RCA DTA800 Digital to Analog TV Converter Box - Page 15 - AVS Forum | Home Theater Discussions And Reviews
Baselworld is only a few weeks away. Getting the latest news is easy, Click Here for info on how to join the Watchuseek.com newsletter list. Follow our team for updates featuring event coverage, new product unveilings, watch industry news & more!


Forum Jump: 
 2Likes
Reply
 
Thread Tools
post #421 of 435 Old 10-02-2014, 10:07 AM
Member
 
jvvh5897's Avatar
 
Join Date: Oct 2011
Posts: 61
Mentioned: 0 Post(s)
Tagged: 0 Thread(s)
Quoted: 15 Post(s)
Liked: 14
Quote:
Originally Posted by satpro View Post
Does anyone know what this is output screen is for? It is from a hidden feature on the dta800b I just started testing. I can see chs, snr, pids but I don't know what the rest is for yet. you can get there by pressing channel down and power simultaneously on the front panel, you will have to unplug to reboot afterwards or wait 10-15 minutes to auto reboot,
I will post a complete review and pictures of this model soon. already not to impressed with the tuner sensitivity or video quality of the rca being worse than the funia tb100 series.
The above uses hard coded channel list. In the early dta800b code there are three channels in the list--one is KTLA the others are just a jumble of letters in the name. In the newer B1 code there are more in the ch list with 0x24 bytes per channel--KTLA is still in there but with a diff freq/ch Others on the list:
T H E T U B
c h -5 9 - 1
c h - 5 9 - 2
c h - 5 9 - 3
T B T - D T
R F 3 8 - 1

Since these end up in RAM, you should be able to create a little code to overwrite them with channels in your area.
jvvh5897 is offline  
Sponsored Links
Advertisement
 
post #422 of 435 Old 10-03-2014, 12:26 PM
Member
 
jvvh5897's Avatar
 
Join Date: Oct 2011
Posts: 61
Mentioned: 0 Post(s)
Tagged: 0 Thread(s)
Quoted: 15 Post(s)
Liked: 14
Hum, if you have box's serial port hooked up to PC then you can enter the factory screen from any channel and see the details of the channel on that screen (option 21 get you to the screen and once in if you hit 8 you get the channel details). You can see the channel's PIDs, the channel number and real frequency, the signal to noise ratio (seems to be in dB--a reading of about 65 on the signal meter gives 27 reading SNR, 43 gives 22 or so). Rest of the info is about how full the FIFO buffers are--audio tends to be about 3k in a 64K buffer, video reaches close to a megabyte at times in the buffer.

If you bother to change the factory channel list you can use the serial port to control the channel you have on, but the list seems to only have space for 7 channels--so maybe good for a FAV list. Or use the code to figure out how to get more control.
jvvh5897 is offline  
post #423 of 435 Old 10-04-2014, 11:32 AM
Member
 
jvvh5897's Avatar
 
Join Date: Oct 2011
Posts: 61
Mentioned: 0 Post(s)
Tagged: 0 Thread(s)
Quoted: 15 Post(s)
Liked: 14
It seems you can even do a primitive form of serial control of the box via the serial port. You hold down the front buttons as though getting into the factory screen, but do it after you plug in the box not before. The box then starts up normally, but on the serial port it stops before giving you the console menu, and at that point you can type in numbers from 1 to 9 and they will go into the info OSD as though you pressed the keys on the remote. You can't specify sub-channel in most cases, but you can get to the first channel (ie you can get 8-1 easy by just typing 8, but cant get to 8-2 this way).
The code is just writing the number you send to a single register 0xb0102034, so you can write a little code and test other key than the numbers that the above allows. I've found the ch up and down keys sent this way tend to keep cycling through the channels rather than move up or down a single ch. You can also get to the mute and volume up and down settings this way, but the volume up and down also keep going to one extreme or the other--still you can see that they do try to work and you do have that control in the code.
jvvh5897 is offline  
post #424 of 435 Old 10-13-2014, 09:34 AM
Member
 
