Jekyll2023-04-12T20:03:21+00:00https://svenschwermer.de/feed.xmlSven’s BlogElectronics, Embedded and other projects…Sven SchwermerFixing a toaster2021-10-03T00:00:00+00:002021-10-03T00:00:00+00:00https://svenschwermer.de/2021/10/03/fixing-a-toaster<p>The other day our toaster (<a href="https://web.archive.org/web/20211003171927/https://www.severin.com/en/produkt/en15_kitchen/en5_toasters/at-2514-automatic-toaster/">Severin AT 2514</a>) stopped working. When
actuating, the lever would not stay in the downward position. The power
indicator LED would light up, however.</p>
<p>I opened the toaster up and found a 2-PCB construction. I started by reverse-
engineering the circuit. I couldn’t find any information on the main controller
IC that had the marking <code class="language-plaintext highlighter-rouge">GA5214P</code>. I found the following circuit detail
particularly interesting: The heating elements form a voltage divider which is
used to bring down the voltage for the controlling circuitry. The following
“regulator” is just a single rectifying diode with a zener diode in addition to
some passives.</p>
<figure>
<a href="/assets/toaster/schematic.svg">
<img src="/assets/toaster/schematic.svg" alt="The toaster's schematics" />
</a>
<figcaption>The toaster's schematics</figcaption>
</figure>
<p>My initial suspicion for the cause of the issue was an electronics problem. I
suspected that either the main proprietary controller IC or the transistor
driving the electromagnet were the suspect. The controller IC was ruled out by
measuring the transistor base voltage which correctly went up upon switching on
the toaster causing the NPN transistor to energize the electromagnet. The
transistor was just switched out for another <code class="language-plaintext highlighter-rouge">S9014</code> from China without success.</p>
<figure>
<a href="/assets/toaster/electromagnet.webp">
<img src="/assets/toaster/electromagnet.webp" alt="Secondary PCB with electromagnet" />
</a>
<figcaption>Secondary PCB with electromagnet</figcaption>
</figure>
<p>Upon closer inspection of the electromagnet, I noticed that there were a few
bread crumbs between the W-shaped core and the iron plate closing said core.
This would seriously reduce the holding force of the electromagnet. And sure
enough, after cleaning the crumbs away, the toaster worked flawlessly again.
In hindsight, the reverse engineering was overkill even though it was intersting
to learn about the inner working of a cheap toaster.</p>Sven SchwermerThe other day our toaster (Severin AT 2514) stopped working. When actuating, the lever would not stay in the downward position. The power indicator LED would light up, however.Build Yocto on up-to-date Arch Linux2020-06-12T00:00:00+00:002020-06-12T00:00:00+00:00https://svenschwermer.de/2020/06/12/building-yocto-on-up-to-date-arch-linux<p>When I recently tried building an embedded Linux system using Yocto Zeus on
Arch, I ran into a couple of issues. Here’s a summary of the problem and and a
workaround.</p>
<h2 id="problem-1-gcc-10">Problem 1: GCC 10</h2>
<p>From version 10, <a href="https://gcc.gnu.org/gcc-10/changes.html">GCC defaults to <code class="language-plaintext highlighter-rouge">-fno-common</code></a> instead of the previous
default <code class="language-plaintext highlighter-rouge">-fcommon</code>. This can lead to linker errors due to multiple symbol
definitions. The natural solution would be to override this new default with
the old one using something like <code class="language-plaintext highlighter-rouge">BUILD_CFLAGS</code>. Unfortunately, this doesn’t
work for all <code class="language-plaintext highlighter-rouge">-native</code> recipes as not all allow to override the <code class="language-plaintext highlighter-rouge">CFLAGS</code>, e.g.
