Hi
I have received my cable and it works a little at a time.
Then I plug the cable in and start a video, I see the video about 90 seconds and then it stops and a message pops up on the iphone saying -
"This accessory is not made to work with iphone"

I have disassembled this cable and it has MCU in it

How can I start Preferences app in shell in 1.2.0 iphone firmware, so I can see some debug info? mobile user always reiceives Killed message and if I start it by root user, it just hangs.

Hello again,

I managed to log debug messages of SpringBoard and Preferences app in 1.2.0 firmware, but there were no info about accessorys.
So I downgraded my iphone to 1.1.4 firmware and the cable works!
Here are the debug messages of Preferences app -
If I plug the cable in:
2008-08-01 11:07:21.729 Preferences[68:d03] accessoryAvailabilityChanged: lingoMask: 0 availability: 0
2008-08-01 11:07:21.741 Preferences[68:d03] accessoryAvailabilityChanged: lingoMask: 0 availability: 0
2008-08-01 11:07:24.327 Preferences[68:d03] accessoryAvailabilityChanged: lingoMask: 0 availability: 0
2008-08-01 11:07:24.332 Preferences[68:d03] accessoryAvailabilityChanged: lingoMask: 0 availability: 0
2008-08-01 11:07:24.351 Preferences[68:d03] accessoryAvailabilityChanged: lingoMask: 13 availability: 0
2008-08-01 11:07:24.355 Preferences[68:d03] accessoryAvailabilityChanged: lingoMask: 13 availability: 0
When I unplug the cable:
2008-08-01 11:07:35.587 Preferences[68:d03] accessoryAvailabilityChanged: lingoMask: 13 availability: 0
2008-08-01 11:07:35.592 Preferences[68:d03] accessoryAvailabilityChanged: lingoMask: 13 availability: 0
2008-08-01 11:07:35.656 Preferences[68:d03] accessoryAvailabilityChanged: lingoMask: 13 availability: 1

It seems like this cable has Apple Universal Dock accessory ID 13 as stated in Xian's post here

So it looks to me that Apple has patched out support for accessory ID 13 from 1.2.0 firmware?
But I can't understand why it works about a little time and then a message pops out about incompatible accessory.
There is also one difference behaviour in 1.1.4 and 1.2.0.
In 1.1.4, if I have cable plugged in and I start video or slideshow, then a message pops up asking if I wan't it to watch on TV.
But in 1.2.0, cable plugged in, no message pops up if I start video or slideshow, it just plays on TV about 90 secs and then it stops and complains about incompatible accessory.

seems to me that either after first 90 seconds it checks for something or every 90 second it would check for some continuty which would only be provided by original accessory , and knowing this is again painful because i can't think of providing cotinuty signal every 90 second would get rid of the fun of watching any videos.

how are you able to debug it, my iPhone 3g just goes nuts when you try to run a process interactively from a console,

i do have some advancements though: the process IAPD which can be found witha quick ps aux|grep iapd

cannot be killed, it respawns automatically, and contrary to my (and maybe others belief) is the binary that is disabling everything. heres how i figure:

issuing a:

#kill (THE PID NUMBER OF IAPD) && mv /System/Library/Private.frameworks/IAP.framework/Support/iapd /System/Library/Private.frameworks/IAP.framework/Support/iapd.off

throughly kills iapd, and when you try to run ANYTHING like music, VIDEO etc. resprings your iPhone (i dont recommend doing this again, it froze and i went nuts) but it shows that:

when any video is selected to be played, it first checks with iapd to see if it should output video then acts accordingly, we now need to dump iapd, and change the conditional "is accessory good" to a non conditional selection. OR tell MobileMusicPlayer.app that its good to output video (i dont think will work).

todo list:

1. dump iapd
2. patch it

TheCrapTop:~/IAP.framework# arm-apple-darwin-otool -vVt iapd|grep compat
000109c0 e59f1330 ldr r1, [pc, #816] ;[0x00010cf8] = 0x0008e118 (@* "compatible")

is this of significance? the assembly here is ldr, or LOAD REGISTER, more commonly know ar mov? does this finally mov onto r1 if it is compatible...?

can anyone read otool output, or get the debug (stdout) messages from /System/Library/PrivateFrameworks/IAP.framework/Support/iapd???

to get debug messages from apps there are two possible solutions:

• move original binary to binary_ and make a shell script named as original binary and put this code into it.
  For example:
  mv /System/Library/CoreServices/SpringBoard.app/SpringBoard /System/Library/CoreServices/SpringBoard.app/SpringBoard_
  and make a new file named as /System/Library/CoreServices/SpringBoard.app/SpringBoard and put the code below into this file
  
  Code:

  #!/bin/bash
  exec /System/Library/CoreServices/SpringBoard.app/SpringBoard_ >>/tmp/SpringBoard.log 2>&1

  Don't forget to add an execute bit to this new file (chmod 755 /System/Library/CoreServices/SpringBoard.app/SpringBoard)

• Activate syslogd. This can be done if you execute
  echo '*.* /var/log/syslog' >/etc/syslog.conf
  and change /System/Library/LaunchDaemons/com.apple.syslogd.plist file.
  Find line: <string>/usr/sbin/syslogd</string>
  and right after that line put
  <string>-bsd_out</string>
  <string>1</string>
  save and reboot

i also have bought one cheap tv out cable on ebay, and it was working good on 1.1.4 software.. but when i have upgraded to 2.0 it's gone..
the behaviour is the same as yours, .. some second ok, then a message pop up on the iphone ' not compatible etc..".. then i can only get audio out but no video at all.

