Hacks

For over fifteen years my friend Jay and I have exchange trapped presents at Christmas. When I say trapped I mean it in the classic Circle of Death game style — if you open the present carelessly a buzzer will sound or explosive cap will trigger.

I usually focus on making it difficult to find and disarm a simple explosive-cap trap, but this year I wanted to change things up a bit and focus on the effect itself. In particular, I wanted to make a box trap that would shoot darts out in all directions, machine-gun style. It had to be completely mechanical (what can I say, I like the style better), and had to be stable enough to ship through the mail without going off or getting jammed. After many attempts I landed on this rather elegant sprung-hammer design (click for video and construction notes).

Here I’ve been complaining about simply unbranding my Treo, when somebody’s managed to put Linux on a Treo 650.

(By way of Engadget, by way of Nerfduck.)

My Treo 600 has never had good voice quality and the past week or two has started crashing when wireless is used, so I picked up a 2-month-old Cingular/AT&T Treo 650 off of Craig’s List. In the US, smart phones are mostly sold by carriers who are hellbent on locking their customers into their own revenue streams, which means most cellphones on the market are “locked” to a particular carrier and some of the functionality, like the ability to use the cellphone as a wireless modem over bluetooth, are deliberately crippled. [Update: apparently, both Cingular and Sprint have now uncrippled this feature — good for them.] The previous owner of my phone had already finagled an unlock code, so my phone can be used with any GSM carrier just by inserting a new SIM card, but it was still running the Cingular-branded ROM. This weekend’s project has been to replace it with the generic unbranded Palm-OS ROM — which turned out to be much more difficult than I had expected. Below are some notes on the process, intended mostly for people searching Google after running into the same troubles I did.

Note: All the instruction sheets I’ve run into warn that trying to upgrade your firmware to the generic version can be difficult and may very well ruin your Treo completely. Attempt at your own risk.

I started by following the instructions at Uneasy Silence, with help from a description at Treonauts. The upgrade is a two-step process: first you need to upgrade to the beta version of the unbranded firmware & software (1.23 & 1.06), and then to the current 1.28/1.13 versions. That’s because all versions since 1.23 now check to see if you’ve got a branded ROM already, and refuse to upgrade if you do.

The first attempt to upgrade to 1.23 ran through the steps but then ended with an error message, leaving me in an odd indeterminate state. My phone’s firmware showed up as 1.23 and the software version showed “Treo650-1.06/2078-…” with the last part of the version not fitting onto the info screen. I think the missing part was ROW, the ID for the unbranded-Treo version of the OS, but the phone still showed the Cingular logo on reset. The phone was also somewhat flakey in this state, with hotsync not working from the cable and other attempts to upgrade to 1.28 resulting in the cryptic error “”Different partition detected. Hotsync installer cannot be used. To upgrade your device, use the SD installer.” It took me a while to recognize that the upgrade had only partially succeeded and to redo the 1.23 upgrade process a second time, but once I did the phone showed the generic Treo logo on reset.

Upgrading to the 1.28 firmware and 1.13 software was harder, and I still have no idea what the problem was. If I were running Windows I’d just run an EXE file, but since I’m using Mac OSX the official instructions say to hotsync to load 44 files, at which point the upgrade program would run. I forgot to bring my hotsync cable with me for Thanksgiving break, so I tried hotsyncing via Bluetooth instead. Unfortunately, the phone continued to reboot in the middle of the hotsync, try running the update software with incomplete files, then complain “There is not enough memory available to complete this operation.” (I suspect this error message is spurious — it came up in all sorts of situations.) Copying the 44 files onto an SD card, transferring them to the phone using Launcher X and then doing a soft reset led to the same error, as did transferring only the DB files over using the SD card and using the normal Bluetooth hotsync to transfer the program files. Running the “DeviceConfiguration” program directly from SD card gives an error about not being able to find its scenario files.

What eventually worked was this:

1. Copy the 44 files onto my SD card
2. Do a hard reset to the phone, thus erasing all files
3. Beamed Launcher X from my Treo 600 to my 650
4. Inserted the SD card into the 650, and used Launcher X to copy the 44 files from the SD card to RAM (handheld)
5. Without doing a soft reset or removing the SD card, I ran the program “D.C.” which now showed up in the applications section
6. Plugged the phone into power, pressed OK and watched the upgrade (finally) go off without a hitch!

