HD-A1 Exploration / Repair (Standalone HD-DVD) - Page 5

awhitehead · 22nd May 2007, 21:05

@FrankRizzo

For what it's worth, it's widely believed that the data on the first generation Toshiba units is encrypted, with each image being tied to the hardware. Since replacing both drive and flash at the same time seems to fix it, it's most likely that the serial number (or some similar identifier) of the drive is used to encrypt the files on the flash.

So an image would be rather useless to you without the rest of the hardware.

sega32x · 23rd May 2007, 05:51

Nope, see, all of the goodies are encrypted on the usb flash (hddvd player, dvd player, cd player, setup, update, scripts, everything)

And that site, the majorty of the code wasnt anything useful, IE strings about the filesystem (which isnt encrypted, just the contents are!)

The only things not encrypted are just a few, any of the images (for the GUI), and the error messages, ie "THIS DISK CANT BE PLAYED".

Seems the A2's, atleast as the service manual states, are based somewhat off Windows CE, if you want a hole, thats probably got plenty

awhitehead · 11th June 2007, 10:38

Quote:

Originally Posted by sega32x

Seems the A2's, atleast as the service manual states, are based somewhat off Windows CE, if you want a hole, thats probably got plenty

Is it Windows CE based? I was thinking about picking up an HD-A2. *sigh* Is the manual available as a PDF from Toshiba?

Edit: HD-A1, HD-XA1, HD-A2, HD-XA2 manuals are all availble from http://209.167.114.38/support/ceg/manuals/ (press 2006 -> HD-DVD for firsg gen, 2007 -> HD-DVD for second gen units)

Edit2: Page 61 of the 72 page user manual for HD-A2 states:
"License information on the software used in Toshiba HD-DVD player"

Pre-installed software EULA Pre-installed software EULA
Linux Kernel Busybox Exhibit A
glibc Exhibit B
OpenSSL Exhibit C
freetype Exhibit D

Various exhibits are the apropriate licenses - GPL, LGPL, OpenSSL license, and Freetype license.

Thus I suspect that HD-A2 is also Linux based.

sega32x · 12th June 2007, 19:23

Ironically, the service manual says the -2's are CE based, so now with what you found, I am not sure which it is!

arnezami · 15th June 2007, 03:56

Has anybody here spoken to Boing99 lately? I'm trying to contact him.

.

natronicus · 2nd November 2007, 20:12

With the HD-A2's now selling for $98, anyone planning on reviving this project?

sega32x · 2nd November 2007, 20:55

Would love to, but dont have any funds for an A2. Id love to get my hands on a broken one tho (any GEN2 player).

Namely, the debug access alone should be a bit easier (real chips vs unknown xilinx chips). If anyone wants to sell a broken one (or a working one cheap), do let me know.

Nevertheless, the fate of my original unit, it did work again, did not play movies (the drive was hosed), however I used it for parts to fix two other units, and they both work great!

evdberg · 26th February 2008, 21:44

I had some contact with awhitehead some time ago and he claimed that he had succeeded to get his Xbox360 drive to work with the HD-A1. When I asked him how to do this, his reply was that he could explain it to me but it was of no use since it did not work with AACS. This ofcourse is true, since the NEC drive uses KCD and not the authentication through RSA certificates like the 2nd gen and Xbox does.

Now since my problem is that the HD-A1 does not play my homebrew disks correctly, I was pretty interested in his solution. Unfortunately I never got word from him again. Now with the current situation that Toshiba has given up on HD-DVD, getting a replacement drive to work with the player has even more interest. The drive is the weakest part of the whole player, so it is pretty interesting to be able to use another one.

Unfortunately I have not much experience in Linux, and am not much of a hacker. Is there anybody who has any clue how to do this?

