For some time, I own a Philips DVDR3590H dvd recorder, which has a 250GB harddrive and is capable of recording both on DVD’s and on the harddrive. To see what was inside, I opened it some years ago. Maybe to spot if the harddrive was upgradeable, the dvd drive was exchangeable or which components are inside.
In fact on the AVSforums there are users that replaced/upgraded the harddrives, see Avsforums. This blogpost is featured there as well.
But I wanted to go further, and after obtaining a 3570H (which has a 160GB harddisk instead of a 250gb) I began serious dissasembly of the device.
Luckily, I have obtained the service manual, which guided me through the process of what was inside.
I have found the following:
- Manufactured by Sea Star (http://www.sz-seastar.com/)
- Board type: LecoPlus
- Decoder NXP SAA7136 – PAL/SECAM/NTSC, a sound and video (10 bits) (Courtesy of Progtown.com)
- Chipset NXP PNX7350 – the media processor of series Nexperia, codec MPEG2, MPEG4, MP3, DD, DivX and other (Courtesy of Progtown.com)
But, I discovered there was a service port, which communicated over RS232!
After some tries with a standard Prologic PL2303 USB to TTL converter, I received garbled output on Putty.
But, after much more reading on the web, I have found that it needs a MAX232 to invert the signals as well, in order for proper USB connection.
So I soldered my own cable, which I connected to a socket found in an old LCD display.
How to set up the connection between the dvd recorder and a pc:
- When connecting, the device needs to be off
- Get the cable out of the 1404 socket on the motherboard which is left from the HDD
- Plug in the cable you have manufactured yourself.
- Connect the USB to RS232 converted to your USB port
- Start up Putty, with settings 19200, 8 bit, 1 stop bit, no parity, no flow control
- Put the power cord into the power outlet. The device will boot.
- I entered command 100 to show some device information.
Philips DVDR Service mode initial startup, “DS>” is the prefix which waits for a nucleus, a command.
The available commands are here: from page 42:
Service manual
So far I have been able to:
-Read out device information
-Open and close the tray
-Put on the lights and enter display data, example shows Hacked. Only uppcase works, no ( ) or other symbols
-Read out harddrive firmware and serial number
-Route video from CVBS input to the CVBS output on the back.
-Test the video signal both with RGB and CVBS, generating test signals (green, yellow,red)
-Spin up and spin down the harddrive manually
I would like some help with:
-Disabling Macrovision goes with command 111, but seems to do nothing??
-Store the disabled Macrovision on the chip, so it works also outside the diagnostic / service mode
-Read out the harddrive via USB / other method, currently it is possible to write RAW data onto a DVD (have not tried it yet).
-Read out the EEPROM. This is possible with a command but I don’t know how to do it.
-Read out the NVRAM. This is possible with a command but I don’t know how to do it.
So that’s where you can help. If you appreciate my work, please leave a comment.
Pingback: Hacking a DVD Recorder - RaspberryPiBoards
Pingback: rndm(mod) » Hacking a DVD Recorder
Pingback: Belgaum news | About Belgaum | Belgaum information | Belgaum district | Belgaum city | Belgaum Hotels | Belgaum People | Belgaum tourism | Belgaum entertainment | Belgaum students | Inside facebook | Hack | make use of | technical news | | Hacking a DVD R
Pingback: Hacking a DVD Recorder — Blog of MPRosa
Pingback: Hacking a DVD Recorder | ReMarx
Pingback: Hacking a DVD Recorder | Orange Claymore Red Slime
Pingback: Philips DVDR Service mode via RS232 - W00fer's ...
Pingback: Hacking a DVD Recorder | Hack The Planet
nice!
I willing to do the same with my Sagemcom-UHD86. There is is a hard drive 320gb witch is protected.
There is a FTDI JTAG connector that I will use.
This device appears to be running a small linux OS.
The fun is coming…
Thanks for your comment. Keep me posted on the progress.
Any progress on this?
I checked out the service manual, and it seems you can read the nvram by sending nucleus 304 like this:
serial.write("304 {} {} {}\n".format(location, offset, length))
serial.readLine()
returnedBytes = re.match(r"(0x[0-9A-Fa-f] ?)*", serial.readLine()).group(0)
returnedBytes will contain a string like “0x00 0x30 0x70”, I think (haven’t opened up my dvd/hdd recorder yet)
Thanks, I have indeed found that Nucleus but I don’t know what it does, or how to use it.
0x00, 0x30 0x70 are not easy variables to understand.
These are the returned bytes, starting from the offset.
Puck Meerburg, it’s you. Unbelievable 🙂
I’m definately going to mail you for some further info.
On page 38 (pdf ordering), there is an explanation of the returned value from the tests, where ” [Test OK | Error] @” is the last line. The rest is somewhat more random.
Hi,
Any new developments on disabling macrovision with command DS 111 which does not seem to work? I have tried to do it with a dvdr 615, command is accepted but macrovision still present when you try to copy a macrovision protected DVD.
Regards
Absolutely, I tried everything until I stumbled upon a Macrovision decryptor. A very rare one. I’m going to review it in a couple of weeks on this blog.
DS111 does ONLY seem to disable Macrovision on Playback of material, from what I have found on the web. If you exit service mode, the original mode is present.
So we have to find a way to play a dvd WITHIN the service mode with DS111 off.
That’s good news ! I’m eager to learn about that decryptor ! Can you mail me more details about it ?
Will do, but it might be possible to do this native, without an external decryptor. I have to look further into the Nucleus and possible NVRAM
Hi guys! its Kamzar from South Africa. I have the Philips DVDR3590H recently i lost the 6 hour recordings from the camera and the DVD Rec could accept signal from front AV(satellite decoder). i left the system unplugged during december holidays and when i plugged it the AV input was working but my HDD list from the navigator was cleaned out.
i tried to plug the HDD on Win7 & 8 but PC doesn’t see the HDD. what software can i use to try to recover the lost partition?
Hello,
i just have to recover the hardware id.
My DVDR5570 stuck on Firmware update.
i just only have the philips splash screen with the info “starting” on display.
do i need a usb adapter. i have a laptop with serial port. is a serial port cable sufficient?
is someone here who can show me the right adapter cable?
Hello Marcel. Firmware update is done via CD or USB. Serial port won’t work most likely as that is for diagnostics only as far as I was able to discover.