All Penbex manufactured Internet Radios working again!

We ( have finally created a solution that allows any Penbex manufactured Internet Radio to connect and use our database.

Previously, firmware updates were required but this is no longer the case.
Our new solution works with the original firmware! Penbex manufactured Internet radios for, among others:
Neon, Akira, IPMicro, König, DNT, Centrios, Amitech, Kingsun, Fenda, Odys, Olympia, Cobra MC609, Lafayette, Vega, Sabre, MPMan, IR9003, Kinyo, Sixpack, JW, Elton, Forworld and many other brands
These Internet radios were manufactured until the end of 2010 but they were sold long after 2010 by dealers and retailers.

If your Internet Radio was using the so called “WorldStation” Internet Radio portal located at  then it is for sure a Penbex Internet Radio and you can enjoy it again with our database.

Visit for more information, creating a personal favorites list and more things…

New firmware for Penbex Radios which will restore functionality!

A while ago the Worldstation server went down for good.
Yes, it will noit be back. The company is bankrupt and the erver is gone.
I have released new firmware for the Penbex radios that will restore functionality.
After the firmware upgrade you can use your radio again!

Firmware has been released for most models (among others: Centrios, Kenwin, IPMicro, Odys, Goodmans …), if a version for your model is not released then leave a message and I will get it done asap.

Penbex replacement firmware

The Taiwanese company Penbex has created several Internet radio models. The company went bankrupt and there is no longer any form of support for the devices that they created. These devices are sold under various brand names: DMTech, Watson, ctiradio, Joybien, eradio, KW-1004, HipShing, Goodmans, Proline, Neon, Clas Ohlson, Orchard, Yusan, Zylux, Logik, Sabre, MPMan, Uptoday, LA302, Olympia, Centrios, Amitech, Odys, Forworld2, Boom, VEGA, Pbirkit, IRM8001, Lafayette, DNT IPMicro, Akira, SL-D960, GP-60X, PBXBoom2-SI, Pbirkit2, Konig HAV-20/21/22 etc.
To know if your Internet radio is a Penbex device, a good indicator is that they used to connect to the “WorldRadio” portal.
We have modified firmwares for various models that will make your radio work with the ListenLive database.
Most recently a firmware for the König models has been released. Check for more information our website and forums on

Listenlive firmware

The “Listenlive” firmware is a replacement firmware for Internet Radio devices that are build by the Chinese company SkyTC and are sold under various brand names. SkyTC delivers these radios with a poor firmware and no real support. Also the database that these radios get their station lists from is often outdated.
Some of the popular brand names are Mediabox 135, Arnova WebRadio & TV, Xoro HMT350 HMT370, LinePro, Pearl Auvisio IPTV2335 (PX-8595), Wiwa eRTV208, Otek IPTV510, Envivo PO1119 PO1171 PO1235, Disgo TVGo, Vista Quest, Xenta KMP510, Foxman, Apex, Cayenne, Roxcore, Aigo, Lookeetv etc. The firmware offers many additional features compared to the original firmware. for more information and support questions visit our website


Technisat InternetRadio1 – Part 3

It turned out that there is another recovery possibility. By holding the reset switch and turning on power and keeping reset pressed for 8 more seconds I can get back into the recovery menu. I have reflashed the device and its working again. Now back to making modifications.
I am still looking for firmware files for the SMC WAA-G and Philips Streamium SL1100 firmwares.

Technisat InternetRadio1 – part 2

I managed to recover the IR1 through the serial console connection on the mainboard🙂.
This is the mainboard with the 4 pin serial console connector right between the digital audio out and RJ45 connector.
IR1 Mainboard
The photo is made without the mini PCI wifi board on it, but of course it is present.
I also found a picture of the SMC WAA-G mainboard which is nearly identical. This photo shows the mini pci wifi board.
SMC WAA-G mainboard
Anyway, after flashing the board with modified firmware it was clear that eventhough the flashing went successul it somehow ignored to take the most important changes (the redirections to It is possible to make these changes through the serial console and the server is already answering correctly as well but this is not the way to go as it is not very convenient to open the case, get a signal convertor board and connect to the serial console pins.

In the end it seems I killed the bootloader as the mainboard is again dead😦, this time I can also not access it through the serial console anymore.
So I either need to find a way to get JTAG access or I need to program the Spansion S29GL064 flash chip directly…
Too bad, as it seems I was minutes away from the solution.

Also, I am looking for an older version of the IR1 firmware. (older than the latest 6791 version) if you have it, please mail me.

Here is part of the console output when booting the IR1:
FLB running @ 24576000Hz; Flash Drivers: S29GL064MxR6/R7 detected
Starting Bootloader Level 1

Copyright 2000-2005 by BridgeCo AG, Duebendorf, Switzerland
Type Start End Size
Heap cached 0x60222860 0x60e00000 0x00bdd7a0/12441504
Heap non-cached 0x70600000 0x70800000 0x00200000/2097152
AHB0 cached 0x004015ec 0x00410000 0x0000ea14/59924
AHB0 non-cached 0x00500028 0x00510000 0x0000ffd8/65496
AHB1 cached 0x00416304 0x00417c00 0x000018fc/6396
AHB1 non-cached 0x00510000 0x00517c00 0x00007c00/31744
TCMD 0x00540e10 0x00542000 0x000011f0/4592
TCMI 0x00582cc4 0x00584000 0x0000133c/4924