jvvh5897's Avatar
 
Join Date: Oct 2011
Posts: 61
Mentioned: 0 Post(s)
Tagged: 0 Thread(s)
Quoted: 15 Post(s)
Liked: 14
I've found another factory screen, or maybe it is supposed to be the first page of factory screen. It has a label--"Debug". You see the GMT offset, daylight setting mode, UTC. There is the virtual ch #, SNR and sig % reading. There might be EIT and Ratings info from stream as well, but that part might be defeated. I get to the Debug screen and factory screen by overwriting the struct for thesig meter with the 0x2c byte struct for those screens as I want to see them. You get the video and sound for the channel you have the box set for behind either of these screens.
jvvh5897 is offline  
post #425 of 435 Old 10-16-2014, 09:28 AM
Member
 
jvvh5897's Avatar
 
Join Date: Oct 2011
Posts: 61
Mentioned: 0 Post(s)
Tagged: 0 Thread(s)
Quoted: 15 Post(s)
Liked: 14
Figured I would post a few of the projects I've tried since switching from hand coding machine code to compiling C with a gcc variant that works under windows and is optimized for MIPS. I still have to do some hand coding as I use the box's routines as much as possible. The size of most of the C routines are bigger than I think should go into the 80016000 space, so I do a 3 step process--load a routine that I hand coded to call the Xmodem load routine in the box's code, use that to load my code to free RAM at 80200000, and then load a routine that just calls to 80200000 to run the code.

I use dummy routines in the C code to call the box code, but compile the code with the longcall option active so that all I need to is moddify the jalr to call the machine code routines I really want--I bet it could be done better, but that is what I do. Since those machine code addresses are version specific, I'm not including the dummy routines.


Here is the routine I'm using to capture the SNR--it uses the timer ticks (200 per second), serial port read, serial port send, as well as the SNR read routine.

void main1(unsigned long StartAddr,int number)
{
unsigned char c;
unsigned int diff_time;
int i;
asm("lui $0,0x0\n\t");

*( unsigned long *)0x80001F04=0;
*( unsigned long *)0x80001F08=0x01030200;
*( unsigned long *)0x80001F0c=0x04;

//going to use 40k in 4k blocks to store SNR info with an index to where to write at the start
mems(0x80180000,0,0xa000);
for(i=0;i<10;i++){*( unsigned long *)(0x80180000+(i<<12))=4;}

for(;
{
*( unsigned long *)0x80001F00=*( unsigned long *)0x800047FC;
while((*( unsigned long *)0x800047FC - *( unsigned long *)0x80001F00)<200) {;}
far_call2(0x80004640,0x80001f10); //read SNR
//use a couple bytes to save the greatest and least SNR seen
*( unsigned char *)0x80001F20=*( unsigned char *)0x80001f18;
*( unsigned char *)0x80001F22=*( unsigned char *)0x80001f18;
while((*( unsigned long *)0x800047FC - *( unsigned long *)0x80001F00)<200*60)
{
c=far_call(0xb0400180,0); //read RX serial port
if (c==0x26) return;
if (((*( unsigned long *)0x800047FC)>>9)&1==1)
{far_call2(0x80004640,0x80001f10); //read SNR
if ((*( unsigned char *)0x80001F20) > (*( unsigned char *)0x80001f18)) *( unsigned char *)0x80001F20=*( unsigned char *)0x80001f18;
if ((*( unsigned char *)0x80001F22) < (*( unsigned char *)0x80001f18)) *( unsigned char *)0x80001F22=*( unsigned char *)0x80001f18;
}
}

i= *( unsigned char *)0x800873d8;
*( unsigned char *)(0x80180000+(i<<12) + *( unsigned long *)(0x80180000+(i<<12)))=*( unsigned char *)0x80001f20;
*( unsigned char *)(0x80180000+((i+5)<<12) + *( unsigned long *)(0x80180000+((i+5)<<12)))=*( unsigned char *)0x80001f22;




