Relisys RWT200EM (Exilis TR333) Thin Client

A few months ago I was given a Relisys RWT200EM (also known as Exilis TR333) thin client (see detailed specs and review here).

I was expecting to “jailbreak” the thin client and get to install some sort of OS (DOS, Linux, early version of Windows on it). However, upon further testing, my disappointment soon came.

The thin client was manufactured by Exilis (also known as Relisys RWT200EM, see Relisys Thin Client) as shown in the splash screen:

It was re-branded by TOA E&I, a Singapore company, and manufactured in 2000 as shown in the about page:

All it will do is to boot up to a Windows CE Remote Desktop client:
 

Issue: unknown administrator password!

Upon pressing F2 to enter terminal settings, it prompts me for a password. I tried all default passwords and common passwords, only to be replied with an error message. I guess whoever last used the client has set an unknown password.

Without the password, the connection settings cannot be changed. And the default connection settings is so odd that the client won’t connect via a normal network using DHCP:

About the only way to get this unit to do something is use a router and setup a network with the expected parameters, then create a remote desktop session from the client to other computers in the network, which seems pretty useless.

The keyboard settings follow Windows CE standard:

It supports up to 1280×1024 @ 60Hz display resolution. However, changing the resolution again asks me for the password,which I do not know:

Apparently it supports remote firmware update if the correct password is provided. Where to find firmware, I don’t know:

Again, the password cannot be changed if the original password is not provided:

BIOS setup

All this seems to be a dead end. I tried to enter the BIOS to see if there’s an option to reset the password there. The website provided at the beginning of this article suggests pressing F1 to enter BIOS,which doesn’t work. What works is to connect a PS2 keyboard (a USB keyboard is only detected by Windows CE and not by BIOS) and press DEL repeatedly AFTER the power button is pressed but BEFORE the text “Starting System… please wait” appears. Pressing F1 during the “Starting system” phase will hang the boot process, with the keyboard still responsive – pressing Ctrl-Alt-DEL again will reboot the set. Probably reserved for some recovery ROM, etc. which was never implemented.

The unit is using the standard PC award BIOS:

Much like a PC BIOS, this bios has options to detect hard disks and set up floppy disk drives:

Examining the motherboard

There are empty connectors to solder an IDE connector (and also floppy connector, not shown) on the motherboard:

I guess luck was not on my side. Unlike the website author’s unit which has empty connector holes, my holes are pre-filled with existing solder. I tried with a 60W soldering iron to clear the solder from the holes but the temperature was not hot enough to melt the solder. The same thing applies for the floppy connector. So installing a hard disk or a floppy disk is out of the question.

Upgrading the firmware

I also tried booting from USB or LAN without success. The only option now would have been to upgrade the firmware on board. The Windows CE firmware is stored on a 16MB M-System DiskOnChip 2000. Up to 64MB DOC is available on eBay. However, no programmer/reader for these DOC seems publicly available. My research reveals the following possible methods to read/write the DOC, none of which I can do myself:

1. You can use an old ISA network card, enable Boot ROM, insert the DOC to the socket on the network card. The system can boot from the DOC and see it as a disk drive.

My system does not have an ISA slot and I do not have any ISA network card.

2. Build your own ISA card to access the DOC. I found the PCB here but however no schematics or software is provided.

3. Use the DOC evaluation board (available for ISA and PCI), see this and this. However, it seems that the evaluation board is no longer in production (M-Systems was eventually taken over by Sandisk)

4. Use a programmer. A user guide is available here but it seems the programmer is rather expensive. It is also unknown to me how to create the image to be programmed.

5. There seems to be an SDK of some sort for the M-Systems DiskOnChip 2000 such as this but there seems to be no good tutorial.

With all possible methods leading to a dead end, I decided to give up on the unit, package it and find someone who is willing to buy it. The board also does not have a lot of components useful for hobby projects. Among these few are a speaker and some audio/LAN connectors but the time taken to desolder these components would definitely outweigh any savings they may offer.

See also:
eBox 3350MX x86 Compact PC
AMD Geode LX TR2350 mini x86-compatible motherboard