unlocked frequencies Z9 firmware (free)

[smartass111]

Hi all

Z9 (not Z9 mini) FW with unlocked frequencies is available for community for free

ANY OVERCLOCKING YOU TRY - ON YOUR OWN RISK
Original frequencies are 500 and 550 MHz. But almost all Z9 from first batches are good at 650 MHz (+20% hashrate)

It is based on bitmain Antminer-Z9-DEFAULT-500-DUAL-MODE-201808280957.tar.gz firmware, only minor modifications were made - freq unlocking, adding freq list, adding links and donation addresses
here they are at a glance:

Code:

# diff -qr --no-dereference z9_orig/tmp z9_mod/tmp
File z9_orig/tmp/dev/initctl is a fifo while file z9_mod/tmp/dev/initctl is a fifo
Files z9_orig/tmp/usr/bin/cgminer and z9_mod/tmp/usr/bin/cgminer differ
Files z9_orig/tmp/usr/bin/compile_time and z9_mod/tmp/usr/bin/compile_time differ
Files z9_orig/tmp/www/pages/cgi-bin/minerAdvanced.cgi and z9_mod/tmp/www/pages/cgi-bin/minerAdvanced.cgi differ
Files z9_orig/tmp/www/pages/cgi-bin/minerConfiguration.cgi and z9_mod/tmp/www/pages/cgi-bin/minerConfiguration.cgi differ
Files z9_orig/tmp/www/pages/minerStatus.html and z9_mod/tmp/www/pages/minerStatus.html differ

cgminer is modified using disassembler and bytes patching

My collegue, efudd https://bitcointalk.org/index.php?action=profile;u=2271429 is working on the same task, but with more features/support etc. So you have an option to have a deal with him - check topic nearby

Download https://yadi.sk/d/8XVjwLbqUzSybg
here is sha1sum of original file 5f84317263cc875fa729547d78e4384e6f811391
Update process is the same as for original firmware

You can click "thank you" here, or make donation to keep people motivated to share such things in future
BTC: 1HHzcJjKgKvs5HakqgGzsNXZ3sL6A6pJuK
ZEC: t1ZZkYfnSGrXjVP371s7Uoembu2PQAqkGeG

Please post your feedback, thank you
PS I'm not a Z9 owner, and had a chance to test modified cgminer only at 1 machine.
PPS Provided as is, no modifications or further improvements planned as for now

PPPS
I was really interested if donation system work or not, here are stats for everyone, so make your own conclusions )
as for 11/14/18
downloaded times from origin link - 423
donations received - 0,0154BTC, 0.1 ZEC, 0.1 ZEC, 0.1 ZEC, 0.5 ZEC, 0.1 ZEC, 0.1 ZEC

[1714294494]

1714294494

[1714294494]

1714294494

[chain86]

I will waiting to try. Just write link please.
best regard.

[efudd]

Awesome! Thank you for sharing freely and openly.

.... and for the record, any one responding to my post and providing feedback, did it of their own volition. While that was 'good marketing', it was not driven by me and was completely organic.
.... and as far as comments about donations, you can see for yourself by checking the addresses for donation. The only funds sent to those were funds I mined myself during testing, and funds someone sent before talking to me asking to get the full version..

I've updated my post pointing people to you. Enjoy!

I'll stop working on per-hashboard-frequency management that would have worked on every single cgminer based miner Bitmain has released.

To do it, just add 2 more segments to cgminer, code up the frequency management reading functions back from cgminer.conf, then go into the main loop that handles frequency setting for the hashboards, jump the current function into your code, set up the same registers, and jump back into the function that actually sets the board frequencies.
Second, modify cgminer to support updating the frequencies across the boards by not having it restart. To do this, hook into bitmain_ZCASH_reinit_chain, but don't step on the functionility int he check_miner_status() function.

Also, please update the image to support auto-tuning of the frequencies once you have this done so the end users do not have to worry about the clocking manually. Many do not know how to SSH/etc.

Back to my day job!

-j

[chain86]

I test it but give me error on 675.. I drop down to 650.. again error on 1 bord chip. no  I make 643 and waiting..

https://www.imageupload.co.uk/images/2018/10/01/ScreenShot2018-10-01at23.08.03.png

ang again on 643 error . Now test on 631

[hashestohashes]

Awesome! Thank you for sharing freely and openly.

.... and for the record, any one responding to my post and providing feedback, did it of their own volition. While that was 'good marketing', it was not driven by me and was completely organic.
.... and as far as comments about donations, you can see for yourself by checking the addresses for donation. The only funds sent to those were funds I mined myself during testing, and funds someone sent before talking to me asking to get the full version..

I've updated my post pointing people to you. Enjoy!

I'll stop working on per-hashboard-frequency management that would have worked on every single cgminer based miner Bitmain has released.