The audio is coming out continuosly, not only in ipod app , every game or app that is putting out audio signal.

please find some way to solve this problem

yeah, the second method just keeps a syslogd.log, which is very good in it self, im gonna keep it like that:

i still get no more than i started with, in running iapd interactivley: but when i kill it and then try to start a process that hasnt started from posix_spawnp(....iapd...) it says:
launchd: pid (my pid) dosent have enough privileges or something

and my process outputs abort trap AND (to the file) could not register with bootstrap server (im assuming is launchd), can ANYONE run /System/Library/PrivateFrameworks/IAP.framwork/Support/iapd


-> lol mines deleted now... i have to repwn

update: repwned and here is the msg

Aug 11 20:10:47 iSchmaves-sPhone com.apple.launchd[1] (0x105240.iapd[128]): Check-in of Mach service failed. PID 128 is not privileged: com.apple.iapd
Aug 11 20:10:47 iSchmaves-sPhone iapd[128]: Couldn't register with bootstrap server unknown error code (0x44c); failing...
Aug 11 20:10:48 iSchmaves-sPhone com.apple.launchd[1] (com.apple.iapd[127]): Exited abnormally: Bus error
Aug 11 20:10:48 iSchmaves-sPhone com.apple.launchd[1] (com.apple.iapd): Throttling respawn: Will start in 7 seconds
Aug 11 20:10:49 iSchmaves-sPhone ReportCrash[124]: Saved crashreport to /var/mobile/Library/Logs/CrashReporter/iapd_2008-08-11-201045_iSchmaves-sPhone.plist using uid: 0 gid: 0, synthetic_euid: 501 egid: 0
Aug 11 20:10:49 iSchmaves-sPhone ReportCrash[124]: Formulating crash report for process iapd[128]
Aug 11 20:10:50 iSchmaves-sPhone MobileBluetooth[29]: Session::detach "iapd headsetevent handler"
Aug 11 20:10:50 iSchmaves-sPhone ReportCrash[124]: Saved crashreport to /var/mobile/Library/Logs/CrashReporter/iapd_2008-08-11-201047_iSchmaves-sPhone.plist using uid: 0 gid: 0, synthetic_euid: 501 egid: 0


the line to note is

Check-in of Mach service failed. PID 128 is not privileged: com.apple.iapd

Mach service? not privileged?

we need to get the kernel to run it and log it that way or trick it into think we are privileged... ive tried it as root and mobile...

Another developer says he saw an official Apple demo where the screen was displayed through TV-OUT, just like janwar mentioned. Has anyone else seen something like that? Know how to do it?

first we will have to stop pesky iapd from locking down when it sees the cable

UPDATE:

checkout these "Sec" group of functions, there is no "enable_tvout" but rather an acceptance of the security key provided in response:

TheCrapTop:~# cat iapd.dump |grep Sec
0006e09c eb0004ea bl _SecCertificateCreate
0006e1b4 eb0004b0 bl _SecPolicyCreateiAP
0006e1e8 eb0004a9 bl _SecTrustCreateWithCertificates
0006e254 eb00047c bl _SecCertificateCreate
0006e2b0 eb000465 bl _SecCertificateCreate
0006e304 eb000468 bl _SecTrustSetAnchorCertificates
0006e328 eb00045c bl _SecTrustEvaluate
0006e4b4 eb0003e7 bl _SecKeyCreateRSAPrivateKey
0006e4e8 eb0003da bl _SecKeyCreateRSAPrivateKey
0006e568 eb0003bd bl _SecKeyRawSign
0006e7f8 eb00031f bl _SecPolicyCreateiAP
0006e82c eb000318 bl _SecTrustCreateWithCertificates
0006e898 eb0002eb bl _SecCertificateCreate
0006e8f4 eb0002d4 bl _SecCertificateCreate
0006e948 eb0002d7 bl _SecTrustSetAnchorCertificates
0006e96c eb0002cb bl _SecTrustEvaluate
0006e984 eb0002bf bl _SecTrustCopyPublicKey
0006e9c0 eb0002aa bl _SecKeyRawVerify
0006eaf4 eb000251 bl _SecCertificateCopySerialNumber

notice branch on Security trust:

bl _SecTrustEvaluate

do we just need to change this to unconditional branch on SecTrustEvaluate...?