HD-A1 Exploration / Repair (Standalone HD-DVD)

[awhitehead]

After re-reading the thread on HD-1100A not being able to read HD-DVDs under XP, and looking at the dates of the posts, I am convinced that the problem there was lack of UDF 2.5 drivers in the host operating system.

UDF 2.5 drivers for windows XP exist.

Take a look at http://uneasysilence.com/archive/2006/11/8303/ - they needed the UDF 2.5 drivers too, before xbox HD-DVD drive started to work with Windows XP and HD-DVDs.

[sega32x]

Well, at a last resort here, software is really starting to seem possibly like the hard way in. Anyone possibly have a scope that can ID some pins? (namely the two debug headers)

I'm nearly sure the upper one may be a serial port, it matches the same general pins that Toshiba used on an older model DVD player w/ serial port, but still investigating it, its not easy tracing a multilayer PCB !

The lower is mostlikely a JTAG to the NEC chip on the back (its function is unknown however)

Worse comes to worse, I can buy a hot air station, remove the BGA chip, read it, make a pinout to external pads, dump one from my working player, and go from there. (This would probably need to be coupled w/ a reflash of the HD-DVD drive, if it is tied, as they say, and also a replacement of the flash) so we would essentially have a bunch of cloned boxes, which still works for me.

Issue is however, that 32mb spansion is our bios, but does it have our crypto / bootloader etc in there, or is the bootloader in our launcher, thats about 4mb, which does fit for a very tiny linux kernel, busybox etc.

[awhitehead]

If i wait for the 2.1 update is it likely to reflash the drive firmware or just the os side of things?

This (http://www.avsforum.com/avs-vb/showthread.php?p=10202133&&#post10202133) post on avsforums indicates that indeed 2.1 firmware updates the drive firmware:

Well, going by lookings at, 2.0T is the new drive firmware (as Ive pulled a drive from a 2.0 model, thru a PC it shows revision at 2.0R, R S T) so we can assume a new one, and hopefully much more reliable!


I've not upgraded yet.

[sega32x]

Indeed, I saw that, and thats the new working theory, atleast on the bricked units, is that when the disk is in the drive, and it reboots after a reflash, it mucks (somehow) the reflash.

I know the drive has a debug output, as do many NEC drives, but as for the exact protocol to use, im not sure. Also incontact w/ the guys who wrote binflash, sent them some stuff, hopefully they will have support for the drive in a future version as well.

Also working on jtagging the pentium 4 itself, mabe get better access, able to step thru code, dump memory (or the flash itself), Out of the 5 jtag pins, 3 are accessible on the underside, the other two, need to tap into the processor itself (vs the socket) which will be very fun to do (one is on the edge = easy, other is in the middle = tough!)

Ideally, a Socket 478 interposer would be great, but alas, havent found one for sale (yet).

Worst case scenario, I drop the money on a hot air rework station, pull the BGA chip, trace a pinout, dump the flash of the working unit, do the same to the HD-DVD drive, but thats nuts.

Looking at the kernel modules however, kills me, modules for the broadcom chip, southbridge, audio controllers, EVERYTHING, this unit will be amazing to play with in time, but we just cant get into it , yet!

Edit: It also seems like on a non working unit (or a bad flash etc), it searches the usb stick around every 30sec - 1 min for a file. I am wondering if its a failsafe for reflashing, alas I am not sure how to monitor and log USB activites!

[awhitehead]

*sigh*

[sega32x]

I was just gonna reply that the new binflash has dumping support, and I was dumping both my drives for a compare (to possibly find a key)

[awhitehead]

I would be very interested in looking at the flashdump.

[awhitehead]

What is somewhat amusing is that Toshiba software reports itself as GPL.

Joys of corporate license violations... Just spent about about thirty minutes on gpl-violations.org Lots of people with too much spare time there.

(For the record, I don't care other then find it amusing)

[sega32x]

Really? I love how toshiba never responded to anyones GPL requests, which is something, but I dont think any of us has the cash to go up against Toshiba in a court!

[awhitehead]

So is the support for the NEC HD-1100A drive is in the latest binflash?

