Author Topic: Mac Mini G4: "Out of range" Issue on non-Apple displays. Experimental way to FIX  (Read 13540 times)

Offline whoisthisguy

  • Enthusiast Member
  • ***
  • Posts: 45
  • Nyaaa
Introduction

As we all know Mac Mini G4 has a Single-Link DVI port which can drive displays up to 1920x1200 resolution digitally and maximum 2048x1536 via VGA adapter.
But there is a huge problem: on pre-Tiger OSes you will get no more than 1280x1024 resolution on non-Apple Displays such as AOC, Dell, LG, Sony etc. More info to read in this thread: http://macos9lives.com/smforum/index.php/topic,4337.0.html 

I want to share my personal experience. Maybe together we will find the solution.

Hardware I'm using in this experiment

Monitor: Dell S2719DGF 27 inch 2560x1440 155hz. Ports: 1 x DisplayPort, 1 x HDMI 1.4, 1 x HDMI 2.0
PowerMac #1: Apple Mac Mini G4 1.5GHz, ATI Radeon 9200 64MB
PowerMac #2: Apple Power Mac G5 Late 2005, Quadro FX4500
Adapter #1: StarTech DVI-D (Single Link) to DisplayPort USB-Powered Active Converter
Adapter #2: Atlona AT-DP400 Dual Link DVI to Mini DisplayPort USB-Powered Active Converter
Adapter #3: Noname VGA to HDMI USB-Powered Active Converter

Experiment #1: The Power Mac G5 + Adapters Experience
Nvidia Quadro FX4500 has two Dual-Link DVIs capable of powering two 2560x1600 Apple Cinema 30-inch displays.

- Booting G5 into Tiger: only 1280x1024 max

- Booting G5 into Tiger with Adapter #1: 1280x1024 max

- Booting G5 into Tiger with Adapter #2: 2560x1440 native

- Booting G5 into Tiger with Adapter #3: 2048x1536 max. * Blurry picture. Screen area distorted, has wrong position and proportions. The monitor itself hasn't controls to stretch and move screen area as CRT monitors.

- Booting G5 into Leopard: same results.

-------------------------------------------

- Booting Mini into Tiger: 1920x1080 max * No option to select 1920x1200. Have Overscan option in Displays like if I'm using a TV as my second monitor.

- Booting Mini into Tiger with Adapter #1: 1920x1080 max, overscan

- Booting Mini into Tiger with Adapter #2: 1920x1080 max, overscan

- Booting Mini into Tiger with Adapter #3: 2048x1536, blurry picture, screen area issues.

-------------------------------------------

- Booting Mini into Leopard with and without adapters: same results


Experiment #2: Mac Mini G4 - Running Jaguar + Panther + Adapters Experience
* For this experiment you will need a clean separate ~ 10GB partition.

Step 1: Boot into Tiger.

Step 2: Somehow obtain Mac OS X Panther or Jaguar Install CDs.

Step 3: Download 10.3.9 / 10.2.8 Combo Updates

Step 4: Mount Install CD 1.

Step 5: Go to /Volumes/[Mounted Install CD]/System/Installation/Packages

Step 6: Launch OSInstall.mpkg. Unselect all additional install options and Run the setup as usual. You have to install OS onto your separate clean Partition. * Wait for setup to complete. If it's not: just force quit.

Step 7: Install Combo update onto partition you have just installed the OS.

Step 8: Run Terminal: diskutil repairpermissions /Volumes/[Volume you installed Panther or Jaguar] * Wait the process to complete

Step 9: Reboot with Option (ALT) key pressed. Select Panther or Jaguar Partition. Hit Enter.
-------------------------------------------

- Booting Mini into Panther: 1280x1024 max

- Booting Mini into Panther with Adapter #1 and #2: 1280x1024 max

- Booting Mini into Panther with Adapter #3: 2048x1536, blurry picture, screen area issues, glitches, freezes.

-------------------------------------------

- Booting Mini into Jaguar with and without adapters: almost the same results.

-------------------------------------------

- Booting Mini into Jaguar or Panther without /System/Library/Extensions/AppleNDRV: 1920x1080, bad colours, glitches.


Experiment #3: Mac Mini G4 - Running Jaguar + Panther with 10.4.11 NDRV + Adapters Experience

Step 1: Copy the contents of Tiger's /System/Library/Extensions/AppleNDRV/ into the same folder of your Panther or Jaguar Partition.

