loading

Serial/Console Interface for Video Brochure?

Hello All! 

I recently acquired one of those cheap video brochures (the kind that loops a video on full volume until you want to dash it against a wall)... Anyways, I couldn't resist the urge to hack with it, so I pulled the enclosure apart to expose the electronics. Inside I found a magnetic switch, a USB mini connector with all pins wired (two power/two data), a motherboard with three ICs and a scattering of other components, and a rechargeable battery (seems to be LiPo) all wired up to a 5.5" display. I plugged the usb to my computer and it mounted as a drive labeled "MediaPlayer". Inside was the original video file that I replaced with one of my own videos in the same format. It now plays my video with sound. Where I am stumped is with the circuit board. I have not found any markings on the board itself, however it has some pins around the edge to which the switch and speaker were connected to (I'm guessing these may be GPIOs.....). There is also an unpopulated four pin header (to the right of the display connector) that looks like it may possibly be for another USB port. There are also four solderable connections (on the bottom of the left side of the board) that are labeled GND, HRP, HRL, and DET... I wasn't able to find any meaning for those, but is it possible to establish communication through that? Last but not least, the three ICs on the board seem to be a CPU, and two flash chips.

The markings on the center one (which I'm assuming is the CPU) are:

F1
E200
F8148DA 19H1 

The second IC, to the right of the "CPU" is marked:

hynix 812A
HY5DU121622CTP-D43
KOR N7EAX553Q2 - also engraved with the letters JHY

The final IC, left of the "CPU" is marked:

hynix KOR
HY27UF082G2M
TPCB 604A
M8SD53321

According to Google, the E200 refers to the all winner E200 SoC that supports UART, SPI and TWI... It also says that it runs OS Melis 2.0...

I would like to hack into this system if possible and/or find a way to interface the LCD through SPI for my Pi Zero... Any help is greatly appreciated! Thanks! I included a couple of High Res photos to show the PCB (the display ribbon cable has been removed to show the third IC). 



Picture of Serial/Console Interface for Video Brochure?
_DSC6362.JPG
sort by: active | newest | oldest
RichardA1479 months ago

Joew79,

http://www.mikrocontroller.net/attachment/268937/F...

Also plug the device into a PC's usb connector, wait for the charge indicator on screen and then hit the pause button 4 times. You should then be able to access the device as usb storage.

HakatoX11 months ago

any progress on this?

This is the only source I have been able to find.

Any and all info would be appreciated.

JoeW79 (author)  HakatoX11 months ago

No luck yet; I'm still looking for info when I get time. As for the LCD, I have been trying to find a compatible Driver IC to use it for a Raspberry Pi or something similar. I'm starting to wonder if the flash tools online for the cheap USB smartwatches (yes, I ordered one of those too to hack around with) are compatible with this. If so, I might be able to get a dump from the flash memory and start trying to extract the software. Let me know if you find anything!

JoeW79 (author) 1 year ago

Another quick update:

I found a wiki page on the E200, that stated that one of the pads were actually a serial TX connection, so I hooked up my 3.3v FTDI Serial to USB adapter and fired up the serial monitor at 115200 baud while probing ground and the TX line and was able to pick up some text. This is what it read:

initializing SDRAM OK.

Succeed in opening nand flash.

Succeed in reading Boot1 file head.

The size of Boot1 is 0x0002e000.

current block is 2 and last block is 6.

current block is 3 and last block is 6.

The file stored in start block 2 is perfect.

Ready to disable icache.

Succeed in loading Boot1.

Jump to Boot1.

begin to init file system

mount successfully.

4444444444

can't find c:\apps\boot.axf

0

request BAT-DET pin!

Mount Parts Thread running.....

partition [D] plug in..

partition [Z] plug in..

Mount Parts Thread work now.....

partition [E] plug in..

Mount Parts Thread work end....

shell dsk_power_get_battery_level pbstatus.bat_vol = 3575

Execute startup script begin..............

Esh Error: OpenConfigFile y:\config\config.bin failed.

dsk_config_set_get(CONFIG_LABEL_VOLUME) = 28

...............Execute startup script end

Esh msg: shell main thread: Bye Bye!

The webpage did not specify any sort of RX connection, so it seems that this UART is read-only for now...

JoeW79 (author) 1 year ago

On a side note, I forgot to mention that I soldered another switch in place of the magnetic one.