Since I am out of ideas, I am toying around with an idea of opening the player, and moving the drive into a PC. Sadly she who must be obeyed is not thrilled by the idea of cannibalizing a working piece of expensive AV gear.

[sega32x]

Heh, yeah, it is supported (read only for now apparently), hopefully write support will be soon (clone drives anyone!)

[gonesuper]

Sorry its been a while since i posted, been busy with work. Got a few updates to list. Got my RCA fixed by removing the bios battery to clear all settings then booting up using a hr-1100a from a mates machine. i then hot swapped my drive and performed a network update to 2.1.

Since then i've went back to 2.0 using the iso on 1080x1920.net with no problems and all functions of the player work fine.

Later on tonight i'll reupdate to 2.1 and dump the new drive firmware and hopefully post the results along with any windows compatibalty changes if present.

Been able to dump the firmware using liggys testdump.exe tool but the output has only been something that liggy can work untill now. Hopefully with the full binflash dump the firmware can be edited and made rpc1.

According to this post (http://www.videohelp.com/dvdhacks.php?select=Toshiba+HD-A1) the player will play a non region 1 disc if the drives region setting is changed so a rpc1 patch should be a step in the right direction

[sega32x]

You got your RCA fixed? Very nice! So it did the whole "freeze on welcome screen" thing, you pulled the battery, booted w/ a secondary drive, and that worked? (and you did the hotswap for the repair)

If so, kudos to you, I may have to try that myself!

The new Binflash (1.39) does dump the FW fine, problem is, it cant write it back, yet!

[gonesuper]

yeah i'd been told that hooking up any other connection (i use hdmi) and hitting v.output on the remote remote can solve the welcome message crash but i figured that mine was more than a handshake issue.

esp since i'd blown out most of the power psu.:devil:

with my player after i'd removed and resolidered the cmos battery it would begin to boot, i could see the activity light on the usb storage rom go mad but it would just hang with welcome on the screen. the rca didn't accept any remote or front button presses. so the v.output fix didn't work but with the other drive connected the player booted. couldn't get any movies to work but all the menus seemed fine.

i then used a y splitter on the drives power supply and hot swapped the drive when all usb activity had stopped. after that it was easy enough to update the firmware which seem to sort the drive out.

The player is working 100% now. Ended up finally watching V for Vendetta on it late last night. I'd promised myself i wouldn't rent the DVD out as it was the main drive in fixing the player. It was def worth the wait. The only other HighDef player i have is a ps3 which, until i saw the output from my rca side by side, had impressed me. The rca def handles things a lot more cleanly. On the ps3 i'd noticed some blocking on superman returns which isn't there on the hd-dvd edition

As far as binflash goes, i'd been following liggys progress with it. He sent me the testdump.exe file which produced a dump but was no real use to me or him as the drive was wrecked in the first place. i was hoping others with a working drive would follow the same route which is what happened with sega32x (thanks for that btw) and ended up with dump support in 1.39.

Liggy works fast so i'm sure write support wont be too far away when dumped firmware appears. I'll dump the new 2.1 drive image when i get my xp machine back over the weekend. tried it last night on vista but it was a no go.

Very thankfull for all ur help. Google searches on this player doesn't turn up much. if u want any linux dumps of my player then i'd be glad to help.

I'm a linux noob but learn quite quickly and i'm finding that i remember more from my dos days than i thought. the RCA has a rs232 port on it which i think the xa1 is missing, don't know if it will help u guys out but if u need any more info on it then talk me thru it and i'll upload the outcome. hopefully get the hr-1100a dump on sunday night.

:thanks:

[bshep]

I was wondering if any more work has been done in exploring the hack-ability of the linux based players.

I dont have one but I do have some knowledge of how linux works and one thing seemed to jump at me when I saw the file listings. The libz library, if that is used by the OS that is probably easier to hack than libpng and libjpeg since its is much simpler ( and probably has less dependancies )

Anyway I'm thinking of getting one of these players just to mess around with it, are there any models to stay away from ( i.e. any that have been know to have been updated to be less hackable ).

