Hacking the Fiery X3e and X2

The Fiery is a standalone print server to which you can connect any printer and turn it into a network printer, kind of like a souped-up version of a JetDirect box. There are several different Fiery units, some MIPS based, some on a PCI card, and some x86 based. We got a couple of these from work, and now Justice and I are working on them and trying to hack them into MP3 servers or something. Read on for more details.

Updated 7/16/04: Pictures, details on the hard drives… Updated 7/19/04: Partial file listing from the X2 drive!

__Fiery X3e __CPU: 366MHz Celeron RAM: 64MB (3 slots, max 512MB) Interfaces: 2x 3.3v PCI, 1x NuBus(?) Network: EtherExpress 100Mbit (using a 3C509 because of driver issues) External: Parallel/Serial/USB Disk Controller: 40-pin IDE, 44-pin IDE HDD: 8GB ext3 (stock is 10GB ext2) LCD: /dev/ix1284 OS: Fedora Core 1 (stock is a custom Debian)

We removed the hard drive and mounted it in another Linux system. First thing we did was reset the root password. The partition table was as follows:

Disk /dev/hdb: 10.2 GB, 10262568960 bytes 255 heads, 63 sectors/track, 1247 cylinders Units = cylinders of 16065 * 512 = 8225280 bytes /dev/hdb1 Linux (128MB, /boot) /dev/hdb2 Linux (512MB, /) /dev/hdb3 Linux swap (256MB) /dev/hdb4 Linux (9+ GB, /scsi0, spool?)

The bootloader was LILO, and loaded the default image of diablo. Diablo stands for Diagnostics, Install and Boot LOader. The default console is the serial port, so we used HyperTerm to boot. The system boots to a Debian login. It is a very barebones install, however apt-get is installed. There is no DNS support, everything is in /etc/hosts. The only apt sources were for the EFI servers. No GCC, no wget, nothing of any real use. There is an efisys process running which appears to control the LCD. There were well over 150 processes started.

A person by the name of Fumiaki Okushi seems to be involved with the X3e development. fumiaki appears in several log files, and there is a fumiaki who works at EFI and has posted in Linux dev lists (Google for it).

To replace this, we did a clean install of FC1 on an 8GB drive. After installing, we removed GRUB (the X3e didnt like it at all) and replaced it with LILO. /etc/lilo.conf and /etc/inittab were updated to run a console on the serial port and everything went fine from there. The system finds an EtherExpress Pro 100 network card, but fails to initialize it, complaining about an invalid EEPROM. Were using a 3C509 for the time being.

The LCD is controlled by the ixSerial driver, and is an IX232. It is available at /dev/ix1284 with maj 254 min 0. Software for the LCD appears to be available in LCD.dpkg file on /boot or lcd_1.02.tar.gz in /packages. The command to control the LCD is /bin/dialog, but I havent tested this in a non-Debian system.

Now we need to find an audio card for it.

Fiery X2 CPU: 200MHz MIPS RAM: 64MB (4 slots, max ???) Interfaces: 1x 5v PCI, 1x 64-bit PCI(?) Network: Unknown (100Mbit, has ethernet & token ring) External: Parallel/Serial/USB, and what appears to be either SCSI or a custom Epson interface Disk Controller: 40-pin IDE, 68(?)-pin SCSI, 34-pin floppy HDD: 4GB HDD (unknown partition type) LCD: Same as X3e but on non-standard connector OS: Unknown, proprietary, possibly BSD based

The hard drive has no partition table that I can find. I dumped the drive to an image on my linux machine. Running strings on the image turns up quite a few tidbits, some CSH scripts, and what looks like assembly or some Adobe scripting code, complete with comments. Heres one of the many copyright notices in there:

”© Copyright 1998 Electronics for Imaging, Inc. (EFI). All Rights Reserved EFI products contain certain trade secrets and confidential and proprietary information of EFI. Use, reproduction, disclosure, distribution by any means are prohibited, except pursuant to a written license from EFI. Modification, translation, reverse engineering, decompiling, disassembling, and creating derivative works based on this software are prohibited, except pursuant to a written license from EFI. Use of copyright notice does not imply publication or disclosure.”

I managed to get the drive image mounted, but its not working quite right yet. All files are unreadable and show up as 538,976,288 bytes. Mount lists the filesystem as vfat, but Im guessing thats not correct.

[root@localhost temp]# ls adobe drivers lcdstr pspages startup..o boot feature_.not libs queuedic.t sysdict boot.st fonts65 mxinsta.ll rebooton system calib halftone net release..ver system.d.ict color httpd nvram res.dict tmp config.l.ist hwdecomp..of passdict spool videodic.t dev0 initdict product..ver start disable..pcl l10n project.mxw start.no.tel