Monthly Archives: August 2010

Technisat InternetRadio1 – Part 3

It turned out that there is another recovery possibility. By holding the reset switch and turning on power and keeping reset pressed for 8 more seconds I can get back into the recovery menu. I have reflashed the device and its working again. Now back to making modifications.
I am still looking for firmware files for the SMC WAA-G and Philips Streamium SL1100 firmwares.

Technisat InternetRadio1 – part 2

I managed to recover the IR1 through the serial console connection on the mainboard :).
This is the mainboard with the 4 pin serial console connector right between the digital audio out and RJ45 connector.
IR1 Mainboard
The photo is made without the mini PCI wifi board on it, but of course it is present.
I also found a picture of the SMC WAA-G mainboard which is nearly identical. This photo shows the mini pci wifi board.
SMC WAA-G mainboard
Anyway, after flashing the board with modified firmware it was clear that eventhough the flashing went successul it somehow ignored to take the most important changes (the redirections to listenlive.nl). It is possible to make these changes through the serial console and the server is already answering correctly as well but this is not the way to go as it is not very convenient to open the case, get a signal convertor board and connect to the serial console pins.

In the end it seems I killed the bootloader as the mainboard is again dead :(, this time I can also not access it through the serial console anymore.
So I either need to find a way to get JTAG access or I need to program the Spansion S29GL064 flash chip directly…
Too bad, as it seems I was minutes away from the solution.

Also, I am looking for an older version of the IR1 firmware. (older than the latest 6791 version) if you have it, please mail me.

Here is part of the console output when booting the IR1:
FLB running @ 24576000Hz; Flash Drivers: S29GL064MxR6/R7 detected
Starting Bootloader Level 1

Copyright 2000-2005 by BridgeCo AG, Duebendorf, Switzerland
Type Start End Size
Heap cached 0x60222860 0x60e00000 0x00bdd7a0/12441504
Heap non-cached 0x70600000 0x70800000 0x00200000/2097152
AHB0 cached 0x004015ec 0x00410000 0x0000ea14/59924
AHB0 non-cached 0x00500028 0x00510000 0x0000ffd8/65496
AHB1 cached 0x00416304 0x00417c00 0x000018fc/6396
AHB1 non-cached 0x00510000 0x00517c00 0x00007c00/31744
TCMD 0x00540e10 0x00542000 0x000011f0/4592
TCMI 0x00582cc4 0x00584000 0x0000133c/4924

Stacks Start End Size
timer 0x00540a10 0x00540e10 0x400/1024
supervisor 0x00540490 0x00540890 0x400/1024
user 0x00540890 0x00540a10 0x180/384
irq 0x00540330 0x00540490 0x160/352
fiq 0x6021c504 0x6021c524 0x20/32
undef 0x6021c484 0x6021c504 0x80/128