I should also add that this discussion has been very interesting ;-)

Some other questions:
- What architecture are the players based on? ( I think I read Pentium 4, but just to be sure)
- Has anyone tried replacing any of the libs with a custom build (and had a successfull boot)?
-- If so, anyone tried adding fopen('/var/testfile') and then checked to see if the file was created on the usb drive(asuming it is mounted read/write when the system boots)?

[sega32x]

Well gonesuper, your way worked, I just did it here, and it got the player revived (will go into details later), although it wont play any DVD's ("A system error has occured"), or HD-DVD (The drive motor = fubar, disk wabbles too much when the HD-DVD is in), but alas , it boots!

Still need to get a longer FFC cable to replace the one there (it came cut), as well as fix the motor, but, it boots :)

[luipic]

Firt i apologize for my poor english, i'm from Italy.

Please, help.
My hd-a1 just frozen upgrading to 2.1, going back to 2.0 and then reupdating to 2.1 all seems ok and i get the massage 2.10 in, but powering up now i get 01-system error and my player freezes.
I opened the player and i see on the flash memory a red led flashing. I also tried to unplug the cmos battery, but nothing changes.
What can i do? i don't have another player to swap my drive.

Thanks and regards
Luigi

[luipic]

Please, anyone will be so kind to send me a dump of the drive firmware so, when bin flash will allow to write, i'll try to flash the drive of my dead player.
Thanks
Luigi

[sega32x]

The issue is , even that wont work, yet. I am in the same boat, though mine does not error, but it refuses to play any VIDEO disks, due to some type of mismatch (after the reflash/hotswap etc).

Nevertheless, what is yours doing? are you getting any picture on the screen? or is it the fun "Welcome" bug?

[luipic]

First 01-sistem error on the display, then welcome.
Thanks
Luigi

[sega32x]

Well, if your curageous, unplug the HD-DVD drive, and remove the flash, if it still does it, your basically screwed, if not, you have hope! As if it says the error before anything, it could be the data on the main board, and there is no current way to fix that (short of removing a 64 ball bga chip from two boxes, cloning one, if thats even possible, etc)

[luipic]

I've got the error message after 1 min that the player load from the flash memory.
I already tried to un plug everything
Regards
Luigi

[FrankRizzo890]

Do you guys know of anywhere that I can get a dump of the USB "Disk on a chip"? I'm both a Linux programmer, and a good reverse engineer, and I'd LOVE to have a look in there, and "see what I can see."

[mdray]

Well, if your curageous, unplug the HD-DVD drive, and remove the flash, if it still does it, your basically screwed, if not, you have hope! As if it says the error before anything, it could be the data on the main board, and there is no current way to fix that (short of removing a 64 ball bga chip from two boxes, cloning one, if thats even possible, etc)

Hi.
Firstly, apologies for jumping straight in with a request for help.

I have an A1 which froze after downloading 2.2 firmware. It completed successfully and powered down. When I rebooted, I got the welcome screen followed by the message "system error 01".
The only way to switch it off now is via the button push on the front panel, pressing for 10 seconds. With the cover removed I can see the led flashing red on the Daughterboard? during bootup.

I did then remove the "daughterboard" and booted up to see what would happen. With that removed I get the welcome screen permanently displayed.

Tosh USA can't help me because I'm in England.

Can anyone give me some advice please?

[awhitehead]

Hi.
Firstly, apologies for jumping straight in with a request for help.

I have an A1 which froze after downloading 2.2 firmware. It completed successfully and powered down. When I rebooted, I got the welcome screen followed by the message "system error 01".
The only way to switch it off now is via the button push on the front panel, pressing for 10 seconds. With the cover removed I can see the led flashing red on the Daughterboard? during bootup.

I did then remove the "daughterboard" and booted up to see what would happen. With that removed I get the welcome screen permanently displayed.

Tosh USA can't help me because I'm in England.

Can anyone give me some advice please?


Daughter board contains, amongst other things, the images necessary for the menu system to operate, libraries necessary to decode and display the .png files, and persistent storage file.

Thus it would make sense that the system will freeze if it can't find the graphic elements of the images that you have to display.

