This was posted by myself over at BimmerForum’s, but as China’s Firewall is being particularly unpleasant these days about what sites I can and cannot visit, I thought I’d repost it here, so its more accessible for me.

Note – I no longer own a 7 series, so any requests for modded rom’s should probably be accompanied with nice gifts to persuade me to do the work involved

As I saw people asking about Tuned ROM’s in another post I thought I’d do some research.

Its quite niche – hence the ridiculous pricing people charge for roms – time is money though!

Here’s my research so far. I’m basing it on the E32 735iL 1989/1990, as thats what I own (and can test for).

Googling for E32 735iL gives:

ELECTRONIC CONTROL UNIT, DME MOTRONIC

BOSCH 0261200179
BMW 1730697
*26SA0840*

Vehicle Applicability:
1986-1993
BMW 3′ E30 320i Touring 2.0 95kW/129PS (M20/ 206EE/KA)
BMW 5′ E34 535i 3.4 155kW/211PS (M30/346KB)

BMW 6′ E24 635CSi 3.4 155kW/211PS (M30 B35)
BMW 7′ E32 735i 3.4 155kW/211PS (M30/ 346KB/EC)
BMW 7′ E32 735iL 3.4 155kW/211PS (M30/ 346KB/EC)

ELECTRONIC CONTROL UNIT, DME MOTRONIC

BOSCH 0261200179
BMW 1722611
*26RT2794*

Vehicle Applicability:
1986-1993
BMW 3′ E30 320i Touring 2.0 95kW/129PS (M20/ 206EE/KA)
BMW 5′ E34 535i 3.4 155kW/211PS (M30/346KB)
BMW 6′ E24 635CSi 3.4 155kW/211PS (M30 B35)
BMW 7′ E32 735i 3.4 155kW/211PS (M30/ 346KB/EC)
BMW 7′ E32 735iL 3.4 155kW/211PS (M30/ 346KB/EC)

ETK however says

No.Description Supplement Qty Part Number Price
01AT-Control unit Motronic HARDWARE 1.3 1 12141738168 ENDED
01AT-Control unit Motronic HARDWARE 1.3 1 12141748258 $813.86

Whatever the actual revision used, its pretty clear we have a v1.3 Motronic.

Wiki (

Motronic

) says:

DME / ECU 1.3 Info.

Tuning is set in 2D map.

Motronic 1.3 from 1989: The fault code memory is extended to contain all fault codes that are detected by the EMS.
In vehicles sold in the USA, when the ECU detects that a some faults are present it earths pin 15 and the Check Engine warning lamp on the dash will light. The lamp will stay lit until the fault is no longer present. A warning lamp is not fitted to vehicles sold in other markets. The faults that will turn on the lamp are mainly those concerned with emissions. Other faults are logged by the ECU but the lamp will remain out.

ECU (DME) sensors run off 5v

Download extended info here – http://www.opel-scanner.com/files/DME_1.1_1.3.pdf

DME bootup: (roughly paraphrased)
Interestingly enough I got to learn this properly via the tips and tricks for checking why the car doesn’t start..

Ignition switched on:
ECU earths 85 , 36 which causes relay to close and 30 is connected to 87 starting the fuel pump. (30+87 can be bridged manually under the green relay to test pump). Its opened for +- 1 second.

Next up it reads values from the CAS (Pulse Sensor). If it reads a speed signal (aka is it turning), so fuel pump stays on.

CAS is used to time the pulses (read from each turn of the flywheel), this is checked against the map file for correct speeds (need to use a multiplier for the map values vs the flywheel pins).

The Motronic ECU contains a fuel map with an injector opening time for basic conditions of speed and load. Information is then gathered from engine sensors such as the AFS, CAS, CTS, and TS. As a result of this information, the ECU will look-up the correct injector pulse duration right across the engine rpm, load and temperature range.

The injectors are arranged in two banks with injectors 1 and 3 (4 cylinder) or 1, 3 and 5 (6 cylinder comprising one bank, and injectors 2 and 4 (4 cylinder) or 2, 4 and 6 (6 cylinder) making up the other bank. Each bank is connected to the ECU via an independent ECU pin.

The Motronic 1.1 & 1.3 multi-point injection system pulses the injectors semi-sequentially and once every two engine revolutions. During engine start-up below 600 rpm the ECU pulses all injectors simultaneously. Once 600 rpm has been attained and if the ECU has received a signal from the CID sensor, each injector bank will be pulsed alternatively according to which pair of cylinders are approaching TDC. If a signal is not received from the CID sensor the injectors will remain on simultaneous operation. However, if the CID sensor subsequently sends a signal to the ECU after the engine has commenced running, the ECU will pulse the injectors semi-sequentially after the next deceleration phase – even if the CID sensor then ceases to send a signal.