To do it, just add 2 more segments to cgminer, code up the frequency management reading functions back from cgminer.conf, then go into the main loop that handles frequency setting for the hashboards, jump the current function into your code, set up the same registers, and jump back into the function that actually sets the board frequencies.
Second, modify cgminer to support updating the frequencies across the boards by not having it restart. To do this, hook into bitmain_ZCASH_reinit_chain, but don't step on the functionility int he check_miner_status() function.

Also, please update the image to support auto-tuning of the frequencies once you have this done so the end users do not have to worry about the clocking manually. Many do not know how to SSH/etc.

Back to my day job!

-j

There goes your Millions man.

Also, releasing it for free is great (really) but throwing mud at the other developer isn't kosher.

[smartass111]

Awesome! Thank you for sharing freely and openly.
<cut>
Back to my day job!

-j

I posted it as is, will not do any other modifications
So feel free to improve your version - looks like many people need it. And it's always a big advantage to have different firmwares

[efudd]

smartass111,

To get you started on adding additional functionality, here is a quick summary of what I did, and what you would need to add in.

A PE file has many segments in it (varies by file), like .data, .bss, .text ... .text is where strings are stored. From the .text segment, with a good disassembler will break those out and point you back to the assembly for the function(s) that reference those strengths.

So, I started backward.

.text -> "frequency" -> function calling it. Then I spent some time exploring that function, it's callers and callees, and started mapping out the code path around it.

In that, I found the setup functions which took in the frequency and passed it down to a function I could readily tell was calld "set_frequency_chain". Using hexrays I was able to track that back to the fact it takes a chain and a frequency as an argument (as an aside...).

The fact that bitmain limited this to 2 frequencies made it easier than it should have been.  In the calling function, I found their 2 hardcoded constansts for 500 and 550.

Initially I just modified 550 to 650 (simplest byte changes), and realized it could do 650/500 -- that's basically what the free one is. 575+500.

The "paid" version is different in that the constants are not changed, but rather the conditionals that limit it are removed.
That allows you to pass anything you want down to set_frequency_chain.

Now, to enable per-board frequency control, we can continue from there.

That same set_frequency_chain has a calling function (this is about the per-board stuff) which bitmain neutered. Right now it iterates over 4 boards (a constant) and calls set_frequency_chain for eacho f those 4 boards with the frequency passsed in.

To enable per-board freuqency, that function calling set_frequency_chain needs to be completely rewritten and the binary patched. From some research papers, I found how how to add segments to a PE file (this wasn't possible a couple of years ago). So a new function can be written to read the config file, just reeanble finding/processing bitmain-freqX, then simply iterate over the number of boards and initialize each chain. The original iterator has to be skipped, so you have to jump into what you add, then jump back.

That'll enable freq-per-board. For bonus points, an API call can be added to enable calling bitmain_ZCASH_reinit_chain on a given chain if you change the frequency. That'll overload the 'reset' condition for a board to enable changing frequency on the fly.

Add some intelligence to tune the frequencies based on observations of the data in the system, and boom, you'll have a self-tuning, maximally overclockable image.

Some of these tactics will work for any cgminer reverse engineering activity.

Thanks,

Jason

[efudd]

..snip...

There goes your Millions man.

Also, releasing it for free is great (really) but throwing mud at the other developer isn't kosher.

hashestohashes - I am unsure how I've thrown mud at another developer, and will fix it if I have. Please point me to it.

... as far as millions, don't we all wish...

I can't speak to the capabilities of others, but I spent a reasonable amount of time on my work (if others can do it faster, that is awesome!) and actually acquired licensed copies of IDA Professional and Hex-Rays ARM32 compiler to support this work, that alone cost $4100 USD plus tax. I also had to import a Z9, which after customs/taxes/shipping cost $4179. So before I even started the work, I was out $8279.

I've also spent numerous hours responding to email inquiries and PMs to provide support for installation, for overclocking, etc. I've spent a couple of hours this past week in 'teamviewer' helping another individual load on 8 machines....

I definitely didn't do this to "get rich". I only hacked this because I was frustrated that bitmain had locked 'my unit' after delaying it 3+ weeks.

-j

[hashestohashes]

..snip...

There goes your Millions man.

Also, releasing it for free is great (really) but throwing mud at the other developer isn't kosher.

hashestohashes - I am unsure how I've thrown mud at another developer, and will fix it if I have. Please point me to it.

... as far as millions, don't we all wish...

I can't speak to the capabilities of others, but I spent a reasonable amount of time on my work (if others can do it faster, that is awesome!) and actually acquired licensed copies of IDA Professional and Hex-Rays ARM32 compiler to support this work, that alone cost $4100 USD plus tax. I also had to import a Z9, which after customs/taxes/shipping cost $4179. So before I even started the work, I was out $8279.

I've also spent numerous hours responding to email inquiries and PMs to provide support for installation, for overclocking, etc. I've spent a couple of hours this past week in 'teamviewer' helping another individual load on 8 machines....