(*( unsigned long *)(0x80180000+(i<<12) ))++;
(*( unsigned long *)(0x80180000+((i+5)<<12) ))++;

s_port("ch %d : Lo %d, Hi %d\n",i,*( unsigned char *)0x80001f20,*( unsigned char *)0x80001f22); //use 80081088 string %x08x or 8008173e %d
//s_port("0x%x\n",*( unsigned char *)0x80001f22);
*( unsigned long *)0x80001F04=(*( unsigned long *)0x80001F04)+1;
if ((*( unsigned long *)0x80001F04)>4) {*( unsigned long *)0x80001F04 = 0;}
*( unsigned char *)0x800873d9=*( unsigned char *)(0x80001F08+(*( unsigned char *)0x80001F04)); //put value into the prev ch spot
*( unsigned long *)0xb0102034=0x38; //write prev command
}

}
jvvh5897 is offline  
post #426 of 435 Old 10-16-2014, 09:31 AM
Member
 
jvvh5897's Avatar
 
Join Date: Oct 2011
Posts: 61
Mentioned: 0 Post(s)
Tagged: 0 Thread(s)
Quoted: 15 Post(s)
Liked: 14
Here is one that loads registers in the audio part of the processor to make a sine wave play out.

unsigned long rawData[0x30] =
{
0x00000000, 0x00010B51, 0x0002120F, 0x00030FBC,
0x0003FFFF, 0x0004DEBE, 0x0005A827, 0x000658C9,
0x0006ED9E, 0x0007641A, 0x0007BA36, 0x0007EE7A,
0x0007FFFF, 0x0007EE7A, 0x0007BA36, 0x0007641A,
0x0006ED9E, 0x000658C9, 0x0005A827, 0x0004DEBE,
0x0003FFFF, 0x00030FBC, 0x0002120F, 0x00010B51,
0x00000000, 0xFFFEF4AF, 0xFFFDEDF1, 0xFFFCF044,
0xFFFC0001, 0xFFFB2142, 0xFFFA57D9, 0xFFF9A737,
0xFFF91262, 0xFFF89BE6, 0xFFF845CA, 0xFFF81186,
0xFFF80001, 0xFFF81186, 0xFFF845CA, 0xFFF89BE6,
0xFFF91262, 0xFFF9A737, 0xFFFA57D9, 0xFFFB2142,
0xFFFC0000, 0xFFFCF044, 0xFFFDEDF1, 0xFFFEF4AF
};
*/

unsigned long rawData[0x18] =
{

0x00000000, 0x0007BA36, 0x0003FFFF, 0xFFFA57D9,
0xFFF91262, 0x0002120F, 0x0007FFFF, 0x0002120F,
0xFFF91262, 0xFFFA57D9, 0x00040000, 0x0007BA36,
0x00000000, 0xFFF845CA, 0xFFFC0000, 0x0005A827,
0x0006ED9E, 0xFFFDEDF1, 0xFFF80001, 0xFFFDEDF1,
0x0006ED9E, 0x0005A827, 0xFFFC0001, 0xFFF845CA
} ;

//table with 0x18 elements gives high tone, 0x30 gives low tone
//seems to be amplitude data
//but 0x182fb0 gives low tone with 0x18 elements
//181770 gives muted sound

int main(void)
{
int i;

*(unsigned long *)0xb04820FC = 0x001820d0; //seems to be required for unmute
for(i=0;i<0x18;i++)
{
*(unsigned long *)(0xb0482100+ (i<<2))=rawData[i];
//printf("%x %08x\n",0xb0482100+ (i<<2),rawData[i]);
}


}

------------------------------------------------------------

and here is one that makes a "color bar" example of three wide bars across the screen--left to right: yellow, green and dark blue against a light grey border and black behind it full screen.

void rect1(unsigned int a0,int a1,int a2,int a3,int a4,int co);


int main(void)
{
rect1(0x800862cc,0x0,0x0,0x2d0,0x1e0,1);
rect1(0x800862cc,0x28,0x28,0x280,0x190,3);
rect1(0x800862cc,0x50,0x50,0xba,0x140,8);
rect1(0x800862cc,0x10a,0x50,0xba,0x140,0xc);
rect1(0x800862cc,0x1c5,0x50,0xba,0x140,0x4);
}

//a1 is left start, a2 top, a3 right, a4 bottom

void rect1(unsigned int a0,int a1,int a2,int a3,int a4,int co)
{
asm("li $2,0x9FC04570\n\t"
"jalr $2\n\t");

