New to hardware hacking & hacking a DVD player, need some guidance.
Phoenix wrote 06/20/2024 at 21:52 • -1 pointI'm a low level software guy hobbyist, but I've little experience when it comes to hardware.
But I'm curious, curious enough to see if I can reprogram my DVD player to do something else.
The DVD player I have is: Sony dvp-ns38 I, took out the processing board and started looking up the names of the integrated circuits. After some time I found a service manual. https://www.manualslib.com/manual/839588/Sony-Dvp-Ns38.html
Which includes some schematic diagrams and some useful pin information. But I think it's for a slightly different model, than I have because the component names don't match.
The next steps I wanted to take were:
a. Find more info on the processor .
b. Dump the EEPROM,
But that's where I'm stuck, on both counts.
a. I couldn't find anything on the micro controller named: "CXD9933R 0936-LETL KL8199210", and I've got no clue what the instruction set is of the micro processor, let alone the architecture.
b. Never dumped a EEPROM before. And I've got some shopping to do. As I don't have the hardware to read/write the contents of a EEPROM. (Only a soldering iron)
https://images2.imgbox.com/a0/84/5k0RgHC1_o.png (EEPROM chip)
My question is: Where do you find the documentation of the various parts (micro controller/EEPROM) to figure out on how they work?
What hardware would you recommend I buy for such a project? Also what is the most versatile to dump a EEPROM? I was thinking of something USB related.
Any advice would be appreciated.
ask
Discussions
Become a Hackaday.io Member
Create an account to leave a comment. Already have an account? Log In.
Looks like a quite challenging project! The main chip appears to be a SOC, a system on a chip, quite likely a proprietary design. In the schematic it is annotated as a "microprocessor" which is confirmed by the architecture with external address and data buses and external SDRAM and FLASH. There may be a (JTAG) debug connection but those pins are probably multiplexed to other pins and not named in the schematic. There appears to be a serial diagnostic bus (DIAG) connector, so that is worth to look at using 3.3V serial adapter (like USB-Serial dongle). System access through that may be protected.
Dumping the parallel FLASH may require desoldering it and using a suitable programming adapter with a parallel FLASHer tool, which may be an expensive route, or making own adapter and using something like Arduino to read the FLASH. Some HW tinkering needed. You may find a filesystem on the FLASH, and the processor may be running some commercial or proprietary RTOS or even embedded Linux (not uncommon in embedded devices of that era and later).
Thumbs up with the project!
Are you sure? yes | no
The system chips in these Sony DVD players appear to be various versions of the MediaTek MT1389 series desktop DVD player SOCs. Some data sheets can be found in the net.
Are you sure? yes | no
The number one thing to hacking existing electronics like this is finding out whether the microcontroller is flash-based or if it uses mask ROM. Mask ROM is permanently baked into the chip when it's packaged and can't be changed. Flash-based microcontrollers can be reprogrammed, but because they cost more many devices that are made on huge scales like DVD players and other commodity items won't use them.
If you want to get into playing with hardware, a great first step is to pick up a development board with documentation. Arduino isn't for everyone but it's a decent choice; you can also buy development boards for other microcontrollers and program them directly in C/C++. For example, the Nucleo series of boards from ST, or the Launchpad boards from Texas Instruments. Microchip also has their Xplained boards which are excellent as well. I've used boards from all three manufacturers (and more) and the biggest difference between them is usually just register names and build systems -- their IDEs help with a lot of this.
If you do want to play around with hacking existing devices, take a look around online for projects that people have already done with particular consumer products. This will give you a decent overview of what types of devices have reprogrammable microcontrollers, and you might find you already own some hackable devices!
To answer your question about dumping EEPROMs, you have a few different options. You can get a full fledged programmer like the TL-866, or you can take a different approach with something like the Bus Pirate. There are also cheap devices on eBay etc that dump EEPROMs and flash devices, but they are somewhat limited in the chips they support so make sure to check if they can do the chips you want. As far as finding documentation, you did the right thing: Google for the part number, sometimes with the word "datasheet". If you find you are hitting a brick wall and not getting any results, that usually means it's a proprietary chip. Some advanced reverse engineering people can often figure out if the chip is based on a more common architecture by looking at the code dump (if they can get one) but that can be a massive job.
Are you sure? yes | no
To embark on the project of reprogramming your Sony DVP-NS38 DVD player, here are some steps and advice:
1. Finding Documentation
Microcontroller (CXD9933R)
Manufacturer's Website: Visit Sony's official site or contact their technical support for any available datasheets or technical documentation.
Forums and Communities: Join electronics forums like EEVblog or Electro-Tech-Online where experienced users may share documentation or advice.
Reverse Engineering Tools: Utilize tools like IDA Pro or Ghidra for firmware analysis to understand the microcontroller's architecture and instruction set.