—

Motronic troubleshooting (aka code readout)

The fault codes for these systems will appear on the check engine light when you turn the ignition key to the On position (but dont start it), then: fully depress the accelerator pedal, then fully release it. Repeat the depress,release cycle 5 times fairly quickly, but not too fast. It should be completed in a few seconds. What you are doing here is clicking the wide open throttle switch then the idle switch each 5 times. This signals the Motronic unit to send the fault codes by flashing the Check Engine light. You should see the light flash once then it will start flashing the 4 digit codes. If there are no faults, you should see the 1444 code (and 2444 if you have a 12 cylinder). The codes appear as a series of flashes for each digit. The flashes indicating one digit are about 1 second apart, the next digit appears after a couple second interval.

Get the codes from: http://www.unofficialbmw.com/repair_faqs/motronic.html

Other notes:

CPU most likely 8051
EEPROM 26C256, so 32KB / (32768 byte) chip. 28 pin.
Can also use a 64KB chip, just ground the relevant pins for which 32kb to use or burn one rom at appropriate location. Useful for running 2 tunes – eg original and second.

Tools available for this eg http://www.moates.net/font-size-12ti….html?cPath=31

Should run from a AT29C256 or similar.

ECU interesting pinouts:

Pin 55 TX
Pin 13 RX
Pin 2/19/24/26/14 GND

File layout (unchecked)

AFR idle: 0x662E (pos 26158)
AFR partial: 0×6662

AFR full: 0×6640

ign idle: 679A
ign partial: 0x67FE
ign full: 0x67CC

Sample bin file here: ftp://anonymous@bmw-wiki.org/ROMs/Mo…y-Motronic.bin

(I’m having issues downloading that from China, so haven’t checked it yet against the alleged layout).

Table calculations:

fuel maps correspond to (value/128 +1)*lambda_1

Bosch-Motronic f(n) = (n-30) x 0.75
some Bosch f(n) = (n-509) x 0.75

Bosch KE-Motronic und Mono-Motronic
f(n) = [(255-n)/6] +1

Motronic info

http://motronic.ws/

Very useful info for looking this up from http://motronic.ws/map201.htm

Maps 20 bytes each

Other thoughts – now we know what pinouts / values are expected in the system, guess just need to see what equipment provides appropriate inputs. eg, replace expensive spares with cheaper/better modern versions.

Most of the differences are usually in the mounting afaik, not the tech.

Motronic pinouts and board details here – http://www.e34.de/tips_tricks/motronic/m1_3.pdf

Lots of people working on this kind of thing with software like tunerpro / xdf (map) files.

*Good* forum for info (although not relevant to the Bosch ECU’s, but concepts / strategies same)
http://www.thirdgen.org/techboard/di…uide-book.html

The motronic 1.3 software in most of the E32′s should be fairly easy to modify – its all been documented well online before, so just a matter of getting a few rom files for specific models, and comparing tables.

Shogun has at least one rom (as he’s burning and selling them according to another post).
I can extract the current one from my DME and make a bin file for comparison.
We also have the rom from ftp://anonymous@bmw-wiki.org/ROMs/Mo…y-Motronic.bin

Should be enough to see where the changes are for the E32 / 8051CPU Motronic 1.3 anyway, so that I can tweak.

Another lucky thing is that I also used to write embedded software on 8051 cpu years ago (although I’ve forgotten it all by now)

Any interest in this from others (I’ll need more rom’s though)?

As my car currently has only 1 key, I thought I’d do a little bit of research into getting another one.
BMW quoted 2000rmb, which although understandable, is a little bit expensive. That doesn’t include the remote functionality in the current key either.

A check of taobao shows that you can buy blanks for slightly less – in the 30rmb range.
Mine is a 3 button remote, rather than a 2 button remote.

Images of both below:

Yes, I realise that these are just keys, and don’t contain the remote stuff either, but as a spare, its all I really need.

There is a fly in this ointment though. All European cars post 94 are mandated to include anti-theft immobilizers, which in BMW’s case involves checking for a transponder, so a key won’t start the car.
BMW calls this system EWS – Electronic Watchdog System.
A datasheet aimed at BMW workshop staff on EWS is here BMW EWS Overview and Worksheet

The infrastructure looks something like this:

I could buy a small board to bypass the EWS (about 130rmb), but I like the idea of having the anti-theft still working.

So, how does the EWS2 do the immobilization in my car?

A little bit of research shows that my current BMW (a 96 E36 import from German) uses BMW’s EWS2 for antitheft. This appears to be based on a motorola chipset ( XC424114CFN ) for the immobilizer side, and its relatively easy to read out or reflash the existing data from the chip if necessary should I need to do so.
eg if I lost all my keys, and needed to start from scratch. There are 3rd party tools galore that go into that eg CarProg, so not much point looking at that for me.

Lets look at the transponder side.
The transponder in my current key is a Philips PCF7930

This comes in a series – PCF7930, PCF7931, and PCF7935, and PCF7936

The main differences between the transponders are as follows:

PCF7930 – can read / write data.
PCF7931 – write once (one time programmable), read data.
PCF7935 – it has 2 area’s of memory general, and shadow memory, and both are read / write.
PCF7936 – it adds a crypto mode to the 7935 functionality.

