Hacking devices can/will void your warranty and can turn your expensive consumer electronics into worthless trash if you don't know what you're doing. This blog is for information purposes only, and if you try to hack into your own consumer electronics, you do so at your own risk. The device I'm currently hacking is the Canon SX10 IS camera.

Monday, February 22, 2010

Direct screen control

I am now able to control every pixel on the screen. Apparently they chose the R5G6B5 bitmap format for a reason -- it's the native storage format for the screen.

DG_GetSurfaceDesc (m_hSurface, &surfDesc);
DG_Lock(m_hSurface, 0, 0, unitRect.width, unitRect.height, 0);
x = horizonal value from 0 - 1920 (for 1080I)
y = vertical value from 0 - 1080 (for 1080I)
*((uint16_t *)((uint8_t *)surfDesc.lpsurface + (y*surfDesc.lPitch)) + x) = 0xffff;
// format is r5, g6, b5
DG_Unlock(m_hSurface);

edit: It was quite easy to switch it to a higher color format by just changing it from Format_16 to Format_32 when the surface was being created. It does not affect the video, it only applies to the overlay surfaces. But the SDK has Format_16 as the default, possibly inserted there by Ellion.

Sunday, February 21, 2010

MPG, Dvd, ISO, and JPG now working

Latest adjustments to the HelloWorld-JC program now include the ability to playback MPG, Dvd files, and automatically mount ISOs. I was also able to extract some code for having the chip render JPG. I was concerned that the method used for decoding the JPG was to pass the information via RPC to the chip. I figured that would interfere with the playback. Turns out, it doesn't! Since all of the decoding is done on the chip, the processor continues to be free to read and unpackage the media it is streaming.

Sunday, February 14, 2010

After nearly a month of having to work until late night to finish my project at work until I finished it Friday, I finally got a chance last night and tonight to continue hacking on the ScreenPlay. And the verdict? Success!

It's pretty limited right now. I've added several files and I'm still very dependent upon the library...For simplification, I've got only the AVI file types working right now (with corresponding audio). I now have the Hello World start up with a hard coded AVI filename that it launches and then it overlays the video screen with a translucent "Hello World", along with the cursor that continues to display as a green block (and the graphic structure still mystifies me).

Right now, it plays the video for about 10 seconds and then kicks out. Look at the main2.cpp program for more info. As always, I have checked this into the git repository on opensphd.sourceforge.net.

Monday, January 25, 2010

Dvdplayer, additional progress

Most of what I have been working on lately has been trying to understand the DvdPlayer program from Ellion. I've posted the source so far at opensphd.sourceforge.net in the HelloWorld git repository. Presently, I have it able to display a PNG and BMP on NTSC, PAL, and HDMI 720p and 1080i on the Iomega ScreenPlay Pro. I'm attempting to understand the video streaming. A99 has successfully added audio streaming to his version of the Hello World program.

In the meantime, Iomega has released r1.96 of the firmware. I have not investigated it yet, and quite frankly I don't have an interest in doing that because once I get my own DvdPlayer program written, I won't need their new firmware.

Superberney has also run out of time for maintaining IomTools, so he has agreed to open source it. I placed it out on the SVN repository in the opensphd.sourceforge.net, along with the changes I made to get the VSFTP and BFTP stuff working. I have not compiled and done any testing on it yet.

So there is plenty of stuff to do, and plenty of stuff in progress, just no discoveries to report right now. It's very interesting to see how Realtek constructed this. What I have learned from this is that the DvdPlayer program has plugin modules for pulling the data from files, http internet, streaming, transcoding server, etc, all which it puts in line to choose where the data comes from. It then analyzes it to determine what type of package the information is in, AVI, MPG, MPV, RM, etc. Again, all of those are put in line to choose which format applies. Then it unpacks and I believe at that point it sends the corresponding audio and video streams to the 1282 chip. They also have a module for picking out the SPU stream (subpicture unit, the subtitles). Anyway, I'm not getting any hacking done by posting this, so I'll end this post for now and hopefully my next post will be about playing a video.

Thursday, December 17, 2009

Recent progress

Currently working with some of the people over at the xtreamer forums. Some have been looking at the Ellion sources and if we can get to the point that the Hello World is displaying on the Ellion, then it may result in more people looking and helping to understand the Realtek chip (although the xtreamer uses the 1073, but there should be many common things between that and the 1282). Feel free to join the discussion.

Sunday, November 29, 2009

Update and minor discovery

I haven't been posting much to my blog, but what I've been doing is studying the Ellion source and trying to understand the structure.

I have managed to create the traditional "hello world" and have it appear on the TV. That may not seem significant, but for me that's a major step forward since it means I have all of the steps identified for initializing the ScreenPlay. However, most of the steps for painting the rectangle, loading the font and writing the Hello World text on screen still rely on the internal structures of the DvdPlayer program.

In the process, I've had to stop/restart multiple times. Each time that the program stops, whatever was displayed on the TV stays there. If you try to run the program again, it fails to allocate graphical memory because the memory is already allocated. I've been using "stopall" to free up the memory.

What I didn't realize was that stopall was NOT the program responsible for freeing up the memory. It's RootApp, which is called without any command line arguments by the stopall program.

