution anyway): needed was explorer.exe, asform.dll and ceshell.dll, all from the epods packages.
a little japanese exe (trice 1.0) helped with remapping the hardware buttons without inputting anything as it was able to import some custom registry entries specifically made for this purpose, which i modified to my taste.

we could not get the ms sip to work as the systray will not display anything on it except the battery warnings
microcheng's mc21key was the solution for a working keyboard in the end (both inside and outside the casio shell!)...

the file dialogs are still crippled, i.e. not working at all in most apps, gsgetfile.dll and such dlls do work, but only in programs that are compatible (gsfinder for example).

wceload works now for cab installing as well (with some limitations that will probably be overcome).

next time i will check if pocketpc apps run in this regard, too bad the screen is landscape 320x240 and not the other way around.. otherwise it is nice to have landscape mode!

if someone else ever gets one of these little things, this story may help. the process is similar for the casio pocketpostpet too. documentation for both devices is available only in japanese (the messagecam is called toricomail over there).

screenshots (well, no, photos, easier that way): from proprietary shell to real usable CE shell & nice CE 2.12 system info!!

Edited by cmonex 2006-08-24 5:02 AM

oh almost forgot to show one of the traces of CE in that proprietary casio crap

(see that warning, it is proprietary elsewhere except here with the normal CE titlebar and looks )

Edited by cmonex 2006-08-24 5:25 AM

Nice hacking Cmonex

Lol nice. Is the camera really only 320x240 (according to the linked page)? And does it take MMC cards only (no SD)?

2MB of RAM hehehe...

I can't believe you traded the G138 for that!?!?! ;D

Good work. Does it have mask ROM or flash? If the latter we'll expect to see a CeMoneX 3 distro really soon

takwu, no, it has 8mb, about 2.5 is available as storage ram. yes the camera is 320x240 but this device was made and sold in 2000 MMC only. i happened to have a 16mb one in the drawer..

insurgent, where did i say that? lol. to your question, i think it is flash. nice idea on the cemonex 3 distro

"Find the hidden OS." You gotta love it.

no one can be more familiar with this cutie than me here.

about 4 to 5 years ago, i bought a Japanese version of mc20 (toricomail) and later sold. last year, i bought an English version again, mainly for collection purpose now. of coz, both is hacked and used as pda, not a vodaxxx gadget.

this has been probably the most talked about pda in China over the past few years. It inspires the early generation of pda users playing around with affordable pdas, including me. to me, mc21 really really popularizes the concept and acceptance of pda. Some sellers also made a good fortune selling this gadget around 2001.

Many chinese users have hacked this pda inside out. of coz, it is little left to hack and play with now in 2006. u know, there is not much u can do about with PsPC today, especially for oriental users with mc21 who has to put a big big font on this 2mb pda for language support.

FYI

1. easy hardware hack can make mc21 support SD card. work hard and try 2 find out.

2. the camera is 110,000 pixel cmos. not 300,000 lol. but it does support 320*240

btw, i dont think cmonex will trade g138 for this cutie. sb is teasing u.

Edited by iamjoe 2006-08-26 5:10 PM

iamjoe did anyone ever hack it by getting the real explorer shell onto it?

so the mc21 is the japanese version.. i guessed so. i have the mc20.

btw does it have a dstn screen? it is just so nice, looks like a tft to me. well i'm convinced now that it is dstn, gsfinder has a line where it shouldn't, so it is dstn, tft doesn't do that. i wonder how well it would play video... ok of course the vr4121 won't cope with very serious videos, i mean the screen refresh rate here. i see no ghosting effect on the screen so far and it is very clear and sharp.

and yup it is a nice amazing little gadget

Edited by cmonex 2006-08-26 8:53 PM

oh well pics got lost.

here they are

also here is a nice hacking package, of the apps i mentioned in my first post.

http://hpcmonex.net/izemize/casiomc20b_package1.zip

one thing.. one of the apps remap the hardicons on the touchscreen very nicely, i think it was mc21, not 100% sure.

edit: sorry nope, it is registry entries in the registry bat file i included there are examples of that.