The PCF7936 is also referred to as a Hitag2.
This is also the transponder current generation of BMW’s are using eg the E90/E92/E94′s

They’re quite simple devices really, a datasheet for them is here – PCF7930 / 31 / 35 Datasheet

They essentially have a few bytes of memory to work with.
32 bytes for control, and 80 bytes for user data.

Physically they’re about half the size of a fingernail and a few mm thick.

They look something like this –

A quick search on taobao shows that a PCF793x sells for between 17-20rmb or so.

So, so far I can get the key for about 30 odd, and the transponder for about 20rmb or so.

I still need to be able to program the transponder though, so whats available for that?

Another quick google shows that there is a common windows tool called anahtar which works with quite a few programmers.

As you can see, it supports quite a few pieces of hardware. Anahtar does need some hardware to talk to the transponder though, so I also need a transponder programmer.

A search for a normal RFID programmer is pretty polluted with car remote programmer spam sites.

That said, the usual result for BMW’s is the AK90 programmer. This is a bit on the expensive side – its around 1500rmb, and I really only need to do this once, so lets look for other options.

Ideally we’re looking for a low frequency rfid programmer.
If possible, I’d like to have something that does other chips too, so something that can cope with the below may be handy at some point, if only so I can steal peoples cars play with it.

RWProg looks interesting, as it has a lot of support for other rfid chips – http://www.bicotech.com/?page=prod_rwprog&lg=en.

Unfortunately a search for that on Taobao shows no results. RFID reader’s on the other hand are dirt cheap, with the cheapest usb ones going for 35rmb or so.

The specs for the PCF793x series don’t actually say what frequencies it runs off unfortunately, so its a little hard to find an appropriate device quickly.

I do note that there appear to be a disproportionate amount of card writers advertised on Taobao which claim to do Mifare, which not co-incidentally is similar enough to what is being used on the metro here in China in most cities for travel cards. I guess that means there probably are lots of fake ones around…

If I check whats usually used for programming the PCF793x series, Philips (NXP) pushes their PCF7991, while Philips doesn’t write what frequency that runs on either, this chinese site says 125khz http://www.docin.com/p-74627587.html

So, its a 125khz programmer.

Unfortunately those are 500bucks on tabao, so I keep looking.

…and Bingo, I can find a BMW key programmer which will do it for 350rmb.
Sounds good.

350 for the transponder reader/writer, 20 odd for the transponder, and 30 odd for a key.
400RMB total, and new copies of the keys will cost about 50rmb each vs the 2000rmb bmw wants.

Its a win!

Next up, what frequency does the remote use, so I can get a replacement for that…

My remote frequency is 433.92Mhz, as I have a Europe car.
I’ll guess it would probably be 315MHz if it was a US, CN or SA built car.

As I’ve had some negative comments about this all being possible, added some photos of the tool I bought to successfully clone my keys.

The box full of goodies.

Box contents

Key Cloning tool

Key Cloning tool side view

Key Cloning tool MCU adaptor side view

Box contents

Cloned keys (original on far left)

Software Side:

Installing hardware drivers
Device is a standard FTDI usb serial chip based product, needs 2 drivers installed, the first for the serial chip, then a second for the device driven by the usb to serial chip.

Installing software

Software running

The new year has arrived, and so has cheaper pricing for internet access at home.

Currently for home use, there are 3 options for internet over fixed lines.

• China Telecom with ADSL over Copper / FTTB+Lan / FTTH
• China Unicom
• Orient Cable

Incumbent China Telecom has reduced their rates significantly since last year, as Unicom is encroaching on their space.

Lets start with Unicom’s packages:
The latest pricing for 2011 for Unicom is here:

http://www.sh.chinaunicom.com/family/ywcp/jtkh/kdl/index.html#lt_dw_md

Unicom can provide up to 30M for home use (assuming your area can have Fibre access via FTTB+Lan or FTTH)

10M is 198 /month
20M is 248 / month
30M is 288 / month

If you don’t have fibre, and can only get ADSL lines, then your max speeds will be 4M – 6M depending on distance from the local substation.

4M is 144 / month
6M is 168 / month.

Shanghai Telecom has committed to rolling out Fibre to all users by 2013 though, so most areas will start to see fibre availability coming soon.

Shanghai Telecom

Shanghai Telecom pricing is obviously being directly targeted by Unicom’s. Each Unicom price point has been aimed squarely at beating Telecom’s.. Competition is good, although Unicom could do better. Shanghai Telecom has far better backend infrastructure though, and that’s going to take time for Unicom to improve on.

