Internet Radio Exploration

JTAG

noreply@blogger.com (rdk) — Wed, 23 May 2007 11:16:00 +0000

I've wanted to get the JTAG pinouts for the Reciva Barracuda board for a long time. That way it should be possible to resurrect bricked radios without having to desolder the flash and add an XD card socket.

Since the Samsung processor is a BGA package, the only way to be sure of the connections seemed to be removing the chip and buzzing out the pads with a multimeter. I mentioned this to a friend at work, he said he'd like to have a look at the board. 2 minutes later he arrived back and the board looked like this (thanks Robin!):

After work I got busy with the multimeter and datasheet. The results seem to be as shown below - I've marked up one of the diagrams from the Sharpfin project:

I've got a JTAG cable, but haven't had chance to try anything yet.

Remote Control

noreply@blogger.com (rdk) — Tue, 01 May 2007 22:00:00 +0000

I had a quick look for anything interesting in the kernel sources Reciva have on their site and noticed lirc_barracuda.c. LIRC is the well known Linux Infrared Remote Control software. Some Reciva based radios have a remote control so I though it'd be interesting to see if I could add one to the Logik IR100. All the software is already installed so it should just be a case of adding a bit of hardware, connecting it to the right pin on the Barracuda board then tweaking the appropriate configuration file.

A glance at lirc_barracuda.c showed that the radio expects incoming IR signals on GPIO pin GPG6. This is present on the long connector of the Barracuda board.

Here's the hardware I'm currently using (based on an IR reciever for the NSLU2 "Slug" here modified slightly, it uses an SFH5110-38):

It seems to work fine and provides additional buttons such as Alarm, Sleep and Media. I did have to cross compile irrecord to create the configuration file for my remote.

Web Server

noreply@blogger.com (rdk) — Sat, 28 Apr 2007 17:00:00 +0000

Many devices running embedded Linux tend to have webserver giving control over various configuration options. A similar thing could be handy for Reciva based Internet Radios.

I've installed boa, a small web server and am currently experimenting. It currently just shows the contents of my presets but there's a lot of scope there...

New firmware

noreply@blogger.com (rdk) — Thu, 12 Apr 2007 22:09:00 +0000

So, looks like the AE radios have got a new firmware revision: 257-a-181. Would be nice if the same firmware worked on the Logik radios too. I mean, it ought to, as long as it includes the right configuration file and modules...

Success! But I don't seem to have any fancy new options. Time for a quick fiddle with config1012.txt.

Ah, that's better you can now get at the Alarm Clock from the top level (oh and enable more than one).

In Configuration > Clock you can also enable a menu to correct for daylight savings. Very useful since my IR100 has been an hour slow since the switch.

The Media Player menu can also have a Demo Mode item enabled. This allowed me to play tracks of a USB flash drive. It also looks like this firmware supports a 32MB of flash memory (the current radios 16MB) so you could play music from that too.

USB devices

noreply@blogger.com (rdk) — Mon, 09 Apr 2007 15:54:00 +0000

Interestingly, the usb wifi dongle used in the IR100 can be removed and a hub plugged in to the empty socket. Plugging the wifi device into the hub allows the radio to function as normal. More importantly it allows for other usb devices to be connected :)

If a usb flash disk is connected as the radio boots it is recognised and mounted under /tmp/usb/a/1 (in the case of /dev/sda1) automatically.

Modules are included for usb to serial converters including the popular Prolific PL2303 chip. After installing the usbserial and pl2303 modules a connected usb to serial cable is available as /dev/usb/tts/0.

Success!

noreply@blogger.com (rdk) — Fri, 06 Apr 2007 17:31:00 +0000

So, with the help of SimpleDNS, Apache and the familiar linux dropbear ipkg I've finally got a shell:

Soldering Again

noreply@blogger.com (rdk) — Wed, 04 Apr 2007 17:00:00 +0000

XD Card Arrives

noreply@blogger.com (rdk) — Tue, 03 Apr 2007 16:25:00 +0000

New Reader

noreply@blogger.com (rdk) — Fri, 30 Mar 2007 17:16:00 +0000

Bite the Bullet

noreply@blogger.com (rdk) — Sat, 24 Mar 2007 17:18:00 +0000

Oscilloscope action

noreply@blogger.com (rdk) — Sat, 24 Feb 2007 22:03:00 +0000

Right, since it looks like subverting the firmware upgrade is going to require work to crack or circumvent the encryption maybe there's an easier way in.

Perhaps a serial console, for testing purposes, is just waiting to be found on the Barracuda board?

First, those pins on the headers which have obvious uses (power, display, keypad, usb etc.) were identified. Then, the rest of the pins, including the test points on the back of the board, were monitored with an oscilloscope during startup in the hopes of identifying something that looked like the Tx line of a UART. Nothing. Back to the drawing board.

Time for a bit of snooping

noreply@blogger.com (rdk) — Fri, 16 Feb 2007 21:46:00 +0000

One of the most obvious routes to shell access would be to subvert the firmware upgrade process.

Using ethereal to analyse network traffic turned up lots of interesting information about how the radio functions. Unfortunately it also showed that new firmware is transferred via an encrypted protocol - RTP (Reciva Transfer Protocol?). The curl application has been modified to implement this and accept urls of the form "reciva://xxx.xxx.xxx".

Ideally it would have been possible to intercept a firmware upgrade, analyse the contents and produce a version which would enable a telnet or SSH server. The encryption makes this a tougher task.

Christmas

noreply@blogger.com (rdk) — Mon, 25 Dec 2006 17:19:00 +0000

I've received an Logik IR100 as a fantastic Christmas present. It works, I've done a firmware update and listened to lots of stations. But there must be scope for hacking it...

The official Reciva site has documentation that states it runs Familiar Linux. As does the Sharpfin project wiki.

It would be great to get a shell on it via telnet or SSH. Or maybe find connections inside for a serial console?

As a start I tried a port scan to see if there were any exploitable services running (would rather not open the case unless absolutely necessary). Nothing.