Zotty · 26th February 2008, 22:45

No help, but a partially overlapping problem; I'm trying to get into a HD-EP30 (http://forum.doom9.org/showthread.php?t=135265). My primairy target is the firmware. It's encrypted, so that's a major problem, but the thought it that once we can get into the firmware (maybe same encryption or method), it might be possible to modify it to play homebrew discs, change DVD region, hack AACS, etc.. May or may not be possible, but it would allow you to make homebrew discs works by changing firmware instead of modifying the hardware.

batteryman · 29th February 2008, 08:53

You know what would be awesome is if you could just drop in a blu-ray drive. any of you tried just installing a plain old dvd-rom drive? I just got a hd-a1 today.

sega32x · 3rd March 2008, 00:25

I think the best goal is as a streaming media server (even drop in a hard disk)

On the hardware side that is fairly easy (just solder in a new pad, some resistors), which i have done. Or even easier, use a USB hdd. The larger issue is compiling software to run on the box!

batteryman · 4th March 2008, 00:48

yeah I would even be willing to pay for the software. Toshiba just needs to release the update

. I mean why not if their format is dead in the water. Then I could still have some use for it. Come on Toshiba!

batteryman · 14th March 2008, 06:47

BUMP, come on guys! do you have any solutions?

sega32x · 14th March 2008, 19:21

I have been tinkering with my XA2 as of late, the hardware is a bit more standard (no more mystery FPGA's). Attempting to dump the flash (boot), but my adapter is being flakey. There is a JTAG and UART for the REON (CNP01 and CNP02), uart even outputs some nice stuff. Still searching for one for the actual player (it should be on here, somewhere)

Anyone got a LA/Scope and wanna take a peek?

batteryman · 20th March 2008, 07:55

So it sounds like things are more standardized and easier to get at on it?

sega32x · 21st March 2008, 11:56

Well yes, since the Gen 2's are much closer to the DSTB reference design than the Gen 1's, there are more documents on them etc. Although the Gen 1 is based off of the DSTB reference design, the Gen 2's are much closer (no reprogrammable fpgas!)

At the moment, ive traced out the flash lines on the XA2, and need to get ahold of another Gen 2 box to dump the flash. Needless to say, removing tons of epoxy kinda destroyed the flash, which sucks, but shouldnt be too hard to fix!

Namely since its directly connected to the southbridge, there should be no encryption etc, since the southbridge is not custom logic (unlike the gen 1)

Sechrist · 28th March 2008, 05:59

Well, this thread seems pretty much dead now.
Anywhos..

I was able to gain a root shell and install dropbear on my HD-A1 and RCA-HDV5000 units.

Your suspicions with key-signed files were close, the problem with swapping without swapping both the uDoC and the HD-DVD drive is that the binaries that the linux system executes to load the actual "player" are encrypted with the AACS key from the IDE device itself.

However, the kernel is NOT on the filesystem that the linux mounts from the 32mB rom chip. I think it is loaded into memory on boot each time. The only way we can get our /etc/ and important linux changes to stick is to reverse engineer the update process(well, excluding actually flashing it with an external programmer, which I would want anyway to not brick my units!).

I managed to get a lighttpd running on it, just for funsies. (http://chasesechrist.com/).

Here's some general information about the system:
[Linux:Ash30]$cat /etc/passwd
root:EDITED OUT:0:0:root:/tmp:/bin/sh
bin:x:1:1:bin:/bin:
daemon:x:2:2:daemon:/sbin:
adm:x:3:4:adm:/var/adm:
lp:x:4:7:lp:/var/spool/lpd:
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:
news:x:9:13:news:/var/spool/news:
uucp:x:10:14:uucp:/var/spool/uucp:
operator:x:11:0

perator:/root:
games:x:12:100:games:/usr/games:
gopher:x:13:30:gopher:/usr/lib/gopher-data:
ftp:x:14:50:FTP User:/home/ftp:
nobody:x:99:99:Nobody:/:

[Linux:Ash30]$mount
/dev/root on / type ext2 (rw)
/proc on /proc type proc (rw,nodiratime)
/sys on /sys type sysfs (rw)
/proc/bus/usb on /proc/bus/usb type usbfs (rw)
/dev/sda1 on /mnt/ROM type ext2 (rw,sync)
/dev/loop0 on /mnt/ROM/HD_DVD type vfat (rw,sync,nodiratime,fmask=0022,dmask=0022,shortname=mixed)
/dev/loop1 on /mnt/ROM/NetArea type vfat (rw,sync,nodiratime,fmask=0022,dmask=0022)
none on /dev/pts type devpts (rw)
[Linux:Ash30]$

(/dev/root doesn't exist, it's a pseudo device.)

