I've successfully downgraded firmware by replacing a new OS version with an old one. I have 2 devices now with 2 different firmwares: the latest 1.6.53 (With HDD lockdown) and the oldest 1.3.10 (without HDD lockdown). I successfully used HD Clone software to clone the hidden partition of both devices. Thus, I downgraded (replaced) 1.6.53 to 1.3.10 by moving the hidden partition from 1.3.10 HDD over 1.6.53 HDD. The bootloader version stays the same, but you can downgrade the bootloader by starting for example 1.5.53 firmware file or anything older than 1.6.53 to be able to hack your device with GFT technique using arcwelder's hack.
Also I successfully unlocked plugins on the old 1.3.10 device by just replacing its HD with the one having 1.6.53 installed and used the same plugin files bought for the second 1.6.53 device. Because the hard drive stayed the same, the same plugin files worked fine!
But I had to hurry because after my old player started with the new 1.6.53 (even 1.5.53) I have around 5-6 seconds to start the file because the player reboots suddenly. So I quickly started one file, updated, rebooted and started another file, rebooted. It happens because old bootloader and new OS version are incompatible.
I will release a hack for bootloader which will unlock the plugins with no pain. But for now here are the files you will need:cinema_DFP6ZNLRCLJ86E.zipvideopodcast_DFP6ZNLRCLJ86E.zipa604wifi(1.5.53).aos
the firmware file for downgrade1_3_10(604Wifi).zip
- 1.3.10 hidden partition image1_6_53(604Wifi).zip
- 1.6.53 hidden partition imageWD_Firm.zip
- HD Clone for installing those images (follow my links below to get a password)flash
- an utility for dumping and flashing bootloaderbootloader_1.3.10_a604wifi.dump
I could finally compile libcrypto.so.0.9.7 for starting arcwelder hack to input commands with my laptop. Much quicker way for hacking other things. You can download the whole arcwelder archive from here arcwelder.zip
. You should unpack the files to Data\arcwelder directory. Then just put this System.bin
file into the System directory by replacing the original one. Remember to change the name to System.bin. Disconnect your device from PC, go to file sever settings and you should see there long strings in workgroup and password fields. Otherwise try to reboot your device. If you can see them, start wifi and go to wifi stats to see the IP address of your device. Then start putty (for windows). In the Host Name field input the ip address of your device, connection type should be SSH, port 22. Press Open. If everything goes right, the console window will ask you to input username for login. You should login as root and then you will see the welcome message. Wait until the next message from busybox appears and then you're welcome to your device! Have fun!
How to unpack WD_Firm.zip: the main archive file WD_Firm.zip (password: ☤ﮝﻻ⋩ﻛԷ따덕ڦ㏶쳥) contains another archive file called Firm.zip (password: ☃✧〠Ⓙ〶✰ǬⓆ). Unpack the file Reports.rar from Firm.zip and change its extension to exe. Then run it to install the HD Clone. If those passwords don't work just let me know.
Follow this link on how to use the software for downgrade:viewtopic.php?f=23&t=70886&p=417594#p417594
The final file bootloader_1.3.10_a604wifi.dump is a bootloader dump (WITH UNLOCKED PLUGINS!!
) in case if you want to replace an almost dead hard drive with a new one or install an SSD. The HDD lockdown function is disabled there. You can use the flash utility for flashing the dump file. DANGEROUS!! Read my 704 topic about it.
How to start it. Put it into whatever folder you like. Let's says you put it into Data. All gen4 devices have a 16Mbit Intel flash chip called 28F160C3BD. According to its datasheet its memory ends at FFFFF (In HEX). Let convert it into decimals for bytes. It becomes 1048575 bytes.
Let's dump the whole flash memory into a file:
/mnt/data/Data/flash -d /mnt/data/dump.bin 0x0 1048575
/mnt/data/Data/flash is a path to the utility
-d is a dump flag
/mnt/data/dump.bin is a path for saving the dump file
0x0 is a starting address
1048575 is the number of bytes to be read.
How to write your file back:
/mnt/data/Data/flash -f /mnt/data/dump.bin 0x0
-f is a flash flag
I suppose my device froze because maybe I should kill avos_helper.sh avos first.
I don't know why, but if you kill avos_helper.sh the avos get frozen.
By the way, if you kill avos, Archos will stop responding to any button and touch pressing. Even lights will not respond when you connect a charger. But the file server will keep running so you may keep using the console.
As gen4 devices are almost identical among each other I recommend you to read more information on other stuff like getting a remote access with SSH, bootloader hacks and more ideas:viewtopic.php?f=18&t=70333viewtopic.php?f=23&t=70890