Stacks Start End Size
timer 0x00540a10 0x00540e10 0x400/1024
supervisor 0x00540490 0x00540890 0x400/1024
user 0x00540890 0x00540a10 0x180/384
irq 0x00540330 0x00540490 0x160/352
fiq 0x6021c504 0x6021c524 0x20/32
undef 0x6021c484 0x6021c504 0x80/128

module: gpioModule
module: SysDevUart1
module: SysDevSPI
module: FlashDrivers S29GL064MxR6/R7 detected.
module: cneModule CnE from Flash
module: systemDataService
module: cneSystemDataMgr
module: UIServices
module: AudioHWService
module: HALCompatibilityService
module: chekovModule
module: _tcs_InternetRadio1_Board
module: PcmciaHal
module: StreamDeviceManager
module: StreamDeviceObserver
module: IsoStreaming
module: StreamDeviceAv
module: StreamDeviceArm
module: StreamDeviceDeframer
module: NetworkingSystemDataModule
module: NetworkDriverSystemDataModule
module: networking
Networking TCP/IP Stack
prep_ifaces() for iface 0: MAC-Address is: 00:11:22:33:44:xx
MACB Ethernet MAC interface
preped 2 interfaces, initializing…
wireless interface installed
initialized sysDataProxy on path sds://static/Networking/DrvStatus/WlanCfg/Mac
copying MAC address to persistent parameters
set PersParam MAC 00:11:22:33:44:xx
change net state to
module: NetCfgServiceSnap EIPCFG_DHCP_IN_PROGRESS
module: UPnPModuleService
module: StreamingFrmWrk
module: DataStreamManagement
module: StreamingFramer61883
module: ShoutcastStreamProcess
module: WMSClientProcess
module: MP3StreamProcess
module: WmaStreamProcess
module: WaveStreamProcess
module: LpcmStreamProcess
module: FramerStreamProcess
module: webserverModule
module: guardDevice
module: sdsShellModuleBoot code condition: secure
module: flashBurn
module: GenaService
module: SsdpClientstartup Webserver
Execute batch f
module: UpnpControlrom “cne/Shell/a
module: KeyCheck
module: NapModuleutoexec”
No leaf name “cne/Shell/autoexec” found
sdsShell ready for commands. Try “help” for help.
sds://>ShoutcastStreamProcessor: Could NOT retreive the Cardea Service !!!!
ShoutcastStreamProcessor: could not get DTCP service.
ShoutcastStreamProcessor: Could not get EF service.
module: NapModuleTest
module: Presets
module: Favourites
module: MultiRadioStationDBServiceMRSDBModule::createServices() size of the data
base = 4096 kB.
MultiRadioStationDBUpdate::MultiRadioStationDBUpdate: Registering service MRSDB0
module: LCDDisplayServiceL
module: ResourceManagerServiceCDDisplay initialized!
iOffset = 1332134 ISize = 7077760
module: InternetFwUpdater
module: WaveRadio2AppControl
Initializing Wr2_AppControl
LibraryVersion: APP:DMP3x_UI35/HW:EVM32 (Release)
LibraryBuildVersion: 6791 (2007-09-11 16:04:24)
LibraryCVSTag: waDMP_tcs_IntRadio1-1_0_0-6791_RC
module: LocalUi2UpnpAvDidlReader: cannot get DrmServiceManager
cannot get DrmServiceManager
UpnpAvDidlReader: cannot get DrmServiceManager
cannot get DrmServiceManager
UpnpAvDidlReader: cannot get DrmServiceManager
cannot get DrmServiceManager
upnpCpService.cpp(359) Could NOT retrieve the Cardea Service !!!!
IRInterpreter::registerIrHandler() successfully handled
UIFwEvtHandler::UIFwEvtHandler():register firmware update call back successfully
module: UPnPDevice
module: CheckAsserts
module: GenaServiceTest
module: modBroadcom11gCommand
module: webCfgBaseModule
module: webCfgAppModule
module: webCfgNetModule
module: modPersParamCommand
module: TestModuleTest
module: NapContentManagerTestSystem initialisation done.
Network driver #0 status: connected.
change net state to EIPCFG_DHCP_IN_PROGRESS
DHCP client: got address 192.168.x.x mask
change net state to EIPCFG_DHCP_FINISHED, IP address: 192.168.x.x
WaaSnapImpl(WaaSnapImpl.cpp[835]):TRACE WARNING:cipher is zero length string ->
default to TKIP
WaaSnapImpl(WaaSnapImpl.cpp[835]):TRACE WARNING:cipher is zero length string ->
default to TKIP
WaaSnapImpl(WaaSnapImpl.cpp[835]):TRACE WARNING:cipher is zero length string ->
default to TKIP

Technisat InternetRadio1 (IR1) work in progress..

Holidays are over so back to the projects.. I was able to get an IR1🙂
So far, I logged and analyzed Internet traffic and analyzed the firmware files.
It happens that the mainboard of the IR1 is a Bridgeco DM830 board which is close to what is used in some Philips (SL1100), Grundig and Terratec Noxon models.
I have already modified the server to correctly reply to the IR1’s inquireries. However, this was done by redirecting traffic and thus not a permanant solution.
In order to have the radios work in a regular way they need to be laoded with modified firmware.

Next I modified the firmware of the IR1 and tried to apply it but that crashed the radio. Right now it only displays “HTTP://…” when it tries to boot and then seems to hang.
I have removed the mainboard from the case and it is now waiting for the next step, a recovery through the serial console. I will post some photos and technical details as soon as possible.
More to follow..