[Linux:Ash30]$cat /proc/cpuinfo
processor : 0
vendor_id : GenuineIntel
cpu family : 15
model : 2
model name : Mobile Intel(R) Pentium(R) 4 - M CPU 2.50GHz
stepping : 9
cpu MHz : 2499.914
cache size : 512 KB
fdiv_bug : no
hlt_bug : no
f00f_bug : no
coma_bug : no
fpu : yes
fpu_exception : yes
cpuid level : 2
wp : yes
flags : fpu vme de pse tsc msr pae mce cx8 sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe cid xtpr
bogomips : 4947.96

[Linux:Ash30]$busybox
BusyBox v1.00 (2005.09.13-00:20+0000) multi-call binary

Usage: busybox [function] [arguments]...
or: [function] [arguments]...

[Linux:Ash30]$uname -a
Linux (none) 2.6.10-R040 #20 Mon Mar 20 09:43:01 JST 2006 i686 unknown

[Linux:Ash30]$lspci -i ./pci.ids
00:00.0 Host bridge: Intel Corporation Unknown device 358c (rev 02)
00:00.1 System peripheral: Intel Corporation 82852/82855 GM/GME/PM/GMV Processor to I/O Controller (rev 02)
00:00.3 System peripheral: Intel Corporation 82852/82855 GM/GME/PM/GMV Processor to I/O Controller (rev 02)
00:02.0 Display controller: Intel Corporation Unknown device 358e (rev 02)
00:1d.0 USB Controller: Intel Corporation 82801DB/DBL/DBM (ICH4/ICH4-L/ICH4-M) USB UHCI Controller #1 (rev 03)
00:1d.1 USB Controller: Intel Corporation 82801DB/DBL/DBM (ICH4/ICH4-L/ICH4-M) USB UHCI Controller #2 (rev 03)
00:1d.2 USB Controller: Intel Corporation 82801DB/DBL/DBM (ICH4/ICH4-L/ICH4-M) USB UHCI Controller #3 (rev 03)
00:1d.7 USB Controller: Intel Corporation 82801DB/DBM (ICH4/ICH4-M) USB2 EHCI Controller (rev 03)
00:1e.0 PCI bridge: Intel Corporation 82801 Mobile PCI Bridge (rev 83)
00:1f.0 ISA bridge: Intel Corporation 82801DBM (ICH4-M) LPC Interface Bridge (rev 03)
00:1f.1 IDE interface: Intel Corporation 82801DBM (ICH4-M) IDE Controller (rev 03)
00:1f.3 SMBus: Intel Corporation 82801DB/DBL/DBM (ICH4/ICH4-L/ICH4-M) SMBus Controller (rev 03)
00:1f.5 Multimedia audio controller: Intel Corporation 82801DB/DBL/DBM (ICH4/ICH4-L/ICH4-M) AC'97 Audio Controller (rev 03)
01:08.0 Ethernet controller: Intel Corporation 82801DB PRO/100 VE (LOM) Ethernet Controller (rev 83)
01:09.0 Bridge: Broadcom Corporation Unknown device 7411
01:0b.0 Multimedia controller: Toshiba America Info Systems Unknown device 0419
01:0b.1 Multimedia controller: Toshiba America Info Systems Unknown device 041a
01:0b.2 Multimedia controller: Toshiba America Info Systems Unknown device 041b
01:0c.0 System peripheral: Toshiba America Info Systems TC6371AF SmartMedia Controller (rev 06)
[Linux:Ash30]$

I haven't tried getting the AC'97 to work, and the graphics chips seem to be proprietary

If anybody here is interested in helping, has any questions, or is a programmer/general hacker willing to help, please contact me on AIM (sekhrist).

