When do we start hacking the CECB's ? [Text View]

doublejack

04-10-08, 01:18 PM

I love hacking electronics of all descriptions. ... Hacking a STB is kinda pointless though.

No, you're missing a huge possibility. If a CECB could be hacked to tune in channels via QAM that would be a massive breakthrough. There are probably many others like me that have premium cable service only to their primary TV. That works because I can pull in a limited number of analog channels to my other TV's, like the one in the garage. Now, I could buy something like a Samsung 260 but it would be hard to justify that level of expenditure for a seldom used 13" junk TV. Or I could deal with the hassle of an antenna and a stock CECB, but that isn't really cheap either. Optimally, if I could pair a CECB with the cable already run to the TV that would be the cat's meow. Even if I didn't use a coupon for the purchase, it would still be worth $50 to me to buy a CECB for face value and mod it to work.

The trick is finding a CECB that should have the native ability to tune in QAM, and then figuring out how to enable that feature.

hahaha...

she hacked it to work with another brand of liquid. The danged thing is designed to only accept Swifter brand solution which, apparently, is twice the price of her preferred brand.

She was pretty proud of herself.

My wife did this too, or something similar. What she did is figured out how to open up the Swifter brand bottles and fill them with whatever cleaner she desired. The way they are made is as a one-time use disposable item. So not only is she saving money and using better chemicals (per her determination), but she's also recycling!

Whidbey

04-10-08, 01:46 PM

No, you're missing a huge possibility. If a CECB could be hacked to tune in channels via QAM that would be a massive breakthrough. There are probably many others like me that have premium cable service only to their primary TV. That works because I can pull in a limited number of analog channels to my other TV's, like the one in the garage. Now, I could buy something like a Samsung 260 but it would be hard to justify that level of expenditure for a seldom used 13" junk TV. Or I could deal with the hassle of an antenna and a stock CECB, but that isn't really cheap either. Optimally, if I could pair a CECB with the cable already run to the TV that would be the cat's meow. Even if I didn't use a coupon for the purchase, it would still be worth $50 to me to buy a CECB for face value and mod it to work.

The trick is finding a CECB that should have the native ability to tune in QAM, and then figuring out how to enable that feature.

I'm really not totally understanding this - you want to hack a CECB to tune "in the clear" QAM channels, which I assume are just HD counterparts to the SD channels already available without a box, and the CECB will downcovert them to SD for an older TV. Why? Are there extra channels on QAM?

adrianblack

04-10-08, 02:57 PM

Not sure if you guys saw my post in the DTX9900 thread, but I have a DigitalStream DTX9900 converter and took it apart after I got it.

http://www.flickr.com/photos/adrianblack/2394475058/sizes/l/
http://www.flickr.com/photos/adrianblack/2393646939/sizes/l/in/photostream/
http://www.flickr.com/photos/adrianblack/2394480440/sizes/l/in/photostream/

I put the serial TX pin on my O-scope and found it to be transmitting data when turning the box on and off and also when pushing buttons and changing channels.

So I bought a serial converter board and am going to see what kind this port can do. I'll post and update when I crack open the box again.

http://farm3.static.flickr.com/2170/2401653442_75b70e1d79_b.jpg

doublejack

04-10-08, 03:25 PM

tzank

04-10-08, 03:31 PM

wblynch

04-10-08, 05:06 PM

dattier

04-10-08, 06:42 PM

The menus of the Digital Stream DTX-9900 include a function to scan for QAM channels. I'm surprised it wasn't removed for the CECB version. Naturally I couldn't resist sticking the cable company coax into it and trying a scan, and of course it found no channels.

tzank

04-13-08, 12:31 AM

This is a topic I have been wondering about. Could there be a hidden service or engineering menu in any of these CECBs? There would be a "secret" key press combination that would activate such a menu. Also, such menus could also be accessed via a console connection via the box's serial interface.

These menus are found in many devices such as cell phones, tv sets, DVD players, and cable television HD/DVR converter boxes. The Motorola DCT series HD/DVR boxes have a complex engineering menu available through a console serial port connection using a special card that plugs into the TV Passcard slot.

I find all of this to be quite fascinating! :D

Tim

satpro

04-13-08, 02:16 AM

RCA has a hidden menu, I couldn't get it to do much, but it is there.
see this post
http://www.avsforum.com/avs-vb/showthread.php?p=13402176#post13402176

wmcbrine

04-13-08, 03:11 PM

Here's an idea for any hacker-friendly CECB manufacturers out there:

We know HD outputs are banned. But, what about dual sets of video/audio composite outputs? I ask because, if you had two, then maybe you could set things up so that a firmware change would turn one set into component outputs. (You'd need the second set so you'd still have audio... unless digital audio outputs are allowed?)

OK, so it's never going to happen. But a man can dream.

tvropro

04-13-08, 05:13 PM

You could add a second set of composite video outputs to any CECB. Just take the video before the 75 ohm matching resistor to ground and install a buffer amp there. Then feed it to 2 outputs. It isn't that hard to do.

WackyPacks

04-14-08, 02:21 AM

Any hope for these? The Zinwell CECB's product page on exdigitaltv says the boxes are "software upgradeable".

ZAT-856
http://www.ezdigitaltv.com/Zinwell_ZAT-856.html
ZAT-970
http://www.ezdigitaltv.com/Zinwell_ZAT-970.html

The Fuyai ATSC 630 also uses the upgradable term as well & even includes a QAM tuner according to their own webpage, though I doubt the tuner feature actually works.

Fuyai ATSC 630
http://www.fuyai.com/atsc_home.htm

Jim McCauley

04-14-08, 07:33 PM

Any hope for these? The Zinwell CECB's product page on exdigitaltv says the boxes are "software upgradeable".

Dunno how authoritative this page is (they appear to have the wrong picture for the product), but they claim upgradability via RS-232!

http://williambryson.blogspot.com/2008/02/zinwell-zat-856-atsc-converter-box.html

Jim McCauley

drlava

04-15-08, 04:28 PM

adrianblack

04-23-08, 01:28 AM

I put the serial TX pin on my O-scope and found it to be transmitting data when turning the box on and off and also when pushing buttons and changing channels.

So I bought a serial converter board and am going to see what kind this port can do. I'll post and update when I crack open the box again.

I got my serial converter board today. It came from Bulgaria! Ebay is amazing.

Anyway, I'll bring home the DTX (from work) and try it out this weekend. What's cool is the converter board even has the same 4-pin header the DTX has, making connections even more easy!

Jim McCauley

04-25-08, 12:24 AM

What's cool is the converter board even has the same 4-pin header the DTX has, making connections even more easy!

Please let us know when you have booted Linux on your CECB :D

Jim McCauley

aethyrmaster

04-25-08, 08:07 AM

Yeah, but can you imagine the install time to copy it over via SERIAL? Even with BusyBox that'd probably still take a while.:p

Jim McCauley

04-25-08, 11:47 AM

Yeah, but can you imagine the install time to copy it over via SERIAL? Even with BusyBox that'd probably still take a while.:p

No kidding...

Which brings up a point -- is this link like a 20 ma current loop? I suspect so, since there are no hardware handshaking lines -- just TX/RX/GND, right? Or is there a UART buried in there somewhere to support software handshaking? IIRC, something like a current loop will give you 110 baud, but if there's a UART, you might get more substantial data rates.

Jim McCauley

ota.dt.man

05-19-08, 12:06 AM

I wish someone would hack the Samsung DTB-H260F. Figure out if anything can be updated or modified through the USB port.
Agreed! I would like to see this model:

Also display menus & CC on S-video output for TVs that lack component inputs.
Have additional aspect ratio choices for 4:3 analog SDTVs

And since the DTB-H260F is not a inexpensive CECB, it may be more worth the effort to modify it.

Thanks!

ota.dt.man

05-19-08, 12:19 AM

The CM-7000 shows promise for enabling s/pdif coax out. There is a digital stream going to a few blank pads for a pair of buffer transistors, which lead to an unused output. Information on this page:
http://www.avsforum.com/avs-vb/showthread.php?t=1004274&page=3

drlava,
I like the way you think! I started this thread, CM-7000: Re-enable digital audio out? (http://www.avsforum.com/avs-vb/showthread.php?t=1029964) (based on earlier posts) before I found this thread.

SirVette

05-19-08, 08:51 AM

I love hacking electronics of all descriptions. ... Hacking a STB is kinda pointless though.
I do too- I have the ideas & then have the EEs do the mods.

If someone hacks it to output HDTV ...

Beaker74

05-20-08, 05:18 PM

I got my serial converter board today. It came from Bulgaria! Ebay is amazing.

Anyway, I'll bring home the DTX (from work) and try it out this weekend. What's cool is the converter board even has the same 4-pin header the DTX has, making connections even more easy!

Hey Adrian, any luck with hacking that guy yet? Just checking. It's been a while.

aethyrmaster

05-21-08, 07:55 AM

Just a quick note: Check the Tivax thread for some info on what we've managed to get out of the serial port!

http://www.avsforum.com/avs-vb/showthread.php?p=13881421#post13881421

It continues on for a little bit too.