Shanghai Telecom’s current best value package is this:

http://sh.ct10000.com/pptc/ehome/bundle/e8/gwe8sqb/

This offers 10M internet (again with the caveat of Fibre availability in your area) for the sum of 188RMB a month. If you don’t have Fibre, they reduce that price by 10RMB and provide the standard 2M / month (which in comparison with standard adsl rates is not a good deal).

They sell this as a bundle with Telephone access also, so you get reduced phone rates too.
This includes a few other random things like incoming caller ID and custom ringtones for your callers, as well as 30hrs of monthly wifi access assuming you need to use or can find their wifi when around town.

Bundles are:

E8 – ( http://sh.ct10000.com/pptc/ehome/bundle/e8/gwe8sqb/ )
10M – 188rmb /month.

E9 (http://sh.ct10000.com/pptc/ehome/bundle/e9/zxe92011/)
20M – 369rmb / month

Orient Cable

Last and least, we have Orient Cable. OCN rates are here
http://www.ocn.net.cn/gsgg_cuxiao07.html

I’m not going to bother listing their package in detail, as its pretty crappy.
1M for 110 / month.

Looking at the options, my pick for best choices would be

Fibre users:
China Telecom at 188rmb / month with 10M if you can get it value for money wise.
For the speed demons China Unicom for 30M / month.

ADSL only:
China Unicom for their 4M or 6M options if you can only get ADSL installed in your area.
Unicom’s may not offer this in your area though, so you may be stuck on the standard 2M for 150/month till they upgrade lines.

Good luck!

China Mobile may start coming to their senses at some point and offer unlimited fixed wireless, but for now their offerings are too expensive for home use.

Lawrence.

Comment spam is a big load on servers – recently troubleshooting some intermittent load issues on one of our webservers, I discovered that one page was getting hammered by comment spam abuse – the page had already generated over 400,000 comments, which was causing the server to be slightly unhappy loadwise.

After clearing out the comment table for that clients site, I looked into solutions.

mod_security was an obvious one, and the atomic corp rules seem to be better than the default mod_security ones (which break most popular apps, sigh).  However, although the gotroot rules were good at blocking comment spam, they don’t block the ip’s, so persistent spammer bots will still hammer the server.

So, whats a solution?
Blocking the ip’s dynamically for a short period.
Assuming you have a standard setup, the below should be of interest.

I stick my ruleset into /etc/modsecurity2, so amend your url’s accordingly.

My default initialise code is below (pretty much stock except for the end part)

/etc/modsecurity2/modsecurity_crs_10_config.conf

SecRuleEngine On

 SecRequestBodyAccess On

 SecResponseBodyAccess On

 SecResponseBodyMimeType (null) text/html text/plain text/xml

 SecResponseBodyLimit 2621440

 SecServerSignature Apache

 SecComponentSignature 200911012341

 SecUploadDir /var/asl/data/suspicious

 SecUploadKeepFiles Off

 SecAuditEngine RelevantOnly

 SecAuditLogRelevantStatus "^(?:5|4(?!04))"

 SecAuditLogType Concurrent

 SecAuditLog /var/log/apache2/modsec_audit.log

 SecAuditLogParts ABIFHZ

 SecArgumentSeparator "&"

 SecCookieFormat 0

 SecRequestBodyInMemoryLimit 131072

 SecDataDir /var/asl/data/msa

 SecTmpDir /tmp

 SecAuditLogStorageDir /var/asl/data/audit

 SecResponseBodyLimitAction ProcessPartial

SecPcreMatchLimit 100000

SecPcreMatchLimitRecursion 100000

SecDebugLog /var/log/apache2/modsec_debug.log

SecDebugLogLevel 3

### Ruleset additions for blocking ########################################

# Make sure to clear the default action

SecDefaultAction phase:1,pass

# Initialize collection and deprecate by 3 points per day (86400 seconds)

SecAction phase:1,initcol:IP=%{REMOTE_ADDR},deprecatevar:IP.spam=3/86400,nolog

# If there are already >15 spam points for this IP, then drop

# the connection and add 1 point (instead of 3, as below).

SecRule IP:spam "@gt 15" phase:1,setvar:IP.spam=+1,drop,setenv:spam=spam

# Clear the default action for any mod_security rules later in httpd.conf.

SecDefaultAction phase:1,pass

### End Ruleset additions for blocking ####################################

What does it do?  Basically we keep score of any ip address that visits the site.
Every day any scores depreciate by 3 points per ip.
If any ip scores more than 15 points, we block it.

Now, as it stands, its pretty useless, as we don’t do any scoring.

So, next we’ll need to add some scoring to some of the rules.

In our case, we were getting seriously hammered by pharmacy spam (mostly out of latvia)

So, I went into the default gotroot ruleset that I installed into /etc/modsecurity2

Comment spam is in this file: 30_asl_antispam.conf

I added some scoring there.
In my case, we saw hundreds of thousands of attempts for levitra and tramadol spam, so I went to the pharmacy scoring, and added this:

setvar:IP.spam=+15 in the SecRule check.
This means that any positive lookup for that rule will give the ip a 15 point score.
That will block that attacker ip from the site for 5 days (as we decrement 3 points per day for a given ip).

