Patching 3com 3c905 driver (rhapsody) to work with unsupported variants

Hey everyone

Recently I've been putting together a build for running rhapsody on real hardware. Mainly just to poke around and have fun with all the old code

Anyway, I noticed there is a 3com 3c905 driver included with rhapsody dr2. I've got one of those cards but apparently the driver rejects it because it's eeprom checksum is unknown, and the device id isn't in a list of valid device IDs. The one I have is the cost reduced "3c905cx-txm" card released in ~2002


After dropping the driver into IDA and poking around, apparently its trivial to change the checks on both. I inverted the result of the eeprom check, added my device ID and it started working with my card without issue (so far)
though it seems it only runs at 10mbit.

I think it's pretty safe to assume it will work with all 3c905 variants, as long as you use the right device ID (both in the patcher, and in configure.app advanced section)

I've included the small java program I used to modify the binaries, it should compile using the javac included with rhapsody dr2

I'm trying to figure out if there is a cleaner way of doing this (adding eeprom checksums and device ids) but for now this at least gets the cards working. Also currently trying to modify the EIDE driver to work with promise ultra133 controllers, but that's a bit tougher.

How it works
To patch the driver, the program changes 3 bytes. First it adds the device ID (in my case, 0x9200) to the driver. Then it inverts the result of the eeprom check.

Inside EtherLinkXL_reloc
- Seek to address 0x45AC and write device ID
- Seek to address 0xD62 and write byte 0x74


Source
import java.io.RandomAccessFile;
public class patch {
        public static void main(String[] args) throws Throwable {

                int deviceID = 0x9200; // 3c905cx-txm. find your device id in device manager on windows (or google the model)


                RandomAccessFile raf = new RandomAccessFile("/private/Drivers/i386/EtherLinkXL.config/EtherLinkXL_reloc","rw");

                long len = raf.length();

                /* find offsets
                int last = 0;
                for(long i = 0; i < len; i++){

                        int now = raf.read();

                        if(now == 0x1C && last == 0x75){ // find bytes for eeprom check. change this to 0x50 && 0x90 to find device id (0x9050 aka vanilla 3c905 device id)
                                System.out.println("Detected at " + String.valueOf(i-1));
                        }

                        last = now;
                } */

                raf.seek(17836); // patch device id
                raf.write(deviceID & 0xFF); //0x50
                raf.write((deviceID >> 8) & 0xFF); //0x90

                raf.seek(3426); // patch eeprom check
                raf.write(0x74);

                raf.close();
        }
}

To do this, add your device id at the top of the code. Then save it as patch.java
Then (as root) run this command:
javac patch.java && java -classpath /System/Library/Frameworks/JavaVM.framework/Classes/classes.jar:. patch
Make sure you already have the 3c905 driver installed

I'm happy to report this trick also works with the 3c905b! (0x9055 device id)

I picked up a dell optiplex GX1 the other day, which has a 3c905b integrated. Interestingly enough configure.app autodetects the 3c905b, but it doesn't work without the patch.

Really nice system for running rhapsody actually, everything except the sound is supported with the included drivers and a little modification. (I also had to add the device ID for the rage pro)