Jim McCauley

05-22-08, 11:47 AM

bizzybody

05-28-08, 02:48 AM

Somebody wake me up when the S-Video hack for the DTA800B is figured out. ;)

I have until July 22 to use my second coupon, hopefully more boxes with S-video will be available by then, or there will be all kinds of nifty hacks for others.

P.S. A while back I got lucky on getting two early version Apex AD-1100W DVD players that had the ability to be hacked to eliminate region codes and to be "VCR friendly". So far I've never played a non R1 DVD nor have I copied a disc to tape but I could if I wanted!

P.P.S. My DTA800B gets all the available ATSC stations here except for 2.1 (CBS) using a real POS old collapsible motorhome antenna I have up on the roof. PBS runs up to 4 channels, ABC and NBC stations run two each while FOX and CBS are stingy cheap outfits with only one channel each. PBS' offering is one full-time HD and three standard def. CBS goes HD (get it on my 37" Magnavox) when they run HD shows. ABC has one full-time HD and one full-time SD. NBC runs one like CBS and the other is 24 hour local news. FOX does theirs different from everyone else. It's always in HD mode and they do something funky to the signal that prevents my big Magnavox from auto-stretching their pillarboxed SD shows.

Just for the heck of it, I connected the CECB to an olde Pinnacle PCTV Pro PCI TV card in one of my PCs. Tried it first on the coax in but for some reason the tuner refused to get audio there, so I switched to the composite in and used the line-in on the soundcard for the audio from the CECB's RCA output.

m_k

06-01-08, 03:27 PM

I'm really not totally understanding this - you want to hack a CECB to tune "in the clear" QAM channels, which I assume are just HD counterparts to the SD channels already available without a box, and the CECB will downcovert them to SD for an older TV. Why? Are there extra channels on QAM?
Jumping in late in the thread, maybe this has already been addressed, but it not, you can pick up a cheap DVD-writer with QAM for about $50 and even if you don't use it as a DVD recorder, you can use it as a "set top box" converter (NTSC/HDTV/QAM to NTSC).

I got an LG on Woot for that price range a few weeks ago. I have heard of lots of others, it wasn't that rare a deal.

Now, to get on-topic<g>, what I'd like to see by way of hardware fiddling with the converter boxes would be a way to tap into the HDTV signal after it's been decoded, but before it's been RE-encoded (to NTSC), and then, use that ouput to drive an analog computer (CRT) monitor. IMO nothing matches the image quality of a good CRT, and the Last Great Generation of computer monitors had incredible quality -- extremely fine dot pitch (or line pitch for the Trinitron variants), nice high maximum refresh rate, very flexible in terms of scan rates, etc. I think it'd be doable for someone the knew their way around inside these things (the converters). I don't think any modifications would need to be done to the monitors -- and they're a glut on the market these days.

Sure, it wouldn't be 62" super-wide-aspect-ratio, but, it *would* be near-photographic quality, and, likely to outlast any "modern" hardware (won't burn-in like a Plasma, no gradually dimming panel like an LCD, no several hundred dollar lightbulb like a DLT...

Ah, well, a man needs his dreams!

whitis

06-05-08, 04:48 AM

Some hacking possibilities

Some boards may have pads where you can solder an s-video or smart antenna connector. If not, you may still be able to add one but it is trickier.
Channel change for VCR/DVR recording on boxes with RS-232 ports. You could hack a TiVo or MythTV to send the satune (probably for smart antenna, not tuner) or zir commands to allow automatic recording.
Heavier duty channel change hacks:
Program a small microcontroller to take Sony S-link, or similar, from a VCR and send the channel change commands to the box.
program a microcontroller to send channel change commands to a box and IR blast, S-link or similar to a VCR or DVD recorder.
Composite video/audio passthru. If your TV only has one set of video inputs, for example, you might want this for your DVD player.
JTAG - lets you muck with all kinds of stuff including firmware downloads. There are likely to be JTAG pads on many of the boards.
USB to TTL/CMOS serial converters. The SoC chips probably have serial ports (kinda like the Tivax) even if they aren't brought out.
VGA monitor RGB outputs or component outputs. Only SD. But some people use surplus monitors as TV sets.
Closed caption readout over RS-232 port
Power mods. DC supply for AC supply units and vice versa. Make it be a dual AC/DC unit. Battery power. Useful for emergencies.
dump broadcast format info
use i2c or raw frequency tuning commands and signal level (before demodulator) commands over RS-232 to turn unit into a spectrum analyzer.
hack smart antenna functions to control VCR or other recorder.
add missing channel change buttons. Maybe even a menu and OK button. So it can work without a remote. The zoran reference design has at least 5 buttons.
build in a remote control so you can control all functions when the other one is missing.
internal IR blaster
RF analog passthru. You could substitute a tuner module, though the replacement one may be hard to obtain. You might also provide the missing components on the existing tuner module.
Baseband ATSC input (the digital equivalent of a composite video input). Most people don't have ATSC sources but useful for those that do.
progressive scan output
kill macrovision output if you have a TV/VCR combo that freaks out. (if any programs turn it on).
build the converter box into your TV set.
use the smart antenna connections to get your TV to tune to appropriate channel (and enable passthru) so you can channel surf across digital and analog channels
enable NTSC tuner, where present, so you can channel surf across digital and analog channels (may require substantial firmware mods).
change the threshold for channel autoscan
Hack a VCR so it uses the video inputs when it thinks it is using the tuner and have a microcontroller sense (using i2c or prescaler output) what channel it is attempting to tune to, map that to a digital channel number, and send RS-232 commands to the CECB box to tune that channel.

Now some of these may be more trouble or cost than upgrading equipment but some people might find it more fun, and educational, to do things the hard way.

bizzybody

06-05-08, 02:27 PM

Hack the firmware to allow manual direct tuning of digital channels. Such a "brilliant" idea to leave that capability out, same thing for boxes that don't allow manually adding channels to the scanned list.

Anything to do with analog NTSC is going to be a non-starter for hacking because of the limited lifespan of the hack. According to the commentary on the Final Rule, some companies wanted to leave out analog passthrough because it had a negative effect on signal strength. Come Feb. 2009, look for hacks to eliminate analog passthrough. ;)

whitis

06-05-08, 04:22 PM

Some more hacking possibilities:
[LIST]
add an LED channel number (major only) display using smart antenna datastream.
Use it with a computer (RS-232) or TV as a smart antenna controller (testing purposes).
Use RS232 (shenzhen MTC) to dump firmware using memory modify/display commands. Or use JTAG or direct connection to SPI flash pins. This allows upgrading another box with outdated buggy firmware.
[LIST]

whitis

06-05-08, 10:08 PM

Hack the firmware to allow manual direct tuning of digital channels. Such a "brilliant" idea to leave that capability out, same thing for boxes that don't allow manually adding channels to the scanned list.

There is a whole boatload of things that could be done if you do major hacks to the firmware. Lacking the source code, however, this could be an enormous amount of work. Little changes like modifying the initialization of a variable aren't so bad if you can use a monitor like zrmon and/or jtag hardware breakpoints to help determine the location.

Anything to do with analog NTSC is going to be a non-starter for hacking because of the limited lifespan of the hack. According to the commentary on the Final Rule, some companies wanted to leave out analog passthrough because it had a negative effect on signal strength. Come Feb. 2009, look for hacks to eliminate analog passthrough. ;)

Using NTSC tuning capabilities (where present) eliminates the signal drop due to analog passthru and is much easier to use. But probably major firmware hack. The complaint about analog passthrough reducing signal strength assumes the passthrough doesn't have a preamp before the splitter. The version of the thomson tuner used in some boxes has an optional passthru model that does have a preamp. They same folks who argued against passthru argued that users could implement it externally (splitter, two a/b switches, lots of cables, lots of clutter, lack of remote control) which would be inferior in many ways to a good internal implementation.

It is an oft-repeated myth that all analog channels are going away real soon now and that NTSC capabilities will soon be useless. Low power stations, Class A stations, repeater/translator stations, canadian stations, mexican stations, are exempt. There are also security cameras and other devices around the house that may still generate an NTSC RF modulated signal. Some people use satellite plus off the air and have an RF modulated output of their satellite box distributed around the house to other sets. NTSC has been around for decades and a lot of devices use it. You can feed the output of a DVD player, VCR, DVR, satellite box, etc. through a modulator, into your antenna distribution system and be able to move from room to room. Fewer people will need it after the transition date, but not none. Baseband NTSC (composite video) will still be used in most homes with old sets to hook up VCRs, DVD players, video games, etc. so composite A/V input hacks are not affected by the transitions.

But unless a box manufacturer left the NTSC code in and just disabled it with a variable, it could be a lot of work to add back. It isn't the benefit side of the equation that is the problem, it is the cost side. For the manufacturer the cost would have been negligible but for hackers the reverse engineering cost is potentially very high.