You can try downloading the 2.0 firmware image from http://www.1080x1920.net/ , burning it to CD, and attempting a downgrade. However, chances are high that it will not work, since it's my understanding that you need to get the "No disc" prompt, before you can do a downgrade.

sega32x was successful in figuring out that in order to resurrect a system you need both the HD-DVD drive and the internal flash, since the encrypted files are keyed to the serial number of the drive.

Were you to have a second HD-A1 unit, a complicated shuffling of drives and daughterboards together with copious flashing might have gotten you somewhere, if it's the files on the flash daughterboard that are corrupt, but chances are slim...

I am idely curious: Isn't it 110 volts in USA, and 220 volts in UK? Are you running HD-A1 through a transformer?

Oh, another thing that just came to mind. Try calling Robert at http://www.valueelectronics.com/ in the States. People on AVSforum are very fond of him. See if he will repair your unit for you if you ship it to US, and pay him for return shipping. He is authorized to service Toshiba products. Yes, it's expensive, but it's likely cheaper then a new unit.

[mdray]

Thanks for your advice.

Yes, I am using a step down converter for the power supply. Also, I did try loading firmware disc 2.0, but as you say, I need to get past the welcome screen and the 01 error.

Toshiba USA did say they would repair it if I shipped it over, but it's not worthwhile. It would cost around $150 to ship it there and back, I think.

[sega32x]

Well actually, one one of mine (the USB stick isnt big enough to hold everything , like 252mb vs 256), none of the bootup images display, however it does still work, there is also a blink pattern to the daughterboard as well, sounds insane, but true.

As awhitehead said, the best way to do it, is to get someone elses drive and daughterboard , stick em in yours, boot up, run the update (from net), hotswap the drives, and be all set, of course, reimage the daughterboard first, so the other player does not brick (you can also just image it to a usb key etc).

Issue is, I did that too, though it still will not play HD-DVD's, but its a drive issue (the drive wont pass AACS verification), however, hopefully you will not have the same problem!

Ideally, in the future, if we had a way to boot a "universal" dvd/flash, we would be set, but nothing of that sort, atleast not yet!

[mdray]

Thanks for your advice.

So it couldn't be done just by swapping the daughterboard then? Booting it up with another daughterboard, then switching them once it's booted, to allow access to the set-up options. Then running the firmware disc? I would need another drive too?

Sorry, I should have read the post properly. I see why you need two drives. Doh!

[sega32x]

Yeah, like you read, it wont, as the data on the daughterboard is tied to something in the HD-DVD drive!

[FrankRizzo890]

So no takers? No suggestions on where I can find it?

We might be able to break the ties between the software, and the drive through my investigations.

[awhitehead]

@FrankRizzo

For what it's worth, it's widely believed that the data on the first generation Toshiba units is encrypted, with each image being tied to the hardware. Since replacing both drive and flash at the same time seems to fix it, it's most likely that the serial number (or some similar identifier) of the drive is used to encrypt the files on the flash.

So an image would be rather useless to you without the rest of the hardware.

[sega32x]

Nope, see, all of the goodies are encrypted on the usb flash (hddvd player, dvd player, cd player, setup, update, scripts, everything)

And that site, the majorty of the code wasnt anything useful, IE strings about the filesystem (which isnt encrypted, just the contents are!)

The only things not encrypted are just a few, any of the images (for the GUI), and the error messages, ie "THIS DISK CANT BE PLAYED".

Seems the A2's, atleast as the service manual states, are based somewhat off Windows CE, if you want a hole, thats probably got plenty :D

[awhitehead]

Seems the A2's, atleast as the service manual states, are based somewhat off Windows CE, if you want a hole, thats probably got plenty :D

Is it Windows CE based? I was thinking about picking up an HD-A2. *sigh* Is the manual available as a PDF from Toshiba?