Step 2: Delete Extensions.mkext and Extensions.kextcache from your Panther's or Jaguar's /System/Library folder (you could not have both files there).

Step 3: Run terminal "diskutil repairpermissions /" from Panther or Jaguar or "diskutil repairpermissions /Volumes/[Panther or Jaguar Partition]" from Tiger. * Wait for completion.

Step 4: Cross your fingers and Reboot.

-------------------------------------------

- Booting Mini into Panther with Tiger's NDRV: 1920x1080, no overscan options etc. No glitches.

- Booting Mini into Panther with Tiger's NDRV and Adapters #1+#2: same results.

- Booting Mini into Panther with Tiger's NDRV and Adapter #3: 2048x1536, blurry picture, screen area issues but no glitches or freezes.

-------------------------------------------

- Booting Mini into Jaguar with Tiger's NDRV and with and without adapters: almost the same results.

As you can see there is a Huge improvement with Tiger's NDRV here.

Experiment #4: Mac Mini G4 - Running OS9 + Adapters Experience

* For this experiment you will need OS9 Mac Mini V8 Distro from this thread: http://macos9lives.com/smforum/index.php/topic,4365.msg30502.html#msg30502 installed on separate partition.

- Booting Mini into OS9 with ATI Extensions: 1280x1024 max, Millions of Colours, 2d / 3d acceleration enabled

- Booting Mini into OS9 with ATI Extensions + Adapter #1 & #2: same results.

- Booting Mini into OS9 with ATI Extensions + Adapter #3: 2048x1536, Millions of Colours, 2d / 3d acceleration enabled, blurry picture, screen area issues.

- Booting Mini into OS9 without ATI Extensions: 1920x1080, 256 Colours, 2d / 3d acceleration disabled.

- Booting Mini into OS9 without ATI Extensions + Adapters: same results.

As you can see we have 1920x1080 support here but no acceleration and only 256 colours. It's almost the seme behaviour we saw earlier on Panther and Jaguar.
It would be wonderful to make things from experiment #3 possible here. And I want to say: it's nearly possible. Thanks to darthnVader for his brilliant guide from this thread: http://macos9lives.com/smforum/index.php/topic,4319.0.html

Experiment #5: Mac Mini G4 - Running OS9 with 10.4.11 NDRV

* First of all you will need something:

Super ResEdit which can be found here: https://www.macintoshrepository.org/1867-super-resedit-2-4-2-1-3-.

a Hex Editor of your Choice (I found ResEdit's Hex Editor strange). I'm using HexEdit 1.8.5 which can be found here https://www.macintoshrepository.org/7323-hexedit.

Tiger's NDRV which can be obtained from here: /System/Library/Extensions/AppleNDRV/ATIDriver.bundle/Contents/MacOS/ATIDriver

ATI Extensions from Mac Mini V8 Distro. I recommend to backup this extensions. We will work with ATI Via Driver Extension here.

------------------------------------------

Step 1: Open ATIDriver with Hex editor of your choice.

Step 2: Search ASCII Next for "RockHopper".

Step 3: Search ASCII Previous for "joy".

Step 4: Delete all ASCII code before "Joy!peffpwpc".

Step 5: Search ASCII Next for the next "joy".

Step 6: Delete all ASCII code from the founded "Joy!peffpwpc" to the end of the file.

Step 7: Save the results as a New File.

Step 8: Open newly created file with Super Resedit.

Step 9: Hit YES if it asked you to create Resources.

Step 10: Go into DF section. CMD+C on "Data Fork". Remember the number in "size" column.

Step 11. Open ATI Via Driver with Super Resedit.

Step 12. Go to DF section. CMD+V on "Data Fork". Click "Yes" when being asked for ID replacement.

Step 13. Go back and open "cfrg" section. Then, open the resource itself. Scroll down to the "Length" input field and replace numbers there with the numbers you remembered on Step 10.

Step 14. Save file.

Step 15. Put ATI Via Driver inside the Extensions folder.

Step 16. Reboot the machine.

------------------------------------------

— Booting Mini into OS9 with Patched NDRV: 1920x1080. No "out of range" anymore, but System will freeze right after the ATI Extensions have loaded.
— Booting Mini into OS9 with Patched NDRV without ATI Graphics Accelerator Extension: 1920x1080, Millions of Colours, 2d / 3d acceleration not working.
 