Yes, some people with weak signals and poorly implemented passthru may hack out the passthru. But since passthru is missing from the commonly available units, people who have it will have wanted it enough to get a unit that has it and not necessarily to get off the air stations. For example, they have a DVD player, RF modulator, and TV with no composite inputs.

For OTA reception of mixed analog/digital broadcasts, passthru (vs. NTSC tuning) was a pretty crude hack - people are going to hate having to turn the converter off and on to surf all their channels. An NTSC/ATSC to NTSC converter would have been far more user friendly. And while some of the chips used in these boxes left off the NTSC tuning, that seems pretty foolish. Consider the Zoran Supra741 chip which omits NTSC. The first thing it does is use an ADC on the ATSC signal It is pretty trivial to modify that to get black and white NTSC. Color is a little more work. You need some filters, the color demodulator, and a sync separator (trivial). The company already has ATSC/NTSC macros they use on other chips; the extra silicon area should be very small compared to other functions on chip.

whitis

06-06-08, 01:35 AM

In response to tvropro's interest in having duplicate a/v outputs:
You could add a second set of composite video outputs to any CECB. Just take the video before the 75 ohm matching resistor to ground and install a buffer amp there. Then feed it to 2 outputs. It isn't that hard to do.

In some cases, depending on the drive strength of the driver, you can get away with just connecting another 75 ohm resistor there. Often there is a buffer amp IC and the simple way to construct a second buffer is to take an identical IC and bend the pins so you can piggyback it on top of the other IC. You bend the output lead up so it isn't connected to its counterpart and solder a wire or a resistor there to go to the jack. You may need to double up on the decoupling caps. The piggybacking won't work if the amplifier needs feedback resistors. If you can find a board with the connectors and buffer amplifiers on it, you are golden.

The audio is pretty easy. Just connect another 1K ohm output resistor where the first one connects. On some boxes, such as the shenzhen MTC AT2016 family (tivax, rjtech, etc.) the mute is implemented by shorting across the output of that 1K ohm resistor so your second audio output won't be muted (but that may be a good thing).

For both audio and video, you may find a series cap in series with the output resistor and that you may want to duplicate as well. For audio, it is simpler to use an external Y adapter. You may be able to use one on the video as well. If your cables are short (under 6 feet) they are lumped sum capacitance rather than a transmission line at 6Mhz. For both audio and video, your signal will be somewhat weaker but the boxes on the other end may boost the gain to compensate (or you adjust brightness and volume) so you can get away with stuff like this.

These changes would be pretty simple on the shenzen ATC family. It uses a FMS6143 video amp ($0.96 digikey). The schematic is labeled "change to eliminate the IC" (and let the zoran drive directly), but since it wasn't changed before certificaitn they are probably stuck putting the IC on the board especially since it is both filter and driver. If they did eliminate it, that would probably have involved shorting C34 and U6 pin 1 to pin 6 which affects us very little. If there is an empty pad we either cut the trace and piggyback two ICs or leave it there and install one with pin 6 bent up into the air. The IC is surface mount but it is a SOIC (0.05" lead spacing) so it isn't hard to work with.
But wait, there is more. Though it doesn't show it on the schematic, that IC is actually a 3 channel amplifier and only one channel is used. Short Pins 1,2, and 3 (the inputs) together and you can tap off two extra video signals on pins 6 and 7 with a series resistor and capacitor. This chip doesn't actually appear to need the input capacitor shown on the schematic. The zoran chip appears to have some extra video inputs as well, though there are two problems: 1) software probably doesn't support, and 2) they are on BGA pins you can't get too unless the board designer included vias for every pin whether it was used or not and it does not look like that was the case.

The schematic is included in the FCC filings. Can't link but lookup UVD20071228001 under eas reports.

That board has a rather high parts count, unnecessarily. Each extra component costs you 1) the price of the component, 2) board area costs, 3) part placement cost, 4) yield reduction, 5) solder, and 6) reel feeder setup cost for each unique component. If I had designed the board, I might have been able to shave the cost enough to be able to throw in all the features allowed by law. There are lots of 2N3906 transistors (each accompanied by several resistors) that could have been replaced with 1/6 of a hex inverter and maybe 1 resistor. The RS-232 is one example, it produces a substandard 0-12V (instead of +/-12V output) which doesn't work any better than a 0-5V output. 9 components, could have used 1/3 of a hex inverter plus 3 resistors for 3-1/3 components. The smart antenna circuit could be done similarly. The mute circuitry (4 components, plus 10 on another page) should be totally unnecessary - you can do that in software, though it looks like they may have had a problem with spikes on power up that can probably be eliminated by being smarter about your DAC initialization sequence. The audio amplifier/filter uses lots of components. A mini-din connector for s-video costs $0.40 qty 1000 US from an expensive distributor, plus soldering. And the tuner/modulator with built in pass thru can't cost much more than the version without since it is just a few extra components stuffed on a module that already has sites for them and CECB's are about the only devices on the planet that don't do passthru. Asian companies do this a lot. They are too cheap to spend $0.50 on an IC so they try to roll their own, but if you need 21 extra components at $0.36 to avoid using a $0.11 IC, you are $0.25 in the hole even before you count stuffing cost. 12 components to mix left and right audio for the RF modulator when two 100K resistors and a cap would have done the job better. Why buffer something (with an input impedence of 10K) when you are going to put it through a 100K resistor? And why use two transistors and two resistors to make two copies of the video signal when you have two unused amplifiers in an IC on the same signal?

whitis

06-12-08, 04:55 AM

Way back in my Apple ][ days, I fiddled around with data transmission over that computer's game paddle port, which featured several "annunciators" for outbound bits and a couple of leads that could serve as input ports. Here is a link to a project that went further than I ever did: http://members.aol.com/MJMahon/NadaNet.html. See "Documentation Links" for all the deliciously gory details.

After taking a look at the CEA-909 spec, it occurs to me that something similar might be hackable on the Smart Antenna ports of certain models of CECBs. There's a fundamental chicken-and-egg problem, though, in that unless the system already has usable access (in the form af a UART that could support a serial interface), you can't get there from here in terms of data communication.

One of my CECBs, an RCA DTA800B, has a Smart Antenna interface. The physical port provides six wires, which is a puzzle, because the TVP9900 spec document requires only one line (and presumable a ground) is needed for bidirectional communication. According to the spec, in the "B" mode that supports bidirectional communications, a 14-bit stream goes out to the antenna and a 10-bit stream comes back from it.

You could bit bang TTL serial 9600 baud or so. But you only have one pin, not two. And you can get boxes (Shenzhen MTC/tivax family) that already have RS-232, with a serial monitor. The limit on the box side is not having access to the source code. Unless you have deep pockets and buy a development kit from Zoran or whoever makes the chip in your box.

However, you can do some hacking on the other end. CEA-909 devices are supposed to have a mode where you can explicitly specify 7 bits of the 14. Someone has already posted here that they used the 12V from the smartantenna connector to drive a relay to control power to the TV.
Building a smart antenna protocol based antenna selector should be practical, the standard mentions that but I don't think there are any commercial implementations yet.

One could also configure a relay so that when you tuned to a certain unused channel with the remote (leave out of your favorites list), it automatically turns on the popcorn popper :-). And you could build an LED channel number indicator (physical channel only).

And, no the interface is not 20MA current loop. It is basically an open collector transistor with a 1K ohm pullup inside the box and a 2.2K pulldown inside the antenna (for presence detection). More or less TTL or 3.3V CMOS levels. The Tivax family of boxes does it a little differently using two transistors and two 1K resistors that is roughly equivalent to putting a 1K resistor from the output of a 5V CMOS buffer.

I wrote up enough on the CEA-909 protocol to actually hack stuff here:
http://www.freelabs.com/~whitis/electronics/dtv_converters/

Furthermore, the revised spec, CEA-909A, calls for antenna control data to be piggybacked onto the coax connection to the antenna, so why the six-wire port even exists is a bit of a puzzle.
Jim McCauley
The CEA-909 (without the 'A') illustrated how to do this with a tone encoder but didn't specify the frequency to be used.
Building a box that uses the coax interface would need additional circuitry and it would need a special tuner/modulator module that gave internal access to the RF connection, you would need to shield the circuit so you didn't muck up the TV reception, and since you are connected to an antenna you would need to not radiate interference out through the antenna to the world. Basically, you would want a tuner/modulator/CEA-909 module and I doubt anyone makes those.

drlava

06-17-08, 01:12 AM

WeThePeople

06-17-08, 01:36 AM

Gosh I wish I didn't get pissed off from the performance of the last seven models I purchased. I saw unused pads in more than a few. But they last less than a week before I get super pissed at the performance.

I have not, nor will I return the (overpriced) CM-7000. It handles all my rural trees and nearby international airport have to offer (Unlike the previous 7).

Any CM-7000 board level technician questions welcome. :)

Malouff

06-17-08, 01:53 AM

WeThePeople, can you tell us what your other 7 CECBs were?