The setvar needs to go after the “capture,…” part of the rule.

eg

(don’t copy, paste this, you’ll need to add “setvar:IP.spam=+15″ into your existing file)
# Rule 300040:
SecRule ARGS|!ARGS:/domain/|!ARGS:description|!ARGS:redirect_to|!ARGS:setting[banemail]|!ARGS:/username/|!ARGS:/user_name/|!ARGS:/page_content/|!ARGS:/search/|!ARGS:/email/!ARGS:Mensaje|!ARGS:/product/|!ARGS:/domain/|!ARGS:description$
"capture,setvar:IP.spam=+15,id:300040,rev:7,severity:2,msg:'Atomicorp.com - FREE UNSUPPORTED DELAYED FEED - WAF Rules: Spam: Pharmacy',logdata:'%{TX.0}'"

I added this to appropriate places, and watched for our first victim^Mspammer in our site logs.
Bingo – here we have a spammer trying to add to a url on one of our sites:

[23/Dec/2010:11:39:45 +0800] [www.chou.cn/sid#bcf3f338][rid#b339b670][/gallery/papratiti/img_5993.jpg.php][1] Access denied with code 403 (phase 2). Pattern match “(?:buy[-_ ]?(cheap)?[-_ ]?(?:adipex|suboxone|pseudovent|topamax|trazodone|prevacid|zyrtec|xenical|toprol|zoloft…” at ARGS:comment. [file "/etc/modsecurity2/30_asl_antispam.conf"] [line "194"] [id "300061"] [rev "10"] [msg "Atomicorp.com - FREE UNSUPPORTED DELAYED FEED - WAF Rules: Spam: Pharmacy"] [data "xanax"] [severity "CRITICAL"]

[23/Dec/2010:11:43:16 +0800] [www.chou.cn/sid#bcf3f338][rid#bfac9d68][/gallery/papratiti/img_5993.jpg.php][1] Access denied with connection close (phase 1). Operator GT matched 15 at IP:spam. [file "/etc/modsecurity2/modsecurity_crs_10_config.conf"] [line "40"]

Bam, that ip is blocked (for 5 days).  Next time around, as its the first rule to run, it will block immediately without processing other rules.

You can amend the block times by decreasing the increments or scoring as per your requirements.

All in all, this is an easy amendment to make to the gotroot rules, and makes for faster experience for users.
Thanks to http://linux.icydog.net/apache/commentspam.php for his implementation, this is pretty much based off that.

Lawrence

I’ve been seeing a bunch of failed Apple Time Capsules recently.
The issue is that the PSU’s are dying, as opposed to the HDD’s.

I took one apart to take a look, and the issue is the oh too familiar someone bought cheap capacitors that use the wrong formula. Tsk tsk Apple!

Here are some photos of a faulty power supply from a Time Capsule I’ve taken apart to demonstrate -

Read more »

Although most of my friends are using 3G/s now, I do get the odd 2G phone to play with.

Today I had another crack at enabling MMS on a 2G. For some reason not much documentation, and too much misinformation out there on the net.

Guaranteed working instructions for China Mobile users below:

Note #1 – this is for 2G iPhones only. 3G and newer phones, skip to the MMS settings at the bottom of the post, and put those in Settings / General / Network / Cellular Data Network…

Note #2 – 2G users – if you used BlackRa1n to jailbreak, this will not work either, and will b0rk wireless. Use PwnageTool, and create a 3.1.3 jailbroken / boot neutered (carrier unlock) firmware, install that first, then continue.

iPhone 2G users –

Install 3.1.3
Jailbreak with usual steps.
Add cydia.ifoneguide.nl in Cydia / Sources
Wait a bazillion years for cydia to timeout with the various blocked in China repositories.
Click Search
Download Activate 2G MMS
Reboot

Normally we’d be done, however the MMS settings won’t let us save a diffferent MMS and GPRS name, so we need to install a specific IPCC (iPhone Carrier Setting file) for China Telecom.
As China Telecom is (at time of writing) not an official iPhone supplier, they don’t have an IPCC file, so we need to roll our own.

Here’s one I found earlier – ChinaMobileCarrierSettingsWithMMS.zip

Download that, unzip, and throw on the desktop.

We’ll need to tell iTunes that its ok to use the IPCC file first, so close iTunes.
Now head off to terminal (or a DOS window for those on Windows), then paste this in.

Mac users:
defaults write com.apple.iTunes carrier-testing -bool TRUE

Windows users:
(32 bit)
“C:\Program Files\iTunes\iTunes.exe” /setPrefInt carrier-testing 1

(64 bit)
“C:\Program Files (x86)\iTunes\iTunes.exe” /setPrefInt carrier-testing 1

Done?

Ok, now open iTunes again, connect the phone if its not connected, and..