PS: I got in with libcdaudio at first, then later got in with libpng(so I didn't have to have a CD in the tray).
I just recompiled the libraries and dropped them on my flash drive(which I DD'd from the original, so it was a exact bit-per-bit match).

PSS: http://www.remotecentral.com/cgi-bin...hread.cgi?1160 for serial port control. It won't give you a shell, but it's neat to tinker with!

PSSS:

laserfan · 28th March 2008, 15:31

Quote:

Originally Posted by Sechrist

Well, this thread seems pretty much dead now....If anybody here is interested in helping, has any questions, or is a programmer/general hacker willing to help, please contact me..

Yeah I think you're very "bleeding edge" with this, it's way over my head, but thought I'd post some words of encouragement anyway:

I'm Impressed!

sega32x · 29th March 2008, 02:18

Well very nice! Its about time someone else did it. A few of us have had it for a while, but kept it hush hush due to the whole aacs thing.

Considering that the player is dead now, not much hassle.

For boot, it boots the kernel from the NOR flash on a BGA chip behind the XC2C256 chip iirc, its a tiny kernel and bootloader.

There is a debug interface, but have yet to gain access.

Check out the intel PDK kit, with a little tinkering you can compile an application to output to the on screen display.

In regards to the update, the kernel image is encrypted, so you need to decrypt/crypt to take care of that.

Ideally, a port of mplayer or the like would make this player great. It is possible to boot up the player WITHOUT the HD-DVD drive (software needs to be tinkered with, but its fairly simple). So we could throw in a HDD, and use it as a nice network media player, in time!

Sechrist · 29th March 2008, 02:27

Oh wonderful!

How are you able to change the boot process to boot without the drive in? I've been working on a cable to get a slave device in, as well.

As far as I know, the only problem with it booting without the dvd drive in is that it needs it to decrypt the actual player with the key from the drive. Are you able to get permanent storage on it(On the chip, not the uDoC)?

Originally before I even bought the thing, I was hoping I could port XBMC linux to it, and with the PDK it might be possible with a good bit of work.
I was planning to set up MPD on it as soon as I got the AC'97 working.
Is it standard AC'97, and alsa will work?

26th February 2008, 22:45	#89 \| Link
Zotty Registered User Join Date: Sep 2006 Posts: 110	No help, but a partially overlapping problem; I'm trying to get into a HD-EP30 (http://forum.doom9.org/showthread.php?t=135265). My primairy target is the firmware. It's encrypted, so that's a major problem, but the thought it that once we can get into the firmware (maybe same encryption or method), it might be possible to modify it to play homebrew discs, change DVD region, hack AACS, etc.. May or may not be possible, but it would allow you to make homebrew discs works by changing firmware instead of modifying the hardware. __________________ libaacs

