|
|
| (6 intermediate revisions by the same user not shown) |
| Line 1: |
Line 1: |
| == Pioneer == | | == Personal == |
|
| |
|
| My old amp (home cinema audio system) died, so this gave me a chance to buy a new set. | | [http://www.lundman.net/gallery/ My Gallery] |
|
| |
|
| I bought the Pioneer MCS-434 - mainly as it was in the rough price bracket I was willing to
| | [http://www.lokien.net/gallery/ Lokien's Gallery] |
| pay for. (Ie, not too much).
| |
|
| |
|
| This appear to share firmware file with these models:
| | [http://www.ushka.net/gallery/ Ushka's Gallery] |
|
| |
|
| MCS-838
| |
| MCS-737
| |
| MCS-434
| |
| MCS-333
| |
| MCS-FS131
| |
| MCS-FS232
| |
|
| |
|
| and the file itself is named BD-HTS5_Vxxx
| | Buying a [[tokyo_house|house in Tokyo]] |
|
| |
|
| | Registering for [[Minpaku_AirBnB|Minpaku and AirBnB]] in Shibuya, Tokyo |
|
| |
|
| I don't care that it has a bluray player in it (but had no models without in the store) but
| | Proposed 2008 [[2008_Holiday]] |
| that it could do UPNP Media devices was a nice surprise.
| |
|
| |
|
| I found it working rather well with llink. Some minor troubles.
| | Proposed 2011 [[2011_Holiday]] |
|
| |
|
| * trickplay, ie, fast-forward and chapter skip did not work. llink was not sending the full DLNA flags required.
| | Proposed 2014 [[2014_Holiday]] |
| * ObjID has a maximum length of 64 chars. Even though the spec has no limit, clearly the Pioneer does. Use shorter paths.
| |
| * Refreshing (adding, or removing contents from a directory) does not work right.
| |
|
| |
|
| The last issue is the only one I was unable to fix. The Pioneer subscribes to events in UPNP to be notified when
| | Mum asked me to write down my experiences with having a child, so I did that, and for some reason carried on doing it even after she could no longer read them. |
| ContainerID has been updated. llink informs it of that, and the Pioneer re-issues a listing, as you would expect.
| |
|
| |
|
| But what it asks for in the listing is only 1 item. Ie, '''StartingIndex=1, RequestedCount=1'''. And no sorting.
| | [[birth]] giving birth in Tokyo as a foreigner. |
| After that, it just stops. It is confusing as to what it expects to get here. I have sent a whole new record,
| |
| as well as updated timestamps etc. But it also fails to refresh against Windows Media Center, so I think it
| |
| is just plain broken.
| |
|
| |
|
| I have attempted to contact Pioneer, and the developer of '''IPI/1.0 UPnP/1.0 DLNADOC/1.50''' but I have had no replies.
| | [[year one]] first year of child rearing |
|
| |
|
| So, attempting to gain access myself.
| | [[year two]] second year |
|
| |
|
| | [[year three]] third year, toilet training. |
|
| |
|
| === Firmware ===
| | [[birth two]] detailing the birth of the second child |
|
| |
|
| The first file of the firmware is quite straight forward:
| | [[year four]] first turns 4, second turns 7 months. Eye operation. |
|
| |
|
| # binwalk MCS838_V00.38.bin
| | [[year six]] first goes to school at 6, and second is 3. |
|
| |
| DECIMAL HEX DESCRIPTION
| |
| -------------------------------------------------------------------------------------------------------
| |
| 66580 0x10414 Mediatek bootloader
| |
| 119052 0x1D10C Mediatek bootloader
| |
| 425000 0x67C28 U-Boot boot loader reference{
| |
| 521792 0x7F640 uImage header, header size: 64 bytes, header CRC: 0xAC601819, created: Mon Oct 7 01:20:36 2013, image size: 1815444 bytes, Data Address: 0x3A00000, Entry Point: 0x3A00000, data CRC: 0xAD70A84B, OS: Linux, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: ""
| |
| 539189 0x83A35 gzip compressed data, maximum compression, from Unix, last modified: Mon Oct 7 01:17:17 2013{file-epoch:1381076237}
| |
|
| |
| 4265104 0x411490 Squashfs filesystem, little endian, version 4.0, compression:gzip, size: 65376434 bytes, {file-size:65376434} 1189 inodes, blocksize: 65536 bytes, created: Mon Oct 7 01:46:24 2013 {
| |
| 69772432 0x428A490 PNG image, 1920 x 1080, 8-bit/color RGB, non-interlaced
| |
| 69810320 0x4293890 PNG image, 720 x 480, 8-bit/color RGB, non-interlaced
| |
| 69834368 0x4299680 U-Boot boot loader reference{
| |
|
| |
|
| |
|
| Unpacking the squashfs, the bulk of the GUI code appears to be in;
| |
|
| |
|
| -rwxr-xr-x 1 lundman admin 20197340 Oct 7 01:45 usr/local/bin/bdpprog
| | Back in 1998 or so, I got quite sick, probably both from an ulcer and my gallbladder stones. I wrote a story about that, which I will move in here. |
|
| |
|
| and it would appear that it has some sort of secret code, based on;
| | [[gall stones]] |
|
| |
|
| g_onekey_secret_input
| |
| g_onekey_load_secret_input
| |
| g_onekey_sysinfo_secret_input
| |
| open_telnet
| |
| telnetd invoked ok
| |
| telnetd invoked failed
| |
|
| |
|
| But IDA has not revealed anything that works. My best guess was
| | [[OsX]] thoughts on Mac |
|
| |
|
| g_onekey_load_secret_input DCD 0x20103
| | [[tmphack]] |
|
| |
|
| Ie, 0 2 1 3, at the place where it prints the mcu and dsp versions. But that alone does not appear to work. Also checks for 0x03010200
| | [[ipad]] |
| | |
| I could roll my own firmware file, with telnetd running, and figure out whatever checksums they might have, but not that much time.
| |
| | |
| Preferably, Pioneer fixes the last issue and I don't have to do any of this :)
| |