Mac Users:

Press + hold down Alt(option), and Click “Update”

Windows Users:

Press + hold down shift, then Click “Update”

iTunes will prompt you for a file.
Choose the IPCC file you downloaded.

Sync the phone.

Finally… shut the phone off again.

Once you power up again, you should be able to send/ receive MMS!

If its not working for you, check that the settings are in there –

Settings / General / Network / Cellular Data Network

(anything not listed below should be empty)

Cellular Data
APN -> cmnet

MMS
APN -> cmwap
MMSC -> http://mmsc.monternet.com
MMS Proxy -> 10.0.0.172
MMS Max Message Size -> 300172

Tested, and working on lots of 2g iPhones.

UPDATED May 5 2010

Note: I don’t personally own an N310. I don’t have access to one either, as the owner of this one went back to the States with it.
Updates to this page are mostly from the comments people have made. When I can assist I have / will, but as I don’t own an actual N310, I rely on you for feedback!

One of my friends brought round a notebook for me to Hackintosh yesterday. Unlike the usual god no… kind of options I get given, this is actually a nice machine.
This one is almost as Mac friendly as my current Nano sized Hackintosh (aka Loz’s Hackbook Nano)

I present the next best thing in Mini Mac’s (until the will it? won’t it? Mac Tablet comes out! (ok, so it came out already, and its a bit meh..) ) – The Samsung N310

The Samsung is a generic Atom based Netbook with the following hardware:

CPU Intel Atom N270, 1600 Mhz
Chipset Intel 82945GSE Graphics Controller
Graphics Card Intel GMA 950
Audio Realtek ALC272
Wifi Atheros AR5007EG Wireless
Ethernet Marvell Yukon 88E8040 PCI-E Fast Ethernet
Bluetooth Adapter USB Based Generic
Webcam USB Based Namuga 1.3M

Installation is remarkably easy.
You’ll need the following things – an External USB DVD drive, and Snow Leopard.

Suggest before you install anything, update your BIOS to the latest version. This should be something like BIOS version 06BA or newer.
The bios updates are windows only, so you’ll need to do that before installing OSX, or have some other method of booting into Windows afterwards (google for Hiren Boot CD 10 for something that will provide a bootable Windows XP amongst other tools).

There are two bios files that are available currently. This first one is the one that you will likely have to use:

http://downloadcenter.samsung.com/content/FM/201002/20100203094911375/Win_N310_06BA.exe

And here is the second one:

http://downloadcenter.samsung.com/content/FM/201003/20100302094206890/Win_N310_01BD.exe

CHECK YOUR VERSION OF YOUR BIOS IN YOUR BIOS. IF YOUR VERSION ENDS IN A “BA”, USE THE FIRST ONE. IF IT ENDS IN “BD”, USE THE SECOND ONE.

Ready?

Download the latest NetbookInstaller ISO from here – http://osx.mechdrew.com/downloads/
Burn to CD. Connect your USB drive to the N310, and boot off of the newly burned CD.

Follow the instructions to swap with your Snow Leopard DVD at the appropriate time, and boot into the installer.
Install as normal (in my case, I just wiped the existing partitions, set the boot type to GUID instead of MBR in Partition, Options, and did a full install)
Once the OS reboots (or finishes with a cannot install error right at the end – don’t worry, its not a problem!).
Reboot into the NetbookInstaller ISO again, but this time choose the HDD (as we still need to install a valid bootsector for the OS to run)

The OS should boot up ok, fill in the relevant bits and pieces, and get to the desktop screen.
Open up NetBookMaker from the CD, navigate to the Tools folder and open NetbookInstaller:

I did this using 0.8.3RC4, but newer versions should be similar. Current version is 0.84rc1 as of April 2010.
Click Continue for the Unrecognized Hardware Prompt.

Choose the correct disk in the Volume Dropdown, and
Check Install Chameleon 2
Check Install General Extensions
Check Generate a System Specific DSDT.AML file.
Uncheck everything else.

Click Install.

It should trundle away for a few minutes, then recommend you reboot.

Remove the NetbookInstaller DVD, and make sure that you can reboot ok from the Hard Drive

Right now you should have working Webcam, Video, Bluetooth, and Trackpad will support 2 finger scroll (go to System / Preferences/ Trackpad to configure)

We’re still missing Wifi, Audio, and you’ll notice that sleep doesn’t quite work yet.
To install those, we’ll need to set some BIOS parameters, and replace the wifi card.

Wifi – the original card is a crap atheros. I couldn’t be buggered looking for drivers, and immediately swapped it out for a Dell1390 Broadcom card. Cheap, and the same as real Macbooks, so no driver issues. Should be about $8 on eBay (RMB50 or so locally in China on Taobao).

The N310 is reasonably easy to disassemble, just remove all the plastic plugs underneath (including the larger feet ones), and remove the screws. Gently remove the case bottom, and replace the wifi card.
If you use the Dell1390 you won’t need to install any drivers, they’re built in, yay!

