Finding hidden serial ports on DTV receivers.  - Page 1
Forum section: electronics / projects

author: Stonent
author_rank: Super Contributor
timestamp: June 03, 2014, 12:58:08 am
content: This past weekend I decided to poke around inside some consumer electronics looking for hidden things. I had 2 ATSC DTV converter boxes that weren't being used that I poked around with.The first one was an Insignia (Best Buy) branded LG Rebadge and also had the LG model number silkscreened to the board.. There was an unpopulated area of about 10 pins.The first and last pin both appeared to be grounds, one pin had .3V on it and the others were all 3.3V.There was one revision of this DTV receiver that I found online had an installed pin header labeled CN400 with RX and TX marked that someone was able to get into with an FTDI cable, but it was a 4 pin installed header, not a row of 10 unlabeled pads (also labeled CN400). I tried each pad on that unpopulated place and got nothing.I probed with my oscilloscope and found 2 of the pads showed some oscillation of about +/- .2mV when first powered on for about 15 seconds with occasional bursts every so often, but it was right at about the limit of what my scope can clearly show.So if there is some kind of data or protocol there, it's only oscillating at a very tiny amount.Here's a site that got an RS232 connection to the 4 pin version and did a lot of poking around:http://www.devttys0.com/2012/08/reverse-engineering-a-dtv-converter/The second was an APEX DT502 and I had much better luck with that one. It had a 4 pin unpopulated area with the pins labeled and I easily got RS232 data from it. It starts with Busbox and loads a Linux kernel. I was able to interrupt the boot by pressing enter and navigate the MTD flash system. I googled several of the lines of text from the bootup and found no hits, so I may have been the first one to peek inside this one./proc/cpuinfo shows it's running a MIPS R3000 variant. The cpu itself is buried under a glued on heatsink. I'm somewhat surprised that they were using an R3000 rather than a R4x00 series, but it may have come down to what was cheapest to license.There were several .TXT files in a folder called /data, when I viewed them, they were mostly random junk with occasional recognizable TV call signs like KTVT-DT.I'll post more info when I get home.

author: rexxar
author_rank: Frequent Contributor
timestamp: June 03, 2014, 01:38:35 am
content: I imagine the first one is a JTAG port.

author: Stonent
author_rank: Super Contributor
timestamp: June 03, 2014, 01:41:47 am
content: Quote from: rexxar on June 03, 2014, 01:38:35 amQuite possibly. I had high hopes because of the same silkscreened label "CN400" as the other one that was RS232.