------------------------------------------

Issues

— Issue 1: Having issues with empty Grey Screen and a cursor on it after resolution / colour changes. To fix that just shortly press the power button to initiate the fake sleep (Thanks to Sleeper Extension).

— Issue 2: How to install OS9 if I have only "Out of Range" mode. You can't install OS9 from OSX because you need to format HDD via OS9 to Enable OS9 drivers. So, to boot from CD you need to use VGA monitor or VGA adapter. Also you can disable ATI Extensions. I recommend to Install OS9 from USB. To achieve this:

***** You can lose your data so please do it on your own risk *****

a) Download V8 distro onto your Tiger / Leopard desktop.

b) Insert an Empty USB Drive with enough free space for OS9 Install CD.

c) Open Disk Utility and partition Flash Drive with Mac OS Extended File System and Apple Partition Map.

d) Open Terminal. Insert this "diskutil list". It will list all of yours HDDs. Find the partition from the USB Drive (something like disk2s1, you will identify it by the size).

e) Unmount the Volume with the command "diskutil unmount disk2s1(put your volume here).

f) Now we will copy our install cd onto the flash drive by bites. It will take time (5-20 minutes) so be patient. Type into the terminal "dd if=[Path to Install CD] of=/dev/rdisk2 bs=4096"

So what all this commands mean?:)
dd - the name of the program.
if - short from Input File
of - short from Output File
bs - block size. You can use 1024, 2048, 4096 or any other value here. So every XXXX bites the data will be written onto the drive.

Why you are using /dev/rdisk2 instead of disk2 or disk2s1?
Remember the step "e" when we unmounted disk2s1. We just unmounted the Volume to avoid conflicts, but the disk itself (disk2) is stil present in the system. Also, as you may know, Mac OS X is a UNIX-based system. In UNIX based environment all devices are represented as files in /dev/ directory even HDDs. And we are using unix "dd" command to copy the cd image onto the drive... So, you know what I mean. Also we are using whole disk not only the partition because we will copy all the data, including CD bootsector etc.

Finally: whats wrong with the "r" letter before the "disk2"
Well, I can't provide any info here. But without "r" this operation will require hours. Maybe someone can provide some info on it in the comments below?.

g) Ok. After you insert the dd command and double checked that "if" is your input cd and "of" is your flash drive disk (and not only the volume) hit "Enter". Wait for this procedure to complete. There is no prompts or progress bars so wait until the new terminal input string appears (yourname@nameofyourmac: ).

h) If all is ok, unmount the drive with terminal "diskutil unmountDisk disk2 (the name of your disk without r or /dev/).

i) Reinsert the drive if the partition is mounted successfully you're done. If not - check the steps again. There might be an error.

j) Go onto the mounted partition and delete or move somewhere ATI Via Driver Extension.

k) Reboot your machine holding O+F+CMD+OPT buttons after the Chime sound. You will boot into Open Firmware Environment.

l) type "boot ud:,\\:tbxi". There only 1 space after the "boot" command. Also you will need all symbols like ",",":" etc exactly in mentioned order for this operation to work. Hit Enter. If you follow all the steps you will be booting from OS9 via USB with 2d / 3d disabled and without "Out of Range" issues.
 
-----------------------------------------

Conclusion

As you can see, the Mini's "Out of Range" problem can be solved by the software. But we need to experiment more and share our experience with the community. I want to thank darthnVader, and all the community members who made the boot and use OS9 under unsupported hardware possible. Also I'm sorry for my english. It's not my native language.

-----------------

Please share your experience and comments here. Cheers!
=^__^=

Offline darthnVader

  • Moderator
  • Platinum Member
  • *****
  • Posts: 679
  • New Member
I abandoned 'NDRV's later than 10.3.7 because of the "Grey Screen" issue, oddly it seems only the R9200 was effected by it. The R9550 in one of my iBooks has no issue in OS 9 using the 'NDRV' from 10.5.x.