Edit: HD-A1, HD-XA1, HD-A2, HD-XA2 manuals are all availble from http://209.167.114.38/support/ceg/manuals/ (press 2006 -> HD-DVD for firsg gen, 2007 -> HD-DVD for second gen units)

Edit2: Page 61 of the 72 page user manual for HD-A2 states:
"License information on the software used in Toshiba HD-DVD player"

Pre-installed software EULA Pre-installed software EULA
Linux Kernel Busybox Exhibit A
glibc Exhibit B
OpenSSL Exhibit C
freetype Exhibit D

Various exhibits are the apropriate licenses - GPL, LGPL, OpenSSL license, and Freetype license.

Thus I suspect that HD-A2 is also Linux based.

[sega32x]

Ironically, the service manual says the -2's are CE based, so now with what you found, I am not sure which it is!

[arnezami]

Has anybody here spoken to Boing99 lately? I'm trying to contact him. :).

[natronicus]

With the HD-A2's now selling for $98, anyone planning on reviving this project?

[sega32x]

Would love to, but dont have any funds for an A2. Id love to get my hands on a broken one tho (any GEN2 player).

Namely, the debug access alone should be a bit easier (real chips vs unknown xilinx chips). If anyone wants to sell a broken one (or a working one cheap), do let me know.

Nevertheless, the fate of my original unit, it did work again, did not play movies (the drive was hosed), however I used it for parts to fix two other units, and they both work great!

[evdberg]

I had some contact with awhitehead some time ago and he claimed that he had succeeded to get his Xbox360 drive to work with the HD-A1. When I asked him how to do this, his reply was that he could explain it to me but it was of no use since it did not work with AACS. This ofcourse is true, since the NEC drive uses KCD and not the authentication through RSA certificates like the 2nd gen and Xbox does.

Now since my problem is that the HD-A1 does not play my homebrew disks correctly, I was pretty interested in his solution. Unfortunately I never got word from him again. Now with the current situation that Toshiba has given up on HD-DVD, getting a replacement drive to work with the player has even more interest. The drive is the weakest part of the whole player, so it is pretty interesting to be able to use another one.

Unfortunately I have not much experience in Linux, and am not much of a hacker. Is there anybody who has any clue how to do this?

[Zotty]

No help, but a partially overlapping problem; I'm trying to get into a HD-EP30 (http://forum.doom9.org/showthread.php?t=135265). My primairy target is the firmware. It's encrypted, so that's a major problem, but the thought it that once we can get into the firmware (maybe same encryption or method), it might be possible to modify it to play homebrew discs, change DVD region, hack AACS, etc.. May or may not be possible, but it would allow you to make homebrew discs works by changing firmware instead of modifying the hardware.

[batteryman]

You know what would be awesome is if you could just drop in a blu-ray drive. any of you tried just installing a plain old dvd-rom drive? I just got a hd-a1 today.

[sega32x]

I think the best goal is as a streaming media server (even drop in a hard disk)

On the hardware side that is fairly easy (just solder in a new pad, some resistors), which i have done. Or even easier, use a USB hdd. The larger issue is compiling software to run on the box!

[batteryman]

yeah I would even be willing to pay for the software. Toshiba just needs to release the update :D. I mean why not if their format is dead in the water. Then I could still have some use for it. Come on Toshiba!

[batteryman]

BUMP, come on guys! do you have any solutions?

[sega32x]

I have been tinkering with my XA2 as of late, the hardware is a bit more standard (no more mystery FPGA's). Attempting to dump the flash (boot), but my adapter is being flakey. There is a JTAG and UART for the REON (CNP01 and CNP02), uart even outputs some nice stuff. Still searching for one for the actual player (it should be on here, somewhere)

Anyone got a LA/Scope and wanna take a peek?

[batteryman]

So it sounds like things are more standardized and easier to get at on it?

[sega32x]

Well yes, since the Gen 2's are much closer to the DSTB reference design than the Gen 1's, there are more documents on them etc. Although the Gen 1 is based off of the DSTB reference design, the Gen 2's are much closer (no reprogrammable fpgas!)

At the moment, ive traced out the flash lines on the XA2, and need to get ahold of another Gen 2 box to dump the flash. Needless to say, removing tons of epoxy kinda destroyed the flash, which sucks, but shouldnt be too hard to fix!