author: Stonent
author_rank: Super Contributor
timestamp: June 03, 2014, 05:23:09 am
content: Here's the boot up.Code:display onentering half loader, turning on displaydecompressing kernel:from 80a04620 to 80b354e5decompressing kernel: to 80100400decompressing kernel: to 80000000kernel size: 42170start to execute linux. 80000200Mounted /dev/mtd on /dataMounted /proc**** Wake up NOR AV_RISC...80000000: 401a6000, 800000190: ffffffffWe don't support reboot!!!init started: BusyBox v1.00 (2007.11.13-12:16+0000) multi-call binaryinit started: BusyBox v1.00 (2007.11.13-12:16+0000) multi-call binaryStarting pid 16, console /dev/console: '/bin/sh'BusyBox v1.00 (2007.11.13-12:16+0000) Built-in shell (ash)Enter 'help' for a list of built-in commands.m:1rtd2885_private_openUser Register watch dog, thresholdUser register kernel's watch dog, timeout is Gpio_Initgpio init fail!PIO_CTRL0=6261f16PIO_CTRL1=54291313PIO_CTRL2=9c873a13============Mem Manage Init================virtualMemBaseAddr = 0x2aaa8000============Interface Init============================BG Init============================GDE Init============================OSD Init============================MASKWIN Init============================IRRC Init================PIO_CTRL0=6261f16PIO_CTRL1=54291313PIO_CTRL2=9c873a13$$$ Ds_Display_Init() time = 110msPREPARE SEND MVD FRAME BUFFER IRCSet MVD frame buffer addr/len[c00000/16512k]... WAIT videoIrcWait....VID-ACK-4f0049fOK!!OK!!Sent atsc indicator 0WAIT:stopAVOK....V0STP-OKOK1!!$$$ AVP_Open() time = 20ms==========SI Configuration Table Detected==========ENABLE_SI_TABLE_LOGGING = 0SI_TABLE_FILE_PATH = ../StreamData/sarnaff/71CURRENT_NEXT_CHECK = 1PROTOCOL_VERSION_CHECK = 1PRIVATE_INDICATOR_CHECK = 1RESERVED_BITS_CHECK = 1SECTION_SYNTAX_CHECK = 1STT_CRC_CHECK = 1SERVICE_TYPE_CHECK = 1UPDATE_DEFAULT_RRT = 0Create Linux Driver>> Open Transport Driver: i_rdev=7f00000, type=0, num=0 !tp driver open success!*** TP Q MMAP=> ****** TP Q MMAP=> ****** TP Q MMAP=> ****** TP Q MMAP=> ****** TP Q MMAP=> ****** TP Q MMAP=> ***$$$ SiApi_Init() time = 90mscheckSum = 0x15d7>>>>>>>>Call mInitDisplay()A0STP-OKOSD: InitMEM1_ADDR=1001cc60MEM2_ADDR=1001d510RING_BUFFER_ADDR=1001c2d0dsDev_open: open 1, TRUE:1open okRealtype Init Success (/data/font/PrimaBold_12.rtf)Realtype Init Success (/data/font/PrimaBold_14.rtf)Realtype Init Success (/data/font/PrimaBold_18.rtf)antenna_openirrc.o: irrc-0 ioctl, cmd: 0x7706, arg: 7f7ffb60.>Enter QHsmDtv_Active(): ENTRY_SIG>Enter QHsmDtv_Active(): INIT_SIG>Enter QHsmDtv_PowerOn(): ENTRY_SIG>Enter QHsmDtv_PowerOn(): INIT_SIGswUart_InitReceive swUart ioctlReceive swUart ioctl>>>>>>>>Call Xsys_InitChannel()Change Count = 1XuiCh_SetChannel():frequency = 503000000XuiCh_SetChannel():physicalChNum = 18XuiCh_SetChannel():Name = KTVTXuiCh_SetChannel():majorNum = 11XuiCh_SetChannel():minorNum = 1XuiCh_SetChannel():videoPid = 49XuiCh_SetChannel():audioPid = 52XuiCh_SetChannel():isScrambled = 0XuiCh_SetChannel():modulation = 5FE_ANTE_IS_CONNECTED: ret = 4Detect No Smart Antenna----- In IRC_AI_CMD_SET_MUTE Channel= -----AI-ACK-3f003ffSet ADAC1=10100 , set=1$$$ set channel time 1 time = 10msWAIT:stopAVOK....V0STP-OKA0STP-OKOK1!!TP_Proxy_ResetRST$$$ set channel time 2 time = 20ms$$$ set channel time 2.1 time = 20msSet Tuner Frequency to 503000000 | source = 0$$$ set channel time 2.1.2 time = 30msrtd2812_initrtd2812_set_fertd2812_writetunerTuner Bytes: C2 22 30 C6 08$$$ set channel time 2.1.3 time = 690msError: Set tuner frequency failed!!!$$$ set channel time 2.2 time = 690msTP_Proxy_ResetRSTSI Audio Codec: AC3(4)PAVV0STP-OKA0STP-OK->xsys.video.readyVersion = 101$$$ set channel time done time = 710msAI-ACK-3f0026fAI-ACK-3f0037f>Enter QHsmDtv_SingleVideo(): ENTRY_SIG-------------Xmod_MsgBoxApi_ShowPARSERLIB_ERROR:TextComp_Draw() string length = 0, needn't draw!>Enter QHsmDtv_SingleVideo(): INIT_SIGSent AC3 CompModeAI-ACK-3f002afXui_Thread is created>Enter QHsmDtv_SingleVideo(): LIB_TIMER (DTV_NO_SIG_TIMER_ID)>Enter QHsmDtv_PowerOn(): LIB_TIMER (DTV_NO_SIG_TIMER_ID)----- In IRC_AI_CMD_SET_MUTE Channel= -----AI-ACK-3f003ffSet ADAC1=10100 , set=1DDS_OFF-------------Xmod_MsgBoxApi_Show>Enter QHsmDtv_SingleVideo(): LIB_TIMER (RESETTUNER_TIMER_ID)>Enter QHsmDtv_PowerOn(): LIB_TIMER (RESETTUNER_TIMER_ID)DDS_OFF>Enter QHsmDtv_SingleVideo(): LIB_TIMER (RESETTUNER_TIMER_ID)>Enter QHsmDtv_PowerOn(): LIB_TIMER (RESETTUNER_TIMER_ID)V0STP-OKTP0[SIGNAL HALT]A0STP-OK>Enter QHsmDtv_SingleVideo(): SYS_TP0_SIGNAL_HALT>Enter QHsmDtv_PowerOn(): SYS_TP0_SIGNAL_HALTDDS_OFF>Enter QHsmDtv_SingleVideo(): LIB_TIMER (RESETTUNER_TIMER_ID)>Enter QHsmDtv_PowerOn(): LIB_TIMER (RESETTUNER_TIMER_ID)>Enter QHsmDtv_SingleVideo(): LIB_TIMER (DTV_NO_SIG_TIMER_ID)>Enter QHsmDtv_PowerOn(): LIB_TIMER (DTV_NO_SIG_TIMER_ID)----- In IRC_AI_CMD_SET_MUTE Channel= -----AI-ACK-3f003ffSet ADAC1=10100 , set=1DDS_OFF-------------Xmod_MsgBoxApi_Show>Enter QHsmDtv_SingleVideo(): LIB_TIMER (RESETTUNER_TIMER_ID)>Enter QHsmDtv_PowerOn(): LIB_TIMER (RESETTUNER_TIMER_ID)DDS_OFF>Enter QHsmDtv_SingleVideo(): LIB_TIMER (RESETTUNER_TIMER_ID)>Enter QHsmDtv_PowerOn(): LIB_TIMER (RESETTUNER_TIMER_ID)DDS_OFF>Enter QHsmDtv_SingleVideo(): LIB_TIMER (RESETTUNER_TIMER_ID)>Enter QHsmDtv_PowerOn(): LIB_TIMER (RESETTUNER_TIMER_ID)>Enter QHsmDtv_SingleVideo(): RC_POWER>Enter QHsmDtv_PowerOn(): RC_POWER-------------Xmod_MsgBoxApi_Destroy>Enter QHsmDtv_SingleVideo(): EXIT_SIG-------------Xmod_MsgBoxApi_Destroy-------------Xmod_MsgBoxApi_Destroy>Enter QHsmDtv_PowerOn(): EXIT_SIG>Enter QHsmDtv_PowerOff(): ENTRY_SIGpowerOnSecond = 0checkSum = 0x15d7Receive swUart ioctlReceive swUart ioctlThe last 4 lines are when I pressed the power button to turn it off.Something new, hitting ESC right away, gets me this:Code:=============== RealTek(RTD2885) version 2703 ===============Uart init Find EXCEL chip command set. ES25P16 : mfr_id = 0x0000004a,dev_id = 0x00000014,size = 0x00200000==============================================================<RealTek>nknown command !<RealTek>help----------------- COMMAND MODE HELP ------------------? : Print the commands supported in bootloadertD : Dump memory from specified RAM addressE : Edit memory with specified address and valueU : Download image to specified RAM addressFL: Load image to NOR flashFR: Read data from NOR falsh to RAMALL: Flash all image into flashJ : Jump to the specified address & GoSL : sleep n secSet : Save env to flash.-------------------------------------------------------<RealTek>?----------------- COMMAND MODE HELP ------------------? : Print the commands supported in bootloadertD : Dump memory from specified RAM addressE : Edit memory with specified address and valueU : Download image to specified RAM addressFL: Load image to NOR flashFR: Read data from NOR falsh to RAMALL: Flash all image into flashJ : Jump to the specified address & GoSL : sleep n secSet : Save env to flash.-------------------------------------------------------<RealTek>

