Hacking devices can/will void your warranty and can turn your expensive consumer electronics into worthless trash if you don't know what you're doing. This blog is for information purposes only, and if you try to hack into your own consumer electronics, you do so at your own risk. The device I'm currently hacking is the Canon SX10 IS camera.

Friday, November 6, 2009

More about Ellion Firmware on Iomega ScreenPlay Pro HD

Ok, here's the code for the remotes:


#include <Platform_Lib/RemoteControl/RemoteControl.h>

ENUM_REMOTE_PROTOCOL getIRProtocol(void) {
// return IR_PROCOTOL_C03;

char IRCodeTranslate(int code) {
if((code & 0x0000ffff) != IOMEGA_CUSTOMER_CODE)
return -1;
switch((code & 0x00ff0000)>>16) {
//for the complete list of available commands, see Include/Platform_Lib/Graphics/user_cmd.h
case 18: return CMD_POWER;
case 27: return CMD_DISPLAY;
case 72: return CMD_SETUP;
case 21: return CMD_PSCAN;
case 22: return CMD_MENU;
case 12: return CMD_GUIDE;
case 1: return CMD_UP;
case 9: return CMD_DOWN;
case 25: return CMD_LEFT;
case 17: return CMD_RIGHT;
case 23: return CMD_SELECT;
case 31: return CMD_RETURN;
case 8: return CMD_DELETE;
case 24: return CMD_ZERO;
case 65: return CMD_ONE;
case 77: return CMD_TWO;
case 69: return CMD_THREE;
case 66: return CMD_FOUR;
case 78: return CMD_FIVE;
case 70: return CMD_SIX;
case 67: return CMD_SEVEN;
case 79: return CMD_EIGHT;
case 71: return CMD_NINE;
case 4: return CMD_STOP;
case 14: return CMD_NEXT;
case 15: return CMD_PREV;
case 20: return CMD_FFWD;
case 28: return CMD_FRWD;
case 11: return CMD_SEARCH;
case 3: return CMD_REPEAT;
case 2: return CMD_AB_REPEAT;
case 75: return CMD_STITLE;
case 73: return CMD_AUDIO;
case 74: return CMD_ANGLE;
case 16: return CMD_ZOOM;
case 13: return CMD_VOL_UP;
case 19: return CMD_VOL_DOWN;
case 29: return CMD_FORCE_RECORD;
case 26: return CMD_SOURCE;

// return CMD_EJECT;
// return CMD_GCODE;
// return CMD_SCHEDULE;
// return CMD_HDD;
// return CMD_DVD;
// return CMD_USB;
// return CMD_DVCONTROL;
// return CMD_FILE_COPY;
// return CMD_CMSKIP; // commercial skip
// return CMD_RECORD_PLAY;
// return CMD_PLAY;
// return CMD_PAUSE;
// return CMD_SFWD;
// return CMD_MUTE;
// return CMD_ZOOM_IN;
// return CMD_ZOOM_OUT;
// return CMD_QUALITY;
// return CMD_NET; // ellion specific

return -1;

And then a minor adjustment in RemoteControl.h. I added:


So how did I find out the IOMEGA_CUSTOMER_CODE value? In the ir_control.cpp program, there's a couple of places where IRCodeTranslate(key) is called. All I had to do was put a printf("code: %x\n", key); before it, then run the ./DvdPlayer and press a few remote buttons. It is the last 4 characters (LO WORD) that are returned. At least, for that particular remote protocol it is. That's a fairly common remote protocol, but they did have one other listed (which I left commented in the above code).

So what's so exciting about the Ellion vs the Iomega in terms of functionality? There are several features that the Ellion had implemented that were wish list items on the Iomega.
1) Screensaver
2) USB shows label on NTFS drives
3) Ability to shut off the preview
4) Returns to where you left off. If you exit to the main menu and then reselect the HDD drive, you'll be in the same directory as when you left.
5) Continue movie after stop.
6) Timeshifting (doesn't yet work, may require a dedicated partition on the hard drive)
7) Network browsing / favorites (appears to be able to store username/password, can access root of hard drive).
8) NDAS friendly
9) Favorites folder
10) Auto Chapter during recording
11) Can record to USB
12) Can edit recorded video
13) Good file copy / management
14) Quick display of wifi integrity by pressing display button twice

In addition, there is also DTV tuning and channel scan/set. These are not useful on the Iomega, at least not until somebody figures out what hardware is needed to hook up to the iomega to get it working. There's definitely an area in the bottom of the drive reserved for it, so it's just a matter of determining what tuner module needs to be added.

Now, it's not a pretty interface. Some of the words are very hard to see (for instance, white on yellow) but that kind of thing is easy to change (just edit the Resources in the resource folder). Mapping buttons on the remote to other key commands should be easy. I'm eyeing the instant replay and commercial skip commands.

Also worth mentioning... when I was playing a movie and pressed Home, the menu translucently overlaid the video, which continued to play in the background. That's good, because it means it will be possible to do that in a future replacement media player. So there is a lot we can learn from studying this firmware.


  1. Turns out the front panel is also controlled through the same translation routines.

    up: 92
    down: 94
    left: 95
    right: 93
    play: 91
    stop: 90
    ntsc/pal: 89

    I'm putting those values in decimal for consistency with what I've already posted, which was consistent with the way they are typically reported as remote controls codes in the JP1 group.

    To add panel control, just add them as extra cases. For instance, for UP

    case 92:
    case 1: return CMD_UP;

    Or,if you feel better about not letting cases drop through, add a return CMD_UP after case 92. But I'm sure you get the idea.

  2. I was wondering, would it be possible to control the SPP with my Ipod? I mean, not to synchronize the music on my Ipod, but to view the contents of the SPP on the Ipod screen, and to select what needs to be played. Perhaps a little bit to farfetched, but I want to know your opinion. Thanks, and keep up the fun!


  3. So, you're talking about using your IPOD as a remote control for the ScreenPlay. Absolutely it is possible.

    Look at my post on http://consumerelectronicshacker.blogspot.com/2009/10/controlling-dvdplayer-from-external.html

    In the comments, ralexs refers to his blog http://ralexs.blogspot.com and if you look there, you'll find webpages for controlling another device with the iphone. He's already done the work, it would probably adapt to the screenplay fairly easily.

  4. IS it possibile to remove all options from the menu apart from the video menu, so rmeove music, photos etc from them iomega menu?

    Also is it possibile to pasword protect it?

  5. I don't think there's any easy way to accomplish that task, especially given the recent developments relating to the firmware this post was about.

    What you may want to look into, however, is the automation of selecting those items. http://consumerelectronicshacker.blogspot.com/2009/10/controlling-dvdplayer-from-external.html gives the details. So you can skip the first menu and navigate to a specific directory for the kids. As for password protecting -- put those things you don't want others to have access to on a usb drive and just take the drive away. if they don't have the drive, they can't watch it.