A few months ago [Jason] got his hands on a free Coby DP700WD digital picture frame and thought it would be fun to hack. After realizing that the frame did not run any sort of Linux-based OS he figured his options were pretty limited, but he gave it a shot anyways.
The frame came with a set of built in images, and his goal was to swap them out for pictures of his own. He started by trying to read data from the frame’s serial flash chip, but found that the processor was preventing him from doing so. He de-soldered the chip from the frame, mounted it on a makeshift breakout board, and started reading up on SPI.
He was eventually able to read the device’s flash chip and swapped out the built-in images with his own. After a bit of trial and error, he was able to replace the frame’s boot screen with his own custom image as well.
If you are looking to do something similar, be sure to swing by his site – all of the tools and code he used to hack his frame are available for the taking.
Continue reading to see his modified picture frame in action.
[youtube=http://www.youtube.com/watch?v=xevG0ZCW-Fo&w=470]
Well, certainly, anything you do with a “Coby” product is better than leaving it how it came from the factory — hacking it, tearing it down for parts, smashing it with a sledgehammer, whatever.
do they really make frames with only preset pictures?
So he went to all this effort to hack the photo frame into … a photo frame with different default images?
Not to brag, but I hacked a photo frame recently too: http://forums.parallax.com/showthread.php?130116-28-lines-by-60-columns-on-a-NEW-Ativa-7-inch-photo-frame
Does anyone know of a hack where the picture frame is “told” what to display by a computer from power up? Preferably over the USB port. And preferably one of the cheap picture frames(<$50). Much more than that and you might as well build one from scratch:
http://combattlefield.com/Forum/index.php?topic=30.0
@uky
The preset pictures are for when you don’t have a SD card installed.
@localroger
So, what you have done is tap the power off the USB port to power a parallax which drives the LCD (sort of) directly. Essentially cutting out all the logic of the picture frame.
Ok, but I am still looking for cheap (information only) 2nd display for an entertainment center. I want to render a JPEG in the entertainment center’s computer, load it into the picture frame and forget about it (i.e. I don’t want to continue to provide a video feed).
So I guess I’m still looking for the perfect picture frame hack.
BTW, the picture frame you spec’ed out is on sale until the end of today (2011.05.07) for $10 less at the store you mentioned.
Nice work Jason. I like the reverse engineering. :)
@uky, @localroger
The picture frame takes images off of a USB flash drive or an sdcard which he says he did not have, so he changed the default images instead.
Obviously he did it more for the purpose of honing his hacking and reverse engineering skills than to get different images on a frame he could’ve simply gotten a flash drive for.
@uky These were the included demo photographs, the device still has USB and SD capabilities. Which I had neither available which kind of inspired the idea.
@localroger the actual changing of the firmware was surprisingly easy, the only really hard part was building the tools to do it, which will be used on more than just this project. I wanted to learn how to download data of such chips, this was the test run basically, not really a lot of hassle. I have zero use for the gadget anyways, this was a good way to get some value out of it.
@st2000 if you search the internet, this particular frame has its source code available, its a generic one I believe. DVD capabilities are built into it, but no hardware. So there is that route if you’re good with cross compiling. If you were crafty enough, you could probably force the SD into SPI mode, and then spoof the file system or something like that, or possibly share the SD card between the two. It updates every 5sec max, I’m sure you could probably change that, possibly with out a complete rebuild. This was one of my first ideas for the frame, its just learning how to download off serial flash was something I needed to do.
@st2000 yeah, the prop mod isn’t suitable for what you want to do because it can’t display a photographic image. It’s meant for using the frame as a very cheap dense text display.
@PhilKll you have the source code for this thing? From where?
First of all: WTF is all the effort in ‘protecting’ the damn thing for? They seem to be trying harder than sony does for userinfo.
Second, I would like to see someone find a way to emulate a SD card and then connect that to a makeshift thingy that you put in SD card-using devices to hack them that way, a way to add data live while making the device think it’s just an SD card, a bit like that wifi-sd-card does but then done by the amateur.