let me explain why is itaskmanager mapped to one of the hard icons? you need to kill the old shell first, then start explorer. and why have gsfinder on the other icon? you need to start gsfinder before the task killing stuff so that then you can start explorer from gsfinder. you cannot run anything or switch between apps when you've killed the old shell and the hard icons won't work either - dependant of the casio shell (*if* i remember right). so make sure gsfinder is visible in the background when you play with the taskmanager.
this is important (of course you can still have gsfinder on autorun but that's annoying as you need to do a reset to start this)

Edited by cmonex 2007-07-21 11:17 AM


















Attachments
----------------
image201.jpg (45KB - 6 downloads)
image202.jpg (50KB - 5 downloads)
image203.jpg (34KB - 4 downloads)
image006.jpg (83KB - 4 downloads)
image007.jpg (68KB - 4 downloads)
image008.jpg (64KB - 6 downloads)
image009.jpg (79KB - 7 downloads)

hmmm i found some old email i sent to someone fully describing the steps to hack into it.

it is in hungarian... having a go at translating it now

0) as you dont have a cable you need to copy the stuff to a MMC card (cab files etc).

1) create the CE/R4100 folder patch on the MMC (CE then within that R4100). CE has to be in the card's root.

2) copy the stuff here from my package that is in CE/R4100 in the zip too. (note: the one that i've just uploaded to my site )

3) create the folder apps in the card root again, as well. again copy the corresponding stuff from the package (from apps folder in the zip).

4) copy the contents of the registry and windows folders too, the path doesn't matter now.

5) i recommend copying the file from keyboard folder too. my recommendation for a final destination path is \windows\startup when you get to access that folder later.
you can keep it on the card too, to spare ram, as only 8mb is available and 3 of that is storage..
this program will be the software keyboard.

6) insert the mmc in the casio, do a soft reset. gsfinder will startup automatically (from CE/R4100 - you can delete this later after you fully hacked the device and if you don't like the autostart on every reboot).

...from now on everything is done on the device!

7) navigate to the registry folder on your mmc card with gsfinder. run trice.exe. this will import some reg entries for you using the included bat file. you can edit that of course. the default settings i included will reprogram the last two hardicons on the touchscreen, 4th one will launch gsfinder and 5th one will be itaskmanager.
this is useful when you are in the casio (original) shell, you can run gsfinder anytime *when* in the casio shell, so you can enter the normal explorer shell easily.

8) copy the files from the windows folder on the card, into \windows in ram. you could also try keeping them on the card and run explorer from card, i don't know if that works well.

9) very important: leave gsfinder running. now run itaskmanager (apps/itaskmanager.exe). this will bring up a nice taskmanager with the running processes shown. kill the one called taskman. press OK to the warning. kill it. then close itaskmanager.

10) now immediately go to \windows (in ram) with gsfinder! run explorer.exe (which you've already copied here in step 8). you will see the windows CE shell starting up!
now you can run programs quite well, except the original casio ones... you must soft reset to get back to the casio shell, sadly.
you can run many CE apps within the casio shell without explorer too, so the 8-9-10th step can be optional.

11) to be able to type not just in the casio shell, but in explorer too, run mc21key.exe on every reboot, then you can use the casio button for "full display" to bring it up any time. (it will map itself to that button)
you could put it in \windows\startup or make it autorun on the mmc card
(you can easily create shortcuts with totalcommander)

12) to install CAB files / programs.
go into the registry folder in my package and read the instructions within the "installing" folder. use TRE or some other registry editor.
a problem with this method: this will want to install everything into ram. so after installation copy the files to the memory card manually, usually they will still work. (or use cabmanager to extract the files on the PC.)

...so this is the basic hacking process. after this the thing is quite usable like a pda, but for example file open dialogs don't work in many apps. you can do it in gsfinder because of a dll i included with it (gsgetfile.dll).
if you want to open a file from a program, you can just associate the extension to the program using gsfinder.

there is no control panel - haven't tried to make one yet.

etc.etc.... but still, many apps work, i included some in the package. (totalcommander, tre regeditor, warmreboot, pnotepad. but do not move itaskmanager from that folder. note: i also put in a txt assocation registry entry in the auto.bat file, pointing to pnotepad in mmc\apps folder)


...that was all i wrote in that email

Edited by cmonex 2007-07-21 11:43 AM

I Cant find a working media player for this thing. Please help. I even checked your site cmonex, but nothing.

TCPMP should work.