[020] LKV373 Update - GCC for the IT9919
Вставка
- Опубліковано 26 сер 2024
- In this series I will be hacking around with the IT9919 media processor that powers the Lenkeng LKV373 HDMI Extender Device and the EZCAP 283S which were reviewed in previous videos.
In this video I investigate the booting mechanism to try and uncover the mystery of the SMAZ compressions scheme and checksum.
Show Notes: opentechlab.or...
Twitter: @OpenTechLabChan
Mastadon: @opentechlab@mstdn.io
SubscribeStar: www.subscribes...
PayPal: www.paypal.me/...
Bitcoin: 18CU9LxwRuiLHy9HsuMj2vzobbW4J3QVC2 - Наука та технологія
![[016] IT9919 Hacking - part 1 - Reading firmware with flashrom](http://i.ytimg.com/vi/j7JRosD_ua8/mqdefault.jpg)
![[016] IT9919 Hacking - part 1 - Reading firmware with flashrom](/img/tr.png)
![[003] LKV373A: a $40 HDMI capture solution?](http://i.ytimg.com/vi/SAvGylthpkU/mqdefault.jpg)
![[002] Testing the Linux Kernel driver for the Lattice iCE40 FPGA](/img/n.gif)
When opentechlab posts a video, I stop everything and watch carefully. Thanks for not doing the 10 minute format and going deep into the details in every video.
Oh man, you really have the best content ano UA-cam. We miss you. Hope you got more time to continue
Hope you are well. Looking forward to you next video! :)
Looking forward to your return!
just subscribed to this channel to find out its dead. what a shame, such fantastic content presented in such great way. I hope author is just too busy and it is just loooong break, not complete end of such promising channel.
I would love to see one of these random devices be reprogrammed with some really basic video input, and output to a simple stream on an Ethernet port. Like the hardware you originally showed us. This would be a great learning tool, and would also be useful for those who are restricted budget wise, and willing to put the elbow grease into making it do what we want.
If they have a HD1080P High Refresh Rate version, I would be interested in seeing what it's capable of doing, it's processor has to be pretty decent.
Please keep going, and don't spare us the details, this is amazing stuff.
If we can build some momentum around these chips, they would be useful for lots of interesting projects. An open source firmware for these devices could unlock some really cool functionality e.g. swiss-army-knife of internet connected casting/streaming equipment, video-capture Raspberry Pi/FPGA modules.
But to achieve that, it's going to be quite a big job - so we might see some proofs of concept, but to build a proper user-friendly firmware would require a team to dedicate themselves to make it happen.
And in that time, will the chips remain available? I don't know where to source them right now. Are Lenkeng making new stock, or just running down the last remaining IT9070s and 9919s ? Are the newer higher-res Lenkeng devices related? - are those a better platform to processed with? We will hopefully find out soon when I do the teardowns.
So for now I'm just interested to see where this goes, and how people respond to it. There are plenty of interesting avenues to pursue here if anyone cares to look into it.
You are asking what is the goal. We are all want to unlock that web configuration page (or telnet config) to be able to change streaming port, enable rtp, have more flexible IP settings, extended resolutions options, and finally make it encode AAC instead of MPEG2 audio (for God's sake -_- it's 2019 now). Maybe make it stream via TCP instead of flooding UDP and tearing the picture. If you can make a modified firmware, that would be awesome. Thank you for your work!
That rm -rf with the trailing slash at 17:23 made me really nervous. Imagine playing around with the script and making binutils_file_name void for some reason.
Amazing video, as always.
Yea, me to, he does have `set -u` at the beginning of the script """-u
When the shell tries to expand an unset parameter other than the '@' and '*' special parameters, it shall write a message to standard error and the expansion shall fail with the consequences specified in Consequences of Shell Errors."""
TIL that there is at least one electronics product with an OpenRISC-based processor inside. That really surprised me, I didn't think anyone actually fabricated one of those.
I miss these videos
I believe the SDK targets a simple evaluation board which drives a display. Actually the chip seems to have been designed to drive displays, Lenkeng just went a little bit creative.
what about www.it7090.com
@@DAVIDGREGORYKERR does not seem related
@@MissingClara I was able to browse straight in text was all in Chinese.
Such an interesting dive into the process to achieve the demo, fascinating series - thanks.