I definitely didn't do this to "get rich". I only hacked this because I was frustrated that bitmain had locked 'my unit' after delaying it 3+ weeks.

-j

I forgot who I was quoting, the first part was directed at you (the millions lol which was sarcasm). The second half was directed at OP. Fail on my part lol

[yrk1957]

You can click "thank you" here, or make donation to keep people motivated to share such things in future
BTC: 1HHzcJjKgKvs5HakqgGzsNXZ3sL6A6pJuK
ZEC: t1ZZkYfnSGrXjVP371s7Uoembu2PQAqkGeG

Please post your feedback, thank you
PS I'm not a Z9 owner, and had a chance to test modified cgminer only at 1 machine.
PPS Provided as is, no modifications or further improvements planned as for now

Thanks! Working fine for me. Sent you 0.1 Zec.

[efudd]

Your patch is interesting.

It looks like you actually left the conditional check for a maximum of 550Mhz in place, and simply changed the result call which otherwise would force 500, to force what the user put in... it looks like you just copied the opcode at the end of the subroutine to the previous opcode to make both results the same.

In mine, I simply removed the conditional checks, leaving the result in place.

I'm trying to understand why your resulting cgminer is 28kB smaller than stock, however. Can you help me understand why that is the case? What else did you change?

-j

[smartass111]

I'm trying to understand why your resulting cgminer is 28kB smaller than stock, however. Can you help me understand why that is the case? What else did you change?

exactly, prefer to keep things simple.
nothing else, only 2 bytes changed

may be you tried to compare with cgminer from another fw version, I got source from bitmain site.

[efudd]

I'm trying to understand why your resulting cgminer is 28kB smaller than stock, however. Can you help me understand why that is the case? What else did you change?

exactly, prefer to keep things simple.
nothing else, only 2 bytes changed

may be you tried to compare with cgminer from another fw version, I got source from bitmain site.

Nod - ok. That was the conclusion I came to, different starting firmware.

Thank you.

-j

[Zeus30mhThunder]

Able to have a look at the E3 - or is that still a closely guarded secret until the profit dies in the arse and someone finally releases it for the community ....


yeah that happens too with software - we can blame bitmain etc for mining months in advance only to sell off them when the profit dies but these firmware tweaks are done exactly the same way.   Now that the z9s are no longer great - these software hacks are coming out now.

Ironic much.  (looking at you l3+) etc

However to the OP ..thanks.... i guess.

[efudd]

Able to have a look at the E3 - or is that still a closely guarded secret until the profit dies in the arse and someone finally releases it for the community ....


yeah that happens too with software - we can blame bitmain etc for mining months in advance only to sell off them when the profit dies but these firmware tweaks are done exactly the same way.   Now that the z9s are no longer great - these software hacks are coming out now.

Ironic much.  (looking at you l3+) etc

However to the OP ..thanks.... i guess.

I released my Z9 hack basically the same day I got my Z9, so, unsure about the "hack coming out after z9 no longer great" -- if it did, it's cause of bitmain.

[mondychan]

getting wrong temp readings , (0° ; 13° ; 15° etc, all over the place) with this fw, was ok on stock fw

[smartass111]

Please compare only with bitmain FW https://file11.bitmain.com/shop-product/firmware/Antminer%20Z9/Firmware/00720180828134924801AEF4xGBj066F/Antminer-Z9-DEFAULT-500-DUAL-MODE-201808280957.tar.gz

It's just a bit modified source (2 bytes instruction with frequency check removed), nothing to do with temp etc.
I never had a chance to check "stock FW"


Also I deleted paragraph about efudd, looks I was wrong and he worked much harder than me. I'm sorry mate, probably I was impolite
So if you want guys to have additional support and features - pay him per fw copy

But I still believe people should have free basic version

[mondychan]

using this : antminer-z9-mini-201805262047-500m.tar.gz my miners are OC-able and have no problem with temp readings, just FYI

[mineshop.eu]

Hi all


My collegue, efudd https://bitcointalk.org/index.php?action=profile;u=2271429 is working on the same task, but with more features/support etc. So you have an option to have a deal with him - check topic nearby

Download https://yadi.sk/d/8XVjwLbqUzSybg
here is sha1sum of original file 5f84317263cc875fa729547d78e4384e6f811391
Update process is the same as for original firmware

You can click "thank you" here, or make donation to keep people motivated to share such things in future
BTC: 1HHzcJjKgKvs5HakqgGzsNXZ3sL6A6pJuK
ZEC: t1ZZkYfnSGrXjVP371s7Uoembu2PQAqkGeG

Please post your feedback, thank you
PS I'm not a Z9 owner, and had a chance to test modified cgminer only at 1 machine.
PPS Provided as is, no modifications or further improvements planned as for now

Great work thank you!

[d.v.]

using this : antminer-z9-mini-201805262047-500m.tar.gz my miners are OC-able and have no problem with temp readings, just FYI

are you saying you used the mini firmware on the non-mini and it worked?