Well, the code for RootApp reinitialize can now be incorporated into my starting Hello World program to auto reinitialize each time :) Like I said, minor discovery, but I felt it was worth sharing anyway.

Friday, November 6, 2009

More about Ellion Firmware on Iomega ScreenPlay Pro HD

Ok, here's the code for the remotes:


RemoteControl.cpp

#include <Platform_Lib/RemoteControl/RemoteControl.h>

ENUM_REMOTE_PROTOCOL getIRProtocol(void) {
// return IR_PROCOTOL_C03;
return IR_PROCOTOL_NEC;
};

char IRCodeTranslate(int code) {
if((code & 0x0000ffff) != IOMEGA_CUSTOMER_CODE)
return -1;
switch((code & 0x00ff0000)>>16) {
//for the complete list of available commands, see Include/Platform_Lib/Graphics/user_cmd.h
case 18: return CMD_POWER;
case 27: return CMD_DISPLAY;
case 72: return CMD_SETUP;
case 21: return CMD_PSCAN;
case 22: return CMD_MENU;
case 12: return CMD_GUIDE;
case 1: return CMD_UP;
case 9: return CMD_DOWN;
case 25: return CMD_LEFT;
case 17: return CMD_RIGHT;
case 23: return CMD_SELECT;
case 31: return CMD_RETURN;
case 8: return CMD_DELETE;
case 24: return CMD_ZERO;
case 65: return CMD_ONE;
case 77: return CMD_TWO;
case 69: return CMD_THREE;
case 66: return CMD_FOUR;
case 78: return CMD_FIVE;
case 70: return CMD_SIX;
case 67: return CMD_SEVEN;
case 79: return CMD_EIGHT;
case 71: return CMD_NINE;
case 4: return CMD_STOP;
case 14: return CMD_NEXT;
case 15: return CMD_PREV;
case 20: return CMD_FFWD;
case 28: return CMD_FRWD;
case 11: return CMD_SEARCH;
case 3: return CMD_REPEAT;
case 2: return CMD_AB_REPEAT;
case 75: return CMD_STITLE;
case 73: return CMD_AUDIO;
case 74: return CMD_ANGLE;
case 16: return CMD_ZOOM;
case 13: return CMD_VOL_UP;
case 19: return CMD_VOL_DOWN;
case 29: return CMD_FORCE_RECORD;
case 26: return CMD_SOURCE;

// return CMD_EJECT;
// return CMD_GCODE;
// return CMD_SCHEDULE;
// return CMD_DISC_UTILITY;
// return CMD_HDD;
// return CMD_DVD;
// return CMD_USB;
// return CMD_DVCONTROL;
// return CMD_FILE_COPY;
// return CMD_INSTANT_REPLAY;
// return CMD_CMSKIP; // commercial skip
// return CMD_RECORD_PLAY;
// return CMD_PLAY;
// return CMD_PAUSE;
// return CMD_SFWD;
// return CMD_MUTE;
// return CMD_ZOOM_IN;
// return CMD_ZOOM_OUT;
// return CMD_QUALITY;
// return CMD_NET; // ellion specific

default:
return -1;
}
}


And then a minor adjustment in RemoteControl.h. I added:

#define IOMEGA_CUSTOMER_CODE 0x3F40


So how did I find out the IOMEGA_CUSTOMER_CODE value? In the ir_control.cpp program, there's a couple of places where IRCodeTranslate(key) is called. All I had to do was put a printf("code: %x\n", key); before it, then run the ./DvdPlayer and press a few remote buttons. It is the last 4 characters (LO WORD) that are returned. At least, for that particular remote protocol it is. That's a fairly common remote protocol, but they did have one other listed (which I left commented in the above code).

So what's so exciting about the Ellion vs the Iomega in terms of functionality? There are several features that the Ellion had implemented that were wish list items on the Iomega.
1) Screensaver
2) USB shows label on NTFS drives
3) Ability to shut off the preview
4) Returns to where you left off. If you exit to the main menu and then reselect the HDD drive, you'll be in the same directory as when you left.
5) Continue movie after stop.
6) Timeshifting (doesn't yet work, may require a dedicated partition on the hard drive)
7) Network browsing / favorites (appears to be able to store username/password, can access root of hard drive).
8) NDAS friendly
9) Favorites folder
10) Auto Chapter during recording
11) Can record to USB
12) Can edit recorded video
13) Good file copy / management
14) Quick display of wifi integrity by pressing display button twice

In addition, there is also DTV tuning and channel scan/set. These are not useful on the Iomega, at least not until somebody figures out what hardware is needed to hook up to the iomega to get it working. There's definitely an area in the bottom of the drive reserved for it, so it's just a matter of determining what tuner module needs to be added.

Now, it's not a pretty interface. Some of the words are very hard to see (for instance, white on yellow) but that kind of thing is easy to change (just edit the Resources in the resource folder). Mapping buttons on the remote to other key commands should be easy. I'm eyeing the instant replay and commercial skip commands.

Also worth mentioning... when I was playing a movie and pressed Home, the menu translucently overlaid the video, which continued to play in the background. That's good, because it means it will be possible to do that in a future replacement media player. So there is a lot we can learn from studying this firmware.