WeThePeople

06-17-08, 02:18 AM

DTX-9900
DTX-9950 (Lit on fire btw...)
Zenith DTT-901 (Absolute top runner up!)
(Looking for a Thompson tuner 900 currently)
RCA DTA 800 Third worst
RCA DTA 800B Second worst
Magnavox TB100MW9 WORST POS !!!
Philco TB100HH9 odd unit

WaltA

06-17-08, 08:26 AM

The first thing that should be hacked is the time out feature designed to save energy. The CECB's turn themselves off after about 4 hours of no activity.

My GE STB (from Target) has an option in setup to diable that, and even had a yellow slip of paper in the box pointing that out.

WaltA

06-17-08, 08:33 AM

No, you're missing a huge possibility. If a CECB could be hacked to tune in channels via QAM that would be a massive breakthrough.

...

The trick is finding a CECB that should have the native ability to tune in QAM, and then figuring out how to enable that feature.

I have to agree!

I would even pay full price ($50-$70 w/no coupon) for a box like the DTVpal, that simply added a QAM tuner.

Being able to take the "digital" EPG info from ATSC (and QAM) channels, and adding it in a TVGOS format on the CECB's analog NTSC output, would be another feature I would like to have.

ota.dt.man

06-17-08, 02:20 PM

Just received a CM7000. It has a JTAG header :) Also pads for digital out. There is digital (possibly s/pdif) data on RA7. Further testing may confirm the validity of the stream.

Also, have a look at RA14 RA15 RA16. To me they look like they could be YPbPr lines, if they were turned on with a different BIOS. Further support: the 7707 controller chip in there is closely tied to the STM7710, both models advertised as being HD capable on some foreign ST sites.
drlava,
Congratulations on your new CM-7000! I hope you like it.

Your initial report sounds very promising - digital out and perhaps even YPbPr lines too! :cool: I look forward to your future reports.

ota.dt.man

06-17-08, 02:27 PM

I have not, nor will I return the (overpriced) CM-7000. It handles all my rural trees and nearby international airport have to offer (Unlike the previous 7).

Any CM-7000 board level technician questions welcome. :)

WeThePeople,

Glad to hear that the CM-7000 performs so well for you in comparison to all the other models you've tried.

Would you be interested in collaborating with drlava to develop mods for digital audio out and/or component video outputs for the CM-7000?

Thanks:)

WeThePeople

06-19-08, 03:07 AM

I will be slightly scarce due to my ripping apart my house for an addition over the next few weeks. But sure, when I sit down at the end of one of these days I planned to shred the thing to the last screw for scrutiny anyway.

I'll throw a set of oscilloscope probes at the pads and see if the firmware left these funtional and report here to start.

zaphod7501

06-21-08, 03:03 PM

There is a service menu on this model, although it has little value right now.
You can get into it with a JP1 remote using "advanced codes". (details if desired)
The service mode offers the following options:

Front Key Test
HVRAM Test
Factory Reset
Exit
Service Mode (Submenu options: Lock Region - USA, Canada, Both)
Start Download

Going into the mode requires you to do a full setup afterwards even if you just exit. I suspect that accidentally hitting "Start Download" could brick your box.

Avio

06-22-08, 02:31 PM

There is a service menu on this model, although it has little value right now.
You can get into it with a JP1 remote using "advanced codes". (details if desired) ... I'd like to know the details. If you have codes in Pronto hex format, that would be great. I don't use JP1 remotes; instead I use Device Infrared Hex Codes (http://www.remotecentral.com/cgi-bin/codes/) to custom program universal remotes controls.

I use the codes with my PC and a device called USB-UIRT to program my remotes. See:

http://usbuirt.com/

Thanks. Avio

zaphod7501

06-22-08, 08:43 PM

I was hoping to find something interesting, (like the "Freeze" command for the Digital Stream DTX9900) when I was running through the codes. I think there are tools to go from Pronto to JP1, but I don't know about the reverse. In JP1 parlance, the info is as follows.
Protocol: NEC1
Device Number: 247 These are just the basic parameters of all the command codes that operate the box.

EFC: 079
OBC: 234
Hex: A8 These are the different ways to designate the specific command.

Makehex is one utility. http://www.hifi-remote.com/forums/dload.php?action=file&file_id=5209
The OBC code is used as the "Function" (234)
And the "Device" is 247
Note: I have never used this utility myself, There is a readme in the zip.
If you can't download it, I'll try and run it; but it could be a usefull tool for getting Pronto Hex from the JP1 library.

BFWE1ATNET

07-05-08, 05:00 PM

I'm having difficulty understanding why a hack (modification) cannot be made from these converters as the units recieve the digital stream exactly as broadcast then somewhere in the circuitry it then downconverts to 480i.Can't we go from the tuner/reciever directly to a digital to analog chip as is used in most computers to send digital video information from mobo to vga monitors and bootleg the source recievers signal to any VGA monitor?(I have some electronics knowledge never schooled just learned on my own as hobbyist) so excuse my ignorance if any is apparent.I would (if I had the extra resource & may soon have dead Mobo) take from such a source the circuitry from mobo to vga & try to duplicate or use the design to see if that modification makes sense to get video output to vga from the units reciever.(BTW years ago when we used to have RGB monitors & my monitor died I modified the output signal with a few capacitors & finding the video signal from the rgb output used my computer with my tv without any other hardware until I got a new monitor.)

eyager

07-05-08, 08:31 PM

Most (all?) of the converters use system on chip designs. The mpeg decoder, scaler, graphics engine for osd overlays, and video modulator circuits are on the same die. Since CECBs are being made by the millions and an integrated RF modulator is needed for outputting a NTSC signal to channels 3/4, the chips used are purpose built for that application. They are not taking chips designed for use 1080i/720p HDTV's and adapting them for use in a set top box. Even if the chips were capable outputing an HD signal, you would have to reprogram the firmware to enable it.

The only secret video outputs you are likely to find are svideo and component video outputs operating at 480i.

BFWE1ATNET

07-06-08, 07:30 AM

Thanx for the reply but as per the block diagram here noted from Digital Stream cecb it appears to have seperate decoder chips to downconvert the HDTV signal to 480i.Since it seems newbies cannot post url's I'll include it in next post.

BFWE1ATNET

07-06-08, 07:31 AM

http://www.dstreamtech.com/product/product_detail.asp?idx=6

blue_z

07-06-08, 07:56 PM

... as per the block diagram here noted from Digital Stream cecb it appears to have seperate decoder chips to downconvert the HDTV signal to 480i.

Hi there

You're misreading the block diagram.
The "video dec"oder is fed a CVBS signal, which is composite video.
http://en.wikipedia.org/wiki/Composite_video

The signal out of the tuner block that is of HDTV interest is the "TS" or Transport Stream. That goes into the SOC that eyager mentioned, that contains the TS demux and MPEG decoder.

I'm having difficulty understanding why a hack (modification) cannot be made from these converters as the units recieve the digital stream exactly as broadcast then somewhere in the circuitry it then downconverts to 480i.
The high def video is downscaled while it's still digital data. You're not going to find "circuitry" that performs "downconversion".

You may be underestimating the complexity of these converter boxes. That SOC in that DigitalStream diagram does not mention the microprocessor, probably because the term "SOC" implies one. The microprocessor is likely to be a 32-bit RISC chip that might use a memory management unit and virtual memory. There's probably a protected kernel and multi-threaded application firmware. If you think that reads a bit like a computer, yes, it is.

Regards

BTW the DigitalStream block diagram is _not_ for a CECB. The block diagram is for some tuner board that has DVI, a PCI card slot and a whole other bunch of non-approved interfaces.

drlava

07-10-08, 02:12 AM

Had a look at the CM7000 s/pdif pad signal tonight, and it's muted s/pdif code. No combination of remote presses un-muted it. So, something in the firmware probably has to be tweaked to turn it on. There is a labeled jtag header. who can pull the firmware?

Mike99

07-10-08, 03:56 AM

This is partially off topic, but partially on topic because I need a CECB in order to record OTA programs with one DVD recorder. And hopefully in 16:9 anamorphic mode.

I would also like to record 16:9 anamorphic from my Motorola HD STB with a second recorder. However neither recorder has component inputs and the STB letterboxes pictures coming from the S-Video output.

It looks like there is a lot of technical expertise in this thread, and that’s why I’m throwing out my question here.

Is it possible or feasible to modify a recorder’s circuitry in order to accept component video? IOW add a handful of parts to convert the S-Video input to component? I’m guessing the answer is no, based on my limited electronic knowledge. I have searched & found some component to S-Video converters, but I’ve heard the inexpensive ones do not work that well. I have seen plans to build one, but the cost would be more than what I would like to spend for a DIY project. I could buy an older DVD recorder that did have component inputs and just use the unit for conversion purposes.

My options appear to be: modify the recorder, build a converter, buy a converter, buy an old recorder. I’m guessing the last one is the most feasible. But maybe someone here has a schematic or plans that will make one of the other choices possible.