I had only time to watch the first 5 minutes of this video. Now I have enough ideas to study for a couple of months! 😂
The insistence, time and research you have put into this project is amazing! 😉
Uh, I know that FFY00 guy, we're enrolled in the same uni, and even collaborated before, the world is small
I feel so stupid that I genuinely get super excited when I see you upload this series, Most of my subs have nothing to do with coding or electronics but somehow I get mostly excited by this and I cannot explain why. Thank you very much though.
I wish I could understand all things you're talking about :D... nevertheless it's fascinating to see how you are discovering bit by bit (pun intended) the previously black-box device.
Man, that was fantastic! Thank you very much for your effort. Great to see some hardcore assembler and linker skills in use. Is there a way you could do some simple on-chip debugging now? Retrieve some data from register files or the RAM and print it to the UART, to get some insights on the microcontroller peripherals or make some leds on the board blink :)
Certainly having a C compiler will make further experimentation much easier. The hacky python homebrew assembler was pretty accident prone to work with.
At the moment we have no way to send input into U2 - but if we did, perhaps we could write a gdb remote debugging server for the IT9919. But that would probably be overkill for LKV373 experiments. It appears that the U2 software is actually very simple: all it does is kick off the capture/encoding engine - so as you say, just dumping the register settings would be extremely helpful.
I need to take another look at the EzCAP 283S firmware - because I previously suspected it was powered by an IT9919, and it uses the chip to do a lot more: it has USB Host and Slave support, file systems, HDMI input, RGB888 input/output etc.
So there's plenty of directions to proceed here. If you're interested in getting involved, I suggest lurking on the #lkv373a IRC channel on FreeNode.
Ahhhh so as long as you 'thin out' the code enough you can just use GPL stuff :D
Thanks for taking the time to make this video. Intensity in ten cities thats high density video! I'm off to watch it again to see how many of the questions I now have are already answered. :-)
Sadly waiting for your SDR videos... But this is great too.
hey.. where are you man ??????
the uart signal should be connected to the IR , same on the other end, one doc shows a diagram of one TX and many RX in hotels for TV over IP , the uarts are then used to control the RX tv,s (via service port on samsungs) or via IR in some cases. thats what the extra ports are for under nmap. the SPI is control only and the U2 chip has data bus similar to ram access into U1, thats required for the speed. U2 then sends that h264 data out via the phy properly wrapped of course. back to the one tx many rx mention , therse also a many TX to many RX model too, so that offers switchable channels . the encryption option is not HDCP but encrypt between TX/RX for "secure IPTV' implementation , that leads me onto the protocol, out there is a doc for IPTV_UART_CMD protocol, this has a lot of diagrams showing the above implementations and a sample of the protocol for IR control, serial over IP, etc. Also out there is a control panel software for the IPTV part that can serve up files instead of needing a TX unit.
Interesting.
These LKV373 devices have a non-populated jack connector. Other Lenkeng products seem to come with an IR widget on a jack cable.
My understanding is that MU1 controls/monitors U2 through the Host SPI link into U2's memory bus. U2 encodes the HDMI into H.264 wrapped into MPEG-TS packets, and transfers it to MU1 through a TSI serial link - which is a defined standard for MPEG-TS transfer.
OpenRISC turns up in some of the strangest (but also not unexpected - royalty free goes a long way) places.
Another place I know of is deep inside the allwinner arm cortex-a chips. They use it as the low power control processor, basically it does some of the control things when the main cores are asleep or being bootstrapped.
Big Brain Stuffs! Impressive!
yay it continues! thanks for all the knowlage
Port 554 for RTSP is open when multicast check box is unticked, but is needed a url to access it. Is possible to discover what URL the LKV373 is using on the RTSP server? Using RTSP only devices connected to it will receive the data, instead of the network being flooded with multicast. Some people sugest that the receiver use RTSP protocol, and snifing its traffic should reveal the url.
This channel is so underrated!
It will be interesting to look at how much in common do the new chips have with the old ones.
Been waiting for this video. Awesome
This is amazing!