Since the SD system is wellknown it should be doable.
@localroger
The source code for the photo frame is linked on the project page.
http://www.hackchina.com/en/cont/129173
It is also where he got the datasheet for the processor.
@Flood_of_SYN
I just read your reply on hackday. I was wondering if you stil have the source code laying around?
@Whatnot there was no protection on it at all, the JPEG images were there for the taking, its just they are in the firmware, which is stored on the Serial Flash chip that the processor loads its instructions from. Its just a mater of taking the chip off, downloading its contents, changing them, and reprogramming it. The protection isn’t really protection, just a matter of those images weren’t meant to be accessed or changed as a feature.
As for the SD or USB stick adapter to a computer, this is something I want to do, and will give it a go someday. Just need to build up some more skills and figure out the right parts to make it happen.
Did I mess something? I wanted to look at source code so I downloaded this:
1528765 May 7 15:40 d6659a7e718a.rar
But only found this stuff inside:
542720 Apr 12 2007 CT952-ROAD-WELL－VER1.2.DSN
146 Apr 12 2007 CT952-road-well－VER1.2.txt
1662122 Apr 12 2007 CT952-road-well－VER1.2.pcb 1514454 Apr 12 2007 CT952-road-well－VER1.2.asc
60928 Apr 10 2007 CT952-Road-Well-VER1.2.xls
15360 Apr 6 2007 电流.xls
1309416 Apr 4 2007 DVD909.rom
Looks like mostly board layout stuff.
Guess I’m kind of jaded. I don’t like these new Pacific rim players. I’ve been down this road buying hardware and poking around in these so called source code files. Only to find the important bits of code have been left out. I already have a pile of SigmaDesign boxes. And I really don’t want to add Amlogic boxes to the stack.
@Whatnot
You’re not the first to think of this. And I have never found such a device for an SDCard. One problem – you might have to emulate both the 4 bit and 1 bit SDCard data bus. It depends on the device you put the SDCard-emulator into. On top of that, this does start looking like a two-port-video-ram device.
Regarding USB: I believe Microchip runs a USB Client class for (I think) their PIC 18F USB evaluation board. In that class I kind-of remember the PIC emulating a USB Thumb Drive.
But even if you could drop images onto a media drive to display on a picture frame:
1. You probably still have to “manually” start the picture frame reading the images off the drive.
2. You have hacked to a point you might as well have started from scratch. Like with a used NetBook or similar laptop. You will get something much more flexible. And it probably could do complex tasks autonomously. Like scrape the web for weather reports or stock prices.
http://www.hackchina.com/dlpre.php?lang=en&id=99877
This looks to be the source code, its not the exact same, I imagine the manufactures change it up as needed, as the chip is used for various things, as it is capable of a lot more than its being used for. It has DVD playing capabilities, which I did find in the firmware.
Finding the toolchain to cross compile it didn’t turn up much. A bit of research turned up its eCos OS and an ARC based chip. But thats as far as I got.
I have a very similar device and also have dumped the flash for analysis. I confirmed it’s a SPARC-based device (V8, big endian) based on tips here and a bit of disassembling.
If your device is like mine (or anything else I’d expect…) the first instruction in flash should be a jmp to some address containing code needed to start copying everything into RAM. You’ll also see the IVT following this first instruction.
The next bit of analysis will be identifying at what point control is transferred to the code in RAM and going from there. At that point I think it might be interesting to look at some of those source files and .o/.a files linked above to find common strings of opcodes, which I hope would be some standard libc calls.
jrspruitt’s website is no longer there. Where can I find the info on how he hacked it?
@someone may be http://www.jasonpruitt.com/users/jason/projects/_c/Hacking/_p/Coby_Photoframe
Looks like it is here now:
https://jasonpruitt.com/Hacking/_PROJECTS/Coby_Photoframe/
Link and the video do not function anymore…