Hacking devices can/will void your warranty and can turn your expensive consumer electronics into worthless trash if you don't know what you're doing. This blog is for information purposes only, and if you try to hack into your own consumer electronics, you do so at your own risk. The device I'm currently hacking is the Canon SX10 IS camera.

Wednesday, October 21, 2009

Controlling the dvdplayer from an external program

Well, I figured out a couple of things today, my day off...

First, the RootApp. I figured out that it is required in order for the Power Off button to work. Otherwise, the unit does not shut down properly. This becomes critical with the second discovery...

In a prior post, Fun with the Player I detailed that you have telnet control over the screenplay if you launch the DvdPlayer program after executing a stopall. You can then send keypresses to remote control the screenplay. This trick was stopped in R1.8 firmware, although it still works if you kill -9 the RootApp process. The real trick is to get it to allow you to connect to some kind of key queue that you can fill up after the screenplay is booted.

For the ScreenPlay Pro, the /usr/local/etc has an rcS file that launches the DvdPlayer portion in conjunction with the RootApp. So, using a suggestion from jamoba posted to the emtec group back in february, I modified my rcS as follows:

if [ -f $DEFAULT_AP_DIR/DvdPlayer ] && [ -x $DEFAULT_AP_DIR/DvdPlayer ]; then
if [ -f $DEFAULT_AP_DIR/RootApp ] && [ -x $DEFAULT_AP_DIR/RootApp ]; then
echo Running dvdplayer with RootApp
touch /tmp/command_sender.txt
tail -f /tmp/command_sender.txt | RootApp DvdPlayer -l on -o /var/log/dvdplayer/user_input&
echo Running dvdplayer
./DvdPlayer -l on -o /var/log/dvdplayer/user_input&

sleep 10
cat /tmp_orig/startscript >> /tmp/command_sender.txt

So basically, I have a series of keypresses in the startscript file that it sends 10 seconds after launching the program, which is just about right. I can have the startscript read something like:

(There's a single space before XX and a single space after)

To have it automatically go into the ScreenPlay drive and press down twice and select the folder or media at that location.

Now, if I wanted to send more keystrokes outside of the startscript, I can simply add to the /tmp/command_sender.txt by commands like "echo O >> command_sender.txt" to have it automatically shut down the screenplay. I can do this in a telnet prompt AFTER the screenplay has booted. Theoretically, I could write an http webpage that displays all of my movies, say in thumbnail mode, and if I select one, it could send the necessary prompts to the screenplay to automatically select and play the movie. It could even send the necessary prompts to launch the movie from a DVD menu. Or shut off the screenplay from a remote location.

There is a condition in which it won't run the script. This script will run each time the screenplay is powered on, but does not work if the screenplay is brought back from standby mode. If you shut off the screenplay with the remote, then any scheduled recordings you have will automatically boot up the screenplay. The screenplay is in Standby mode.

If you shut it down by holding down the power button on the front of the console, then it shuts off the power and you will miss any scheduled recordings. It is not in standby mode.

When you power up from standby mode, the "Iomega" logo does not appear during the boot process. That is one way you can identify that you are in standby mode. It also isn't going to run the rcS script, and thus won't run the startscript text file either.

Something else I discovered: If you telnet in, go into standby mode, then turn the screenplay back on, your telnet session will still be running. This is a symptom of it coming out of standby mode. All processes are still running. Thought it was interesting.


  1. Hi ConsumerElectronicsHacker,

    the device I'm referring to is an Emtec N200, not a Iomega Screenplay Pro HD, but it uses a similar Realtek Chipset and also uses a main programm called DvdPlayer, so my comments should apply to your device too.

    1) On my device the command relay is much faster when using 'dd' and a fifo instead of 'tail -f'. You need an enhanced busybox though (for mkfifo).

    2) I have written a "Webpage-RC" for the N200, which should be compatible with your device. Some useful buttons not found on the original remote have been added by me. I am planning to add a file-browser (with thumbs-preview perhaps) to it, and then use '/' (= GoTo Root) followed by directional commands to play the specific file. Using that for your plans will perhaps save you some time.

    3) Are you confirming that StandBy-Mode is the same as running "stopall"? I was planning to use "stopall" to 'simulate' StandBy-Mode, since the N200 doesn't have a real StandBy-Mode.

    More info about the N200 and the WebRC is available at my blog.

    best regards, ralexs.blogspot.com

  2. Thanks for the Info. Regarding #3, the stopall on the Iomega player only clears the screenbuffer now and kills the DvdPlayer process. In the R1.8 firmware, it leaves the RootApp running so you have to kill that separately because if you don't, it automatically starts up DvdPlayer again. But to the heart of your question: stopall does not put the screenplay into standby mode. On the SPP, standby mode shuts off power to the video, the drive, and turns off the LED. I suspect it's in a very low power mode at that point. Stopall does not shut off the drive. The unit still responds to network commands, and is still using power for the video even though the signal is black screen.

    I've made a few more discoveries tonight and I'll detail that in my post.

  3. Hello "Me",

    Thanks for providing the information and the keyboard remote mappings at

    I was able to rig up a web remote control interface for the Freeagent Theater Plus using that information.

  4. Great Post. I have been looking for a way to do this with my media box. Wanting to autoplay/autostart w/o user interaction. Just curious what the files startscript and command_sender.txt look like in terms of formatting. Can you post any examples of the files?

    Thanks for the excellent post!

  5. command_sender.txt is not present, it is automatically created from the statement "cat /tmp_orig/startscript >> /tmp/command_sender.txt" mentioned earlier in the post as part of the /usr/local/etc/rcS file. startscript is the character strokes necessary to navigate the menu. See my post "Fun with the player" that I mentioned to determine what keystrokes. I have a startscript example in this post: XX. ( in this case is meant to be replaced by a single space, not typed this way). The spacebar selects whatever the menu is pointing to. The X moves the menu selection down one. So in my case, it selected "ScreenPlay" then moved down to the third line and run it.

  6. Hi there,

    I've made a page just like you have detailed but I have an issue. I'm listening music so I'll like to skip files or to go directly to a specified song and I don't know how to do it