Hacking devices can/will void your warranty and can turn your expensive consumer electronics into worthless trash if you don't know what you're doing. This blog is for information purposes only, and if you try to hack into your own consumer electronics, you do so at your own risk. The device I'm currently hacking is the Canon SX10 IS camera.

Wednesday, January 28, 2009

The seagate problem

I've posted about it in the wiki already, so if you want to see that information, it's at http://screenplayprohd.wikia.com/wiki/Detecting_drive_identity

But my blog is for documenting how I did it.

I started out as I do with many of my ventures by going to google. In looking up how to read the disk drive serial number, I came across the linux IOCTL command, which is for direct device communication. May come in handy in the future. In trying to find a working example of how to use it, I found somebody opening the /proc/something else (I don't recall what it was) and I started thinking that maybe there was something for the drive.

So I looked in proc and found ide, found ide0 inside of it, and several files inside of that.

cat them all out and I could see tons of hexadecimal. So my first thought was to convert the hexadecimal to character format. I went to my favorite hex editor "HxD" (freeware, works really nice) and manually entered the codes. Sure enough, I saw the "SD15" code appear and then the drive model number.

Great, but I can't explain that process to non-programmers very easily. So I figured I'd see if there was some way to do it on the command line. Got as far as awk and decided it would be easier to do this in a simple C program. That would enable me to use my toolchain that I spent so long trying to build.

So the program is simple enough. It uses the built in ability of C to convert a hex string to decimal using strtol command, which is then echoed out as a character.

In other news...I think I've made some progress deciphering the memory dump I took of the machine. I was able to reconstruct a view of the screen that was on the TV at the time I took the screenshot. Don't have time to tell about it now, but details will come.

Monday, January 19, 2009

ScreenPlay Pro HD and "Yet anOther Dummy CTCS"

The instructions are on the Wikidot site: http://rtd1261.wikidot.com/tweaking-the-official-firmware

The only change I needed to make was that after extracting and copying the files, the /usr/local/bin/ctorrent and /usr/local/bin/dctcs files needed to be chmod to become executable. And to make sure that I created the TORRENT and DOWNLOAD directories in the right place /usr/local/etc/hdd/volumes/HDD1/TORRENT and /usr/local/etc/hdd/volumes/HDD1/DOWNLOAD. After that, the torrent web page worked just fine. Sure, it would be nice to be able to enter those from the screenplay, but even to be able to tell the screenplay which torrents to download via a web browser and then come back later to find them already present on the screenplay...well, it's convenient. I'm not a big fan of torrents, but I think if you do like them, it is a worthwhile thing to setup.

Tuesday, January 13, 2009

Fun with the player

Tried a few things tonight. I plugged in a keyboard into the player to see if it supported one right out of the box. Unfortunately, it does not. So I'd have to get a keyboard driver loaded on it.

I also played around with the DvdPlayer part of the OS.

it is located in /usr/local/bin. I believe it automatically starts from the rcS located in the /usr/local directory, although I haven't experimented with that to see if it was the case.

You can stop the current one by typing stopall. It will terminate the RootApp and the DvdPlayer.

So I tried putting in a DvdPlayer from an Emtec player. Copied both the DvdPlayer and the Resource directory. Unfortunately, it wasn't able to boot it. In fact, it even stopped responding to telnet, so I had to use my System Recovery CD to mount the directory and put things back. Oh well.

Now, something really fun to do is to do the stopall, and then start up the DvdPlayer again. You do it by typing, from the /usr/local/bin directory:
./DvdPlayer -l on -o /var/log/dvdplayer/user_input
Now it will launch the Dvdplayer and dump the stdout and stderr to your telnet session. And the information it reports back is very useful...

for instance, it starts off:

Livepause not stop correctly last time
"umount /usr/local/etc/hdd/livepause" failed. The partition "may" not be mounted.

-->There is further mention of the livepause later on. it is possible that with 6 partitions, this drive might support livepause. Continuing with the log:

trying to change type of multiple extents
info, udhcpc (v0.9.9-pre) started
CMD: mkdir -p /tmp/netb/smb
In my system...
CMD: mkdir -p /tmp/smb
In my system...
CMD: ifconfig > /tmp/netb/samba_my_ip
In my system...
GrandMa Revision: 131384
(User Input)Pipe Created.
(Internal Event)Pipe Created.
MediaServer.cpp , 431 bind local IP fail 0 !!error = Address already in use
tandy: AbstractAP::Init, startMode=0
command: rm /tmp/hddmedia
In my system...
command: ln -s /usr/local/etc/hdd/volumes/HDD1 /tmp/hddmedia
In my system...
pli initialization...
free [0] address 0x42000000, size = -16777216 to Cache
free [1] address 0x43800000, size = -2097152 to Cache
free [2] address 0x43a00000, size = -1638400 to Cache
In my system...
In my system...
[udf check done]
In my system...
Video DebugMem Physical Address = 0xa9ea00
MEMCache Hit [0]! size = 16777216, address = 0x42000000
tandy: lba 14,ariid=
MediaServer.cpp , 431 bind local IP fail 0 !!error = Address already in use
MediaServer.cpp , 431 bind local IP fail 0 !!error = Address already in use
MediaServer.cpp , 431 bind local IP fail 0 !!error = Address already in use
tandy: etho enable, static=0
[HDMI]: Set AVMute
[HDMI] setHDMIPscan(456) HDMIPscan = 1
tandy bright=32
tandy contrast=32
pli_allocGraphic 2097152 bytes, Old priority = 0
pli 1st allocated virt addr = 47000000, phy addr = 3000000 , end addr = 47120000
pli 1st allocated virt addr = 470d8000, phy addr = 30d8000 , end addr = 471f8000
pli_allocGraphic 884736 bytes, Old priority = 0
pli 1st allocated virt addr = 47200000, phy addr = 3200000 , end addr = 47320000
pli_allocGraphic 442368 bytes, Old priority = 0
pli 1st allocated virt addr = 47300000, phy addr = 3300000 , end addr = 47390000
pli 1st allocated virt addr = 471b0000, phy addr = 31b0000 , end addr = 47210000
pli_allocGraphic 196608 bytes, Old priority = 0
pli 1st allocated virt addr = 47380000, phy addr = 3380000 , end addr = 473c0000
pli_allocGraphic 147456 bytes, Old priority = 0
pli 1st allocated virt addr = 473c0000, phy addr = 33c0000 , end addr = 473f0000
[HDMI] setHDMIAudioVideoFormat(230) HDMI EDID table isn't ready !!!
pli_allocGraphic 262144 bytes, Old priority = 0
pli 1st allocated virt addr = 47400000, phy addr = 3400000 , end addr = 47440000

-->I think this might be telling me the address of the graphic buffers. The EDID is a documented structure that the HDMI TV reports.

IN : /tmp/ramfs/usb/livepause
IN : /tmp/ramfs/usb/rec
tandy: abstractap: start to activate the gudie ap
MediaServer.cpp , 431 bind local IP fail 0 !!error = Address already in use
tandy: AbstractAp, GetInitialFlag 1
IN : /tmp/net
Create /tmp/net Ok!!!
In my system...
In my system...
In my system...
wait wlan0!!0
lock success
I locked the file
I locked the file
release success
lock success
I locked the file
I locked the file
release success
lock success
I locked the file
I locked the file
release success
GetDeviceUp 0 flag : 0x1043
SetupClass::GetInstance()->GetNetEth0DHCPEnable() = 1
In my system...
lock success
I locked the file
I locked the file
release success
lock success
I locked the file
I locked the file
release success
lock success
I locked the file
I locked the file
release success
lock success
I locked the file
I locked the file
release success
In my system...

0 usb block device found
No Recording Partition Available !!!!!!
No Timeshift Partition Available !!!!!!

-->More mention of the livepause (timeshift) system... very intriguing. Would it do livepause if it had the partition available? I wonder...

DNS IP : 127. 0. 0. 1
/bin/echo nameserver >> /etc/resolv.conf
In my system...
MediaServer.cpp , 431 bind local IP fail 0 !!error = Address already in use
Click eth0 DHCP IP and DNS
In my system...
In my system...
DNS IP : 127. 0. 0. 1
/bin/echo nameserver >> /etc/resolv.conf
[HDMI] HDMI_thread(40) start !!!!0529 PVR
[HDMI]: Disable HDCP
[HDMI] setHDCPEnabled(1854) HDCPEnabled = 0
[HDMI]: Set AVMute
[HDMI] Hotplug Change !!! -1 -> 1
[HDMI] init_HDMI_EDID_data !!!
[HDMI] setHDMIPscan(456) HDMIPscan = 100
[HDMI] setHDMIPscan(456) HDMIPscan = 1
[HDMI]: HDCP_Authenticate HDCPOper_state=0xtandy: discovery: bind fail
Running non-bridged mode...
debug, Sending discover...
debug, Sending select for
info, Lease of obtained, lease time -1
[HDMI]: HDCP_Authenticate HDCPOper_state=0x2