}

I included the dummy routine for rect.
jvvh5897 is offline  
post #427 of 435 Old 10-23-2014, 10:55 AM
Member
 
jvvh5897's Avatar
 
Join Date: Oct 2011
Posts: 61
Mentioned: 0 Post(s)
Tagged: 0 Thread(s)
Quoted: 15 Post(s)
Liked: 14
I have done a successful flash replacement in the DT800B. I now have a mx25l3206 where the mx25l4005 was. Still have to write to the 4meg chip and not mess up the rest of the 512k space that the old chip used, but think I am close.
jvvh5897 is offline  
post #428 of 435 Old 07-22-2015, 10:32 AM
Member
 
jvvh5897's Avatar
 
Join Date: Oct 2011
Posts: 61
Mentioned: 0 Post(s)
Tagged: 0 Thread(s)
Quoted: 15 Post(s)
Liked: 14
Finally got back to the RCA project. You can download a glib zipped image of the flash to the box. The newer RCA box is limited to 0x7f000 uncompressed size, but the older version w/ the smart antenna connection can do the full 0x80000 flash.
Floydage likes this.
jvvh5897 is offline  
post #429 of 435 Old 07-24-2015, 07:40 AM
Member
 
jvvh5897's Avatar
 
Join Date: Oct 2011
Posts: 61
Mentioned: 0 Post(s)
Tagged: 0 Thread(s)
Quoted: 15 Post(s)
Liked: 14
Seems there is a key that lets you dump the channel list in a format that looks like a C structure--parentheses and commas. You have to send it using the xmodem load to box feature number 4 though--don't know of any remotes that send 0x60. Here is code to do it: asm code then the machine code only:
[0x000000] 0x3C04B010 # lui $a0, 45072 ($a0 = 45072 << 16)
[0x000004] 0x34842034 # ori $a0, $a0, 8244 ($a0 = $a0 | 8244)
[0x000008] 0x20050060 # addi $a1, $zero, 96 ($a1 = 96)
[0x00000C] 0xAC850000 # sw $a1, 0($a0) (mem[$a0 + 0] = $a1)
[0x000010] 0x03E00008 # jr $ra (jump $ra)


10 B0 04 3C 34 20 84 34 60 00 A5 20 00 00 85 AC
08 00 E0 03 00 00 00 00 00 00 00 00 00 00 00 00


What you get out the serial port looks like:
{2,1,32,0,49,49,{52,53,0},{0x004b, 0x0057, 0x0047, 0x004e, 0x002
d, 0x0044, 0x0054}, 0xff},
{2,2,32,0,65,65,{68,0,0},{0x0054, 0x0048, 0x0049, 0x0053, 0x0054, 0x0056, 0x0020
}, 0xff},


Where the first couple entries are the virtual ch, then the real channel -2, next I think is something to do with smart antenna, then the VPID the PCR and audio PID and last is the Channel name in Unicode followed by 0xff.


BTW the smart antenna seems to be running whenever you change the channel even if there is not smart antenna hooked up. I've seen the number 5 pin active for three or four groups of data sends on one channel and around 40 groups on another--not sure what is going on but the format seems to be that described in the CECB box information. Here is a snapshot I took using audio card and audacity (with capacitor to aux in) of one group--you can see the reset, start bit and 14 bits but they seem the same regardless of ch selected.
Attached Thumbnails
Click image for larger version

Name:	smart_ch5.jpg
Views:	5
Size:	65.1 KB
ID:	846930  
jvvh5897 is offline  
post #430 of 435 Old 07-25-2015, 12:20 PM
Member
 
jvvh5897's Avatar
 
Join Date: Oct 2011
Posts: 61
Mentioned: 0 Post(s)
Tagged: 0 Thread(s)
Quoted: 15 Post(s)
Liked: 14
Wrote up a little Xmodem transmit code to slip into the code--that way I can just use a single program to send code to and get stuff from the box. Seems to work, but haven't tried to clone from one box to another yet. Just to a PC, but it dumps flash contents OK and just a little slower than the register direct way (I can get about 11k bytes per sec with the old method and only 8K bytes per sec with XModem). Have to figure out a good place to mod the box's code to let the code be resident--as is I have to load a program to the box that loads the 0x300 bytes or so of the xmodem code to RAM and then load a program to call that code in RAM--but on the good side, I'm not madly shutting down one program to get another up in capture mode to get the dump from the box before it begins and then having to edit out a little text from the end when the console program spits out the menu.