28th March 2008, 05:59	#97 \| Link
Sechrist Registered User Join Date: Mar 2008 Posts: 5	Well, this thread seems pretty much dead now. Anywhos.. I was able to gain a root shell and install dropbear on my HD-A1 and RCA-HDV5000 units. Your suspicions with key-signed files were close, the problem with swapping without swapping both the uDoC and the HD-DVD drive is that the binaries that the linux system executes to load the actual "player" are encrypted with the AACS key from the IDE device itself. However, the kernel is NOT on the filesystem that the linux mounts from the 32mB rom chip. I think it is loaded into memory on boot each time. The only way we can get our /etc/ and important linux changes to stick is to reverse engineer the update process(well, excluding actually flashing it with an external programmer, which I would want anyway to not brick my units!). I managed to get a lighttpd running on it, just for funsies. (http://chasesechrist.com/). Here's some general information about the system: [Linux:Ash30]$cat /etc/passwd root:EDITED OUT:0:0:root:/tmp:/bin/sh bin:x:1:1:bin:/bin: daemon:x:2:2:daemon:/sbin: adm:x:3:4:adm:/var/adm: lp:x:4:7:lp:/var/spool/lpd: sync:x:5:0:sync:/sbin:/bin/sync shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown halt:x:7:0:halt:/sbin:/sbin/halt mail:x:8:12:mail:/var/spool/mail: news:x:9:13:news:/var/spool/news: uucp:x:10:14:uucp:/var/spool/uucp: operator:x:11:0perator:/root: games:x:12:100:games:/usr/games: gopher:x:13:30:gopher:/usr/lib/gopher-data: ftp:x:14:50:FTP User:/home/ftp: nobody:x:99:99:Nobody:/: [Linux:Ash30]$mount /dev/root on / type ext2 (rw) /proc on /proc type proc (rw,nodiratime) /sys on /sys type sysfs (rw) /proc/bus/usb on /proc/bus/usb type usbfs (rw) /dev/sda1 on /mnt/ROM type ext2 (rw,sync) /dev/loop0 on /mnt/ROM/HD_DVD type vfat (rw,sync,nodiratime,fmask=0022,dmask=0022,shortname=mixed) /dev/loop1 on /mnt/ROM/NetArea type vfat (rw,sync,nodiratime,fmask=0022,dmask=0022) none on /dev/pts type devpts (rw) [Linux:Ash30]$ (/dev/root doesn't exist, it's a pseudo device.) [Linux:Ash30]$cat /proc/cpuinfo processor : 0 vendor_id : GenuineIntel cpu family : 15 model : 2 model name : Mobile Intel(R) Pentium(R) 4 - M CPU 2.50GHz stepping : 9 cpu MHz : 2499.914 cache size : 512 KB fdiv_bug : no hlt_bug : no f00f_bug : no coma_bug : no fpu : yes fpu_exception : yes cpuid level : 2 wp : yes flags : fpu vme de pse tsc msr pae mce cx8 sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe cid xtpr bogomips : 4947.96 [Linux:Ash30]$busybox BusyBox v1.00 (2005.09.13-00:20+0000) multi-call binary Usage: busybox [function] [arguments]... or: [function] [arguments]... [Linux:Ash30]$uname -a Linux (none) 2.6.10-R040 #20 Mon Mar 20 09:43:01 JST 2006 i686 unknown [Linux:Ash30]$lspci -i ./pci.ids 00:00.0 Host bridge: Intel Corporation Unknown device 358c (rev 02) 00:00.1 System peripheral: Intel Corporation 82852/82855 GM/GME/PM/GMV Processor to I/O Controller (rev 02) 00:00.3 System peripheral: Intel Corporation 82852/82855 GM/GME/PM/GMV Processor to I/O Controller (rev 02) 00:02.0 Display controller: Intel Corporation Unknown device 358e (rev 02) 00:1d.0 USB Controller: Intel Corporation 82801DB/DBL/DBM (ICH4/ICH4-L/ICH4-M) USB UHCI Controller #1 (rev 03) 00:1d.1 USB Controller: Intel Corporation 82801DB/DBL/DBM (ICH4/ICH4-L/ICH4-M) USB UHCI Controller #2 (rev 03) 00:1d.2 USB Controller: Intel Corporation 82801DB/DBL/DBM (ICH4/ICH4-L/ICH4-M) USB UHCI Controller #3 (rev 03) 00:1d.7 USB Controller: Intel Corporation 82801DB/DBM (ICH4/ICH4-M) USB2 EHCI Controller (rev 03) 00:1e.0 PCI bridge: Intel Corporation 82801 Mobile PCI Bridge (rev 83) 00:1f.0 ISA bridge: Intel Corporation 82801DBM (ICH4-M) LPC Interface Bridge (rev 03) 00:1f.1 IDE interface: Intel Corporation 82801DBM (ICH4-M) IDE Controller (rev 03) 00:1f.3 SMBus: Intel Corporation 82801DB/DBL/DBM (ICH4/ICH4-L/ICH4-M) SMBus Controller (rev 03) 00:1f.5 Multimedia audio controller: Intel Corporation 82801DB/DBL/DBM (ICH4/ICH4-L/ICH4-M) AC'97 Audio Controller (rev 03) 01:08.0 Ethernet controller: Intel Corporation 82801DB PRO/100 VE (LOM) Ethernet Controller (rev 83) 01:09.0 Bridge: Broadcom Corporation Unknown device 7411 01:0b.0 Multimedia controller: Toshiba America Info Systems Unknown device 0419 01:0b.1 Multimedia controller: Toshiba America Info Systems Unknown device 041a 01:0b.2 Multimedia controller: Toshiba America Info Systems Unknown device 041b 01:0c.0 System peripheral: Toshiba America Info Systems TC6371AF SmartMedia Controller (rev 06) [Linux:Ash30]$ I haven't tried getting the AC'97 to work, and the graphics chips seem to be proprietary If anybody here is interested in helping, has any questions, or is a programmer/general hacker willing to help, please contact me on AIM (sekhrist). PS: I got in with libcdaudio at first, then later got in with libpng(so I didn't have to have a CD in the tray). I just recompiled the libraries and dropped them on my flash drive(which I DD'd from the original, so it was a exact bit-per-bit match). PSS: http://www.remotecentral.com/cgi-bin...hread.cgi?1160 for serial port control. It won't give you a shell, but it's neat to tinker with! PSSS: Last edited by Sechrist; 28th March 2008 at 06:18.