[HDMI]: Start HDCP Authentication. t=1231876062593
tandy: AbstractAP::Init 1
IP : 192. 168. 42. 5
ioctl error: No such device
In my system...
wait wlan0!!1
tandy: eth0 alive, start eth0 discovery daemon
lock success
I locked the file
I locked the file
release success
tandy: guideap,CMD_USB_UPDATED, don't care
Key processed.
[HDMI]: Tx Reads EDID from Rx.
[HDMI] setDVIMonitor(1865) DVIMonitor = 0
0x00 0xff 0xff 0xff 0xff 0xff 0xff 0x00 0x6a 0x4e 0x94 0x02 0x01 0x00 0x00 0x00
0x00 0x0f 0x01 0x03 0x80 0x40 0x24 0x00 0x0a 0x92 0x03 0xa2 0x56 0x48 0x99 0x25
0x14 0x4a 0x4d 0x21 0x08 0x00 0x01 0x01 0x01 0x01 0x01 0x01 0x01 0x01 0x01 0x01
0x01 0x01 0x01 0x01 0x01 0x01 0x01 0x1d 0x80 0x18 0x71 0x1c 0x16 0x20 0x58 0x2c
0x25 0x00 0xf4 0x19 0x11 0x00 0x00 0x9e 0x01 0x1d 0x00 0x72 0x51 0xd0 0x1e 0x20
0x6e 0x28 0x55 0x00 0xf4 0x19 0x11 0x00 0x00 0x1e 0x00 0x00 0x00 0xfc 0x00 0x5a
0x4f 0x52 0x41 0x4e 0x20 0x48 0x44 0x4d 0x49 0x20 0x54 0x56 0x00 0x00 0x00 0xfd
0x00 0x3b 0x3d 0x0f 0x3c 0x0c 0x00 0x0a 0x20 0x20 0x20 0x20 0x20 0x20 0x01 0x22
0x02 0x03 0x18 0x71 0x45 0x07 0x02 0x03 0x04 0x05 0x26 0x09 0x07 0x07 0x15 0x07
0x50 0x66 0x03 0x0c 0x00 0x10 0x00 0x80 0x8c 0x0a 0xa0 0x14 0x51 0xf0 0x16 0x00
0x26 0x7c 0x43 0x00 0xf4 0x19 0x11 0x00 0x00 0x98 0x8c 0x0a 0xd0 0x8a 0x20 0xe0
0x2d 0x10 0x10 0x3e 0x96 0x00 0x90 0x2d 0x11 0x00 0x00 0x18 0x00 0x00 0x00 0x00
0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x37