Offline whoisthisguy

  • Enthusiast Member
  • ***
  • Posts: 45
  • Nyaaa
darthnVader did you try 10.5 NDRV under 9200? I think its possible to fix only the EDID section of NDRV driver and not to replace the whole code. What do you think about it?
=^__^=

Offline whoisthisguy

  • Enthusiast Member
  • ***
  • Posts: 45
  • Nyaaa
@darthnVader Also I have some experience in PPC AGP Graphics Cards flashing. For example: when I was flashing 9800 pro with reduced 64kb rom years ago it wasn't working correctly in OSX without ATI Rom Extender Kext which could be obtained from ATI drivers update package. So, maybe we need to modify OS9 ATI Rom Extender also to fix things? 
=^__^=

Offline whoisthisguy

  • Enthusiast Member
  • ***
  • Posts: 45
  • Nyaaa
Hey everyone! Maybe someone know any good tutorial of NDRV drivers creation? Sample Projects, Links, PDF-s would be great!
=^__^=

Offline darthnVader

  • Moderator
  • Platinum Member
  • *****
  • Posts: 679
  • New Member
@darthnVader Also I have some experience in PPC AGP Graphics Cards flashing. For example: when I was flashing 9800 pro with reduced 64kb rom years ago it wasn't working correctly in OSX without ATI Rom Extender Kext which could be obtained from ATI drivers update package. So, maybe we need to modify OS9 ATI Rom Extender also to fix things?

All the Rom Xtender is is a group of 'NDRV's.

Offline darthnVader

  • Moderator
  • Platinum Member
  • *****
  • Posts: 679
  • New Member
Hey everyone! Maybe someone know any good tutorial of NDRV drivers creation? Sample Projects, Links, PDF-s would be great!

Apple's documentation on 'NDRV's is near useless, good luck.

Offline ELN

  • Gold Member
  • *****
  • Posts: 295
  • new to the forums
NDRVs are essentially just Apple PowerPC binaries that present a specific interface to the rest of the system. They are mainly (only?) used for PCI device drivers. Daniel’s disassembly toolkit, or alternatively Hopper or IDA Pro, can help you get at the PowerPC code inside. Then patching is probably best done by feeding the output of Daniel’s tool back into the MPW PPC assembler.

To make a brand new NDRV, you would probably compile it from C. The OS 7/8/9 driver dev kits for PCI and CardBus should contain sample code.

I am hoping to see a comprehensive archive of all the video card NDRVs that anyone can find. A wealth of data, in my experience, makes all these problems seems shallow.

Does anyone still have the problem of a blank screen lasting until late in the boot process? It will probably be pretty easy to incorporate an NDRV deep into a Mac OS ROM file to work around this.

Offline whoisthisguy

  • Enthusiast Member
  • ***
  • Posts: 45
  • Nyaaa
Quote
NDRVs are essentially just Apple PowerPC binaries that present a specific interface to the rest of the system. They are mainly (only?) used for PCI device drivers. Daniel’s disassembly toolkit, or alternatively Hopper or IDA Pro, can help you get at the PowerPC code inside. Then patching is probably best done by feeding the output of Daniel’s tool back into the MPW PPC assembler.

To make a brand new NDRV, you would probably compile it from C. The OS 7/8/9 driver dev kits for PCI and CardBus should contain sample code.

I am hoping to see a comprehensive archive of all the video card NDRVs that anyone can find. A wealth of data, in my experience, makes all these problems seems shallow.

Does anyone still have the problem of a blank screen lasting until late in the boot process? It will probably be pretty easy to incorporate an NDRV deep into a Mac OS ROM file to work around this.

Hey, ELN! Thank for your reply! Yeap, I've already tried the Ida Pro. But for now I have no luck there. The result code is unstructured and nearly unreadable. I've heard the "macnosy" able to do the trick, but cannot find the distro.
Quote
The OS 7/8/9 driver dev kits for PCI and CardBus should contain sample code.
Maybe you have some files or links? It would be great!

Quote
Does anyone still have the problem of a blank screen lasting until late in the boot process?
I have on mine Mac Mini. Only 1280x720 works well with darth's RockHopper2 modified drivers. I also could boot with 10.4, 10.5 ndrv into 1920x1080 but without 2d/3d and with grey screen issues.

Quote
I am hoping to see a comprehensive archive of all the video card NDRVs that anyone can find.
We need a thread in download section! @MacOs9Lives?

---
I think it's a good idea to create forum thread with all of NDRVs for the OS9 - modified and unmodified.

