RCA DSB772WE Streaming Media Player

From eLinux.org
Jump to: navigation, search

Description

The RCA Wi-Fi Streaming Media Player brings you a world of movies, TV shows, music, online apps and more — without monthly cable TV or satellite TV subscriptions. Just connect it to your Wi-Fi network, connect its 1080p HDMI output to your HDTV and you're ready to enjoy internet-connected content on your time and your terms. The product can instantly stream Netflix movies and TV shows (Netflix subscription required). You can rent or buy HD movies and TV shows from VUDU. You can also watch your favorite TV shows and movies on demand from Hulu Plus (subscription required). The player also delivers you a wealth of free services, such as YouTube, VUDU Apps, Pandora Internet Radio and Picasa.

Available from Wal-Mart.

NOTE: I have confirmed that this devices is using Linux Kernel 2.6.28.9 - see Linux Support below

Basic Info

Pictures

DSB772-1.jpg

DSB772-2.jpg

DSB772-3.jpg

DSB772-4.jpg

DSB772-5.jpg

Hacking

update/
update/squashfs-7615c0.img
update/cfe-2.1.13-7631-b1-v10-cfe-le-secure-signed.elf
update/vmlinuz-2628.9_760-7631
update/ucfe-2.1.13-7631-b1-v10-ucfe-le-secure-BK1-MFC-signed.bin
update/product_software_update.dat

Root shell

To get a root prompt, you have to press Control-C and login with "root" and now password. The downside to this method is that the device reboots 30 seconds after you killed the foreground process (which you did by pressing Control-C). A work around for that is

  • After connecting power quickly press Control-C, this should drop you to a "CFE>" prompt
  • Now enter the following:
boot -elf -z flash0.vmlinux.0: 'root=/dev/romblock10 rootfstype=squashfs console=0,115200n8 BDVD_BOOT_AUTOSTART=n BAPP_OUT=/dev/null BNET=y ro'
  • This will not start the media software and will directly give you a "(none) login:" prompt
  • log in with user root and no password and the device will not reboot after 30 seconds

USB storage

The original firmware automatically mounts attached USB thumb drives as /mnt/removable/usba

  • vfat,ext2,ext3 support is confirmed

NAND reading/writing

The manufacturer was kind enough to

  • enable both NAND reading AND writing in kernel
  • prepare two partitions for both kernel and rom, meaning we have a safety net

To dump the contents of a NAND partition just obtain a root shell, insert a USB drive into the second USB port (where you soldered a connector) and do the following

nanddump /dev/mtd10 -f rootfs.0

This will dump the first rootfs partition. Whatever you do, DO NOT, I repeat DO NOT overwrite any other NAND partition other than /dev/mtd12 (rootfs.1) and /dev/mtd15 (vmlinux.1) if you are not ABSOLUTELY sure of what you are doing. These two are the second kernel and root partition and even if you overwrite them with garbage the device will still work afterwards

To write to a NAND partition, just do the following

nandwrite /dev/mtd12 shinynewsquashfsrootimage

Root File System

The root file system is present in squashfs 3.0 format. In order to build new root images you will have to use an old version of squashfs-tools from http://sourceforge.net/projects/squashfs/files/squashfs/squashfs3.0/

To unpack a dumped root file system called rootfs.0 into the directory rootfs-dump just enter

unsquashfs rootfs.0 -d rootfs-dump/

To repack a modified root file system enter

mksquashfs rootfs-dump rootfs-modified

and make sure that the squashfs version is 3.0 and the block size is 65536

This new file system can be written to /dev/mtd12. You then just have to boot from root=/dev/romblock12

Binary Format

The architecture of the device is mipsel, eg MIPS little endian. It is confirmed that openwrt mipsel binaries do run on it

# ./bc 
bc 1.06
Copyright 1991-1994, 1997, 1998, 2000 Free Software Foundation, Inc.
This is free software with ABSOLUTELY NO WARRANTY.
For details type `warranty'. 
23+42
65
$ file bc                                                                            [01-15 15:40]
bc: ELF 32-bit LSB executable, MIPS, MIPS32 version 1 (SYSV), dynamically linked (uses shared libs), corrupted section header size

One might be able to utilize the openwrt build chain to create a new root file system

Linux Support

# cat /proc/cpuinfo
system type : BCM97xxx Settop Platform
processor : 0
cpu model : MIPS 24Kc V7.12
cpu MHz : 508.41
BogoMIPS : 508.41 ( udelay_val : 254208 HZ = 1000 )
wait instruction : yes
microsecond timers : yes
tlb_entries : 64
extra interrupt vector : yes
hardware watchpoint : yes, count: 4, address/irw mask: [0x0000, 0x0ff8, 0x0003, 0x0000]
ASEs implemented : mips16
shadow register sets : 1
core : 0
VCED exceptions : not available
VCEI exceptions : not availabled
  • root access is available
(*) Direct/Interface: Loaded 'JPEG' implementation of 'IDirectFBImageProvider'.