Thank you very much. Super interesting video
I would love to see these things get some options for not doing multicast, ideally RTSP, so you can have a couple sets of these on the network as HDMI extenders or HDMI capture devices
Just wanted to thank you Joel - for what is arguably the hacking/tinkering channel with the highest signal-to-noise ratio across the entirety of UA-cam... I can only imagine the time and effort it takes to research and create your content! And I am always learning a lot from your videos - cheers, mate. On a tangent: how do you switch to some form of navigateable terminal output at 22:12?
Glad you're enjoying it. I just wish I could post more often - but that's life.
About the terminal: I switched from using tmux+vim to using vim8 which has terminal support and support for multiple windows and splits. The benefit is that can keep everything in a single instance.
My vim config is here:
github.com/jhol/shellrc/blob/master/vimrc
In the terminal in vim8, the default key-binding is Ctrl-w, N to break into "normal" mode in the terminal which lets you move through the buffer and yank text just as if it was a normal text file. Then press i to return to "insert" mode i.e. normal terminal operation.
I use the tinykeymap plugin to make window management feel more netural to a former tmux user.
So disappointed you stopped making content! I'm betting life just got in the way..too bad..really great videos. Even if you only came out with one per year, would you return??
AMAZING JOB !
Fantastic!! Keep on going.
Great to see an update (as loved the other LKV video). I know you dont rush your videos but 9m later... will there be an update soon on LKV373 progress and also on the new devices you show at 39:03 ?? Subscribed of course...
I have one of those LKV373 and there is a firmware which enables 1080p, any other firmware I have tried has 720p. At the end you asked what the goal was: I absolutely would love to have a firmware which has telnet enabled by default (or by an options on the page) as well as all the options shown on the configuration page while supporting streaming 1080p. Maybe also make the page look a bit better. :P
EDIT: loved watching the videos by the way and am eager for any upcoming videos :)
Well, well well, my guess that this was something from opencores.org wasn't wrong. Props to the guy that spotted this from the opcodes :-)
Unrelated, or kinda related, I recently bought several boards based on the SiFive RiscV cores.
It would be cool if this could convince the device to stream to UA-cam over rtmp. Rather nifty to have a "black box" that streams to your channel anywhere it has a network connection.
Although I'm not at likely to contribute (I prefer cheap microcontroller projects and playing with discarded junk... this is a bit too expensive for my budget) I've really been enjoying this "tale of discovery". This latest contribution from "MW" is both brilliant and a little bit sad. Although v3l0c1r4pt0r's original work on the instruction set and your own additions pointed the way for "MW" to tell you that it's an OpenRISC processor that means v3l0c1r4pt0r's work is now kinda redundant. I s'pose this is often the way with "scientific discovery" the work that paves the way for later development is then eclipsed by those later developments.... anyway, looking forward to the next episode. Keep up The Great Work.
Would you consider testing out the LKV373KVM as well? It's interesting that it adds a few USB ports as well, would perhaps make it a good use case for adding BMC like capability to a desktop with KVM over the network to a laptop.
printf needs malloc because it calls sprintf to format the buffer. There may be a way to configure it to use static buffers, but it looks like you don't need it to.
I'm sure you're correct - though it seems like overkill, when you can implement printf with a simple state-machine.
@@OpenTechLab I think part of it is also that some implementations avoid the syscall and such (think fflush), and so must maintain the buffer somewhere thread safe between calls.
Good point. An unbuffered state machine would have to flush constantly
What happened to this channel? It just suddenly stopped 😢
Newer devices theoretically may have cryptographic protection for firmware. So it is better to check this possibility somehow before buying them.
Wanted to add that I have about 7 transmitting units of lkv373a model, which is capable to output 1080P at 30 FPS (max). 60 FPS is available at 720P res only. Great little device, but it irritates me that I can't supply any custom h.264 parameters, like profile, quality etc. To get the best match of HDMI input quality, I have to set it to 20M bitrate (while input is just about 5M), which makes it very inefficient in term of BW usage.
where can I find the SDK? and is it compatibile with the new LKV372A version 4?
OpenTechLab -- narrated by David Mitchell :-)
Haha, his voice is close but not quite there for me. Do love some David Mitchell though! :)
Hey. Thanks 4 that, if there's any chance that cheap vga to lan extender will work something like that?
What happened to this channel?
I bought some of those LKV373 HDMI senders as well , and I would love to reuse them as KVM adapter for mainboards without VGA port but HDMI instead.
as well on mine I could not get the hack with the unicasts to run.
