Philips DVDR Service mode via RS232

DSC01302

 

For some time, I own a Philips DVDR3590H dvd recorder, which has a 250GB harddrive and is capable of recording both on DVD’s and on the harddrive.
To see what was inside, I opened it some years ago. Maybe to spot if the harddrive was upgradeable, the dvd drive was exchangeable or which components are inside.
In fact on the AVSforums there are users that replaced/upgraded the harddrives, see Avsforums. This blogpost is featured there as well.

But I wanted to go further, and after obtaining a 3570H (which has a 160GB harddisk instead of a 250gb) I began serious dissasembly of the device.

Luckily, I have obtained the service manual, which guided me through the process of what was inside. 

I have found the following:

  • Manufactured by Sea Star (http://www.sz-seastar.com/)
  • Board type: LecoPlus
  • Decoder NXP SAA7136 – PAL/SECAM/NTSC,  a sound and video (10 bits) (Courtesy of Progtown.com)
  • Chipset  NXP PNX7350 – the media processor of series Nexperia, codec MPEG2, MPEG4, MP3, DD, DivX and other (Courtesy of Progtown.com)


But, I discovered there was a service port, which communicated over RS232!

After some tries with a standard Prologic PL2303 USB to TTL converter, I received garbled output on Putty.

But, after much more reading on the web, I have found that it needs a MAX232 to invert the signals as well, in order for proper USB connection.

So I soldered my own cable, which I connected to a socket found in an old LCD display.

 

DSC01298

 

How to set up the connection between the dvd recorder and a pc:

  1. When connecting, the device needs to be off
  2. Get the cable out of the 1404 socket on the motherboard which is left from the HDD
  3. Plug in the cable you have manufactured yourself.
  4. Connect the USB to RS232 converted to your USB port
  5. Start up Putty, with settings 19200, 8 bit, 1 stop bit, no parity, no flow control
  6. Put the power cord into the power outlet. The device will boot.
  7. I entered command 100 to show some device information.

Servicemode-dvdr

Philips DVDR Service mode initial startup, “DS>” is the prefix which waits for a nucleus, a command.

The available commands are here: from page 42:
Service manual

So far I have been able to:

-Read out device information
-Open and close the tray
-Put on the lights and enter display data, example shows Hacked. Only uppcase works, no ( ) or other symbols
-Read out harddrive firmware and serial number
-Route video from CVBS input to the CVBS output on the back.
-Test the video signal both with RGB and CVBS, generating test signals (green, yellow,red)
-Spin up and spin down the harddrive manually

I would like some help with:

-Disabling Macrovision goes with command 111, but seems to do nothing??
-Store the disabled Macrovision on the chip, so it works also outside the diagnostic / service mode
-Read out the harddrive via USB / other method, currently it is possible to write RAW data onto a DVD (have not tried it yet).
-Read out the EEPROM. This is possible with a command but I don’t know how to do it.
-Read out the NVRAM. This is possible with a command but I don’t know how to do it.

So that’s where you can help. If you appreciate my work, please leave a comment.

16 thoughts on “Philips DVDR Service mode via RS232

  1. Pingback: Hacking a DVD Recorder - RaspberryPiBoards

  2. Pingback: rndm(mod) » Hacking a DVD Recorder

  3. Pingback: Belgaum news | About Belgaum | Belgaum information | Belgaum district | Belgaum city | Belgaum Hotels | Belgaum People | Belgaum tourism | Belgaum entertainment | Belgaum students | Inside facebook | Hack | make use of | technical news | | Hacking a DVD R

  4. Pingback: Hacking a DVD Recorder — Blog of MPRosa

  5. Pingback: Hacking a DVD Recorder | ReMarx

  6. Pingback: Hacking a DVD Recorder | Orange Claymore Red Slime

  7. Pingback: Philips DVDR Service mode via RS232 - W00fer's ...

  8. Pingback: Hacking a DVD Recorder | Hack The Planet

  9. it-wizard

    nice!
    I willing to do the same with my Sagemcom-UHD86. There is is a hard drive 320gb witch is protected.
    There is a FTDI JTAG connector that I will use.
    This device appears to be running a small linux OS.
    The fun is coming…

    Reply
  10. puckipedia

    I checked out the service manual, and it seems you can read the nvram by sending nucleus 304 like this:


    serial.write("304 {} {} {}\n".format(location, offset, length))
    serial.readLine()
    returnedBytes = re.match(r"(0x[0-9A-Fa-f] ?)*", serial.readLine()).group(0)

    returnedBytes will contain a string like “0×00 0×30 0×70″, I think (haven’t opened up my dvd/hdd recorder yet)

    Reply
    1. W00fer Post author

      Thanks, I have indeed found that Nucleus but I don’t know what it does, or how to use it.

      0×00, 0×30 0×70 are not easy variables to understand.

      Reply
  11. puckipedia

    On page 38 (pdf ordering), there is an explanation of the returned value from the tests, where ” [Test OK | Error] @” is the last line. The rest is somewhat more random.

    Reply
  12. limo hire london

    Hi, I do believe this is an excellent blog. I stumbledupon it ;) I’m going to revisit once again since I saved as a
    favorite it. Money and freedom is the greatest way to change, may you be rich and
    continue to help others.

    Reply
  13. Kaitlyn

    It’s actually a nice and useful piece of information. I’m happy that
    you simply shared this useful information with us.
    Please keep us up to date like this. Thank you for sharing.

    Stop by my website … Kaitlyn

    Reply

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>