EEPROM
Datasheets: Search for the EEPROM's specific part number (e.g., 25L2005) on datasheet repositories to get detailed information.
2. Dumping the EEPROM
Hardware Recommendations
USB EEPROM Programmer: The CH341A Mini Programmer is affordable and versatile for various EEPROM types.
Adapters and Clips: SOIC-8 test clips or adapters may be necessary depending on the EEPROM's package type.
USB-to-SPI Adapter: Devices like the Bus Pirate provide flexible interfacing options.
Software Tools
Flashrom: An open-source utility for reading, writing, verifying, and erasing flash chips.
CH341A Programmer Software: Use the software provided with the programmer or community-developed alternatives. For additional resources and assistance, you can also explore PicoWorkers.
Steps to Dump EEPROM
Identify the Chip: Confirm the EEPROM type (e.g., 25L2005 as SPI flash).
Connection: Use an SOIC-8 clip for in-circuit programming or desolder the chip for an adapter.
Programmer Software: Install the necessary drivers and software.
Read/Write: Use the software to read the EEPROM contents and save them.
Recommended Hardware List
CH341A Mini Programmer
SOIC-8 Test Clip
Bus Pirate
Soldering Station
By following these steps and leveraging community resources, you can proceed effectively with reprogramming your DVD player. For specific challenges, detailed questions in forums can provide valuable insights from experienced members.
Are you sure? yes | no
hat's a very interesting project! Reprogramming a DVD player to do something else is definitely ambitious, but with some research and the right tools, it could be achievable. Here's some guidance to help you get started:
Finding component documentation:
Datasheets: While you might not find exact documentation for the specific variants on your board (CXD9933R 0936-LETL KL8199210), searching for the base component number (CXD9933R) might yield results. Manufacturer websites and electronics component distributors like DigiKey or Mouser are good places to start searching for datasheets.
Service manuals: The service manual you linked (https://elektrotanya.com/sony_dvp-ns38_ns39_ns47p_ns57p_ns64p_ns67p_sm.pdf/download.html) might be a close match, even if the component names aren't identical. Sometimes manufacturers use similar components across different models. Look for sections on the main board that discuss functionality or schematics related to the processor or EEPROM. You might be able to glean some useful information about pinouts or functionality even if the exact components don't match.
Dumping the EEPROM:
EEPROMs and programmers: You're right, a soldering iron alone won't be enough to dump the EEPROM. You'll need an EEPROM programmer. These can be standalone devices or connect to your computer via USB. The best option depends on the specific EEPROM chip in your device and your budget. Popular brands for EEPROM programmers include Bus Pirate, Willem programmer, and TL866.
Choosing an EEPROM programmer: For versatility, a USB-based EEPROM programmer is a good choice. Look for one that supports a wide range of EEPROM chips and is compatible with your operating system. Many programmers come with software that allows you to read, write, and erase EEPROM contents.
Additional tips:
Safety first: Make sure you understand the risks involved in working with electronics before attempting to modify your DVD player. Research proper handling techniques to avoid damaging components with static electricity.
Start small: Before diving into reprogramming the entire device, consider practicing with a separate EEPROM chip on a breadboard to get comfortable with the programmer and software.
Online communities: There are online communities and forums dedicated to hardware hacking and electronics enthusiasts. These can be valuable resources for finding information about specific components, troubleshooting techniques, and project ideas. Check out websites like https://hackaday.com/ or https://www.eevblog.com/ or DTF
<a href=“https://www.dtfprintuk.com”>DTF</a>
Remember, this project will require research, patience, and some trial and error. But with the right approach and resources, it could be a fun and rewarding learning experience. Good luck!
Are you sure? yes | no
It could be a mask or flash programmed custom MCU and the EEPROM is only used to hold non-volatile settings, particularly if the EEPROM is the serial type, in which case you're out of luck. While some MCUs can execute code out of serial EEPROMs, and I seem to remember the interface has to be SPI, I2C is not fast enough, the code is more likely to be held in the MCU, either mask programmed or flashed.
Are you sure? yes | no
That looks like a very common I2C EEPROM IC. Seems similar to this one: https://www.digikey.com/en/products/detail/rochester-electronics-llc/CAT24C16WGE/12618542 Probably practically identical. It is not difficult at all to read them, but you probably want something like this to solder it to: https://www.tindie.com/products/matematik/4-pcb-breakout-board-set/ (except one that is in stock, obviously) Then you need a device to read it, obviously - Arduino works but there are also dedicated devices you can buy.
There is a bit more info on the processor if you use Yandex to search: https://yandex.com/search/?text=CXD9933
Even then, hardly any information is available - I can find a lot of websites in Russia mentioning it, but no datasheet. Although, perhaps it isn't the processor? Hopefully it could be another chip on the board, maybe with better documentation?
Are you sure? yes | no