Still puzzled about the smart antenna--I put a 2.2K resistor and led on the data line to let me watch it as I go from ch to ch. It blinks a little on box startup to a channel, but really flashes a lot after that on ch change. Eventually the data stops coming out even if the box gets no signal on a channel--you would think it would be trying to search for a signal. I'm going t have to track down the code that controls the data if I can--the Broadcom chip seems to have lots of the way things work hidden inside the chip and just register based control. And I have no data sheet.
jvvh5897 is offline  
post #431 of 435 Old 07-25-2015, 03:53 PM
AVS Special Member
 
Floydage's Avatar
 
Join Date: May 2009
Location: Fort Worth, TX
Posts: 1,710
Mentioned: 0 Post(s)
Tagged: 0 Thread(s)
Quoted: 99 Post(s)
Liked: 59
Probably times out [smart antenna] so it doesn't get stuck in la-la land.

Floydage is offline  
post #432 of 435 Old 07-28-2015, 10:43 AM
Member
 
jvvh5897's Avatar
 
Join Date: Oct 2011
Posts: 61
Mentioned: 0 Post(s)
Tagged: 0 Thread(s)
Quoted: 15 Post(s)
Liked: 14
I suppose that might be true, but in the factory screen (brought up by pressing both power and ch+) the smart data line just lights up the LED for a single group about once a second or so.


Ha! I have made my first permanent mod to the box fw! I make a small modification in the IR and front button task install routine to call my code and that code then modifies the un-packed main sw. That way I don't have to mod the main sw and repack it to fit the space it starts with, I just mod it with a memcpy at run time in un-packed state. That task install routine is called from the un-packed code and only once at main sw start up. It was actually easy--well, if you ignore the weeks of reverse engineering and playing around it took.
jvvh5897 is offline  
post #433 of 435 Old 07-28-2015, 03:36 PM
AVS Special Member
 
Floydage's Avatar
 
Join Date: May 2009
Location: Fort Worth, TX
Posts: 1,710
Mentioned: 0 Post(s)
Tagged: 0 Thread(s)
Quoted: 99 Post(s)
Liked: 59
'Hooks' are often disabled in factory mode.

Floydage is offline  
post #434 of 435 Old Today, 09:47 AM
Member
 
jvvh5897's Avatar
 
Join Date: Oct 2011
Posts: 61
Mentioned: 0 Post(s)
Tagged: 0 Thread(s)
Quoted: 15 Post(s)
Liked: 14
No idea what that means.


I used my IR task install mod to overwrite the factory channel list used in the factory screen and now the box does the smart data a little different. None of the new list channels have the "zero" in the channel list set to one as in all the factory chs and no activity on the smart data line with any of the chs. I only get data coming out if I hit the number 8 key--that is a toggle to set the smart ant--and only one burst on the line and no more until the next press of the 8 key.


Kind of interesting how the factory screen works when you have active channels--you test the serial port, the front keys and the remote in one way or another, decoding of audio and video, the pattern test and audio test parts lets you see a number of qualities as well--if I knew a little more about some of the info displayed I might be able to judge other things--you do see how the buffers deal with the incoming stream and there is supposed to be info on the EIT, you see the gps time data in the debug screen. Lots of stuff.
jvvh5897 is offline  
post #435 of 435 Old Today, 03:31 PM
AVS Special Member
 
Floydage's Avatar
 
Join Date: May 2009
Location: Fort Worth, TX
Posts: 1,710
Mentioned: 0 Post(s)
Tagged: 0 Thread(s)
Quoted: 99 Post(s)
Liked: 59
Example: A radio we designed at Motorola would just do basic functions in factory mode for the factory to test and calibrate. Hooks such as temperature compensation were not active (controlled environmental conditions in the factory).

Floydage is offline  
Sponsored Links
Advertisement
 
Reply Coupon Eligible Converter Box (CECB)



Forum Jump: 

Posting Rules  
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off