29th March 2008, 02:27	#100 \| Link
Sechrist Registered User Join Date: Mar 2008 Posts: 5	Oh wonderful! How are you able to change the boot process to boot without the drive in? I've been working on a cable to get a slave device in, as well. As far as I know, the only problem with it booting without the dvd drive in is that it needs it to decrypt the actual player with the key from the drive. Are you able to get permanent storage on it(On the chip, not the uDoC)? Originally before I even bought the thing, I was hoping I could port XBMC linux to it, and with the PDK it might be possible with a good bit of work. I was planning to set up MPD on it as soon as I got the AC'97 working. Is it standard AC'97, and alsa will work? Last edited by Sechrist; 29th March 2008 at 02:35.

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

22nd May 2007, 21:05	#81 \| Link
awhitehead Registered User Join Date: Jan 2007 Location: Tel-Aviv, Israel Posts: 185	@FrankRizzo For what it's worth, it's widely believed that the data on the first generation Toshiba units is encrypted, with each image being tied to the hardware. Since replacing both drive and flash at the same time seems to fix it, it's most likely that the serial number (or some similar identifier) of the drive is used to encrypt the files on the flash. So an image would be rather useless to you without the rest of the hardware.

23rd May 2007, 05:51	#82 \| Link
sega32x Registered User Join Date: Feb 2007 Posts: 47	Nope, see, all of the goodies are encrypted on the usb flash (hddvd player, dvd player, cd player, setup, update, scripts, everything) And that site, the majorty of the code wasnt anything useful, IE strings about the filesystem (which isnt encrypted, just the contents are!) The only things not encrypted are just a few, any of the images (for the GUI), and the error messages, ie "THIS DISK CANT BE PLAYED". Seems the A2's, atleast as the service manual states, are based somewhat off Windows CE, if you want a hole, thats probably got plenty

12th June 2007, 19:23	#84 \| Link
sega32x Registered User Join Date: Feb 2007 Posts: 47	Ironically, the service manual says the -2's are CE based, so now with what you found, I am not sure which it is!

15th June 2007, 03:56	#85 \| Link
arnezami Registered User Join Date: Sep 2006 Posts: 389	Has anybody here spoken to Boing99 lately? I'm trying to contact him. .

2nd November 2007, 20:12	#86 \| Link
natronicus Registered User Join Date: Feb 2007 Posts: 15	With the HD-A2's now selling for $98, anyone planning on reviving this project?

2nd November 2007, 20:55	#87 \| Link
sega32x Registered User Join Date: Feb 2007 Posts: 47	Would love to, but dont have any funds for an A2. Id love to get my hands on a broken one tho (any GEN2 player). Namely, the debug access alone should be a bit easier (real chips vs unknown xilinx chips). If anyone wants to sell a broken one (or a working one cheap), do let me know. Nevertheless, the fate of my original unit, it did work again, did not play movies (the drive was hosed), however I used it for parts to fix two other units, and they both work great!