author: Stonent
author_rank: Super Contributor
timestamp: June 03, 2014, 05:42:55 am
content: Some poking around after I interrupted the boot.Code:80000000: 401a6000, 800000190: ffffffffWe don't support reboot!!!init started: BusyBox v1.00 (2007.11.13-12:16+0000) multi-call binaryinit started: BusyBox v1.00 (2007.11.13-12:16+0000) multi-call binaryStarting pid 16, console /dev/console: '/bin/sh'BusyBox v1.00 (2007.11.13-12:16+0000) Built-in shell (ash)Enter 'help' for a list of built-in commands.m:1rtd2885_private_openUser Register watch dog, thresholdUser register kernel's watch dog, timeout is Gpio_Initgpio init fail!PIO_CTRL0=6261f16PIO_CTRL1=54291313PIO_CTRL2=9c873a13============Mem Manage Init================virtualMemBaseAddr = 0x2aaa8000# rtd2885_private_release?display onentering half loader, turning on displaydecompressing kernel:from 80a04620 to 80b354e5decompressing kernel: to 80100400decompressing kernel: to 80000000kernel size: 42170start to execute linux. 80000200Mounted /dev/mtd on /dataMounted /proc**** Wake up NOR AV_RISC...80000000: 401a6000, 800000190: ffffffffWe don't support reboot!!!init started: BusyBox v1.00 (2007.11.13-12:16+0000) multi-call binaryinit started: BusyBox v1.00 (2007.11.13-12:16+0000) multi-call binaryStarting pid 16, console /dev/console: '/bin/sh'BusyBox v1.00 (2007.11.13-12:16+0000) Built-in shell (ash)Enter 'help' for a list of built-in commands.### lsdtvFactoryTable.txt.air dtvFactoryTable.txt.cable.HRCdtvUserChT0.txt variables.confdtvFavChannelT0.txt dtvChannelT.txtdtvFactoryTable.txt.cable SiConfigTable.txtdtvFactoryTable.txt shrcdtvFactoryTable.txt.cable.STD# cat dtvUserChT0.txt# cat dtvFavChannelT0.txt????# PuTTY-sh: PuTTY: not found# lz-sh: lz: not found# lsdtvFactoryTable.txt.air dtvFactoryTable.txt.cable.HRCdtvUserChT0.txt variables.confdtvFavChannelT0.txt dtvChannelT.txtdtvFactoryTable.txt.cable SiConfigTable.txtdtvFactoryTable.txt shrcdtvFactoryTable.txt.cable.STD# pwd/data/save# lsdtvFactoryTable.txt.air dtvFactoryTable.txt.cable.HRCdtvUserChT0.txt variables.confdtvFavChannelT0.txt dtvChannelT.txtdtvFactoryTable.txt.cable SiConfigTable.txtdtvFactoryTable.txt shrcdtvFactoryTable.txt.cable.STD# cd /# pwd/# lsdev bin etc tmp dataroot sbin var lib nfslost+found usr proc linuxrc# ls -aldrwxr-xr-x 2 0 0 0 Jan 1 00:00 devdrwx------ 2 0 0 0 Jan 1 00:00 rootdrwx------ 2 0 0 0 Jan 1 00:00 lost+founddrwxr-xr-x 2 513 508 0 Jan 1 00:00 bindrwxr-xr-x 2 513 508 0 Jan 1 00:00 sbindrwxr-xr-x 3 513 508 0 Jan 1 00:00 usrdrwxr-xr-x 2 0 0 0 Jan 1 00:00 etcdrwxr-xr-x 2 0 0 0 Jan 1 00:00 vardr-xr-xr-x 2 0 0 0 Jan 1 00:00 procdrwxr-xr-x 2 0 0 0 Jan 1 00:00 tmpdrwxr-xr-x 2 0 0 0 Jan 1 00:00 liblrwxrwxrwx 1 0 0 11 Jan 1 00:00 linuxrc -> bin/busyboxdrwxr-xr-x 8 0 0 0 Jan 1 00:00 datadrwxr-xr-x 2 0 0 0 Jan 1 00:00 nfsdrwxr-xr-x 15 0 0 0 Jan 1 00:00 ..drwxr-xr-x 15 0 0 0 Jan 1 00:00 .# cat /proc/cpuinfosystem type : Realtek DTV platformprocessor : 0cpu model : R3000 V0.1BogoMIPS : 280.98wait instruction : nomicrosecond timers : notlb_entries : 32extra interrupt vector : nohardware watchpoint : noVCED exceptions : not availableVCEI exceptions : not available#I guess what would be nice is to be able to transfer the contents of the filesystem off the board, but I can't think of a way right now.Here's some pictures. They are all low res because I used a special macro mode camera app to get the close ups.The one with the chip that says "Rock" is behind the front panel which just has a few leds, power button and IR receiver.I couldn't find any information on it. The front panel is connected by a 4 pin cable that says 5V,RX,TX,GND.I probed those lines but they weren't serial that I could see.