Any thoughts & suggestions would be most appreciated. And I apologize for the off topic nature of this post. Thanks in advance.

CasualOTAer

07-10-08, 10:57 AM

My options appear to be: modify the recorder, build a converter, buy a converter, buy an old recorder. I’m guessing the last one is the most feasible. But maybe someone here has a schematic or plans that will make one of the other choices possible.

Any thoughts & suggestions would be most appreciated. And I apologize for the off topic nature of this post. Thanks in advance.

RE your fourth option, have you read
http://www.avsforum.com/avs-vb/archive/index.php/t-761474.html ?

Mike99

07-10-08, 01:22 PM

RE your fourth option, have you read
http://www.avsforum.com/avs-vb/archive/index.php/t-761474.html ?

Thank you for the reply. I have read that thread previously. In fact that's where I got the idea from. I just don't have a place to physically hold another component, not easily anyway. So a small black box would be easier to hide, or of course modify a recorder. I was keeping track of a recorder on Ebay, but the seller retracted the item.

Oversimplifying things, it seems if a DVD recorder can be made with component inputs that it must not be an expensive thing to do, at least not at the manufacturers level. So I'm kind of grasping at straws, so to speak, hoping that a chip and a handful of parts can do the job.

JHBrandt

07-28-08, 12:15 AM

This is partially off topic, but partially on topic because I need a CECB in order to record OTA programs with one DVD recorder. And hopefully in 16:9 anamorphic mode.

This part sounds easy. Most CECBs have a "full" picture size mode that is 16:9 anamorphic. In your case I'd recommend the CM-7000 since it has s-video. (The Apex DT250 also has s-video and anamorphic mode, but there have been complaints of vertical overscan.)

I would also like to record 16:9 anamorphic from my Motorola HD STB with a second recorder. However neither recorder has component inputs and the STB letterboxes pictures coming from the S-Video output.

This sounds a lot harder. The component outputs of your HD STB are probably at 720p or 1080i. The biggest problem you'll face won't converting from component to s-video; it'll be downconverting to 480i. I don't think that's practical (but if anyone here can prove me wrong, feel free to enlighten me!)

dp3659

07-31-08, 11:27 AM

I had read somewhere on this forum about certain converter boxes which would return to a full operational state after a power outage or simply being unplugged. Of course, the Zenith box will not do that.

With some experimentation and luck, I seemed to have discovered a method to allow this to happen with the 901.
I discovered that if the unit is unplugged while "holding in" the power button and either one of the channel selection buttons on the front of the unit, once the power is restored, the converter automatically comes back to the original full operational state.

If you are just a bit handy with a soldering iron, simply remove the front cover from the converter and this will allow access to the underside of the circuit board holding the switches. I just soldered a jumper across the two switches to leave them in a "constant on" position.

Of course, this leaves the buttons on the box inoperable, but the remote is still fully usable for all functions and the converter will always come back on to the last setup that was in use before the power disruption.

zqxthree

07-31-08, 11:38 AM

I discovered that if the unit is unplugged while "holding in" the power button and either one of the channel selection buttons on the front of the unit, once the power is restored, the converter automatically comes back to the original full operational state.

This brought to mind a related question, has anyone found any undocumented "Easter Eggs" in CECB's?

Z_MadDawg

07-31-08, 04:29 PM

what about that service jack on the dta800B? is there anyway to modify a usb or firewire cable to connect it to pc?

Z_MadDawg

07-31-08, 04:33 PM

but even if you found a way you would still have to have a way to identify it on the pc, i dont know about using ubuntu, maybe XP.

wblynch

07-31-08, 05:52 PM

Cool. The first actual hack of a CECB !!

I had read somewhere on this forum about certain converter boxes which would return to a full operational state after a power outage or simply being unplugged. Of course, the Zenith box will not do that.

With some experimentation and luck, I seemed to have discovered a method to allow this to happen with the 901.
I discovered that if the unit is unplugged while "holding in" the power button and either one of the channel selection buttons on the front of the unit, once the power is restored, the converter automatically comes back to the original full operational state.

If you are just a bit handy with a soldering iron, simply remove the front cover from the converter and this will allow access to the underside of the circuit board holding the switches. I just soldered a jumper across the two switches to leave them in a "constant on" position.

Of course, this leaves the buttons on the box inoperable, but the remote is still fully usable for all functions and the converter will always come back on to the last setup that was in use before the power disruption.

blue_z

07-31-08, 07:56 PM

what about that service jack on the dta800B?

Hi there

http://www.avsforum.com/avs-vb/attachment.php?attachmentid=104959&d=1205802505

From the photo, the backside of the "service jack" appears to have three conductors. Then it's highly likely to be an RS-232 serial port, with Rx, Tx and Gnd pins (unless the front of the jack turns out to be a 4-pin DIN for s-video). 115200 baud, 8-N-1 is the typical serial-port setting for such embedded computers. What an end-user can do with such a serial connection is totally dependent on what the kernel/application firmware allows the user to do. The software interface could be an unrestricted system console (unlikely), or a simple maintenance menu, or completely disabled on production boards (what you bought).

Regards

Z_MadDawg

07-31-08, 10:31 PM

thanks, got one question. if it was to have a basic service menu, or just uncontrolled, how would you access that? what windows program or linux program would recognize the box?

tzank

08-01-08, 01:24 AM

thanks, got one question. if it was to have a basic service menu, or just uncontrolled, how would you access that? what windows program or linux program would recognize the box?

You need a program called a "Terminal Emulator" to access the RS232 port on the CECBs. Previous versions of Windows provided such a program called HyperTerminal. A version of HyperTerminal is available for Windows Vista at http://www.hilgraeve.com/hyperterminal.html, but you have to buy it. You can get freeware and open source terminal emulator programs for Windows and linux on the Internet. Do a search on "terminal emulator"

The Tivax box is ready to go with a DB-9 RS232 connector and there is a thread about that box in this forum. Other CECBs might require a level converter to interface the box with your computer's RS232 port.

If your computer does not have a legacy RS232 port, you can use a serial to USB converter.

Tim

blue_z

08-01-08, 02:03 AM

Hi there

For a terminal emulator, I like to use "Tera Term Pro" under WinXP, and minicom under Linux.

To determine if the 3-pin jack is really a serial port, you'll need a voltmeter/multimeter. Find the ground pin; usually it's marked with a square-shaped (instead of round) pinpad. Try to identify the Tx pin; the DC voltage between Gnd and Tx should be between -5 and -12 volts. That's called the "marking" level when the serial line is idle. The third pin is the Rx, and would be floating at 0 volts. Avoid confusing the RX and GND by solely measuring voltage, since both are 0 volts.

Regards

dmatch

08-01-08, 10:40 AM

CorvetteC5

08-01-08, 02:15 PM

What sort of enhancements does the "full operational state" get you? Could you elaborate, please?

From the orignal post I get the impression that this mod forces the box to return to its previous state whenever AC power is lost and then restored. I believe that no new features are added to its operation. This would be helpful for someone using this box to supply a signal to a recorder for time shifting a program.

Curt

bdfox18doe

08-01-08, 07:01 PM

This would be helpful for someone using this box to supply a signal to a recorder for time shifting a program.

Or, for small cable companies / matv systems that use them to feed their subs.. :)

stevec50

10-16-08, 01:12 PM

Has anyone found a way to add an S-video output to the RCA DTA800B yet? I did a mod to run mine on +12 volts and put a heatsink on the decoder chip that gets really hot but I haven't figured out the S-video yet.

confuzzled

10-17-08, 04:32 AM

I thought that was standard?

For anybody capable, is there a way to make the on-screen menu text larger on the Channel Master?

What about a Channel Return on the RCA?

electrictroy

10-17-08, 07:07 AM

S-video on a Coupon converter box is about as rare as S-video out of a standard VHS VCR.

I have a DTVpal:

At what point do I "tap" the circuit board so I can see the ATSC data stream?

mosquito

10-17-08, 02:04 PM

I'm assuming that someone has already tried to tap into the S-Video leads on the Zinwell ZAT-970A, right? I have neither the know-how nor the time, but I did take a peak inside and it's clear a day on the PCB. I know there are some timer issues with DST on that box, but it might make a nice hack for people who want slightly better PQ on their recordings.

stevec50

10-17-08, 02:40 PM

ProfQuill

11-18-08, 02:52 AM

equivocal

11-19-08, 01:13 AM

Yep, I voided the warranty on my ZAT by breaking that little seal thingy to get at the screws, and saw the enticing S-video pads. But, jumpering that to a S-video input produced No Joy. Either there are some components missing or perhaps the firmware would need to enable that. Maybe it is a doable hack, that would be cool.

