Comments on: Serial console and linux prompt http://hackinghava.hankswandering.com/2009/08/serial-console-and-linux-prompt.html Hacking the Hava Titanium HD Mon, 26 Apr 2010 06:54:01 +0000 hourly 1 http://wordpress.org/?v=3.0 By: wiltwong http://hackinghava.hankswandering.com/2009/08/serial-console-and-linux-prompt.html#comment-8 wiltwong Mon, 26 Apr 2010 06:54:01 +0000 http://stage.hankswandering.com/serial-console-and-linux-prompt.html#comment-8 HAVA Firmware Image Analysis (fw_32.272325.rup.img) <br /><br />The following is an analysis of the firmware image from the software that packages with the HAVA Platinum HD. I have no idea how value at offset 0x20 is generated, but if we can figure that out we should be able to modify the CRAMFS images and upload a new file system to the HAVA. Interestingly enough, the image does not include a kernel, even within the CRAMFS.<br /><br />00000000 48 52 55 50 | "HRUP" Magic<br />00000004 10 00 00 00 | Constant (16) <br />00000008 78 56 34 12 | Constant <br />0000000c 02 00 00 00 | Constant (2)<br />00000010 28 00 00 00 | Constant (40)<br />00000014 c5 27 04 00 | Version (272325)<br />00000018 00 00 00 00 | Constant<br />0000001c d0 81 37 4a | Date in epoch (1245151696=June 16,2009)<br />00000020 97 b8 cc 1a | ??? Some sort of 16 bit signature/checksum ???<br />00000024 02 00 00 00 | Constant (2)<br />00000028 50 f0 43 00 | Size of both CRAMFS incl headers (4452432 bytes)<br />0000002c 2c f4 01 00 | Constant (128044)<br />00000030 01 00 00 00 | Constant (1)<br />00000034 00 00 00 00 | Constant (0)<br /><br />00000038 52 55 50 50 | "RUPP" Magic<br />0000003c 08 00 00 00 | Constant (8)<br />00000040 20 00 00 00 | Constant (32)<br />00000044 03 00 00 00 | Constant (3) Identify as CRAMFS Image #1???<br />00000048 10 01 00 00 | CRAMFS edition (272)<br />0000004c d0 81 37 4a | Date in epoch (1245151696=June 16,2009)<br />00000050 a9 f7 ff 25 | CRAMFS Image CKSUM-32 flipped<br />00000054 00 30 2e 00 | CRAMFS Image length (3026944 bytes)<br />00000058 60 00 00 00 | CRAMFS Image start<br />00000060 FIRST_CRAMFS_IMAGE_FOLLOWS<br />...<br /><br />002e3060 52 55 50 50 | "RUPP" Magic<br />002e3064 08 00 00 00 | Constant (8)<br />002e3068 20 00 00 00 | Constant (32)<br />002e306c 04 00 00 00 | Constant (4) Identify as CRAMFS Image #2???<br />002e3070 45 01 00 00 | CRAMFS edition (325)<br />002e3074 00 00 00 00 | Constant 0<br />002e3078 d0 81 37 4a | Date in epoch (1245151696=June 16,2009)<br />002e307c 34 66 1a ab | CRAMFS Image CKSUM-32 flipped<br />00000080 00 c0 15 00 | CRAMFS Image length (1425408 bytes)<br />002e3084 88 30 2e 00 | CRAMFS Image start<br />002e3088 SECOND_CRAMFS_IMAGE_FOLLOWS<br />...<br />0043f088 END HAVA Firmware Image Analysis (fw_32.272325.rup.img)

The following is an analysis of the firmware image from the software that packages with the HAVA Platinum HD. I have no idea how value at offset 0×20 is generated, but if we can figure that out we should be able to modify the CRAMFS images and upload a new file system to the HAVA. Interestingly enough, the image does not include a kernel, even within the CRAMFS.

00000000 48 52 55 50 | "HRUP" Magic
00000004 10 00 00 00 | Constant (16)
00000008 78 56 34 12 | Constant
0000000c 02 00 00 00 | Constant (2)
00000010 28 00 00 00 | Constant (40)
00000014 c5 27 04 00 | Version (272325)
00000018 00 00 00 00 | Constant
0000001c d0 81 37 4a | Date in epoch (1245151696=June 16,2009)
00000020 97 b8 cc 1a | ??? Some sort of 16 bit signature/checksum ???
00000024 02 00 00 00 | Constant (2)
00000028 50 f0 43 00 | Size of both CRAMFS incl headers (4452432 bytes)
0000002c 2c f4 01 00 | Constant (128044)
00000030 01 00 00 00 | Constant (1)
00000034 00 00 00 00 | Constant (0)