(none) login: 
(none) login: 
(none) login: root
# ls -al
total 0
drwxr-xr-x  2 root root   3 Aug  9 12:23 .
drwx------ 16 root root 190 Nov 23 03:44 ..
# 
# 
# 
# ls -al
total 0
drwxr-xr-x  2 root root   3 Aug  9 12:23 .
drwx------ 16 root root 190 Nov 23 03:44 ..
# cd /
# ls
bin  etc      home  lib      mnt   root  share  tmp  var
dev  etc.img  init  libexec  proc  sbin  sys    usr
# 
  • partitions
# mount
rootfs on / type rootfs (rw)
/dev/root on / type squashfs (ro)
none on /proc type proc (rw)
none on /dev/pts type devpts (rw,mode=600)
none on /var type tmpfs (rw,size=64k,mode=777)
none on /var/tmp type tmpfs (rw,size=64k,mode=777)
none on /etc/config type tmpfs (rw,size=64k,mode=777)
none on /sys type sysfs (rw)
/dev/mtdblock19 on /var/log type yaffs2 (rw)
/dev/mtdblock20 on /mnt/psnv type yaffs2 (rw)
/dev/mtdblock21 on /mnt/pstor type yaffs2 (rw)
# 
  • kernel boot log section
bitsPerSample 65535 != 16Loader:elf Filesys:raw Dev:flash0.vmlinux.1 File: Options:root=/dev/romblock12 rootfstype=squashfs ro  BDVD_BOOT_AUTOSTART=y BAPP_OUT=/dev/console panic=8
Loading: 0x80008000/5108544 0x804e7340/306944 
Successfully loaded secure elf image....
Entry address is 0x8000c870
Starting program at 0x8000c870

[    0.000000] -- DDR Bank 0: 128 MB
[    0.000000] -- DDR Bank 1: 128 MB
[    0.000000] Linux version 2.6.28.9 (root@stbcm-and-02) (gcc version 4.2.0 20070124 (prerelease) - BRCM 11ts-20090508) #760 Tue Aug 9 08:10:53 EDT 2011
[    0.000000] Kernel command line: root=/dev/romblock12 rootfstype=squashfs ro  BDVD_BOOT_AUTOSTART=y BAPP_OUT=/dev/console panic=8 console=0,115200n8 LD_BIND_NOW=on
[4294667.347000] DIGSIG: no valid key, digsig security disabled
[4294667.370000] checker_0 control 0x00000008 addr low 0x00002000 hi 0x003a9000 
[4294667.377000] read rights _0 0xffffffff _1 0xffffffff write rights _0 0x00000000 _1 0x00000000 
[4294667.386000] checker_1 control 0x00000008 addr low 0x003aa000 hi 0x0277ff80 
[4294667.393000] read rights _0 0xffffffff _1 0xffffffff write rights _0 0x28000000 _1 0x0001c9f1 
[4294667.402000] checker_2 control 0x00000008 addr low 0x20000000 hi 0x21cfff80 
[4294667.409000] read rights _0 0xffffffff _1 0xffffffff write rights _0 0x28000000 _1 0x0001c9f1 
[4294667.418000] checker_3 control 0x00000018 addr low 0x27d00000 hi 0x27dfff80 
[4294667.425000] read rights _0 0xffffffff _1 0xffffffff write rights _0 0x00000000 _1 0x00000200 
[4294667.453000] Driver 'sd' needs updating - please use bus_type methods
[4294667.460000] Driver 'sr' needs updating - please use bus_type methods
[4294667.466000] vide_ofe_probe: CHIP REV 0x76150020, REQUIRES 0x763xxxxx/0x764xxxxx
[4294667.474000] vide_ofe: unable to add platform device
[4294667.542000] Creating 28 MTD partitions on "bcm7xxx-nand":
[4294667.548000] 0x00000000-0x00180000 : "ucfe"
[4294667.553000] 0x00180000-0x00200000 : "drmregion"
[4294667.559000] 0x00200000-0x00280000 : "drmregion.1"
[4294667.565000] 0x00280000-0x00300000 : "rawnvr"
[4294667.570000] 0x00300000-0x00300090 : "macadr"
[4294667.574000] mtd: partition "macadr" doesn't end on an erase block -- force read-only
[4294667.583000] 0x00300090-0x00300800 : "nvram"
[4294667.587000] mtd: partition "nvram" doesn't start on an erase block boundary -- force read-only
[4294667.597000] 0x00300800-0x00400000 : "virtual"
[4294667.602000] mtd: partition "virtual" doesn't start on an erase block boundary -- force read-only
[4294667.611000] 0x00400000-0x00600000 : "cfe.0"
[4294667.616000] 0x00600000-0x00800000 : "cfe.1"
[4294667.622000] 0x00800000-0x00880000 : "vault-a"
[4294667.627000] 0x00880000-0x06080000 : "rootfs.0"
[4294667.633000] 0x06080000-0x06100000 : "vault-b"
[4294667.638000] 0x06100000-0x0b900000 : "rootfs.1"
[4294667.644000] 0x0b900000-0x0bd00000 : "vmlinux.0"
[4294667.650000] 0x0bd00000-0x0bd80000 : "vault-c"
[4294667.655000] 0x0bd80000-0x0c180000 : "vmlinux.1"
[4294667.661000] 0x0c180000-0x0c200000 : "paniclog"
[4294667.666000] 0x0c200000-0x0c280000 : "cfelog"
[4294667.671000] 0x0c280000-0x0c880000 : "splash"
[4294667.677000] 0x0c880000-0x0cc80000 : "syslog"
[4294667.682000] 0x0cc80000-0x0d080000 : "psnv"
[4294667.687000] 0x0d080000-0x0f600000 : "pstor"
[4294667.693000] 0x0f600000-0x0f900000 : "ofefw.0"
[4294667.698000] 0x0f900000-0x0fa00000 : "ofews.0"
[4294667.703000] 0x0fa00000-0x0fd00000 : "ofefw.1"
[4294667.709000] 0x0fd00000-0x0fe00000 : "ofews.1"
[4294667.714000] 0x00300000-0x00400000 : "config"
[4294667.720000] 0x00000000-0x0fe00000 : "all"
rcS: BDVD_BOOT_AUTOSTART<y>  BQ<y>  BAPP<./app_player>  BAPP_OUT</dev/console>  BNET<>  BNET_DLY<0> OFE_SB<y>
Mounting pstor, psnv with yaffs2!
rcS: Launch PSTOR mount in background