@darthnVader

I've also tried to use Merlin NDRV from eMAC G4 but unsuccesfully. What I've done - changed "Merlin" to "RockHopper2" and fixed the length in "cfrg". The system just ignores this NDRV. What else can I do?
=^__^=

Offline ELN

  • Gold Member
  • *****
  • Posts: 295
  • new to the forums
I think a GitHub repo would be a good idea.

Offline Daniel

  • Gold Member
  • *****
  • Posts: 300
  • Programmer, Hacker, Thinker
Quite a few Apple development kits are located in the Apple FTP archives: https://www.staticky.com/mirrors/ftp.apple.com/developer/Development_Kits/.

Documentation on NDRVs can be found in here: http://mirror.informatimago.com/next/developer.apple.com/documentation/Hardware/DeviceManagers/pci_srvcs/pci_cards_drivers/Designing_PCI_Cards_Drivers.pdf. Look for "TheDriverDescription" for info on how NDRVs are matched to device tree nodes.

The device name field in a NDRV is a constant 32 bytes long. The first byte is the length of the name; the rest are the name itself. To change it, you must carefully preserve the actual length of the file. Go open the NDRV in a hex editor and find where the name is. The 32 byte area starting 1 byte before the 'M' should look like this:
Code: [Select]
06 4d 65 72 6c 69 6e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00Replace it with this:
Code: [Select]
0B 52 6f 63 6b 48 6f 70 70 65 72 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00That should properly change "Merlin" to "RockHopper2".

Though if you want to test NDRVs out on different devices, you should probably just change the Open Firmware device name to the name the NDRV looks for. Then, you can just type a few lines of forth into a console rather than hex edit a driver.

Offline whoisthisguy

  • Enthusiast Member
  • ***
  • Posts: 45
  • Nyaaa
Quote
Quite a few Apple development kits are located in the Apple FTP archives: https://www.staticky.com/mirrors/ftp.apple.com/developer/Development_Kits/.

Documentation on NDRVs can be found in here: http://mirror.informatimago.com/next/developer.apple.com/documentation/Hardware/DeviceManagers/pci_srvcs/pci_cards_drivers/Designing_PCI_Cards_Drivers.pdf. Look for "TheDriverDescription" for info on how NDRVs are matched to device tree nodes.

The device name field in a NDRV is a constant 32 bytes long. The first byte is the length of the name; the rest are the name itself. To change it, you must carefully preserve the actual length of the file. Go open the NDRV in a hex editor and find where the name is. The 32 byte area starting 1 byte before the 'M' should look like this:
Code: [Select]
06 4d 65 72 6c 69 6e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Replace it with this:
Code: [Select]
0B 52 6f 63 6b 48 6f 70 70 65 72 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
That should properly change "Merlin" to "RockHopper2".

Though if you want to test NDRVs out on different devices, you should probably just change the Open Firmware device name to the name the NDRV looks for. Then, you can just type a few lines of forth into a console rather than hex edit a driver.

Hey Daniel! Thank you for this absolutely amazing reply. I will try the HEX way first. I'm afraid of changing something inside the open firmware because don't want to brick my device. Is it safe? Can I return to defaults by CMD+OPT+P+R or changes will stay there permanently?
=^__^=

Offline Daniel

  • Gold Member
  • *****
  • Posts: 300
  • Programmer, Hacker, Thinker
Yes, there are ways to undo bad Open Firmware settings. This forum thread here goes into much of the specifics: http://macos9lives.com/smforum/index.php/topic,4750.0.html.

But if you just type something on the console with CMD-OPT-O-F, the changes will be gone on the next boot unless you specifically enter them into nvram.

Code: [Select]
dev <insert path to Merlin here>
" RockHopper2" encode-string " name" property
unselect-dev
So this code will change the "Merlin" device's name to "RockHopper2", if the angled brackets are replaced with the path to "Merlin". As with most OF changes, this is entirely temporary, and will only last a single boot.

Offline whoisthisguy

  • Enthusiast Member
  • ***
  • Posts: 45
  • Nyaaa
Quote
Yes, there are ways to undo bad Open Firmware settings. This forum thread here goes into much of the specifics: http://macos9lives.com/smforum/index.php/topic,4750.0.html.

But if you just type something on the console with CMD-OPT-O-F, the changes will be gone on the next boot unless you specifically enter them into nvram.