HDMI_EDID.tag = 2
HDMI_EDID.revision = 3
HDMI_EDID.offset = 24
HDMI_EDID.bUnderScan = 0
HDMI_EDID.bBasicAudio = 1
HDMI_EDID.native_format_number = 1
data_block_collection_length = 0x14, VideoTagCode(ptr) = 0x01
HDMI_EDID.VDB_length = 0x05
HDMI_EDID.VDB[0] = 0x07
HDMI_EDID.VDB[1] = 0x02
HDMI_EDID.VDB[2] = 0x03
HDMI_EDID.VDB[3] = 0x04
HDMI_EDID.VDB[4] = 0x05
data_block_collection_length = 0xe, AudioTagCode(ptr) = 0x01
HDMI_EDID.ADB_length = 0x02
(HDMI_EDID.ADB + 0)->coding_type = 0x01
(HDMI_EDID.ADB + 0)->channel_count = 0x01
(HDMI_EDID.ADB + 0)->sample_freq_all = 0x07
(HDMI_EDID.ADB + 0)->sample_size_all = 0x07
(HDMI_EDID.ADB + 0)->max_bit_rate_divided_by_8KHz = 0x00
(HDMI_EDID.ADB + 1)->coding_type = 0x02
(HDMI_EDID.ADB + 1)->channel_count = 0x05
(HDMI_EDID.ADB + 1)->sample_freq_all = 0x07
(HDMI_EDID.ADB + 1)->sample_size_all = 0x00
(HDMI_EDID.ADB + 1)->max_bit_rate_divided_by_8KHz = 0x50
[HDMI]: Pass ADB data to audio firmware.................
[HDMI]: Copy HDMI AUDIO data to physical addr(uncacheable addr)
[HDMI]: ADB[0] = 0x26
[HDMI]: ADB[1] = 0x9
[HDMI]: ADB[2] = 0x7
[HDMI]: ADB[3] = 0x7
data_block_collection_length = 0x7, SpeakerAllocationTagCode(ptr) = 0x00
data_block_collection_length = 0x7, VendorSpecificTagCode(ptr) = 0x01
HDMI_EDID.VSDB_length = 0x06
HDMI_EDID.VSDB[0] = 0x03
HDMI_EDID.VSDB[1] = 0x0c
HDMI_EDID.VSDB[2] = 0x00
HDMI_EDID.VSDB[3] = 0x10
HDMI_EDID.VSDB[4] = 0x00
HDMI_EDID.VSDB[5] = 0x80
data_block_collection_length = 0x0, ReservedTagCode(ptr) = 0x00
data_block_collection_length = 0x0, Reserved_6TagCode(ptr) = 0x00
data_block_collection_length = 0x0, VESA_DTC_DataTagCode(ptr) = 0x00
data_block_collection_length = 0x0, UseExtendedTagCode(ptr) = 0x00
HDMI_EDID.native_format_number = 0x01
HDMI_EDID.native_format[0] = 0x8c
HDMI_EDID.native_format[1] = 0x0a
HDMI_EDID.native_format[2] = 0xa0
HDMI_EDID.native_format[3] = 0x14
HDMI_EDID.native_format[4] = 0x51
HDMI_EDID.native_format[5] = 0xf0
HDMI_EDID.native_format[6] = 0x16
HDMI_EDID.native_format[7] = 0x00
HDMI_EDID.native_format[8] = 0x26
HDMI_EDID.native_format[9] = 0x7c
HDMI_EDID.native_format[10] = 0x43
HDMI_EDID.native_format[11] = 0x00
HDMI_EDID.native_format[12] = 0xf4
HDMI_EDID.native_format[13] = 0x19
HDMI_EDID.native_format[14] = 0x11
HDMI_EDID.native_format[15] = 0x00
HDMI_EDID.native_format[deleting routers
adding dns
16] = 0x00
HDMI_EDID.native_format[17] = 0x98
[HDMI] HDMI_GetCurrentVid(1037) HDMI_Video_List_Index 19
[HDMI] HDMI_GetCurrentVid(1038) HDMI_Video_Info_Index 11
[HDMI] HDMI_GetCurrentVid(1039) HDMI_EDID_VDB_Index 4
[HDMI] i 19 - HDMI_Video_List[i] 5
[HDMI] HDMI_GetNextVideoListIndex 20
[HDMI] HDMI_thread(135) call setHDMIAudioVideoFormat()
[HDMI] HDMI_GetCurrentVid(1037) HDMI_Video_List_Index 19
[HDMI] HDMI_GetCurrentVid(1038) HDMI_Video_Info_Index 11
[HDMI] HDMI_GetCurrentVid(1039) HDMI_EDID_VDB_Index 4
[HDMI] setHDMIPscan(456) HDMIPscan = 2
[HDMI] set setHDMIPSCANFlag = 1
[HDMI] VID = 0x5 1080i 60Hz
[HDMI] VIDEO type = 0x08
[HDMI] VIDEO HDMI_Sd_Hd = 0xa8
[HDMI] VIDEO Vid = 0x05
[HDMI] VIDEO RGB_or_YCbCr = 0x00
[HDMI] VIDEO PixelRepeat = 0x00
[HDMI] check EDID structure !!!!
[HDMI] HDMI_AudioCurrentIndex = 0
[HDMI] AUDIO use Input_I2S !!!!
[HDMI]: Turn on HDMI................... 1 s_freq=3 c_cnt=2 t=1231876063066
MediaServer.cpp , 431 bind local IP fail 0 !!error = Address already in use
[HDMI]: Clear AVMute
[HDMI]: Clear HDMI Audio Mute(Turn on AUDIO)
[HDMI]: Send_AudioMute() Ok, argp.hdmi_mute=0
[HDMI]: HDMISwitchTVSystem SP t=1231876063377