app_ofe_sb: Failed to create device node /tmp/vide_ofe_sb
  syslogd: cannot create /dev/log: Address already in use
Wed Jun 11 00:00:00 UTC 2008
[4294670.210000] bcmdriver: module license 'Proprietary' taints kernel.
[4294670.241000] BCMDRV: Initializing bcmdriver version $ bdvd_v3.0/6 $
[4294670.247000] BCMDRV: Using Interrupt Definition for 7631 (uname -a)
[4294670.254000] BCMDRV: Total intc words=2,Total Irqs=65
[4294670.259000] BCMDRV: Initialization complete...
/etc/init.d/rcS: : command not found
Auto startup
/etc/init.d/rcS: : command not found
/etc/init.d/rcS: : command not found
app 74016:00:06.726  -.--- main(): Application Started
app 74016:00:06.726 +0.000 Time from Startup to Application Start: 12.333 seconds

Flash Partition Table

dev:    size   erasesize  name
mtd0: 00180000 00020000 "ucfe"
mtd1: 00080000 00020000 "drmregion"
mtd2: 00080000 00020000 "drmregion.1"
mtd3: 00080000 00020000 "rawnvr"
mtd4: 00000090 00020000 "macadr"
mtd5: 00000770 00020000 "nvram"
mtd6: 000ff800 00020000 "virtual"
mtd7: 00200000 00020000 "cfe.0"
mtd8: 00200000 00020000 "cfe.1"
mtd9: 00080000 00020000 "vault-a"
mtd10: 05800000 00020000 "rootfs.0"
mtd11: 00080000 00020000 "vault-b"
mtd12: 05800000 00020000 "rootfs.1"
mtd13: 00400000 00020000 "vmlinux.0"
mtd14: 00080000 00020000 "vault-c"
mtd15: 00400000 00020000 "vmlinux.1"
mtd16: 00080000 00020000 "paniclog"
mtd17: 00080000 00020000 "cfelog"
mtd18: 00600000 00020000 "splash"
mtd19: 00400000 00020000 "syslog"
mtd20: 00400000 00020000 "psnv"
mtd21: 02580000 00020000 "pstor"
mtd22: 00300000 00020000 "ofefw.0"
mtd23: 00100000 00020000 "ofews.0"
mtd24: 00300000 00020000 "ofefw.1"
mtd25: 00100000 00020000 "ofews.1"
mtd26: 00100000 00020000 "config"
mtd27: 0fe00000 00020000 "all"