author: amyk
author_rank: Super Contributor
timestamp: June 03, 2014, 12:25:11 pm
content: It appears you have a Realtek RTD2885. Not much info on it to be found on the Internet...

author: PinkPanther
author_rank: Newbie
timestamp: July 05, 2014, 05:20:08 am
content: Quote from: Stonent on June 03, 2014, 12:58:08 amYou may have beat me by a month!I've been working on that model of apex through the serial port as well. While your  trick works for me, I haven't been able to get a shell as you mentioned by hitting enter during the boot sequence, although my boot sequence is the same. Could you explain interupting the boot sequence once more?

author: Stonent
author_rank: Super Contributor
timestamp: July 05, 2014, 05:24:04 am
content: Quote from: PinkPanther on July 05, 2014, 05:20:08 amThere is some timing involved. Since this post I haven't played with it.

author: PinkPanther
author_rank: Newbie
timestamp: July 05, 2014, 05:34:53 am
content: Okay, you were the only person I've found on the net with anything about this device. Just for others, I connected through putty and did a ctrl+c that sent me to some sort of shell that forces a reboot. But seconds before the reboot I ran linuxrc, which allowed me to press enter to activate the console. So far that's where I'm at. Best of luck.Edit: Success. The problem I had getting to the prompt was hidden in the "shrc" script. Here is how I and probably Stonent got past it.The file shrc contains:Code:#!/bin/shcd /bin./mainI had to remove the "./main" so that I could access the shell without ending the ./main process which triggers the watchdog that reboots the system. And of course there were no text editors available or chmod to make new executable scripts. AND.. it has to be done in about 6 seconds before the watchdog reboots the system.Code:cp shrc shrc_bakCode:echo "#!/bin/sh" > shrcNow upon boot you're presented with a #.