If this weren’t a new phone, at this point I’d have used hotsync or BackupBuddy to restore all my data to the phone (you did make a backup before starting, right?).

I have no idea why this worked when nothing else did — for all I know the planets were just in alignment this time and my particular method didn’t matter one bit. If this helps or works for you, great! Let me know in comments! If if doesn’t work feel free to leave comments too — I won’t be able to help, but I’ll a least sympathize.

Update 11/26/05: After searching around a little more I see that Sprint and Cingular both used to cripple Dial-Up Networking (DUN), but apparently Cingular enabled it in February and Sprint enabled it in June.

The mad scientists over at Squid Labs have just launched instructables.com, a free collaboration site for posting step-by-step instructions for making interesting stuff, from bikes to food to protocols for biology research.

After being rightly chastised in the comments, I’ve updated last month’s magnet trap post with my solution for setting and disarming the trap.

I rigged up a new trap a few weeks ago, designed to work with a pretty wooden drawer-box I found at the thrift store. It’s not too hard to disarm, but I like the simple design (details below the fold).

For over a decade my friend Jay and I have exchange trapped presents at Christmas. When I say trapped I mean it in the classic Circle of Death game style — if you open the present carelessly a buzzer will sound or explosive cap will trigger. It all started when we were designing traps for live-action role-playing games, but quickly became a challenge to one-up each other each year. These days we open all the other presents first and then settle down with our flashlights, dentist tools and wire clippers to work on opening each other’s presents while the rest of the family eats pie and enjoy themselves making unhelpful comments.

Jay and I each have our own style of trap-making. Jay has become a master of secreting traps in places that you’d think he couldn’t access. His high-point is probably the time he gave me a deck of gaming cards that he had somehow unsealed, hollowed out, rigged with a cap-popper trap, then resealed and reshrinkwrapped such that it looked like new again. (That’s rivaled by two years ago, when he managed to plant an explosive inside a cut-then-resealed chocolate egg.) I’m always trying a new angle on things — my favorite is still the time I gave him a “special” version of Looking Glass’ PC game System Shock, which included a specially-included candy red button in the second room of the game that when pressed would berate him for not checking closely for traps as it dropped powerful monsters on his head. (It always helps to know the programmers…)

This past Christmas I wanted to try a trap where the mechanism was plain to see but a puzzle to disarm. The result is the magnet trap shown bottom left. The metal plates at the bottom are sold in joke shops as Exploding Toilet Seat gags. They’re spring-loaded to lift up and set off a cap, but in this case the magnets attached to the top of the popper are being pressed down by the magnets attached to the top of the lid. On one side is a north-polarity magnet being pushed down by another north-polarity magnet, on the other side is a south-polarity magnet pushed down by another south-polarity magnet. The whole system is quite stable — until you try to turn the lid to open the jar. Then the north and south magnets on the lid switch positions and pull the poppers up, setting off the caps. You can see the whole thing in action by clicking on the picture below. Jay tried using magnets underneath the jar to counteract the ones on the lid, but that wasn’t enough force to fight both the magnets and the mechanical spring. I’ll leave the right way to disarm the trap (and the way I originally set it) as an exercise to the reader (and will probably eventually put it in an update).

Jay had two traps this year — the first was a buzzer trap held down by a Borg Teddy Bear that he had gotten at the Star Trek Experience in Los Vegas. It was rigged so if I moved the bear or pulled the wrong wire first it would go off. Remembering my MacGyver lore, I pulled the red one (or was it black?) and disarmed it. The main trap, however, was the bear itself — he had taken it to a teddy-bear factory and had them sew in a voicebox that played his own message. I didn’t set it off (I learned long ago never to press something from jay that says “press me” on it), but am still impressed. You can see it in action from the other movie linked below.

Magnet trap explained (Quicktime, 3.1M)	Borg Teddy-bear trap (Quicktime, 750K)

Update (7/24/05): explanation of how to disarm below the fold.