FAQFAQ   GalleryGallery   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in   Forum RSS Feed   Hacked Gadgets Main Site 

Anyone into hacking Digital Photo Frames (DPF)?...

 
Post new topic   Reply to topic    Hacked Gadgets Forum Index -> New Projects Currently Being Developed
View previous topic :: View next topic  
Author Message
Nuno
Newbie


Joined: 29 May 2009
Posts: 3

PostPosted: Fri May 29, 2009 6:36 am    Post subject: Anyone into hacking Digital Photo Frames (DPF)?... Reply with quote

Hello,

I recently bought a cheap DPF (aiptek miro III crystal) thinking in extracting the LCD for another project (a portable oscilloscope). I opened and from a high level point of view the circuit is relatively simple in a double side PCB, and you can more or less easily delimit sub-circuits on the PCB. I have detected and classified the following ones:

1) 3.3V volt switching regulator
2) Current switching regulator for the LCD backlight (it's LED based)
3) Core processing chip, an AML6210A from Amlogic (capable of not only display photos but video and play MP3) (no datasheet available Sad)
4) 2MB flash chip (datasheet available)
5) SDRAM chip (datasheet available)
6) USB host interface
7) SD card interface
8 ) Some LCD interfacing components (a few transistors)
9) An I2C real time clock with battery backup (a super cap) (datasheet available)
10) A combined -10V and 15V switching regulator (seems to be needed by the LCD)

There's an LCD side area of about 2 fingers that is not being used/shown and is hidden by the frame (looks like usable area, since you can see the dots).

I have a photo of the component area of the PCB with my comments, I'll post it later when I get home.

So, this is actually a micro computer, and now I'm thinking that it would be nice to leave the LCD in there and use the thing as a whole, just adding some extra hardware for the application specific stuff and doing new software (the core chips has mechanisms to download new software either from a USB pen or an SD card). How many cool/useful/whatever projects could be done in such a (cheap) piece of hardware...

So, we now reach to the usual problem: no info on the core chip, AML6210A . The manufacturer's page has only a few high level characteristics, and I got no answer to my email requesting such info (I wonder why Smile)). So here goes my questions:

1) Does anyone have any info on this chip?
2) Does anyone has some experience on reverse-engineering such system?
3) Do you think is a too-big-of-a-job to reverse engineer this thing?
4) Would someone join in with me on reverse-engineer this thing? I have good knowledge of software and solid basic electronics.
5) What other interesting "full-computer" cheap devices are out there waiting for someone to re-purpose them?

Leave your thoughts...


Update:
Back to top
View user's profile Send private message

bifferos
Semi Newbie


Joined: 07 Jun 2009
Posts: 6

PostPosted: Sun Jun 07, 2009 9:42 am    Post subject: Reply with quote

Nuno, have a look here:

http://sites.google.com/site/bifferboard/Home/digital-photo-frame-display
Back to top
View user's profile Send private message
bifferos
Semi Newbie


Joined: 07 Jun 2009
Posts: 6

PostPosted: Sun Jun 07, 2009 11:35 am    Post subject: Reply with quote

After a further look, it appears the test points you indicate as being at 3.3v are actually the JTAG. Too bad they are 3.3v because that indicates that the JTAG might be disabled. You can always try to wiggle them and see, but i don't hold out much hope.

Further to my original page, it seems there is a special pin on the CPU which can be used to kick the AML6210 into a state where either the JTAG works, or the flash can be reprogrammed via USB (I don't know which yet). This special pin is connected on my DPF to the 'unused' pin on the small form-factor USB 'B' connector (ahh.. so that's what that pin was for). I believe that injecting a signal into this pin will enable the USB port (which is connected but only acts as a charger on my model, and doesn't enumerate when connected to a USB host). No idea the sequence of commands to put on this pin, but you never know, it might be something simple.

I have interfered with most other pins on this CPU to attempt to activate JTAG, which is normally a pull-up or pull-down resistor somewhere, but to no avail, so I think this pin is the key. It's at the very bottom of the right-hand row of pins as you look at the AML6210DP, hoever it seems the 6210A doesn't have the same pin configuration, making me wonder how much applies to both CPUs.

Nice to finally see a pic of the 6210A though.
Back to top
View user's profile Send private message
Nuno
Newbie


Joined: 29 May 2009
Posts: 3

PostPosted: Sun Jun 07, 2009 3:01 pm    Post subject: Reply with quote

Ahhh.... glad to see that there's someone else on it Smile

Ok, some pieces of info:

According to the manufacturer, the 6210A can have the software updated by USB or memory card. My guess would be that if you create a file with a special name, it would be loaded as firmware (I've seen some other devices doing it).

The USB on this frame only works as a host. There's no PC connectivity; the DPF only works by will scanning the USB/SD for pics to display.

I'll check those 3.3V lines more carefully and see where do they lead.

It's a good info, that one about the core CPU architecture. I'm trying to get a development toolkit, but the request it will most probably be refused.

The 1st attempt I made was to search for a serial port, but no success. I guessed that there would be a serial debug port Smile)

Other than this, my only idea would be to connect a logic analyzer to the address+data+R/W lines and check how Mr. AML6210A boots and what does it do. Unfortunately this is very hard and needs a fast logic analyzer which I don't have...
Back to top
View user's profile Send private message
bifferos
Semi Newbie


Joined: 07 Jun 2009
Posts: 6

PostPosted: Sun Jun 07, 2009 4:13 pm    Post subject: Reply with quote

Dev toolkit? If you are talking about Metaware, which is usually used for development of software for the AML frames, then you'll never get that for free - it'll cost many $$$s.

