Plans
So, it's probably clear by now that our main plan is to get these things to run Linux instead of WinCE. What can we do when we reach that point? Well, we can think about that later. The CPU must be capable of playing ogg/mp3 files, so maybe it'd be a nice network-streamer. Or maybe we can install PCMCIA wireless network cards and use them as bloated access points. Or as X-terminals. Or maybe we can even use rdesktop for Linux to get more recent RDP support.
But we're not quite there yet, of course. We don't even know if it's indeed possible to run Linux on these. But it's worth trying, right?
Try to change things in the firmware
First of all, we downloaded firmware upgrade/addon images from WYSE to see if they make any sense. Well, they did. The file format was quite easy to reverse-engineer, actually. There's a tool available for download on this site to read them. Here you can see part of a file listing of such an image:
Offset Length Cksum? Flags Flags Number Filename 000025ad 00040000 8f7a922d 010000 00010000 3b8e63ea mid_code 000425ad 00000014 fdfc0bfb 010000 00020000 3b8e63ea k 000425c1 00000108 8c3a3502 010000 00020000 3b8e63ea params.ini 000426c9 0037aef3 dfab5bf8 010000 00020000 3b8e63ea nk.bin 003bd5bd 00003b86 296e59d9 010000 00020000 3b8e63ea poweron.bmp 003c1145 00000c4e 670d652f 010000 00020000 3b8e63ea io.sys 003c1d95 000010e1 7a83e7db 010000 00020000 3b8e63ea keybd.com 003c2e79 00000f57 0845510b 010000 00020000 3b8e63ea command.com 003c8b49 0000002a a0d3414f 010000 00020000 3b8e63ea autoexec.bat
When you look at this you'd get the impression that this x86 version of WinCE is more like MS-DOS than you'd expect. Well, we're not sure if those DOS-files are really used. Maybe they're just things left from some debugging environment?
The mid_code file seems to be a special file that, amongst other things, contains a VGA BIOS. Maybe this file is flashed at some special place instead of as a separate file. nk.bin might look familiar to people who worked with Windows CE before, as far as we understand it's an archive with all the Windows CE system files. (There's a little extract-tool for those files available too.) The k file is still a little mystery for us, it seems to be there in every file, even in addons.
Obviously, the first thing we tried when we figured out this file format is to insert a different version of poweron.bmp. This gave us a very nice checksum error, so we can now be sure that the field marked as "Checksum?" is indeed a checksum.
Figuring out how the checksum is calculated wasn't too hard though. It's far from an MD5, and also not quite like CRC32. In short it's the sum of all 32-bit integers (little-endian) subtracted from some magic integer. Besides these per-file checksums, there's also one checksum of the whole archive at the end of the file.
After figuring out the checksum algorithm, we managed to insert a new poweron picture, see the picture. :-) Although just replacing the poweron picture might not look like a big deal, it wasn't that trivial and we certainly consider it a milestone.
After all, if we can replace a bitmap file, it should be possible to replace or add executable files too. But first we'll have to figure out how to make suitable executables for this target. It might be x86-compatible and even Windows, but WinCE does seem to be pretty different from the usual Win32 systems. We hope to be able to use MinGW to generate WinCE/x86 executables, first thing to write will probably be "Hello World".
What's next?
This is where the hacking starts. We're planning to try to write, after Hello World and maybe some other experiments, a Linux bootloader for WinCE. Obviously we never did that before, so it's not exactly going to be easy. But we guess it should be doable. As long as the program will run as Administrator, shouldn't we be able to do anything we want? The XBox-Linux people probably did the same thing with their non-modchip hack.
Of course a WinCE-based bootloader wouldn't be the best solution. Booting directly into Linux would be a lot better. But also, it'd probably be a lot harder. This way Windows will initialize the hardware for us, and we can use it while it's still running to download the kernel and initrd-images. And of course we're less likely to break things when we leave the firmware core alone.
But as soon as Linux runs from WinCE and get more familiar with the hardware, we can try to make this a native Linux box!