Enabling Sleep / Brightness (working on 10.6.3 / BIOS 06BA apparently ) -

Go into the BIOS and set the following:

EDB = Enabled
Legacy USB Support: Disabled
USB S3 Wake-Up = Enabled

Boot into OSX

You’ll need to replace the DSDT.aml from NetbookMaker with the one below.

I’ve uploaded a DSDT.aml for the n310 here – DSDT.aml.
To use, rename file to DSDT.aml, and copy to /Extra, then reboot.

This also apparently works for Brightness control with the latest BIOS revision on 10.6.3. You’ll have to change brightness from the System Prefs / Displays / Brightness though, as the function keys aren’t mapped.

Note: If you do mess around with DSDT.aml files, please have a working recovery method available that you can access the hard drive with (eg an OSX Install DVD + Boot132 CD). Apple’s install DVD can also be used for recovery.

If you find that you can’t boot after installing the DSDT.aml, boot from the Boot132 CD or USB, then boot into to the OSX install DVD. Go to terminal in the installer, and delete the offending file, then reboot.

For the remaining drivers:
Download the zip below for modified Bluetooth (to enable bluetooth on / off keyboard switch), and 10.6.3 compatible Audio drivers (kexts) for the N310.

Thanks to Breathless for modifying the Bluetooth, and emailing me both files.

Samsung N310 Audio and Bluetooth Kexts

Copy to /Extras/GeneralExtensions, then rebuild the Extension cache.

You can do that manually or use a tool. NetbookInstaller nicely places a program called UpdateExtra into the /Extra folder which can rebuild the Extension cache for you. Reboot once done, and you should be good.

Thats pretty much it!

—-

Now you should have a fully working Samsung N310 running OSX Snow Leopard!

The brightness (via Displays System Prefs panel), sleep, audio and bluetooth should all be working fine. The wifi too (assuming you replaced the mini pci-e card as recommended)
The volume on/off keyboard functions should work, the trackpad on/off.

Thanks to Breathless for the feedback so I could update this page.

Good luck with yours!

Useful links:
http://www.kexts.com – kexts (drivers) for OSX
http://www.superhai.com/darwin.html – Power related drivers for OSX
http://osx.mechdrew.com/ – MechDrew from MyDellMini’s site on Hackintosh Installs
http://cid-8b65993ef55cf014.skydrive.live.com/browse.aspx/.Public/OSx86/Snow%20Leopard – some Czech site hosted on live.com full of goodies/ kexts

Apple used to have info about where phones came from on their website, but for some reason have now deleted that info.
Below is a list of verified unlocked part numbers.

Hong Kong

MB489ZP/A 8gb blk
MB496ZP/A 16gb blk
MB500ZP/A 16gb white
Read more »

If anyone wants to mess around with the settings for the Huawei eHome router EchoLife HG522-c (typically the ones supplied with the “3M or 4M” connection), then here are the user / pass settings.

Site: http://192.168.1.1/
User: telecomadmin
Pass：nE7jA%5m

Useful if you want to rejig the QoS settings.

If that login doesn’t work, try this – which is usually seen on the HG226 models -
Site: http://192.168.1.1
User: fiberhomehg2x0
Pass: hg2x0

The other standard modem HG520S is easier – admin / admin

Might be useful for some folks. I’m mostly posting here for myself, as I’ll probably forget and need to google it later.

One of the (not so) fun things about China is that almost everything needs to be licenced.
As part of the China bureaucracy plan, all forms of wheeled transport in Shanghai require a licence (yes, even bicycles!).

Riding motorized transport without one is not recommended, as this can lead to fines, deportation, and jail in worst case scenario’s.
This has been documented enough times by those unfortunate enough to knowingly break the law.

Electric Bikes/ Scooters are not exempt from requiring a licence, despite what the nice man at the shop selling you the bike, or others might say.

To be street legal in Shanghai, you need a plate.

1) Only bikes purchased in Shanghai can get a Shanghai plate.
Keep your official receipt (fapiao) when you buy the bike, as it needs to be used to get your licence.

2) As of a law passed in April 2008, Shanghai Electric bikes have to be:

* Under 40kg.
* Not capable of speeds faster than 20km/hr.
Effectively this means only bikes < 36v.
* Listed in the allowed vehicle database for Shanghai.
Legal bikes have a 15 digit unicode (like a car VIN) which is unique. Manufacturers have to apply for a production licence for this, and not all have done so.

A list of licenced manufacturers is available here:
http://www.shbicycle.com/Article/ShowArticle.asp?ArticleID=6230

If you own a bike that is older than that date that does not conform to the above, and you had a legal licence at that time, then it can be renewed each year, and its still legal.

3) To licence an electric bike/scooter/moped you need to visit the police station for your district.