Something I'd been meaning to do since I soldered an s-video connector into my 970A is follow the path from the resistor pads next to the s-video footprint. Did that tonight and, as expected, traced paths through the missing capacitors TC15 & TC17 and more pads across from the SOC boundary. Does anyone have a pointer to the M3601C data sheet? It does sound like s-video is a matter of populating a half dozen missing positions with the right components, provided the chip actually produces s-video output.

tvropro

11-20-08, 06:56 AM

Something I'd been meaning to do since I soldered an s-video connector into my 970A is follow the path from the resistor pads next to the s-video footprint. Did that tonight and, as expected, traced paths through the missing capacitors TC15 & TC17 and more pads across from the SOC boundary. Does anyone have a pointer to the M3601C data sheet? It does sound like s-video is a matter of populating a half dozen missing positions with the right components, provided the chip actually produces s-video output.

Unless you can hack & update the firmware you may be spinning your wheels. I tried on the Magnavox many months ago to get S video to work by putting all the missing components in the pcb and ended up with no output.

Bruehaha

12-02-08, 10:05 PM

you would think these companies would provide a way for qam with a hack so they would increase their sales. Or are they worried about not becoming coupon elidgible? I suppose they are selling a ton of these without leaking a simple way to turn on QAM. I am not going to get one unless I can get QAM. It would be for the kids room tv's anyway and they are fine with the analog cable.

oldsyd

12-24-08, 01:47 AM

Are there any more hacks for any CECB boxes yet besides the Zinwell EPG hack?

I'm interested in easter eggs for the Zenith boxes and the APEX DT502

Ken H

12-24-08, 02:47 AM

I am not going to get one unless I can get QAM.You're not going to get one then.

twey

02-27-09, 10:00 PM

No, never heard of a Zinwell but the RCA 800B has an empty place on the PC board for an S-video socket with some parts missing around it and I looked at all the traces with a scope and there aren't any video signals anywhere so I think something else is missing down the line.

Just did it on DTA809 and reported on the other thread. Now you can wake...

http://www.avsforum.com/avs-vb/showthread.php?p=15932873#post15932873

The key is the strapping resistor at R452 (next to BCM chip on its right)

equivocal

02-28-09, 02:19 AM

Any images of the pcb with the mod?

twey

03-04-09, 03:57 PM

Any images of the pcb with the mod?

Here you are.

The DTA809-Svideo_mod.jpg indicates two area of interest.
1) S-Video connector and two ferrites.
2)R452 strapping resistor

S-video-filter.jpg zoom in on #1. The S-video connector is a standard foot print. Should not be too hard to get. I took one from one of the old PCI-VGA card I have and it fits fine.

R452.jpg zoom in on #2. The R436/R437/R443 and R452 all look like strapping resistors. The R443 is stalled with 10 Kohm. The R452 was added to allow s-video output (10 Kohm).

What other (and few more look alike) strapping does? Don't know yet. I only have one DTA809 and not ready to to take the risk yet(it became hard to find...). If somebody has the full spec of BMC chip to share that will be nice...

Have fun....

systems2000

03-04-09, 05:50 PM

Your last two photos are kind of dark. Did you modify the image before posting?

twey

03-04-09, 07:15 PM

You do realize that is under a microscope isn't it? Not much light I can get in that close up.

twey

03-05-09, 03:13 PM

The CM7000 has a feature (hidden) called “last known state” (in a general term). Simply say it will return to last power state after power is restored. If the unit was on, it will turn on by itself (after the 30 second RED-boot state then turn to GREEN-on state). If the unit was in “standby”, it will turn on for a second than go back to standby (RED->GREEN->ORANGE). I did not find this in the manual. I fact, the manual not even have the disable auto-sleep listed under “tools” tab.

At least for CM7000 there is no need to hack the power to let it stay on. Not like the DTA809, I found that CM7000 is powered all the time. There is no “off” state, only “standby”. This is implied in the manual under “troubleshooting” too. As far as I can tell the only place the power been gate off is the tuner.

This maybe is a "feature" the Channel Master don't want CECB to know due to the power saving concern.

twey

03-06-09, 03:31 PM

On CM-7000:

Does anybody know what the DM1 at upper left corner is for? From the measurement looks like the composite video can patched to it (with RM12). There are two pins tie to 5V, one ground and one pin with pull up (RM10).

Maybe for a modulator to go with a tuner module that does not support RF out (from the foot print, looks like they can take 3 different kind of tuner at input)?

oldsyd

03-22-09, 05:54 PM

It seems like there's quite a bit of interest in unlocking some hidden features or adding functionality to these boxes, but so far nothing really has been discovered except for:

1. Zinwell hidden EPG

2. Tivax serial port to emulate remote control

I'm amazed the famous Zenith box hasn't been hacked yet.
Any idea what this port is on the Zenith?

http://nuxx.net/gallery/d/72644-3/IMG_0897.jpg

systems2000

03-22-09, 07:14 PM

You could add channel buttons to the APEX CECB's.

I've been wondering if there is any way to pull firmware from one of these units and modify it. :confused:

The early Sunkey seems to have a better firmware and the APEX could do with a manual add.

blue_z

03-22-09, 09:23 PM

I've been wondering if there is any way to pull firmware from one of these units and modify it. :confused:

Hi there

There's an old saying about affordability:
"if you have to ask ... then you can't ..."

To modify the software you need the source code, the ABIs and hardware specs. Unless the manufacturer releases this information or an insider breaks the NDA, forget about it. This is not some 8-bit microprocessor executing just 32-thousand bytes of code. Although simple-looking and inexpensive, these CECBs have 32-bit, 200MHz RISC processors, and a real operating system about a million bytes in size plus application code of another million or so bytes. This computing capability in the CECBs is probably more powerful than what you had in your PC ten years ago, and the software is too complex to disassemble from scratch.

Regards

oldsyd

03-26-09, 08:53 PM

Well, that doesn't seem very hopeful. :mad:

Thanks for the APEX tip, I also forgot to mention these two:

a) Someone around here added S-Video to the RCA box, I think.

b) The Artec can run on 12 VDC (cigarette lighter adapter) with a
simple cable mod.

As I run across things, I'll add them here with a goal of creating a new thread someday with everything in one place.

twey

03-26-09, 09:14 PM

The Airlink101 CECB boxes are using +12V as input as well. I have one tied to a 9" car video monitor and supplied by a single +12V AC adapter (hacked) to replace my analog kitchen under-cabinet TV. It was a $50 monitor + $0 CECB. The wife love it.

oldsyd

03-26-09, 09:30 PM

Did you mod the TV to run on 12 VDC? If so, how?

The Airlink101 CECB boxes are using +12V as input as well. I have one tied to a 9" car video monitor and supplied by a single +12V AC adapter (hacked) to replace my analog kitchen under-cabinet TV. It was a $50 monitor + $0 CECB. The wife love it.

twey

03-26-09, 10:44 PM

It was a video monitor (less DVD player) for the car. It take +12V.

oldsyd

03-27-09, 02:43 AM

According to this:

http://www.ezdigitaltv.com/Additional_Features_Matrix.html

The Kingbox, Sunkey, Tatung and Zentech also run on 12VDC, but I have
not tested them.

The Airlink101 CECB boxes are using +12V as input as well. I have one tied to a 9" car video monitor and supplied by a single +12V AC adapter (hacked) to replace my analog kitchen under-cabinet TV. It was a $50 monitor + $0 CECB. The wife love it.

systems2000

03-27-09, 12:30 PM

The Sunkey SK-801ATSC uses a 12VDC positive center plug at 0.8A.

WeThePeople

03-27-09, 03:10 PM

The Sunkey SK-801ATSC uses a 12VDC positive center plug at 0.8A.

Gosh, I know I'll catch crap for this...
but the fact the connectors sleeve is negative DOES NOT indicate a negative ground chassis!!!!

Sadly, a lot of eastern TV's use positive ground to save cost also, so you need to measure first, and apply power second.

No offense meant to you System 2000, I (Almost always) respect your posts.
But thats not the whole story. I wish more people would talk about external wall-wart-/power-brick CECB's and would measure their unit for true negative ground.

Does your SunKey measure a pure short from your input DC input's negative sleeve(/pin), to RF connector griound? (Assumption made you own one because your cited this item).

I say this because slightly older LCD displays (intended for american vehicle usage) are available for cheap (eBay, CraigsList.org, Etc.) ARE negative ground by design. They are intended as primary, 2nd, 3rd, Etc. displays units for (in-trunk/in dash) displays, and are eveywhere for cheap. They make awsome cost-conscious purchases to prepare for supply main loss outages (During storms, Etc.) and other outages.

I guess I should seize this opportunity to ask the kind of people that would open this thread in the first place,
to measure for a perfect short from the negative DC input lead (Collor/pin) to the RF (Ch-3/4) connector's threaded external ground (You know, the "Other" perfect short), for any externally powered CECB's with a 12-Volts DC (Or less) unit.

Thanks for feedback

systems2000

03-27-09, 05:02 PM

My post was based on the information supplied on the "Wall-Wart."

I grabbed my trusty B&K 388A Test Bench and Ohmed the RF ports and the power port spring clip for the input sleeve. It produced a 0.3 Ohm reading.