module: gpioModule
module: SysDevUart1
module: SysDevSPI
module: FlashDrivers S29GL064MxR6/R7 detected.
module: cneModule CnE from Flash
module: systemDataService
module: cneSystemDataMgr
module: UIServices
module: AudioHWService
module: HALCompatibilityService
module: chekovModule
module: _tcs_InternetRadio1_Board
module: PcmciaHal
module: StreamDeviceManager
module: StreamDeviceObserver
module: IsoStreaming
module: StreamDeviceAv
module: StreamDeviceArm
module: StreamDeviceDeframer
module: NetworkingSystemDataModule
module: NetworkDriverSystemDataModule
module: networking
Networking TCP/IP Stack
prep_ifaces() for iface 0: MAC-Address is: 00:11:22:33:44:xx
MACB Ethernet MAC interface
preped 2 interfaces, initializing…
wireless interface installed
initialized sysDataProxy on path sds://static/Networking/DrvStatus/WlanCfg/Mac
MacAddressCopier::updateObserver
copying MAC address to persistent parameters
set PersParam MAC 00:11:22:33:44:xx
change net state to
module: NetCfgServiceSnap EIPCFG_DHCP_IN_PROGRESS
module: UPnPModuleService
module: StreamingFrmWrk
module: DataStreamManagement
module: StreamingFramer61883
module: ShoutcastStreamProcess
module: WMSClientProcess
module: MP3StreamProcess
module: WmaStreamProcess
module: WaveStreamProcess
module: LpcmStreamProcess
module: FramerStreamProcess
module: webserverModule
module: guardDevice
module: sdsShellModuleBoot code condition: secure
module: flashBurn
module: GenaService
module: SsdpClientstartup Webserver
Execute batch f
module: UpnpControlrom “cne/Shell/a
module: KeyCheck
module: NapModuleutoexec”
No leaf name “cne/Shell/autoexec” found
sdsShell ready for commands. Try “help” for help.
sds://>ShoutcastStreamProcessor: Could NOT retreive the Cardea Service !!!!
ShoutcastStreamProcessor: could not get DTCP service.
ShoutcastStreamProcessor: Could not get EF service.
module: NapModuleTest
module: Presets
module: Favourites
module: MultiRadioStationDBServiceMRSDBModule::createServices() size of the data
base = 4096 kB.
MultiRadioStationDBUpdate::MultiRadioStationDBUpdate: Registering service MRSDB0
1UpdateService
module: LCDDisplayServiceL
module: ResourceManagerServiceCDDisplay initialized!
iOffset = 1332134 ISize = 7077760
module: InternetFwUpdater
module: WaveRadio2AppControl
————————————————————
Initializing Wr2_AppControl
————————————————————
LibraryVersion: APP:DMP3x_UI35/HW:EVM32 (Release)
LibraryBuildVersion: 6791 (2007-09-11 16:04:24)
LibraryCVSTag: waDMP_tcs_IntRadio1-1_0_0-6791_RC
————————————————————
module: LocalUi2UpnpAvDidlReader: cannot get DrmServiceManager
cannot get DrmServiceManager
UpnpAvDidlReader: cannot get DrmServiceManager
cannot get DrmServiceManager
UpnpAvDidlReader: cannot get DrmServiceManager
cannot get DrmServiceManager
upnpCpService.cpp(359) Could NOT retrieve the Cardea Service !!!!
IRInterpreter::registerIrHandler() successfully handled
UIFwEvtHandler::UIFwEvtHandler():register firmware update call back successfully
module: UPnPDevice
module: CheckAsserts
module: GenaServiceTest
module: modBroadcom11gCommand
module: webCfgBaseModule
module: webCfgAppModule
module: webCfgNetModule
module: modPersParamCommand
module: TestModuleTest
module: NapContentManagerTestSystem initialisation done.
Network driver #0 status: connected.
change net state to EIPCFG_DHCP_IN_PROGRESS
DHCP client: got address 192.168.x.x mask 255.255.255.0
change net state to EIPCFG_DHCP_FINISHED, IP address: 192.168.x.x
WaaSnapImpl(WaaSnapImpl.cpp[835]):TRACE WARNING:cipher is zero length string ->
default to TKIP
WaaSnapImpl(WaaSnapImpl.cpp[835]):TRACE WARNING:cipher is zero length string ->
default to TKIP
WaaSnapImpl(WaaSnapImpl.cpp[835]):TRACE WARNING:cipher is zero length string ->
default to TKIP

Technisat InternetRadio1 (IR1) work in progress..

Holidays are over so back to the projects.. I was able to get an IR1 🙂
So far, I logged and analyzed Internet traffic and analyzed the firmware files.
It happens that the mainboard of the IR1 is a Bridgeco DM830 board which is close to what is used in some Philips (SL1100), Grundig and Terratec Noxon models.
I have already modified the server to correctly reply to the IR1’s inquireries. However, this was done by redirecting traffic and thus not a permanant solution.
In order to have the radios work in a regular way they need to be laoded with modified firmware.

Next I modified the firmware of the IR1 and tried to apply it but that crashed the radio. Right now it only displays “HTTP://…” when it tries to boot and then seems to hang.
I have removed the mainboard from the case and it is now waiting for the next step, a recovery through the serial console. I will post some photos and technical details as soon as possible.
More to follow..