<code class="language-plaintext highlighter-rouge">dtc-native</code>. The only solution I have found for this problem is downgrading
GCC.</p>
<h2 id="problem-2-file-with-libseccomp">Problem 2: file with libseccomp</h2>
<p>Some recipe steps fail with errors like</p>
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Command '['file', '-b', '/…/base-files/3.0.14-r89/package/etc/skel/.profile']' died with <Signals.SIGSYS: 31>.
</code></pre></div></div>
<p>This is caused by the fact that the <code class="language-plaintext highlighter-rouge">file</code> utility in Arch is compiled with
<a href="https://en.wikipedia.org/wiki/Seccomp">libseccomp</a> support. This wouldn’t be a problem in itself, but the Yocto
build system uses <a href="https://www.yoctoproject.org/software-item/pseudo/">libpseudo</a> which seems to cause the issue. The
functionality provided by libseccomp can be disabled with <code class="language-plaintext highlighter-rouge">file</code>’s
<code class="language-plaintext highlighter-rouge">--no-sandbox</code> switch.</p>
<h2 id="workaround">Workaround</h2>
<p>I have added a <code class="language-plaintext highlighter-rouge">.bin</code> directory to my Yocto project’s root directory which gets
added to <code class="language-plaintext highlighter-rouge">PATH</code> with the highest priority (left-most). It symlinks <code class="language-plaintext highlighter-rouge">gcc</code> and
<code class="language-plaintext highlighter-rouge">g++</code> to <code class="language-plaintext highlighter-rouge">gcc-8</code> and <code class="language-plaintext highlighter-rouge">g++-8</code> (<code class="language-plaintext highlighter-rouge">gcc8</code> package from the community repo),
respectively. I furthermore included a wrapper script for <code class="language-plaintext highlighter-rouge">file</code>.</p>
<div class="language-sh highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="nb">mkdir</span> .bin
<span class="nb">ln</span> <span class="nt">-s</span> /usr/bin/gcc-8 .bin/gcc
<span class="nb">ln</span> <span class="nt">-s</span> /usr/bin/g++-8 .bin/g++
<span class="nb">cat</span> <span class="o"><<</span><span class="no">EOF</span><span class="sh"> > .bin/file
#!/bin/sh
/usr/bin/file --no-sandbox "</span><span class="se">\$</span><span class="sh">@"
</span><span class="no">EOF
</span><span class="nb">chmod</span> +x .bin/file
</code></pre></div></div>
<p>In order to make working with this a little more convenient, I added a small
script that can be sourced when starting to work on the project:</p>
<div class="language-sh highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="nb">cat</span> <span class="o"><<</span><span class="no">EOF</span><span class="sh"> > source-me
export PATH="</span><span class="se">\$</span><span class="sh">PWD/.bin:</span><span class="se">\$</span><span class="sh">PATH"
. ./poky/oe-init-build-env
</span><span class="no">EOF
</span></code></pre></div></div>Sven SchwermerWhen I recently tried building an embedded Linux system using Yocto Zeus on Arch, I ran into a couple of issues. Here’s a summary of the problem and and a workaround.Mainline OpenWrt on a Wemo® Insight Smart Plug2020-05-31T00:00:00+00:002020-05-31T00:00:00+00:00https://svenschwermer.de/2020/05/31/mainline-openwrt-on-a-wemo-insight-smart-plug<p>The firmware this smart plug (model number: F7C029de) runs doesn’t seem to be
particularly stable and the software base seems very dated. Let’s try running
our own firmware for fun and profit.</p>
<p><em>This article has been updated 2020-06-10, 2020-06-21 and 2020-07-24.</em></p>