NOTE: I see you changed your post. Much better phrasing. :)

systems2000

03-27-09, 05:17 PM

I guesss I should seize this opportunity to ask the kind of people that would open this thread in the first place, to measure for a perfect short from the negative DC input lead (Color/pin) to the RF (Ch-3/4) connectors's threaded extrenal ground (You know, the "Other" perfect short), for any externally powerd CECb with a 12-Volts DC (Or less) unit.
You mean:
"Guess" not "Guesss"
"Collar" not "color"
"connectors'" not "connectors's"
"powered" not "powerd"
"CECB" not "CECb"
right?

Just a helping hand :)

WeThePeople

03-28-09, 01:38 PM

So the Sunkey SK-801ATSC can be used in Auto/RV/Marine applications,
thats good news. Although no CECB will ever work moving of course...

Yeah, I can't type for crap. And I spell worse (Especially tired like that)! :D

You missed
diplasys = displays
feebback = feedback
extrenal = external
lol
I cleaned up the spelling a little to make it easier to read...

Do any others have a wall-wart style box they'd measure for us all?

systems2000

03-29-09, 02:12 AM

lmao :)

The Zinwell is a 5VDC input. Anyone interested?

twey

03-29-09, 02:26 AM

Everything on Airlink101 ATVC102 are ground. It is a negative ground at +12V DC in. RF in/out and AV jacks are all grounded together. In fact, the unit is a full metal shell construct that fully grounded.

WeThePeople

03-29-09, 02:52 AM

lmao :)

The Zinwell is a 5VDC input. Anyone interested?

Yeah, that one is already on my personal list as confirmed.

bizzybody

05-09-09, 12:10 AM

I could open my DTA800B and post some pics of its board. I want S-Video on this thing. :)

CECBs are like so many 1980's microcomputers with "for future use" ports and empty spots on the boards or unused mounts in the cases that never got used for anything.

Here you are.

The DTA809-Svideo_mod.jpg indicates two area of interest.
1) S-Video connector and two ferrites.
2)R452 strapping resistor

S-video-filter.jpg zoom in on #1. The S-video connector is a standard foot print. Should not be too hard to get. I took one from one of the old PCI-VGA card I have and it fits fine.

R452.jpg zoom in on #2. The R436/R437/R443 and R452 all look like strapping resistors. The R443 is stalled with 10 Kohm. The R452 was added to allow s-video output (10 Kohm).

What other (and few more look alike) strapping does? Don't know yet. I only have one DTA809 and not ready to to take the risk yet(it became hard to find...). If somebody has the full spec of BMC chip to share that will be nice...

Have fun....

Ken H

05-09-09, 07:26 PM

I could open my DTA800B and post some pics of its board. I want S-Video on this thing. :)Good luck.

CECBs are like so many 1980's microcomputers with "for future use" ports and empty spots on the boards or unused mounts in the cases that never got used for anything.
Exactly.

luminance

06-24-09, 11:21 AM

Here’s a repost from the ‘RCA DTA800 Digital to Analog TV Converter Box’ thread:

Yep,

Add a S-video connector (natually)
Add two ferrites as the EMI filter (or just bridge them) between two pairs of big pad just behind the connector.
Now, here is the key: Add one 10 Kohm as pull up straping resistor on R452. Locate at right of BCM3543.

I did this on a DTA809 (newer with passthrough). It looks like it have the same placement as DTA800. I ignored all the filter caps due to lack of test pattern to verify it.

I'm really glad I happened to run across this post. This is a great mod.

Yes, you can do this S-Video mod on a DTA-800B. I have two, and decided it would be worth trying on one of them.

It takes only 4 steps, and only one of the four (the last ) is very challenging.

1- Solder a wire between the empty position for L302 and L303 each (behind where the S-Video jack goes).
2- Mount an S-Video jack in the empty position on the board.
3- Drill out the case back for access to the plug (use the circle molded into the case as a guide).
4- Mount a 10k resistor in the empty position for R452.

As you can see (from the attached image), the resistor I used is much bigger than the ones that were intended to be used. But even then, it was very small. Unfortunately, it was still a little too small to fill the gap between the R437 dot (which is electrically common to one side of R452), and the other R452 dot, and too big to fit easily in the regular R452 position. I had to try three times to get the solder to 'mush out' to where it would contact both R452 dots. Working with components on this scale is not so easy, you'll need a lighted magnifier, and small soldering iron.

Use a pin to get contact on the pad surrounding the feed through hole for R452, and measure resistance from there to the common R437 dot to verify success.

I guess I could have used a regular 10k resistor, and run short tiny wires to the common R437 dot and the other R452 dot to connect it with. A dab of epoxy could secure the loose component and wires. Either way should work, pick your poison.

------

The the attached image shows a comparison between the S-Video and Composite outputs. It was obtained from an HD signal, photographed using simultaneous (side by side) displays of the two video outputs. The images consist of equal portions of what was about 25% of the 4:3 screen area.

bizzybody

06-24-09, 06:16 PM

The S-Video shot does look a bit sharper horizontally.

A better compare would be running both inputs into a good video capture card and making short video clips of the same clip.

oldsyd

06-25-09, 01:01 AM

Nice work! Now, if someone can figure out S-Video for the Zenith boxes :)

jjeff

06-25-09, 08:39 AM

Nice work! Now, if someone can figure out S-Video for the Zenith boxes :)

Agreed, that and maybe a 24 hour guide would make it the ideal box:)

oldsyd

07-05-09, 03:20 PM

Agreed, that and maybe a 24 hour guide would make it the ideal box:)

Guide hacks are probably not going to happen. From what I've read, anything involving firmware or software hacking on a CECB isn't really viable. People say it would take too much time for such a little payoff.

However, it seems there's a few hardware hacks out there which are fairly easy.

confuzzled

07-05-09, 05:42 PM

I'd just be happy if someone could figure out how to make the menu and info box text bigger on the CM7000.

jjeff

07-05-09, 07:50 PM

I'd just be happy if someone could figure out how to make the menu and info box text bigger on the CM7000.

Get a bigger TV:D
Sorry, I couldn't resist:o

WeAreNotAlone69

07-06-09, 01:00 PM

Get a bigger TV:D
Sorry, I couldn't resist:o

A no-cost option to make the display appear bigger would be to move closer to the TV set...;)

.

Rammitinski

07-06-09, 03:20 PM

Exactly, to both suggestions. I have no trouble at all reading it on my 32" analog set from about 8 feet away.

jjeff

07-06-09, 09:01 PM

OK, does anyone remember those magnifying glass things that you could hang in front of your 12" TV to make it look something like 15":eek: talk about cheep:p

systems2000

07-07-09, 01:26 AM

I had a Sunkey SK-801ATSC unit die on me. I'm going to remove the UP/DOWN buttons and put them into one of my DT502's. Since they are the same board, I don't foresee any problems.

I'd like to see if someone can figure out how to pull the firmware out of CECB's and push it into other revisions to get better CECB's. Two that come to mind are the Zinwell ZAT-970A's (0830 and lower) and the earlier Sunkey SK-801ATSC (ie. Symbios' unit).

Rammitinski

07-07-09, 06:28 AM

OK, does anyone remember those magnifying glass things that you could hang in front of your 12" TV to make it look something like 15":eek: talk about cheep:pYeah, but we're showing our age.

I also remember those sheets that turned your B&W picture to "color". Man, were those things bogus.

systems2000

07-22-09, 11:34 AM

Has anyone seen this before? http://www.satelliteguys.us/digital-over-air-ota/141463-venturer-stb-7766g-dacb-technical-info.html

equivocal

09-27-09, 02:19 AM

Anyone know what kind of screws those are on the DTVPal wall wart? I've seen three-bladed screw heads before, but those on those the blades radiated straight out. DTVPal's look like a klingon variant.

I'm looking to power a USB hub and thanks to buggy firmware I have a spare 5v power supply. Just needs a barrel connector. Since the connector I have is on a full length of wire I was looking into opening the power supply housing and connecting at the terminals inside.

WeThePeople

09-27-09, 08:42 PM

Anyone know what kind of screws those are on the DTVPal wall wart? I've seen three-bladed screw heads before, but those on those the blades radiated straight out. DTVPal's look like a klingon variant

I don't currently own either unit at the moment...

But when it comes to security heads, there are hundreds.
Look over any page like THIS (http://www.hudsonfasteners.com/security.htm) one as example...

If my "Trecky/Trekky" side (Fans use both...) understands you correctly,
it sounds like your indicating the wings are offset like this style?:

http://www.hudsonfasteners.com/sec/sec_images/sec_tw_phsts.jpg
153770

little kits full of security bits are everywhere,
like eBay and Harbor Freight real cheap.