There is a LKV373KVM on ebay also, which have a few USB ports.
Nice🖒
Love the approach! Have you seen crosstool-NG? Automates a lot of getting a toolchain up.
I know about it yes, though never actually used it. Someone said it doesn't have or1k support yet (maybe a side project for someone).
Anyway, in this case I think it's good for people to understand how gcc bootstrapping works - even if they never do it. Most of the time, a crosstool-ng or a distro-supplied compiler is the right answer
May I ask for your knowledge or any suggestions: Mine came with the following Firmware:
Version :4.0.0.0.20161116
Encoder Version :7.1.2.0.11.20161116
I used DanMan's blog to use the Firmware upgrade to 20160427 - I only did the .PKG one (not the Encoder) and now the device will not grab any IP address on the network. I cannot get to the webserver. The RTP in VLC works (and no longer the UDP). I have other devices I haven't touched and the web servers still work and VLC will only work with UDP and not RTP.
Do you have any ideas of what may have happened that I can no longer see the device on the network, won't grab an IP address, and I can't get into the web server?
I'm curious how did you found newlib __sfvwrite_r() address in Lenkeng software.
Excellent question. Perhaps I should have explained in more detail. I added a note to the show notes,
I used my call-graph script from the previous video to dump out the call-graph of the whole of the Lenkeng upgrader software. I then used the networkx graph library in python to isolate the sub-graph of functions called by puts() which I knew the address of from previous experiments, which gave this diagram: opentechlab.org.uk/_media/videos:020:20191002-puts-printf-subgraph.dot.png?cache=
From various other hints in the strings, I suspected the software contained a build of newlib of whatever vintage.
I then used the or1k disassembler to try and piece together a plausible theory for the number and type arguments to the various functions called by puts().
Still quite uncertain, I decided to take a punt on 0xa512c being the correct address, and voila - it worked!
In future jobs like this will be a bit easier, because v3l0c1r4pt0r has written a patch for radare2 that adds support for or1k.
@@OpenTechLab Thanks for the explanation! It seems to be a fair amount of work.
It took me about four evenings and a Sunday afternoon. It was tricky, yes, but I was reusing a lot of bits of code and information left over from previous work. Otherwise it would have taken a lot longer
is the Projekt dead?
Sorry if this is a stupid question, but could the 'mystery' chip MU1 actually be a FPGA with an OpenRISC soft-core on it?
From what we know, I think that's now ruled out. It seems to be an ITE processor of some sore, and we suspect it contains an ARM core of some kind.
In general an FPGA would be an expensive part to put into a cheap consumer device like this. 10-years ago when 1080p was brand new, before there were mass market chipsets, devices like this may well have contained FPGAs. They would have also cost $$$.
I'm sure 8K will go through a similar evolution in the next decade.
hey dude can you tell us what education you have please
thanks
One of the strings is MSDOS5.0 O.o
Yes, I think that's part of the FAT filesystem handling code. All the web assets are stored in a read-only FAT file system embedded in the image
@@OpenTechLab That sort of makes sense, but Fat doesn't have any hard nor soft reliance on DOS, so it does seem out of place.
Is the channel dead now?
I'm not dead, but it's a bit hard for me to make videos right now.
@@OpenTechLab Glad to hear that you are still alive. Just started watching your videos and really enjoyed it.
Please find time&energy to make more.
Thanks, a new subcriber
Took me for a ride, I was very concerned about that sdk. Glad you took that copyright, and copied what was left!
Yeah and a few more copies have been found now. Check out the show notes for links
Interesting stuff but... what's with wearing your shirt inside out? - 39:44
It would be nice to have your custom compiler bootstrap script as configuration for github.com/crosstool-ng/crosstool-ng to make it easier build with different compiler versions and configurations and make it easier to find for other people.
You have never used malloc before? That seems crazy to me. You are way over my head with this video but malloc I thought was common.
Just on this device
Some other people uploaded the SDK to github. Here's one of the repos: github.com/MindyWei/20171003_Doorbell_SDK_v1.2.3.1_758862
Please make a better Firmware :) *dream* Better Picture 30/60fps or Blu Ray Mode 24fps 1080p. Or a very very low latency Mode. Or Unicast Settings that could be saved after a reboot :)