26th February 2008, 21:44	#88 \| Link
evdberg Registered User Join Date: Dec 2006 Posts: 202	I had some contact with awhitehead some time ago and he claimed that he had succeeded to get his Xbox360 drive to work with the HD-A1. When I asked him how to do this, his reply was that he could explain it to me but it was of no use since it did not work with AACS. This ofcourse is true, since the NEC drive uses KCD and not the authentication through RSA certificates like the 2nd gen and Xbox does. Now since my problem is that the HD-A1 does not play my homebrew disks correctly, I was pretty interested in his solution. Unfortunately I never got word from him again. Now with the current situation that Toshiba has given up on HD-DVD, getting a replacement drive to work with the player has even more interest. The drive is the weakest part of the whole player, so it is pretty interesting to be able to use another one. Unfortunately I have not much experience in Linux, and am not much of a hacker. Is there anybody who has any clue how to do this?

29th February 2008, 08:53	#90 \| Link
batteryman Registered User Join Date: Feb 2008 Posts: 4	You know what would be awesome is if you could just drop in a blu-ray drive. any of you tried just installing a plain old dvd-rom drive? I just got a hd-a1 today.

3rd March 2008, 00:25	#91 \| Link
sega32x Registered User Join Date: Feb 2007 Posts: 47	I think the best goal is as a streaming media server (even drop in a hard disk) On the hardware side that is fairly easy (just solder in a new pad, some resistors), which i have done. Or even easier, use a USB hdd. The larger issue is compiling software to run on the box!

4th March 2008, 00:48	#92 \| Link
batteryman Registered User Join Date: Feb 2008 Posts: 4	yeah I would even be willing to pay for the software. Toshiba just needs to release the update . I mean why not if their format is dead in the water. Then I could still have some use for it. Come on Toshiba!

14th March 2008, 06:47	#93 \| Link
batteryman Registered User Join Date: Feb 2008 Posts: 4	BUMP, come on guys! do you have any solutions?

14th March 2008, 19:21	#94 \| Link
sega32x Registered User Join Date: Feb 2007 Posts: 47	I have been tinkering with my XA2 as of late, the hardware is a bit more standard (no more mystery FPGA's). Attempting to dump the flash (boot), but my adapter is being flakey. There is a JTAG and UART for the REON (CNP01 and CNP02), uart even outputs some nice stuff. Still searching for one for the actual player (it should be on here, somewhere) Anyone got a LA/Scope and wanna take a peek?

20th March 2008, 07:55	#95 \| Link
batteryman Registered User Join Date: Feb 2008 Posts: 4	So it sounds like things are more standardized and easier to get at on it?

21st March 2008, 11:56	#96 \| Link
sega32x Registered User Join Date: Feb 2007 Posts: 47	Well yes, since the Gen 2's are much closer to the DSTB reference design than the Gen 1's, there are more documents on them etc. Although the Gen 1 is based off of the DSTB reference design, the Gen 2's are much closer (no reprogrammable fpgas!) At the moment, ive traced out the flash lines on the XA2, and need to get ahold of another Gen 2 box to dump the flash. Needless to say, removing tons of epoxy kinda destroyed the flash, which sucks, but shouldnt be too hard to fix! Namely since its directly connected to the southbridge, there should be no encryption etc, since the southbridge is not custom logic (unlike the gen 1)

29th March 2008, 02:18	#99 \| Link
sega32x Registered User Join Date: Feb 2007 Posts: 47	Well very nice! Its about time someone else did it. A few of us have had it for a while, but kept it hush hush due to the whole aacs thing. Considering that the player is dead now, not much hassle. For boot, it boots the kernel from the NOR flash on a BGA chip behind the XC2C256 chip iirc, its a tiny kernel and bootloader. There is a debug interface, but have yet to gain access. Check out the intel PDK kit, with a little tinkering you can compile an application to output to the on screen display. In regards to the update, the kernel image is encrypted, so you need to decrypt/crypt to take care of that. Ideally, a port of mplayer or the like would make this player great. It is possible to boot up the player WITHOUT the HD-DVD drive (software needs to be tinkered with, but its fairly simple). So we could throw in a HDD, and use it as a nice network media player, in time!