Tmphack: Difference between revisions
No edit summary |
No edit summary |
||
| Line 13: | Line 13: | ||
<< Syn! | << Syn! | ||
>> 04 "0900" 05 | >> 04 "0900" 05 # 04 = new request for 0900 ? The response seems to be, 01 stuff, 02 stuff, 03 stuff, 04 end | ||
<< 01 "0001" 02 "09000021800000000080000000" 03 09 | << 01 "0001" 02 "09000021800000000080000000" 03 09 | ||
>> 10 30 | >> 10 30 # something | ||
<< 04 | << 04 # 04 = ok? | ||
>> 04 "0700" 05 | >> 04 "0700" 05 # new request for 0700 ? | ||
<< "0700" 04 | << "0700" 04 # empty? | ||
>> 04 "0600" 05 | >> 04 "0600" 05 # gimme from 0600 ? | ||
<< 01 "0001" 02 "longstringofdata" 03 0d | << 01 "0001" 02 "longstringofdata" 03 0d # lots of data | ||
>> 10 30 | >> 10 30 # something? (clear?) | ||
<< 04 | << 04 # ok | ||
>> 04 "1901" 05 | >> 04 "1901" 05 # request for 1901? | ||
<< 10 30 | << 10 30 | ||
>> 01 "0002" 02 "1911 " 03 0b # spaces | >> 01 "0002" 02 "1911 " 03 0b # spaces, normal 01,02,03 reply, but what is it | ||
<< 10 31 | << 10 31 # 10 31 now | ||
>> 04 | >> 04 # ok | ||
>> 04 "0600" 05 | >> 04 "0600" 05 # again, give me 0600 | ||
<< "0600" 04 | << "0600" 04 # now its empty | ||
>> Fin | >> Fin | ||
<< Fin | << Fin | ||
Revision as of 02:09, 3 October 2008
Hacking the HDX-1000 media player.
Firmware analysis
The HDX-1000 minidevice player seems to communicate on port 1441.
The bytes captured are:
host <<=>> minidevice ====================== >> port 1441 Syn? << Syn! >> 04 "0900" 05 # 04 = new request for 0900 ? The response seems to be, 01 stuff, 02 stuff, 03 stuff, 04 end << 01 "0001" 02 "09000021800000000080000000" 03 09 >> 10 30 # something << 04 # 04 = ok? >> 04 "0700" 05 # new request for 0700 ? << "0700" 04 # empty? >> 04 "0600" 05 # gimme from 0600 ? << 01 "0001" 02 "longstringofdata" 03 0d # lots of data >> 10 30 # something? (clear?) << 04 # ok >> 04 "1901" 05 # request for 1901? << 10 30 >> 01 "0002" 02 "1911 " 03 0b # spaces, normal 01,02,03 reply, but what is it << 10 31 # 10 31 now >> 04 # ok >> 04 "0600" 05 # again, give me 0600 << "0600" 04 # now its empty >> Fin << Fin
The longstring of data, appears to contain:
01 30 3030 31 "0001" 02 #Start of record, total of 8 records this time 3331 "31" 3230 3038 3130 3033 3038 3436 "200810030846" # known 3030 3031 "0001" 3030 3030 3030 3132 3232 "0000001222" # known 3030 3031 "0001" #Start of next record 3331 "31" ... etc .. 3030 3031 "0001" # end 03 0d