Namely since its directly connected to the southbridge, there should be no encryption etc, since the southbridge is not custom logic (unlike the gen 1)

[Sechrist]

Well, this thread seems pretty much dead now.
Anywhos..

I was able to gain a root shell and install dropbear on my HD-A1 and RCA-HDV5000 units.

Your suspicions with key-signed files were close, the problem with swapping without swapping both the uDoC and the HD-DVD drive is that the binaries that the linux system executes to load the actual "player" are encrypted with the AACS key from the IDE device itself.

However, the kernel is NOT on the filesystem that the linux mounts from the 32mB rom chip. I think it is loaded into memory on boot each time. The only way we can get our /etc/ and important linux changes to stick is to reverse engineer the update process(well, excluding actually flashing it with an external programmer, which I would want anyway to not brick my units!).

I managed to get a lighttpd running on it, just for funsies. (http://chasesechrist.com/).

Here's some general information about the system:
[Linux:Ash30]$cat /etc/passwd
root:EDITED OUT:0:0:root:/tmp:/bin/sh
bin:x:1:1:bin:/bin:
daemon:x:2:2:daemon:/sbin:
adm:x:3:4:adm:/var/adm:
lp:x:4:7:lp:/var/spool/lpd:
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:
news:x:9:13:news:/var/spool/news:
uucp:x:10:14:uucp:/var/spool/uucp:
operator:x:11:0:operator:/root:
games:x:12:100:games:/usr/games:
gopher:x:13:30:gopher:/usr/lib/gopher-data:
ftp:x:14:50:FTP User:/home/ftp:
nobody:x:99:99:Nobody:/:

[Linux:Ash30]$mount
/dev/root on / type ext2 (rw)
/proc on /proc type proc (rw,nodiratime)
/sys on /sys type sysfs (rw)
/proc/bus/usb on /proc/bus/usb type usbfs (rw)
/dev/sda1 on /mnt/ROM type ext2 (rw,sync)
/dev/loop0 on /mnt/ROM/HD_DVD type vfat (rw,sync,nodiratime,fmask=0022,dmask=0022,shortname=mixed)
/dev/loop1 on /mnt/ROM/NetArea type vfat (rw,sync,nodiratime,fmask=0022,dmask=0022)
none on /dev/pts type devpts (rw)
[Linux:Ash30]$

(/dev/root doesn't exist, it's a pseudo device.)

[Linux:Ash30]$cat /proc/cpuinfo
processor : 0
vendor_id : GenuineIntel
cpu family : 15
model : 2
model name : Mobile Intel(R) Pentium(R) 4 - M CPU 2.50GHz
stepping : 9
cpu MHz : 2499.914
cache size : 512 KB
fdiv_bug : no
hlt_bug : no
f00f_bug : no
coma_bug : no
fpu : yes
fpu_exception : yes
cpuid level : 2
wp : yes
flags : fpu vme de pse tsc msr pae mce cx8 sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe cid xtpr
bogomips : 4947.96


[Linux:Ash30]$busybox
BusyBox v1.00 (2005.09.13-00:20+0000) multi-call binary

Usage: busybox [function] [arguments]...
or: [function] [arguments]...


[Linux:Ash30]$uname -a
Linux (none) 2.6.10-R040 #20 Mon Mar 20 09:43:01 JST 2006 i686 unknown