[HDMI] AUDIO HDMI_AudioInMode = 0x01
[HDMI] AUDIO HDMI_LocalInfo.coding_type = 0x01
[HDMI] AUDIO HDMI_LocalInfo.channel_count = 0x01
[HDMI] AUDIO HDMI_LocalInfo.sample_freq = 0x03
[HDMI] AUDIO HDMI_LocalInfo.sample_size = 0x03
[HDMI] AUDIO HDMI_LocalInfo.max_bit_rate_divided_by_8KHz = 0x00
[HDMI]: HDCP_Authenticate HDCPOper_state=0x3
[HDMI]: HDCP_Authenticate HDCPOper_state=0x4
[HDMI]: HDCP_Authenticate HDCPOper_state=0x5
[HDMI]: HDCP_Authenticate HDCPOper_state=0x6
[HDMI]: HDCP_Authenticate HDCPOper_state=0x9
[HDMI]: HDCP_Authenticate HDCPOper_state=0x7
[HDMI]: HDMI HDCP Authenticated t=1231876063378
wait wlan0!!2
MediaServer.cpp , 431 bind local IP fail 0 !!error = Address already in use
wait wlan0!!3
MediaServer.cpp , 431 bind local IP fail 0 !!error = Address already in use
wait wlan0!!4
MediaServer.cpp , 431 bind local IP fail 0 !!error = Address already in use
wait wlan0!!5
MediaServer.cpp , 431 bind local IP fail 0 !!error = Address already in use
wait wlan0!!6
MediaServer.cpp , 431 bind local IP fail 0 !!error = Address already in use
lock success
I locked the file
I locked the file
release success
wait wlan0!!7
MediaServer.cpp , 431 bind local IP fail 0 !!error = Address already in use
wait wlan0!!8
MediaServer.cpp , 431 bind local IP fail 0 !!error = Address already in use
wait wlan0!!9
MediaServer.cpp , 431 bind local IP fail 0 !!error = Address already in use
wait wlan0!!10
MediaServer.cpp , 431 bind local IP fail 0 !!error = Address already in use
wait wlan0!!11
MediaServer.cpp , 431 bind local IP fail 0 !!error = Address already in use
lock success
I locked the file
I locked the file
release success
wait wlan0!!12
MediaServer.cpp , 431 bind local IP fail 0 !!error = Address already in use
tandy: GuideAP: CMD_POWER
[VIN] VIN_RPC_TVD_TOAGENT_VBI_CTRL, hr != S_OK !!!!!!!!!!!!
[AIN] AIN_RPC_TOAGENT_CREATE_0 send successful
wait wlan0!!13
start ao rpc config
start ao rpc config spdif
[AIN] InitializeInputStatus 1 1 0
[VE] RPC_EN_TOAGENT_ENC_INIT, format: 1, source: 0, hr = S_OK
Input Pin not connected while pause
[AE] RPC_TOAGENT_CREATE, hr = S_OK, agentID: 48
************** connect
[AIN] RPC_CONNECT to AO, 32 0 5 0
[AE] AUDIO_RPC_TOAGENT_INITRINGBUFFERHEADER, input pin, listSize: 4, header: 7ff9c618
[AIN] RPC_CONNECT to AE, 48 0 5 2
[AE] msg ring buf m_pMsgRingLower: 4bd40000, m_pMsgRingUpper: 4bd48000
*** aout pause
[AIN] ADC0_Config: 1 15 0 0, 48000 16
[AIN] ADC0_Config, hr = S_OK
[AIN] ADC1_Config: 1 15 0 0, 48000 16
[AIN] ADC1_Config, hr = S_OK
MEMCache Hit [2]! size = 1638400, address = 0x43a00000
MediaServer.cpp , 431 bind local IP fail 0 !!error = Address already in use
Key processed.
lock success
I locked the file
I locked the file
release success
lock success
I locked the file
I locked the file
release success

-->Somewhere around here, I told it to shut down (not using standby or the power button...read on to see how)

[VE] status: (3, 1, 0, 0, 3)
state force paused
AUDIO_RPC_ToSystem_HDMI_Setting_0_svc(546) prio_process = 0
[HDMI]: AUDIO parameters are the same, no need to setup again.
wait wlan0!!14
free [2] address 0x43a00000, size = -1638400 to Cache
state force stoped
MediaLoaderThread stopped

!!!!!!!!!!!!!!!!!!! CMD_TERMINATE received

lock success
I locked the file
I locked the file
release success
lock success
I locked the file
I locked the file
release success
Free Graphic 0x47000000
Free Graphic 0x473c0000
Free Graphic 0x47300000
Free Graphic 0x47380000
error in pli_freeContinuousMemory()...
error in pli_freeContinuousMemory()...
In my system...
MediaServer.cpp , 431 bind local IP fail 0 !!error = Address already in use
free [0] address 0x42000000, size = -16777216 to Cache
wait wlan0!!15
Entering Suspend Mode ..
I locked the file
I locked the file
release success
Schedule is off.
Delete Network
In my system...