00000038 52 55 50 50 | "RUPP" Magic
0000003c 08 00 00 00 | Constant (8)
00000040 20 00 00 00 | Constant (32)
00000044 03 00 00 00 | Constant (3) Identify as CRAMFS Image #1???
00000048 10 01 00 00 | CRAMFS edition (272)
0000004c d0 81 37 4a | Date in epoch (1245151696=June 16,2009)
00000050 a9 f7 ff 25 | CRAMFS Image CKSUM-32 flipped
00000054 00 30 2e 00 | CRAMFS Image length (3026944 bytes)
00000058 60 00 00 00 | CRAMFS Image start
00000060 FIRST_CRAMFS_IMAGE_FOLLOWS
…

002e3060 52 55 50 50 | "RUPP" Magic
002e3064 08 00 00 00 | Constant (8)
002e3068 20 00 00 00 | Constant (32)
002e306c 04 00 00 00 | Constant (4) Identify as CRAMFS Image #2???
002e3070 45 01 00 00 | CRAMFS edition (325)
002e3074 00 00 00 00 | Constant 0
002e3078 d0 81 37 4a | Date in epoch (1245151696=June 16,2009)
002e307c 34 66 1a ab | CRAMFS Image CKSUM-32 flipped
00000080 00 c0 15 00 | CRAMFS Image length (1425408 bytes)
002e3084 88 30 2e 00 | CRAMFS Image start
002e3088 SECOND_CRAMFS_IMAGE_FOLLOWS
…
0043f088 END

]]> By: Hank Hankins http://hackinghava.hankswandering.com/2009/08/serial-console-and-linux-prompt.html#comment-7 Hank Hankins Wed, 28 Oct 2009 16:31:22 +0000 http://stage.hankswandering.com/serial-console-and-linux-prompt.html#comment-7 No, I haven't had the free time to work on it lately. I was hoping someone else would crack the password entries since I didn't have any luck with them.<br /><br />Not changing channels under windows7 would most likely be something in the player program that runs on the PC. Maybe Hava will release an update for windows7. Have you looked on the myhava.com forum? There's one post from a win7 user that turned out to be a config problem, http://www.myhava.com/forum/viewtopic.php?f=3&t=3990 No, I haven't had the free time to work on it lately. I was hoping someone else would crack the password entries since I didn't have any luck with them.

Not changing channels under windows7 would most likely be something in the player program that runs on the PC. Maybe Hava will release an update for windows7. Have you looked on the myhava.com forum? There's one post from a win7 user that turned out to be a config problem, http://www.myhava.com/forum/viewtopic.php?f=3&t=3990

]]> By: Jpittscell http://hackinghava.hankswandering.com/2009/08/serial-console-and-linux-prompt.html#comment-6 Jpittscell Wed, 28 Oct 2009 12:26:21 +0000 http://stage.hankswandering.com/serial-console-and-linux-prompt.html#comment-6 Any new updates, I have been following your blog for a while, I'd love to get to the linux on this thing, maybe I can find out why it doesn't change channels with windows7 Any new updates, I have been following your blog for a while, I'd love to get to the linux on this thing, maybe I can find out why it doesn't change channels with windows7

]]> By: Hank Hankins http://hackinghava.hankswandering.com/2009/08/serial-console-and-linux-prompt.html#comment-5 Hank Hankins Wed, 14 Oct 2009 06:40:05 +0000 http://stage.hankswandering.com/serial-console-and-linux-prompt.html#comment-5 I don't think the hardware can handle that. The ViXS XC-2110 chip that handles the mpeg is designed to downsample to SD. I don't think the hardware can handle that. The ViXS XC-2110 chip that handles the mpeg is designed to downsample to SD.

]]> By: Aaron http://hackinghava.hankswandering.com/2009/08/serial-console-and-linux-prompt.html#comment-4 Aaron Wed, 14 Oct 2009 03:57:51 +0000 http://stage.hankswandering.com/serial-console-and-linux-prompt.html#comment-4 OMG someone plz find a way to stop the hava from down converting to 480 from 1080!!!!!!!!!!!! i know a modded firmware is the answer. well really i dont know, but just the fact that it down converts from 1080 makes me wonder....if can stop that from happening, then youll have a happauge hd pvr for a heck of a lot cheaper. OMG someone plz find a way to stop the hava from down converting to 480 from 1080!!!!!!!!!!!! i know a modded firmware is the answer. well really i dont know, but just the fact that it down converts from 1080 makes me wonder….if can stop that from happening, then youll have a happauge hd pvr for a heck of a lot cheaper.

]]>