For compiler, you can use the gcc link on my page. Although the Argonaut core is theoretically customizable right down to the instruction level, I believe most implementations keep the same basic instruction set. I'm not sure how you'd access the more advanced stuff like hardware jpeg/mp3 decompression though.

Depends how badly you want to hack this, but if you have hot air, you can lift the flash chip and put it down on one of the cheap routers, then use the JTAG on the router to read the contents. It's a bit extreme, but possible. This would perhaps allow one to find basic things like the name of the file on the CF card that it reads for firmware updates.

Alternatively scour the internet looking for firmware updates for (any) photo frame

e.g.: http://www.sony-asia.com/support/download/281498

Eventually you will find one containing ARC600/ARC700 instruction set, then you're probably onto something.

I wouldn't really describe myself as 'on' this, in fact my frame is back in usable form again (probably be someone's birthday present), and I'll probably not be bothering to hack it further - looks like too much hard work, but I thought I'd try to give you a head start, and I wish you all the best.

cheers,
Biff.
Back to top
View user's profile Send private message
adipp
Newbie


Joined: 11 Jun 2009
Posts: 3

PostPosted: Thu Jun 11, 2009 6:35 am    Post subject: Reply with quote

may be it is useful for you http://rapidshare.com/files/243284713/6210a.rar.html
interesting instead of CF use dvd
Back to top
View user's profile Send private message
bifferos
Semi Newbie


Joined: 07 Jun 2009
Posts: 6

PostPosted: Thu Jun 11, 2009 8:12 am    Post subject: Reply with quote

adipp wrote:
may be it is useful for you http://rapidshare.com/files/243284713/6210a.rar.html
interesting instead of CF use dvd


So you've been to pudn too Smile.

No idea what you mean about 'dvd' but release_Dist6774_Test1271_Common920.rar is potentially more useful, since it includes PDFs with pinouts of a very similar CPU, however I still don't know how to connect a JTAG.

BTW: I started documenting these frames and the chipsets they use at: http://picframe.spritesserver.nl/wiki/index.php/Main_Page (at the bottom of the page).
Back to top
View user's profile Send private message
Nuno
Newbie


Joined: 29 May 2009
Posts: 3

PostPosted: Thu Jun 11, 2009 1:41 pm    Post subject: Reply with quote

Well, either into it or not into it, you've posted some very usefull info, thanks!!

Thanks you too adipp, I'll look carefully into that info.

I actually don't really care about the jpeg/mpeg stuff. I would be very glad just by controlling the CPU core, the LCD and some I/O. This alone is enough for loads and loads of fun...
Back to top
View user's profile Send private message
adipp
Newbie


Joined: 11 Jun 2009
Posts: 3

PostPosted: Fri Jun 12, 2009 1:59 am    Post subject: Reply with quote

i have this package with datashit on 7228 and have on 7218 too. they have 2 pins in jtag section test_n and reset_n near TDO pin and test_n pin pullup via 10kom resistor to 3.3v. may be test_n pin is necessary connect to ground for test mode.
Back to top
View user's profile Send private message
infernall
Newbie


Joined: 24 Jun 2009
Posts: 1

PostPosted: Wed Jun 24, 2009 1:11 pm    Post subject: Reply with quote

If you're trying to add firmware via USB Stick, call your firmware upgrade.img on the root of the USB stick. Navigate to it and you can select it, which prompts you to upgrade with it.
Back to top
View user's profile Send private message
bifferos
Semi Newbie


Joined: 07 Jun 2009
Posts: 6

PostPosted: Fri Jun 26, 2009 2:16 pm    Post subject: Here's another one Reply with quote

http://sites.google.com/site/bifferboard/Home/digital-photo-frames/reddmango-photo-frame
Back to top
View user's profile Send private message
adipp
Newbie


Joined: 11 Jun 2009
Posts: 3

PostPosted: Sun Jun 28, 2009 6:56 am    Post subject: Reply with quote

2 biffero
http://cp.people.overclockers.ru/cgi-bin/dl.pl?id=31620&filename=aml6213d.rar
what do you think about jtag activation on page 1
Back to top
View user's profile Send private message
bifferos
Semi Newbie


Joined: 07 Jun 2009
Posts: 6

PostPosted: Mon Jun 29, 2009 6:03 am    Post subject: Reply with quote

AML6213D = 208 pins
AML6213A = 144 pins

How many bloody chips does this company make anyhow? Smile.

But... going from the address line A10 of the SDRAM back to the CPU, it seems there is a 4k7 resistor arrangement on the Reddmango (R23, at bottom-left of CPU). R22 is missing, so maybe if we add R22, it will enable JTAG.
Back to top
View user's profile Send private message
PierrotLafouine
Newbie


Joined: 18 Aug 2009
Posts: 1

PostPosted: Tue Aug 18, 2009 12:16 pm    Post subject: Reply with quote

Hi
I also would be interested to know what's in this aml6213d chips
( Any OS running on this, driver, pinout etc...)

Thanks
Back to top
View user's profile Send private message
dgenin
Newbie


Joined: 02 Oct 2016
Posts: 1
Location: Gaithersburg, MD

PostPosted: Sun Oct 02, 2016 1:52 pm    Post subject: Reply with quote

Don't know if anyone is still interested in this but I have made some good headway on reversing the P720 photo frame. I have JTAG working and am in the process of REing the OS.
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Hacked Gadgets Forum Index -> New Projects Currently Being Developed All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum



Powered by phpBB © 2001, 2005 phpBB Group