Something else I found was that I could control the DvdPlayer from my keyboard in this mode. These are the keys that did something that I could determine. I know there are some missing because the DVD Player wouldn't allow certain operations at that time. For instance, I can't seem to find a video with multiple angles, but I'm sure one of these keystrokes is the angle button. Update: Post on emtec reveals that e is the angle button.

a - audio button
b - takes you into the recording setup screen
c - delete schedule when in recording, otherwise doesn't appear to do anything
e - angle (reported by other users, not verified)
f - reverse play <<
j - reverse zoom (starts at max zoom and goes back to 1)
l - slow play reverse
m - mute on/off
n - skip to next title (not chapter)
o - Shut down quickly
p - skip to prior title (not chapter)
q - go back 10 SECONDS
r - start recording / switch to av
s - subtitle toggle
v - volume -
z - normal zoom

A - left
B - 30 Second Skip
C - Command Line interpreter, engineering mode, see below
D - right
E - Delete
F - Fast forward >>
G - Asks for GCode. Not sure what the GCode is. Tried a VCR+ code given the context, but the code I tried only crashed the player.
H - report some kind of status
L - slow play forward
M - Menu
N - Next chapter
O - shut down normally
P - Prior chapter
Q - Stop
S - Play
T- AV input screen
V - volume +
W - up
X - down
Z - Step / pause

- - goto
= - repeat a/b
+ - repeat button

# - go to USB screen
$ - go to SPP directory when on another source
& - graphical file copy, looks nice. Much better than the cut/copy/paste concept you can do from the remote.
( - start performance logging
) - stop performance logging
~ - memory allocation status
0-9 - same as entering 0-9. Jumps to title. I did not know you could jump to a specific title that way on this player, so something new.

[ - source button
] - In the menu, will go to the last source accessed.
{ - home button
, - return button
/ - go to setup menu
\ - switch tv system
: - switch tv system (not sure how it is different from \)

ESC - Go to setup menu
Spacebar - Select (this is what the play button on the remote maps to)

In engineering mode, you can type HELP and get this:

Engineering Mode Command List:
port: read or write value to specified address
setdebug: set audio/video debug flag
setbri : set Video In Brightness value (00~ff)
setcont : set Video In Contrast value (00~ff)
setsatu : set Video In Saturation value (00~ff)
sethue : set Video In Hue value (00~ff)
setscal : set the coefficients of VIN Scaling (0x10
: set VO hardware's Color Adjustment transformation matrix
copyfree: enable copy-free
netperf : Enable network performance meter. Use on or o
ff to tern on/off this feature
netperf nodecode, means streaming only withou
t decode.
setyc: set YC separation parameters [6 parameters]
| save: save setting
| load: load setting
| default: use factory default setting
| show: show current setting
shell: Unix Shell to execute unix command
kill: kill the program immediately (to generate coredump)
quit: quit from command line interpreter

So I'm thinking if I can grab the stdin of the DvdPlayer process, I could have another program control it. It could start the recording, for instance. Or it could automatically navigate, play certain files. In fact, some of the information coming back during DvdPlayer execution relates to the video/music/picture it is currently working on. And I would love to be able to map the 30 second skip command to a remote button...

Wednesday, January 7, 2009

Getting buildroot to work

Ok, I've already talked about compiling a binary on the device using the toolchain I found. Unfortunately, it works less often than I expected due to the difference in libraries and linux system.

So a better option would be to build my own so I can specify exactly which linux kernel to use, and which uclibc to use.

Well, this has not been an easy process. I originally started documenting all of the steps, but there have been so many steps trying to get it to work that I've lost track.

Step 1. Get the Ubuntu 8.04 ISO.
Step 2. Get vmware player. This will allow you to play a virtual machine on your machine. It's a way to host another operating system without losing what you have on yours.
Step 3. Get vmx builder. This is a way to build the virtual machines. You'll need to set up one that has a CD Rom that points to the Ubuntu ISO, and a hard drive with at least 20 GB.
Step 4. Launch the ubuntu VMX. This will start the virtual machine and launch the Ubuntu install. After you have completed the linux install, you'll be ready to start the real task.
Step 5. Once into linux, open a terminal screen. At the prompt type:
sudo apt-get install xxxxx
where xxxxx is replaced with the following packages:

That will install those individual packages. You can combine those onto one line separated with a space to save time. I've put them on individual lines so you can see each package required.

Then type:
sudo dpkg-reconfigure dash

and when prompted, select No. This was at the recommendation of another website that said dash would interfere.