As example, a 100-Piece Security Bits Set like
http://rover.ebay.com/ar/1/711-53200-19255-0/1?mpt=1753437374&adtype=1&size=1x1&type=3&campid=5336055023&toolid=10001 THIS (http://rover.ebay.com/rover/1/711-53200-19255-0/1?type=3&campid=5336055023&toolid=10001&mpre=http%3A%2F%2Fcgi.ebay.com%2F100-PC-SECURITY-BITS-SET-TORX-STAR-POZI-PHILLIPS_W0QQitemZ270461538951QQ) for $14.99 (With free shipping too)
should be a good addition to your toolbox
for poking where they don't want you to...

A commonly available 100-Piece set is
THIS (http://www.harborfreight.com/cpi/ctaf/displayitem.taf?Itemnumber=91310) one too for $7.99 if this helps out.
(Shipping not free, so factor that in...)

I have had this (Second) one in my hands.
It is the Drill Master Item# 91310 (http://www.google.com/search?hl=en&safe=off&num=100&newwindow=1&q=Drill.Master+Item.91310&btnG=Search) bit set.
It includes four regular, and three offset bits
(Of the three-bladed security variety).

By "Offset", I mean like the "Klingon" screws (Above)...LOL ;)

equivocal

09-28-09, 12:11 AM

That's it. Thanks for the links.

nyc2010

05-27-10, 12:03 PM

any hacks to add a component or DVI port so we can get HD out of any of these boxes?

Floydage

05-27-10, 07:33 PM

any hacks to add a component or DVI port so we can get HD out of any of these boxes?

Excellent question, we know it's in there somewhere! :D

ProjectSHO89

05-27-10, 09:51 PM

No, it isn't...

Floydage

05-28-10, 07:13 PM

No, it isn't...

Why?

nyc2010

06-04-10, 02:42 PM

Excellent question, we know it's in there somewhere!

:D

only if HD tuner boxes would be as cheap as the cecbs.

Floydage

06-05-10, 01:29 PM

:D

only if HD tuner boxes would be as cheap as the cecbs.

Plus many of us already have CECBs. Can't beat that kind of cheap. ;)

nyc2010

06-08-10, 04:21 PM

Plus many of us already have CECBs. Can't beat that kind of cheap. ;)

I want to watch HD not SD! :)

i don't get it why the HD tuner boxes are so expensive compared to a analog tuner boxes.

blue_z

06-08-10, 07:09 PM

i don't get it why the HD tuner boxes are so expensive compared to a analog tuner boxes.

Probably because you do not realize that the "HD tuner" also has a 32-bit RISC processor and memory plus D-to-A convertors.

As for the low cost of CECBs, do you understand the terms "economy of scale" and "guaranteed market"? The cheap CECB should be regarded as part of a freak, one-time event (the analog TV shutoff) that other products cannot duplicate.

Floydage

06-08-10, 07:15 PM

i don't get it why the HD tuner boxes are so expensive compared to a analog tuner boxes.

Probably more R&D cost, user software, connectors (ex: HDMI, component, s-video, programming comm), etc. Plus the sales volume and marketing economics pushed the price curve down on the CECBs.

nyc2010

06-09-10, 03:50 PM

Probably because you do not realize that the "HD tuner" also has a 32-bit RISC processor and memory plus D-to-A convertors.
.

maybe they should sell the boxes without those two and we can buy a faster processor and add more memory to the box on our own!

blue_z

06-09-10, 08:54 PM

maybe they should sell the boxes without those two and we can buy a faster processor and add more memory to the box on our own!

That is wishful and uninformed thinking.

If you open up one of these tuners or look at photos of their interior, you would find no sockets for any of the components. Everything is soldered and surface mounted, meaning they are not user serviceable.

"Upgrading" would be a waste of time/money, since the embedded firmware is usually written for a specific hardware configuration. Changing any of the chips would probably render the box into a doorstop.

Besides, all the processor (actually SoC, or System on a Chip) and memory chips will be industrial/commercial components that are not sold by PC retailers. Heck we can't even find the datasheets for these SoCs on the web. You probably need to sign an NDA to get any info!

If you want to replace components/chips, then go build & use an HTPC.

Floydage

06-10-10, 11:49 AM

blue_z, please lighten up the way you talk down to folks here.

blue_z

06-10-10, 12:36 PM

Sorry.

WeAreNotAlone69

06-11-10, 04:23 AM

blue_z, please lighten up the way you talk down to folks here.

????, blue_z made some vaild points, upgrading these *CECB boxes isn't going to happen.
*There might be some upgradeability, more hacking options of the boxes that are released to the Canadian market...

That is wishful and uninformed thinking.

If you open up one of these tuners or look at photos of their interior, you would find no sockets for any of the components. Everything is soldered and surface mounted, meaning they are not user serviceable.

"Upgrading" would be a waste of time/money, since the embedded firmware is usually written for a specific hardware configuration. Changing any of the chips would probably render the box into a doorstop.

Besides, all the processor (actually SoC, or System on a Chip) and memory chips will be industrial/commercial components that are not sold by PC retailers. Heck we can't even find the datasheets for these SoCs on the web. You probably need to sign an NDA to get any info!

If you want to replace components/chips, then go build & use an HTPC.

nyc2010

06-11-10, 03:56 PM

????, blue_z made some vaild points, upgrading these *CECB boxes isn't going to happen.
*There might be some upgradeability, more hacking options of the boxes that are released to the Canadian market...

when is that going to happen?

WeAreNotAlone69

06-12-10, 03:49 AM

when is that going to happen?

Google is your friend...

http://en.wikipedia.org/wiki/Digital_television_transition

# Canada: The main FTA broadcasters (CBC, CTV, and Global) have launched HD streams of their programming in limited markets such as Toronto and Vancouver. On Thursday, May 17, 2007, the Canadian Radio-television and Telecommunications Commission (CRTC, Canada's broadcasting authority) ruled that television stations would be forced to switch to ATSC digital broadcasting by Wednesday, August 31, 2011, with minor exceptions in remote areas where analogue transmissions will not cause interference.[13]
As of May 2007[update] there were fewer than 20 digital television stations in Canada. Unlike in the other countries, Canada originally was allowing the market to determine when the analogue switch-off begins. As a result, while analogue and digital broadcasts currently co-exist, digital transmission penetration is still low, and the only way to receive Canadian digital TV in most areas is via cable or satellite TV. In Toronto it is possible to pick up DTV over the air; in Montreal, Ottawa and Quebec City a partial set of channels (most often CBC only) are offered – primarily as a vehicle for limited HDTV deployments. About one-half of Canadian homes have over-the-air access to high-powered US border stations, all of which offer ATSC DTV. New TV's and DVD recorders often include ATSC tuners but are not required to do so; retail-store availability of basic converters for existing NTSC TV's is limited.[14] (Wikinews)
Further information: Digital television transition in Canada

http://en.wikipedia.org/wiki/Digital_television_transition_in_Canada

Floydage

06-12-10, 11:48 AM

????, blue_z made some vaild points, upgrading these *CECB boxes isn't going to happen.

Yes he did and it was very interesting too but that wasn't what I was getting at (previous posts too).

Thank you blue_z for the apology. :cool:

Floydage

06-12-10, 11:51 AM

About one-half of Canadian homes have over-the-air access to high-powered US border stations, all of which offer ATSC DTV.

Interesting. Sounds like they have no urgent rush to go digital as they can sniff off 'US.'

blue_z

06-12-10, 03:26 PM

...but that wasn't what I was getting at (previous posts too).

You're probably refering to post #149?
You responded to the "i don't get it why ..." as if it was a request for information.
I read that same "i don't get it why..." as an argumenative statement when combined with some previous posts. I essentially responded to the "i don't get it..." part, rather than the "...why..." part of that statement.

I just don't get why people have to preface questions with phrases like "i don't get it why ..." or "Am I right that ...".
http://www.at91.com/forum/viewtopic.php/f,12/t,5572/p,16451/#p16451

Regards

Floydage

06-13-10, 12:11 PM

I just don't get why people have to preface questions with phrases like "i don't get it why ..." or "Am I right that ...".

Ah, I see. Understood.

bizzybody

07-17-10, 03:19 AM

There's a couple of really big reasons why the cheap CECB's exist.

#1 The FCC said such inexpensive converter boxes had to exist so us proles could continue to get our prolefeed. ;) Y'know, like "American Idle" and soap operas.

#2 Great heaping gobs of "government money". The $40 from each of those coupons gets split between the retailer and the manufacturer, plus there's money above the $40 for CECB's with a price higher than $40.

The transcripts of the meetings and the manufacturers' input while the CECB specs were being hashed out is interesting reading. IIRC the FCC wanted to make some more advanced features *optional* but Funai convinced them to specifically prohibit them. Fortunately some manufacturers insisted on being allowed the option of S-Video, though few chose to include it.

They even got as nit-picky as discussing whether or not batteries for the remote had to be included.

The bit about requiring auto power off/sleep and having it enabled being the default is in there, so is mandating the option to disable that "feature".

I'm from the BRS school of power control. On is ON and Off is effing OFF. ;)

BRS = Big Red Switch, like the giant toggle on the IBM PC/XT power supply.