Code: [Select]
dev <insert path to Merlin here>
" RockHopper2" encode-string " name" property
unselect-dev
So this code will change the "Merlin" device's name to "RockHopper2", if the angled brackets are replaced with the path to "Merlin". As with most OF changes, this is entirely temporary, and will only last a single boot.

Thank you! I will give it a try.
=^__^=

Offline whoisthisguy

  • Enthusiast Member
  • ***
  • Posts: 45
  • Nyaaa
Hey, Daniel! I've tried Merlin profiler with your OF method and it works! Thanks you! This experience is brilliant! And I finally got my mini to boot 1920x1080 @ 72hz 8). I have some minor color glitches on the screen and not tried acceleration yet. I will continue to experiment with different NDRVs. I have one question here. I tried to do some HEX modifications you mentioned earlier but my code differs. For example I don't have "06" counter before "Merlin" in hex and have no zeroes after. Maybe there is something I miss? Thank you again!
=^__^=

Offline Daniel

  • Gold Member
  • *****
  • Posts: 300
  • Programmer, Hacker, Thinker
I am not really sure why it would be different. I haven't ever actually tried to modify NDRVs myself.

The name in the TheDriverDescription structure should be a Str31, but maybe the string "Merlin" shows up several times in the NDRV? I am not confident enough on that subject to offer further advise with that.

Well, good luck on your endeavor. It seems you have pretty good results already, but maybe you can succeed several more times with this project :)

Offline whoisthisguy

  • Enthusiast Member
  • ***
  • Posts: 45
  • Nyaaa
Quote
I am not really sure why it would be different. I haven't ever actually tried to modify NDRVs myself.

The name in the TheDriverDescription structure should be a Str31, but maybe the string "Merlin" shows up several times in the NDRV? I am not confident enough on that subject to offer further advise with that.

Well, good luck on your endeavor. It seems you have pretty good results already, but maybe you can succeed several more times with this project :)

It's a historical moment now. I booted up successfully 1920x1080@60 full 2d/3d support on 9.2.2. No glitches, no grey screens. Used Merlin NDRV from 10.3.9 with your OF hack. Now its time to figure out how to make proper HEX patch and release the drivers for Mac Mini.
=^__^=

Offline whoisthisguy

  • Enthusiast Member
  • ***
  • Posts: 45
  • Nyaaa
Quote
I am not really sure why it would be different. I haven't ever actually tried to modify NDRVs myself.
Daniel, thank you anyway! I've attached the hex. Maybe you have some ideas on it. I've tried to just rename the Merlin to the RockHopper2 in Insert mode via 0xED but OS9 just igonres it. There is zeroes at the end of ndrv and I tried to fix the final size like it was before but with no luck.

The drivers fix is the almost final step to release them for testing.
=^__^=

Offline Daniel

  • Gold Member
  • *****
  • Posts: 300
  • Programmer, Hacker, Thinker
Well, that is definitely the TheDriverDescription structure. The signature 'mtej' marks the start of them.

It seems that the device node is called "ATY,Merlin" instead of just "Merlin". You will notice the '0a' right before "ATY" indicates the proper length of "ATY,Merlin".

So you the substitution should actually be from this:
Code: [Select]
0a 41 54 59 2c 4d 65 72 6c 69 6e 15to this:
Code: [Select]
0b 52 6f 63 6b 48 6f 70 70 65 72 32Hopefully that 0x15 at the end is replaceable. I kind of get the structure, and I think it might be just padding.

Offline whoisthisguy

  • Enthusiast Member
  • ***
  • Posts: 45
  • Nyaaa
Quote
Well, that is definitely the TheDriverDescription structure. The signature 'mtej' marks the start of them.

It seems that the device node is called "ATY,Merlin" instead of just "Merlin". You will notice the '0a' right before "ATY" indicates the proper length of "ATY,Merlin".

So you the substitution should actually be from this:
Code: [Select]
0a 41 54 59 2c 4d 65 72 6c 69 6e 15
to this:
Code: [Select]
0b 52 6f 63 6b 48 6f 70 70 65 72 32
Hopefully that 0x15 at the end is replaceable. I kind of get the structure, and I think it might be just padding.

Daniel, thanks! I will try it today. For now check this bad boy in attachment.
=^__^=