That's all for the prerequisites.

now type

svn co svn://uclibc.org/trunk/buildroot

That will pull down the buildroot source. Now you need to configure it. Type:

make menuconfig

and after a moment, you will get the configuration. Change the configuration target so that it will do (first option) MIPSEL, (second option) MIPS32. You can also enable Large File support (I suspect Iomega forgot to do that one) and the generic development too.

Now exit. Then type


Bye bye. It'll take a while. When you get back, you'll find that you've just compiled a root file system for the wrong version of the Linux kernel, and the wrong version of the uClibc. Hold on, that doesn't mean get mad at me for not telling you the additional configuration options. You have to do it first the way it is currently checked into SVN. It is possible it won't work. If it doesn't work, solve the problems before continuing on. That'll make it easier to solve the problems you will run into when selecting the right kernel and uclibc.

Ok, if you want the older version of the linux file system that matches the one on the SPP, then go to the ~/buildroot/package/linux directory and modify the Config.in file in it to include the correct version of linux.

Now build, selecting the new version of linux. It'll download and decompress it, but then fail because it doesn't know how to build the Kbuild file. You'll need to pull the Kbuilds from the other linux directory. The Kbuild file appears to tell the buildroot utility what include files are needed. Well, the other linux directory includes files in the Kbuilds that aren't in the older version of linux, so after you copy then you'll have to modify those Kbuild files to remove those references.

Except there's another complication. The newer version of linux includes unifdef which is needed in the build. So you need to pull that one from the other version of linux as well.

Then you may find .h files in different places, which can be resolved by putting in symbolic links from their regular place.

And then there's trying to find the right package selection. I selected the build environment and blew everything up.

uClibc version is there, but you have to select the option for showing obsolete packages. Oh, and be sure to do a make clean when switching between linux and uclibc versions.

Yeah, see, it was getting so complicated I couldn't keep it down to a few simple steps.

Maybe somebody who understands buildroot will find an easier way. But I think from here, the best thing for me to do is to provide the .tar of my buildroot directory (so you can pull down your own packages as needed, and solve the problems with them as you try to compile them).

And for those who are satisfied with a version of linux + 0.9.28 uClibc toolchain + gcc and tools in an .ext2 file that can be chrooted to, I can provide the ext2 file.

All I have to do at this point is find a place to host the files. box isn't going to do it because the ext2 is 75 Mb and the tar file is over 1 gb, although I think I can get the size down on that by removing some of the easy-to-add packages and let them download.

Stay tuned if you're interested in either of these files. In fact, leave me a comment letting me know you're interested, as I probably won't try to find a host until I know somebody wants this.

Friday, January 2, 2009

Solving the NTFS problem

On the way home tonight, my friend and I started talking about the facts that we knew and started speculating as to what is really happening. We had eliminated the operating system as the issue by testing it out on both XP and another Vista machine. We came up with a few experiments to run to eliminate the possibility of it being a hardware issue. On the computer that was causing the problem, we mounted it using a live linux CD, then unmounted and confirmed that it was still working. That eliminated the hardware.

With those eliminated, we figured it had to be related to software. Since we were seeing this on a sony machine and a dell machine, it eliminated sony and dell software (what's on one would not likely be on the other). That made 3rd party software suspect. Found that a common program was Norton Internet Security 2009. Tried disabling it, but it still caused the problem. Uninstalled and... it worked! Installed Norton Internet Security 2007 and it continued to work, so it was specific to the 2009 version.

We're speculating that Norton is marking the drive, much like it does when you use Ghost (also by the same company). It could be marking it to trap boot sector viruses, or marking it as a monitored drive. Whatever the reason, it is apparently compatible with Vista, XP, and Gentoo Linux, but not compatible with the NTFS driver on the ScreenPlay Pro.

Response to comments:
Sabi -- per your request:
/ # cat /proc/mounts
rootfs / rootfs rw 0 0
/dev/root / ext3 ro 0 0
none /dev devfs rw 0 0
none /proc proc rw,nodiratime 0 0
devpts /dev/pts devpts rw 0 0
none /sys sysfs rw 0 0
none /tmp ramfs rw 0 0
/dev/ide/host0/bus0/target0/lun0/part2 /usr/local/etc/dvdplayer ext3 rw 0 0
/dev/ide/host0/bus0/target0/lun0/part4 /usr/local/etc/dvdplayer/hdd/volumes/HDD1
ntfs rw,uid=0,gid=0,fmask=0177,dmask=077,nls=utf8,errors=continue,mft_zone_mult
iplier=1 0 0
/dev/rd/0 /mnt/rd vfat rw,nodiratime,fmask=0022,dmask=0022,codepage=cp437,iochar
set=iso8859-1 0 0

/ # uname -a
Linux Iomega #29 Wed Sep 10 22:00:48 CST 2008 mips unknown

Thursday, January 1, 2009

Change of mind

Ok, so after exploring some new avenues on the SPP and trying to figure out where my discoveries really belong, I decided the wikidot wiki really wasn't the place for it. So I created a new wiki and I'm logging all of the information I'm discovering there.