[Linux:Ash30]$lspci -i ./pci.ids
00:00.0 Host bridge: Intel Corporation Unknown device 358c (rev 02)
00:00.1 System peripheral: Intel Corporation 82852/82855 GM/GME/PM/GMV Processor to I/O Controller (rev 02)
00:00.3 System peripheral: Intel Corporation 82852/82855 GM/GME/PM/GMV Processor to I/O Controller (rev 02)
00:02.0 Display controller: Intel Corporation Unknown device 358e (rev 02)
00:1d.0 USB Controller: Intel Corporation 82801DB/DBL/DBM (ICH4/ICH4-L/ICH4-M) USB UHCI Controller #1 (rev 03)
00:1d.1 USB Controller: Intel Corporation 82801DB/DBL/DBM (ICH4/ICH4-L/ICH4-M) USB UHCI Controller #2 (rev 03)
00:1d.2 USB Controller: Intel Corporation 82801DB/DBL/DBM (ICH4/ICH4-L/ICH4-M) USB UHCI Controller #3 (rev 03)
00:1d.7 USB Controller: Intel Corporation 82801DB/DBM (ICH4/ICH4-M) USB2 EHCI Controller (rev 03)
00:1e.0 PCI bridge: Intel Corporation 82801 Mobile PCI Bridge (rev 83)
00:1f.0 ISA bridge: Intel Corporation 82801DBM (ICH4-M) LPC Interface Bridge (rev 03)
00:1f.1 IDE interface: Intel Corporation 82801DBM (ICH4-M) IDE Controller (rev 03)
00:1f.3 SMBus: Intel Corporation 82801DB/DBL/DBM (ICH4/ICH4-L/ICH4-M) SMBus Controller (rev 03)
00:1f.5 Multimedia audio controller: Intel Corporation 82801DB/DBL/DBM (ICH4/ICH4-L/ICH4-M) AC'97 Audio Controller (rev 03)
01:08.0 Ethernet controller: Intel Corporation 82801DB PRO/100 VE (LOM) Ethernet Controller (rev 83)
01:09.0 Bridge: Broadcom Corporation Unknown device 7411
01:0b.0 Multimedia controller: Toshiba America Info Systems Unknown device 0419
01:0b.1 Multimedia controller: Toshiba America Info Systems Unknown device 041a
01:0b.2 Multimedia controller: Toshiba America Info Systems Unknown device 041b
01:0c.0 System peripheral: Toshiba America Info Systems TC6371AF SmartMedia Controller (rev 06)
[Linux:Ash30]$

I haven't tried getting the AC'97 to work, and the graphics chips seem to be proprietary :(

If anybody here is interested in helping, has any questions, or is a programmer/general hacker willing to help, please contact me on AIM (sekhrist).

PS: I got in with libcdaudio at first, then later got in with libpng(so I didn't have to have a CD in the tray).
I just recompiled the libraries and dropped them on my flash drive(which I DD'd from the original, so it was a exact bit-per-bit match).

PSS: http://www.remotecentral.com/cgi-bin/mboard/rc-touch/thread.cgi?1160 for serial port control. It won't give you a shell, but it's neat to tinker with!

PSSS: http://i25.tinypic.com/2lksc9k.jpg

[laserfan]

Well, this thread seems pretty much dead now....If anybody here is interested in helping, has any questions, or is a programmer/general hacker willing to help, please contact me..Yeah I think you're very "bleeding edge" with this, it's way over my head, but thought I'd post some words of encouragement anyway:

I'm Impressed! :)

[sega32x]

Well very nice! Its about time someone else did it. A few of us have had it for a while, but kept it hush hush due to the whole aacs thing.

Considering that the player is dead now, not much hassle.

For boot, it boots the kernel from the NOR flash on a BGA chip behind the XC2C256 chip iirc, its a tiny kernel and bootloader.

There is a debug interface, but have yet to gain access.

Check out the intel PDK kit, with a little tinkering you can compile an application to output to the on screen display.

In regards to the update, the kernel image is encrypted, so you need to decrypt/crypt to take care of that.

Ideally, a port of mplayer or the like would make this player great. It is possible to boot up the player WITHOUT the HD-DVD drive (software needs to be tinkered with, but its fairly simple). So we could throw in a HDD, and use it as a nice network media player, in time!

[Sechrist]

Oh wonderful!

How are you able to change the boot process to boot without the drive in? I've been working on a cable to get a slave device in, as well.

As far as I know, the only problem with it booting without the dvd drive in is that it needs it to decrypt the actual player with the key from the drive. Are you able to get permanent storage on it(On the chip, not the uDoC)?

Originally before I even bought the thing, I was hoping I could port XBMC linux to it, and with the PDK it might be possible with a good bit of work.
I was planning to set up MPD on it as soon as I got the AC'97 working.
Is it standard AC'97, and alsa will work?