Hacking devices can/will void your warranty and can turn your expensive consumer electronics into worthless trash if you don't know what you're doing. This blog is for information purposes only, and if you try to hack into your own consumer electronics, you do so at your own risk. The device I'm currently hacking is the Canon SX10 IS camera.

Wednesday, November 4, 2009

That's not my menu...!

Tonight, I found that in the Ellion Open source, UnitTest/Grandma_DG_StateMachine was the source code for the DvdPlayer. It was everything necessary, but referenced a few things that weren't quite right. For one, it tried to get to the Utility and Platform_Lib as if they were right there. So I put in a symbolic link to put them there. Second was that it was trying to reference the mp3info.h in the mp3info directory when it was really in the mp3info/Include directory. So I copied to to the mp3info directory (yeah, I should have used a hard link instead, doh!)
Last piece was that it was trying to get to a Tools/MConfig, which wasn't there. So I found a Tools/MConfig in the conceptronic sources and put it there. It all compiled (and I mean compiled, not linked a bunch of already compiled .o files :D )

I copied it and the resource directory out on the ScreenPlay. Like in previous attempts, it came up in Pal mode. Unlike in previous attempts, it was now reading the keyboard. So I exited the program and this time brought it up by typing ./DvdPlayer -f NTSC which forced it to NTSC mode.

It worked.

The remote control didn't work, but I could control everything from the keyboard through telnet. I was able to complete the configuration screen, then browse to both the USB and Main hard drives. Naturally, the menu is based on the same principles that the Iomega SPP is, where it just lists filenames and shows a preview. But I was able to browse to specific movies and launch them.

Since there is a file called ir_control.cpp in the directory, I'm positive I'll be able to get the remote control working...

But not tonight. It'll have to wait a couple of nights before I can get back to it.

Update: Too excited to sleep tonight. RemoteControl.cpp and RemoteControl.h in the Platform_Lib were the ones responsible. In RemoteControl.h, it defines the manufacturer's code for the Ellion, which they had two. So I stuck in a printf in the ir_control.cpp to find out what remote code was for the Iomega, and found out mine was 0x3f40. Stuck that in, now it should process the codes...except that the codes are all different. Luckily, prior work has paid off now: http://screenplayprohd.wikia.com/wiki/Remote the bottom half JP1 OBC codes are listed. So it is just a matter of changing the RemoteControl.cpp switch statement to use the Iomega codes intead of the Ellion ones. :)


  1. A way around the -f NTSC option is to change the VenusSetup.ini file in the Resource directory to do NTSC instead of auto.

  2. Can you please re-post the URL for the DvdPlayer source? Thanks.

  3. Never mind -- I found it just after I posted my comment, naturally.

  4. I'm going to post it anyway. I only referred to the MHDWorld post for the ellion open source, so here are the links:

    Conceptronic sources:

    Ellion open source:

  5. Can you please tell me your toolchain.
    You spoke from gcc3.x, but the existing c++ libraries were built with gcc2.9x name mangling.
    I got RootApp (Watchdog) compiled and linked with 3.xx toolchain, but not DvDPlayer, because of link problems and creating all libraries is not possible, because of missing source files, for example libSecurity.a.
    I did not get a working gcc2.9x toolchain built till now.
    Thanks Martin

  6. The toolchain I use now is the one from conceptronics http://download.conceptronic.net/GNU-GPL/CM3Gxx/ in the toolchain directory. Instructions for setting up the toolchain are in the readme in the 2.00.004 directory.

    Steps for getting the Ellion Open Source DvdPlayer compiled are:
    tar -xvf 351H_AP_GPL.tar.gz
    cd 351H_AP_GPL/system/branch_src_sharedMemory_integration/Unit_test/GrandMa_DG_StateMachine
    ln -s ../../Utility Utility
    cd Utility/mp3info
    ln mplib-1.0.1/src/mplib.h mplib.h
    cd ../../../../Application
    cd ../Platform_Lib/NeptuneTPControl
    mkdir obj
    cd ..
    cd ../Unit_test/GrandMa_DG_StateMachine
    mipsel-linux-strip DvdPlayer

  7. The hint to the sdelinuxmips-5.03 gcc 2.96 toolchain was very useful.
    Many Thanks Martin

  8. Ok, I documented it in a prior post, but since it wasn't here with the specific steps, it ended up costing me a lot of time. If you want to use this firmware with the Iomega device, you have to modify the PLI.h file. Inside is a define that indicates that the device has 256 MB. That's not true, the Iomega one only has 64 MB. So make sure you change that before compiling in the steps that I listed...

    You will also need to do a make for the io, Flows, and OSAL directories. Even then, the first time you run the DvdPlayer, it may still get a segment fault. Just do a stopall and then try again. Also, if you are using an NTSC TV, be sure you are starting it with ./DvdPlayer -f NTSC

  9. I have the Mvix Ultio, do you think it would work if I substitute de toolchain or can I just use it as is?

    Also, which build environment do I need, do I have to install a specific OS or can I make that using mingw in windows?


  10. Well, the Ultio uses the Realtek 1073. There really isn't specified support for the 1073 in this one, but it may work anyway. You'll need to change the PLI.h to use 128 MB. You should be able to use the same toolchain.

  11. Many thanks for the work you have done on this. I have been trying to apply your methods to the Xtreamer which I hope has a compatible Realtek chip.

    I have managed to compile a DvdPlayer but have not yet managed to get it working.

    Your reference to Tools/MConfig has me puzzled. I have not noticed the lack of it while compiling the Ellion sources and neither am I able to find it in the Conceptronic sources I downloaded (cm3pvrxx_1.00.011).

    Do I need it? What is it for?



  12. Hi Richard,

    Don't get hung up on MConfig. Turns out it wasn't as necessary as I thought. While I was doing all of this, I was running the make for every Makefile found in the subdirectories of branch_src_sharedMemory_integration, including all of the Filters which required the MConfig. Well, many of the filters are already compiled and you can't recompile them because there is some source missing. You can compile some of them if you have the MConfig set up. I found the MConfig in the 2.00.004 source of the conceptronic. Yes, that tar file is corrupt, but you can still extract it on the command line. At least, a large part of it. There is an MConfig in the tools directory of both userapp and userapp.ntsc. There's some other pretty interesting stuff there too. Like Bison, which from what I've read, takes MSVC resources and converts them to be used in the DvdPlayer. I haven't tried it myself.

    Best of luck getting the DvdPlayer working on the xstreamer.

  13. It is interesting. Can I use Telnet control in the 1073 players? Do you have a description how to use keyboard through telnet to simulate remote control?

  14. CharlieCL, telnet on other players will depend on what the manufacturer did. For instance, the ASUS OPLAY has a method for adding telnet documented on minimodding.com. The xtreamer's telnet is probably found on forum.xtreamer.net. Iomega initially had it open, but then closed itin their latter firmware so you have to enable it again by plugging it into the computer and modifying the inetd.conf file.

    The ability to do remote control from telnet is described in another blog post: http://consumerelectronicshacker.blogspot.com/2009/10/controlling-dvdplayer-from-external.html