I've added my 2 GB fix to it this morning. It was the luck of a draw, really. I was exploring the wikidot and noticed that on a German page (Peter's) where they discussed the FTP hack, they also had the samba hack. So I pulled that one down, extracted it (WinRar again) and found an smbd binary in it. Tried plugging it directly in place of the one on the drive (located at /usr/local/etc/dvdplayer/samba/bin) but that didn't fix the problem. In fact, it stopped the drive from recognizing any smb requests. I removed it from the inetd.conf file (in the /etc directory) and manually started it myself, specifying the location of the configuration file.

It worked. So I added it back into the inetd.conf file and added the samba configuration file as a parameter to the drive. Tried it again, and it worked. Cool thing is, it ended up transferring the file about twice as fast.

Some other things I've done:

1. With a second screenplay on the network, was able to confirm that they can see each other, that they both have different names (iomega-d7xxxxxx), and both have different divx codes.

2. Was able to format the media partition on the drive as ext3 (used the system rescue cd, fdisk to drop the partition and recreate it at an ext3 partition, then formatted it, which took a long time).

3. Trying to help out a friend -- his drive stops booting whenever he plugs the screenplay pro hd into Vista, even if he doesn't access the drive and just unplugs it. So I formatted mine as ext3, plugged it into his computer and it continued to work afterwards.

That means formatting it for fat32 would probably also take care of the problem, but then you've got a silly 4 gb limit. Reformatted it for NTFS, plugged it into his computer again and it stopped working.

At that point, I used the system rescue CD, disabled the mount (found in /etc/rcS1) and then booted it. Yes, it booted, but the drive was obviously inaccessible. Nonetheless, I was able to get into it via telnet and try to mount it manually. Got a segmentation fault, the drive had been "corrupted." The built in windows scandisk utilities did not fix it.

Vista has added some additional things into the drive which are supposed to be backwards compatible. Tried mounting it with system rescue cd and the ntfs-3g driver and it worked fine. So the problem is the screenplay pro hd ntfs driver. It is not compatible with the Vista changes.

4. Took apart the drive to see its innards. Nothing spectacular to look at, as most of the secrets are under the heat sink. The heat sink covers the main processor and I wasn't about to try to remove it. The shielding was really annoying to get off too.

5. Mapped out all of the remote codes. Tried sending it some of the unmapped remote codes, but didn't find any hidden menus / service menus. I logged all of that on the wiki. Did find that the requirement to point directly at the device comes from the lack of a good IR light on the remote itself. When I used my JP-1 remote, I could bounce the signal off of walls and picture frames and it would still pick it up. So the main unit has a good IR receiver. I think there may be a way to send a keycode to the player using the network. I'm going to explore that someday too.

6. I discovered that the uclibc libraries that ship with the device (0.9.28) are not binary compatible with those found on the toolchain I discovered earlier. So while it is still possible to run programs when you've done a chroot to do the compile, most of those won't work once you exit the chroot shell. So I will need to figure out a way to get a precompiled 0.9.28 toolchain. I think Peter may have the answer.

Response to comments:
Dominik -- haven't looked into the auto mount for the usb drives. It's easy enough to switch them to read/write, but I suspect you're asking how to get them to mount as r/w to begin with. The approach I'd take to figure it out would be to telnet in with the drive just barely powered up and the USB drive attached to it. If it is already mounted, then there may be a startup script on the drive somewhere that does it and it should easy to modify. If it isn't mounted until you select the USB option in the menu, then the main DvdPlayer is responsible for mounting it and it will be much more difficult to change without doing it through telnet every time. I'll take a look at it later and see.
-- followup: after I posted, I recalled that there was a "hotplug" binary that detects the new USB devices. Looking at the binary, I see the mount command being done as -o ro (read only) inside the binary. So you can wait for Iomega to publish their modifications to the hotplug program (yeah, right) or you can use a tool like WinHex to modify that binary so that the devices will be mounted read/write. Just look for the text "mount" in the hotplug file and, you'll find it. Make sure you don't insert new or delete extra characters, or you'll kill the binary. /sbin is where the hotplug file is found.