You will need to bring:

* – The fapiao for the bike
* – Valid form of ID (Passport for foreigners)
* – The bike
* – Money to pay for the licence (11rmb currently)

—–

FAQ’s:

Can I use a legal plate from another province?
eg Jiangsu…
Possibly No, with some caveats -
It is not legal to ride with an out of town plate unless it is a weekend, or public holiday. You can be fined 200RMB if caught riding outside of these times, although this is unlikely. This is a grey area though, so police attitude to this may vary/change. While having a plate is better than not having a plate, it may not help if you have an accident.

Can I carry a passenger?
According to the law, no.

Is is illegal to drive without a plate?
Yes. Being a foreigner does not exclude you from following the law.

Do I need a driving licence for an electric bike/moped/scooter?
No.

Is there an official list of legal bikes?
There are 2 official sites where you can check if a bike is legal – http://www.shbicycle.com and http:/www.shjtaq.com

A current list of legal bikes with photo’s is here:
http://www.shbicycle.com/Photo/ShowClass.asp?ClassID=84

You will need Chinese reading abilities to read either site.

Instructions below for non illiterate:

市民在购买电动自行车时，可以通过上海市自行车行业协会网站上（HTTP://WWW.SHBICYCLE.COM），或上海交通安全信息网（网址： HTTP://WWW.SHJTAQ.COM，点击首页右上方的 “车/牌/证公告”栏目中的“上海电动自行车—上牌备案登记表”）查询该目录。

Are the cool Vespa lookalikes legal?
No.
The Vespa lookalikes / Spicy Motors bikes are not street legal for various reasons – weight, voltage, speed (unless you have a 2008 model licenced prior to 8/2008).
Additionally, they are not listed in the police database of allowed models.

…but XXX / Bike shop / my friend etc says its legal?
In short: They’re lying.

Caveats:
If you are in living a city other than Shanghai this may be ok.
Different cities, different rules.
If the bike is 2nd hand, and has an existing legal Shanghai licence, and it has been renewed each year, then it is also ok (albeit extremely unlikely).
Otherwise, see the short answer.

What about repair / warranty?
By Law, bikes have a “三包” (threefold warranty).

If you have issues within 7 days the seller is legally obligated to give your money back if you so wish.
Within 2 weeks, you are guaranteed a replacement bike.
Within 1 year, if you have more than 2 of the same type of failure, they have to replace, or you can get your money back less depreciation.
Consumables such as lights are not covered by this, nor are collisions..

Parts have the following warranties (by law):
Motor: 2 years
Frame, Fork, Charger, Controller, Battery: 1 year

*For batteries, failure is deemed as holding < 60% of original charge.

More details here:
http://www.shbicycle.com/news/ShowArticle.asp?ArticleID=43

Note that it is while it is illegal for shops to sell bikes that cannot be licensed, many still do.

Where can I licence my electric [bike/scooter/moped]?

Addresses for each district:

Bao Shan
宝山区 凇兴西路长征新村23号 56672872

Chang Ning District:
长宁区
天山路11弄12号
62747031

No 12, Lane 11, Tian Shan Lu

Hong Kou:
上海市丰镇路118号/上海市水电路1656号
上午8：30—11：30；下午13：30—17：00 周五下午不
受理 65161561

Feng Zhen lu / 1656 Shui Dian Lu
Closed Friday morning.

Huang Pu District:
黄浦区
山东南路49号
63289464

49 South Shan Dong rd

Jing An
静安区
昌平路372号
62539361

372 Chang Ping road (off Shaanxi road)

Lu Wan District:
思南路、香山路 交界拐角处－－卢湾区非机动车管理处
卢湾区 思南路46号 63275000
46 Si Nan lu / Xiang Shan lu

Min Hang District:
上海市沪闵路4888号（莘庄镇靠近颛桥）
上午8：00—11：00；下午13：00—16：30
6489 1010-3015

4888 Hu Min lu

Nan Hui District:
南汇非机动车管理所：

上海市南汇川南奉公路6116号
上午8：30—11：30；下午13：00—17：00
电话58021896

Nan Shi District (Southern parts of City?):
南市区 中山南一路161弄5号 63138859

Pu Dong District:
浦东非机动车管理所：
上海市浦东新区杨高中路1500号上午：9：00—11：30；下午13：30—16：30 周五下午不受理电话28946594
or
浦东新区 浦东南路3640号 58394097

1500 Yang Gao Middle Road
or
3640 Pudong South Road

Putuo District:
普陀区
芦定路325号 52811677

Xu Hui District:
龙吴路2388号，徐浦大桥下面
2388/2138 Long Wu Lu, underneath Xu Pu bridge

徐汇区 龙吴路2138号（徐浦大桥） 64340579

Yang Pu District:
杨浦区
双阳路357号
65433020

Zhabei:
闸北非机所
上海市天目中路707号
上午8：30—11：30；下午13：30—17：00 周五下午不
受理 63172110

Also 闸北区 共和新路1985号 56650065

707 Tian Mu Middle Road