<ul id="markdown-toc">
<li><a href="#hardware" id="markdown-toc-hardware">Hardware</a> <ul>
<li><a href="#j15-connector-pinout" id="markdown-toc-j15-connector-pinout">J15 Connector pinout</a></li>
<li><a href="#serial-console" id="markdown-toc-serial-console">Serial console</a></li>
</ul>
</li>
<li><a href="#bootloader" id="markdown-toc-bootloader">Bootloader</a></li>
<li><a href="#stock-os" id="markdown-toc-stock-os">Stock OS</a> <ul>
<li><a href="#partitions" id="markdown-toc-partitions">Partitions</a></li>
</ul>
</li>
<li><a href="#booting-your-own-kernel" id="markdown-toc-booting-your-own-kernel">Booting your own Kernel</a> <ul>
<li><a href="#excursion-kermit-with-minicom-on-arch-linux" id="markdown-toc-excursion-kermit-with-minicom-on-arch-linux">Excursion: kermit with minicom on Arch Linux</a></li>
</ul>
</li>
<li><a href="#controlling-the-relay" id="markdown-toc-controlling-the-relay">Controlling the relay</a> <ul>
<li><a href="#manual-control-via-the-touch-button" id="markdown-toc-manual-control-via-the-touch-button">Manual control via the touch button</a></li>
</ul>
</li>
<li><a href="#interfacing-the-power-sensor" id="markdown-toc-interfacing-the-power-sensor">Interfacing the power sensor</a></li>
<li><a href="#issues" id="markdown-toc-issues">Issues</a></li>
<li><a href="#remaining-work" id="markdown-toc-remaining-work">Remaining work</a></li>
<li><a href="#references" id="markdown-toc-references">References</a></li>
</ul>
<h2 id="hardware">Hardware</h2>
<p>The F7C029de smart plug contains three PCBs:</p>
<ol>
<li>The power board holds the relay, isolation and a power supply for the logic
board.</li>
<li>The power sensor board contains a chip similar (but not identical) to the
78M6610+PSU (<a href="https://datasheets.maximintegrated.com/en/ds/78M6610+PSU.pdf">datasheet</a>) <em>Energy Measurement Processor for Single-Phase
Power-Supply Units</em> and a few passive components. The board is soldered onto
the power board.</li>
<li>The logic board features a Ralink (Mediatek) RT5350F (<a href="https://cdn.sparkfun.com/datasheets/Wireless/WiFi/RT5350.pdf">datasheet</a>) WiFi
SoC with a 360 MHz MIPS24KEc CPU core and a IEEE 802.11n 1T1R peripheral. In
addition, there is a MX25L12835F (<a href="https://www.macronix.com/Lists/Datasheet/Attachments/7397/MX25L12835F,%203V,%20128Mb,%20v1.6.pdf">datasheet</a>) 16 MiB serial NOR flash and
a W9825G6KH (<a href="https://www.winbond.com/resource-files/da00-w9825g6khc1.pdf">datasheet</a>) 32 MiB SDRAM as well as some LEDs, a tactile
button, some voltage regulators and a USB micro AB receptacle.</li>
</ol>
<figure>
<a href="/assets/wemo/power.jpg">
<img src="/assets/wemo/power.jpg" alt="Power board with power sensor board soldered on" />
</a>
<figcaption>Power board with power sensor board soldered on</figcaption>
</figure>
<figure>
<a href="/assets/wemo/logic.jpg">
<img src="/assets/wemo/logic.jpg" alt="Logic board" />
</a>
<figcaption>Logic board</figcaption>
</figure>
<h3 id="j15-connector-pinout">J15 Connector pinout</h3>
<ol>
<li>Relay signal (3.3V level output)</li>
<li>GND</li>
<li>5V</li>
<li>5V</li>
<li>GND</li>
<li>?</li>
<li>UART from power sensor (3.3V level input)</li>
<li>3.3V</li>
</ol>
<p>Pin 1 is marked with a little dot on the silk screen. It’s located on the
right-hand side in the above photo of the board.</p>
<p>The logic board can be powered via the USB receptacle J11 (5V). The 3.3V rail is
generated on the logic board.</p>
<h3 id="serial-console">Serial console</h3>
<p>A serial console is available via test pads. It’s somewhat difficult to solder
