Philips DVDR Service mode via RS232

DSC01302

 

For some time, I own a Philips DVDR3590H dvd recorder, which has a 250GB harddrive and is capable of recording both on DVD’s and on the harddrive.
To see what was inside, I opened it some years ago. Maybe to spot if the harddrive was upgradeable, the dvd drive was exchangeable or which components are inside.
In fact on the AVSforums there are users that replaced/upgraded the harddrives, see Avsforums. This blogpost is featured there as well.

But I wanted to go further, and after obtaining a 3570H (which has a 160GB harddisk instead of a 250gb) I began serious dissasembly of the device.

Luckily, I have obtained the service manual, which guided me through the process of what was inside. 

I have found the following:

  • Manufactured by Sea Star (http://www.sz-seastar.com/)
  • Board type: LecoPlus
  • Decoder NXP SAA7136 – PAL/SECAM/NTSC,  a sound and video (10 bits) (Courtesy of Progtown.com)
  • Chipset  NXP PNX7350 – the media processor of series Nexperia, codec MPEG2, MPEG4, MP3, DD, DivX and other (Courtesy of Progtown.com)


But, I discovered there was a service port, which communicated over RS232!

After some tries with a standard Prologic PL2303 USB to TTL converter, I received garbled output on Putty.

But, after much more reading on the web, I have found that it needs a MAX232 to invert the signals as well, in order for proper USB connection.

So I soldered my own cable, which I connected to a socket found in an old LCD display.

 

DSC01298

 

How to set up the connection between the dvd recorder and a pc:

  1. When connecting, the device needs to be off
  2. Get the cable out of the 1404 socket on the motherboard which is left from the HDD
  3. Plug in the cable you have manufactured yourself.
  4. Connect the USB to RS232 converted to your USB port
  5. Start up Putty, with settings 19200, 8 bit, 1 stop bit, no parity, no flow control
  6. Put the power cord into the power outlet. The device will boot.
  7. I entered command 100 to show some device information.

Servicemode-dvdr

Philips DVDR Service mode initial startup, “DS>” is the prefix which waits for a nucleus, a command.

The available commands are here: from page 42:
Service manual

So far I have been able to:

-Read out device information
-Open and close the tray
-Put on the lights and enter display data, example shows Hacked. Only uppcase works, no ( ) or other symbols
-Read out harddrive firmware and serial number
-Route video from CVBS input to the CVBS output on the back.
-Test the video signal both with RGB and CVBS, generating test signals (green, yellow,red)
-Spin up and spin down the harddrive manually

I would like some help with:

-Disabling Macrovision goes with command 111, but seems to do nothing??
-Store the disabled Macrovision on the chip, so it works also outside the diagnostic / service mode
-Read out the harddrive via USB / other method, currently it is possible to write RAW data onto a DVD (have not tried it yet).
-Read out the EEPROM. This is possible with a command but I don’t know how to do it.
-Read out the NVRAM. This is possible with a command but I don’t know how to do it.

So that’s where you can help. If you appreciate my work, please leave a comment.

21 thoughts on “Philips DVDR Service mode via RS232

  1. Pingback: Hacking a DVD Recorder - RaspberryPiBoards

  2. Pingback: rndm(mod) » Hacking a DVD Recorder

  3. Pingback: Belgaum news | About Belgaum | Belgaum information | Belgaum district | Belgaum city | Belgaum Hotels | Belgaum People | Belgaum tourism | Belgaum entertainment | Belgaum students | Inside facebook | Hack | make use of | technical news | | Hacking a DVD R

  4. Pingback: Hacking a DVD Recorder — Blog of MPRosa

  5. Pingback: Hacking a DVD Recorder | ReMarx

  6. Pingback: Hacking a DVD Recorder | Orange Claymore Red Slime

  7. Pingback: Philips DVDR Service mode via RS232 - W00fer's ...

  8. Pingback: Hacking a DVD Recorder | Hack The Planet

  9. it-wizard

    nice!
    I willing to do the same with my Sagemcom-UHD86. There is is a hard drive 320gb witch is protected.
    There is a FTDI JTAG connector that I will use.
    This device appears to be running a small linux OS.
    The fun is coming…

    Reply
  10. puckipedia

    I checked out the service manual, and it seems you can read the nvram by sending nucleus 304 like this:


    serial.write("304 {} {} {}\n".format(location, offset, length))
    serial.readLine()
    returnedBytes = re.match(r"(0x[0-9A-Fa-f] ?)*", serial.readLine()).group(0)

    returnedBytes will contain a string like “0x00 0x30 0x70″, I think (haven’t opened up my dvd/hdd recorder yet)

    Reply
    1. W00fer Post author

      Thanks, I have indeed found that Nucleus but I don’t know what it does, or how to use it.

      0x00, 0x30 0x70 are not easy variables to understand.

      Reply
        1. W00fer Post author

          Puck Meerburg, it’s you. Unbelievable :)
          I’m definately going to mail you for some further info.

          Reply
  11. puckipedia

    On page 38 (pdf ordering), there is an explanation of the returned value from the tests, where ” [Test OK | Error] @” is the last line. The rest is somewhat more random.

    Reply
  12. Lionel REY

    Hi,

    Any new developments on disabling macrovision with command DS 111 which does not seem to work? I have tried to do it with a dvdr 615, command is accepted but macrovision still present when you try to copy a macrovision protected DVD.

    Regards

    Reply
    1. W00fer Post author

      Absolutely, I tried everything until I stumbled upon a Macrovision decryptor. A very rare one. I’m going to review it in a couple of weeks on this blog.
      DS111 does ONLY seem to disable Macrovision on Playback of material, from what I have found on the web. If you exit service mode, the original mode is present.
      So we have to find a way to play a dvd WITHIN the service mode with DS111 off.

      Reply
      1. Lionel REY

        That’s good news ! I’m eager to learn about that decryptor ! Can you mail me more details about it ?

        Reply
        1. W00fer Post author

          Will do, but it might be possible to do this native, without an external decryptor. I have to look further into the Nucleus and possible NVRAM

          Reply
  13. Kamzar

    Hi guys! its Kamzar from South Africa. I have the Philips DVDR3590H recently i lost the 6 hour recordings from the camera and the DVD Rec could accept signal from front AV(satellite decoder). i left the system unplugged during december holidays and when i plugged it the AV input was working but my HDD list from the navigator was cleaned out.

    i tried to plug the HDD on Win7 & 8 but PC doesn’t see the HDD. what software can i use to try to recover the lost partition?

    Reply

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>