Anyone into hacking Digital Photo Frames (DPF)?...

[Nuno]

Hello,

I recently bought a cheap DPF (aiptek miro III crystal) thinking in extracting the LCD for another project (a portable oscilloscope). I opened and from a high level point of view the circuit is relatively simple in a double side PCB, and you can more or less easily delimit sub-circuits on the PCB. I have detected and classified the following ones:

1) 3.3V volt switching regulator
2) Current switching regulator for the LCD backlight (it's LED based)
3) Core processing chip, an AML6210A from Amlogic (capable of not only display photos but video and play MP3) (no datasheet available )
4) 2MB flash chip (datasheet available)
5) SDRAM chip (datasheet available)
6) USB host interface
7) SD card interface
8 ) Some LCD interfacing components (a few transistors)
9) An I2C real time clock with battery backup (a super cap) (datasheet available)
10) A combined -10V and 15V switching regulator (seems to be needed by the LCD)

There's an LCD side area of about 2 fingers that is not being used/shown and is hidden by the frame (looks like usable area, since you can see the dots).

I have a photo of the component area of the PCB with my comments, I'll post it later when I get home.

So, this is actually a micro computer, and now I'm thinking that it would be nice to leave the LCD in there and use the thing as a whole, just adding some extra hardware for the application specific stuff and doing new software (the core chips has mechanisms to download new software either from a USB pen or an SD card). How many cool/useful/whatever projects could be done in such a (cheap) piece of hardware...

So, we now reach to the usual problem: no info on the core chip, AML6210A . The manufacturer's page has only a few high level characteristics, and I got no answer to my email requesting such info (I wonder why )). So here goes my questions:

1) Does anyone have any info on this chip?
2) Does anyone has some experience on reverse-engineering such system?
3) Do you think is a too-big-of-a-job to reverse engineer this thing?
4) Would someone join in with me on reverse-engineer this thing? I have good knowledge of software and solid basic electronics.
5) What other interesting "full-computer" cheap devices are out there waiting for someone to re-purpose them?

Leave your thoughts...


Update:

[bifferos]

Nuno, have a look here:

http://sites.google.com/site/bifferboard/Home/digital-photo-frame-display

[bifferos]

After a further look, it appears the test points you indicate as being at 3.3v are actually the JTAG. Too bad they are 3.3v because that indicates that the JTAG might be disabled. You can always try to wiggle them and see, but i don't hold out much hope.

Further to my original page, it seems there is a special pin on the CPU which can be used to kick the AML6210 into a state where either the JTAG works, or the flash can be reprogrammed via USB (I don't know which yet). This special pin is connected on my DPF to the 'unused' pin on the small form-factor USB 'B' connector (ahh.. so that's what that pin was for). I believe that injecting a signal into this pin will enable the USB port (which is connected but only acts as a charger on my model, and doesn't enumerate when connected to a USB host). No idea the sequence of commands to put on this pin, but you never know, it might be something simple.

I have interfered with most other pins on this CPU to attempt to activate JTAG, which is normally a pull-up or pull-down resistor somewhere, but to no avail, so I think this pin is the key. It's at the very bottom of the right-hand row of pins as you look at the AML6210DP, hoever it seems the 6210A doesn't have the same pin configuration, making me wonder how much applies to both CPUs.

Nice to finally see a pic of the 6210A though.

[Nuno]

Ahhh.... glad to see that there's someone else on it

Ok, some pieces of info:

According to the manufacturer, the 6210A can have the software updated by USB or memory card. My guess would be that if you create a file with a special name, it would be loaded as firmware (I've seen some other devices doing it).

The USB on this frame only works as a host. There's no PC connectivity; the DPF only works by will scanning the USB/SD for pics to display.

I'll check those 3.3V lines more carefully and see where do they lead.

It's a good info, that one about the core CPU architecture. I'm trying to get a development toolkit, but the request it will most probably be refused.

The 1st attempt I made was to search for a serial port, but no success. I guessed that there would be a serial debug port )

Other than this, my only idea would be to connect a logic analyzer to the address+data+R/W lines and check how Mr. AML6210A boots and what does it do. Unfortunately this is very hard and needs a fast logic analyzer which I don't have...

[bifferos]

Dev toolkit? If you are talking about Metaware, which is usually used for development of software for the AML frames, then you'll never get that for free - it'll cost many $$$s.

For compiler, you can use the gcc link on my page. Although the Argonaut core is theoretically customizable right down to the instruction level, I believe most implementations keep the same basic instruction set. I'm not sure how you'd access the more advanced stuff like hardware jpeg/mp3 decompression though.

Depends how badly you want to hack this, but if you have hot air, you can lift the flash chip and put it down on one of the cheap routers, then use the JTAG on the router to read the contents. It's a bit extreme, but possible. This would perhaps allow one to find basic things like the name of the file on the CF card that it reads for firmware updates.

Alternatively scour the internet looking for firmware updates for (any) photo frame

e.g.: http://www.sony-asia.com/support/download/281498

Eventually you will find one containing ARC600/ARC700 instruction set, then you're probably onto something.

I wouldn't really describe myself as 'on' this, in fact my frame is back in usable form again (probably be someone's birthday present), and I'll probably not be bothering to hack it further - looks like too much hard work, but I thought I'd try to give you a head start, and I wish you all the best.

cheers,
Biff.

[adipp]

may be it is useful for you http://rapidshare.com/files/243284713/6210a.rar.html
interesting instead of CF use dvd

[bifferos]

[Nuno]

Well, either into it or not into it, you've posted some very usefull info, thanks!!

Thanks you too adipp, I'll look carefully into that info.

I actually don't really care about the jpeg/mpeg stuff. I would be very glad just by controlling the CPU core, the LCD and some I/O. This alone is enough for loads and loads of fun...

[adipp]

i have this package with datashit on 7228 and have on 7218 too. they have 2 pins in jtag section test_n and reset_n near TDO pin and test_n pin pullup via 10kom resistor to 3.3v. may be test_n pin is necessary connect to ground for test mode.

[infernall]

If you're trying to add firmware via USB Stick, call your firmware upgrade.img on the root of the USB stick. Navigate to it and you can select it, which prompts you to upgrade with it.

[bifferos]

http://sites.google.com/site/bifferboard/Home/digital-photo-frames/reddmango-photo-frame

[adipp]

2 biffero
http://cp.people.overclockers.ru/cgi-bin/dl.pl?id=31620&filename=aml6213d.rar
what do you think about jtag activation on page 1

[bifferos]

AML6213D = 208 pins
AML6213A = 144 pins

How many bloody chips does this company make anyhow? .

But... going from the address line A10 of the SDRAM back to the CPU, it seems there is a 4k7 resistor arrangement on the Reddmango (R23, at bottom-left of CPU). R22 is missing, so maybe if we add R22, it will enable JTAG.

[PierrotLafouine]

Hi
I also would be interested to know what's in this aml6213d chips
( Any OS running on this, driver, pinout etc...)

Thanks

[dgenin]

Don't know if anyone is still interested in this but I have made some good headway on reversing the P720 photo frame. I have JTAG working and am in the process of REing the OS.