to the pads because they can be quite oxidized. I lifted a pad and decided to
solder to the resistor pads instead. The voltage level is 3.3V and the default
configuration is 57600 baud 8N1.</p>
<h2 id="bootloader">Bootloader</h2>
<p>The board uses a modified u-boot version from the Ralink SDK v3.5.0.0. This is
the u-boot console log:</p>
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>U-Boot 1.1.3 (May 4 2015 - 18:32:38)
Board: Ralink APSoC DRAM: 32 MB
relocate_code Pointer at: 81fb4000
spi_wait_nsec: 21
spi device id: c2 20 18 c2 20 (2018c220)
find flash: MX25L12805D
raspi_read: from:30000 len:1000
.raspi_read: from:30000 len:1000
.============================================
Ralink UBoot Version: 3.5.0.0
--------------------------------------------
ASIC 5350_MP (Port5<->None)
DRAM_CONF_FROM: Boot-Strapping
DRAM_TYPE: SDRAM
DRAM_SIZE: 256 Mbits
DRAM_WIDTH: 16 bits
DRAM_TOTAL_WIDTH: 16 bits
TOTAL_MEMORY_SIZE: 32 MBytes
Flash component: SPI Flash
Date:May 4 2015 Time:18:32:38
============================================
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:128, ways:4, linesz:32 ,total:16384
##### The CPU freq = 360 MHZ ####
estimate memory size =32 Mbytes
#### u-boot for Insight 2013.05.10 ####
set GPIO 0, 1, 2, 18, 19 to 1 Output
set GPIO 17, 20 to 0 Iutput
Please choose the operation:
1: Load system code to SDRAM via TFTP.
2: Load system code then write to Flash via TFTP.
3: Boot system code via Flash (default).
4: Entr boot command line interface.
7: Load Boot Loader code then write to Flash via Serial.
9: Load Boot Loader code then write to Flash via TFTP.
0
3: System Boot system code via Flash.
Trying to boot from B...bootstate=[2]
Boot B addr_str=[0xBC7C0000]
## Booting image at bc7c0000 ...
raspi_read: from:7c0000 len:40
. Image Name: MIPS OpenWrt Linux-2.6.21
Created: 2017-02-13 14:26:50 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 876413 Bytes = 855.9 kB
Load Address: 80000000
Entry Point: 80274000
raspi_read: from:7c0040 len:d5f7d
.............. Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80274000) ...
## Giving linux memsize in MB, 32
Starting kernel ...
</code></pre></div></div>
<p>The interactive shell can be entered by pressing and holding the 4 key while
powering up the board. These are the available commands:</p>
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>RT5350 # help
? - alias for 'help'
bootm - boot application image from memory
cp - memory copy
erase - erase SPI FLASH memory
flash_test - test flash status, argv => test_pattern_start test_pattern_end test_repeat
go - start application at address 'addr'
help - print online help
loadb - load binary file over serial line (kermit mode)
md - memory display
mdio - Ralink PHY register R/W command !!
mm - memory modify (auto-incrementing)
mw - memory write (fill)
nm - memory modify (constant address)
printenv- print environment variables
reset - Perform RESET of the CPU
rf - read/write rf register
saveenv - save environment variables to persistent storage
setenv - set environment variables
tftpboot- boot image via network using TFTP protocol
version - print monitor version
</code></pre></div></div>
<p>The stock environment looks like this:</p>
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>RT5350 # printenv
bootcmd=tftp
bootdelay=1
baudrate=57600
ethaddr="00:AA:BB:CC:DD:10"
ramargs=setenv bootargs root=/dev/ram rw
addip=setenv bootargs $(bootargs) ip=$(ipaddr):$(serverip):$(gatewayip):$(netmask):$(hostname):$(netdev):off
addmisc=setenv bootargs $(bootargs) console=ttyS0,$(baudrate) ethaddr=$(ethaddr) panic=1
flash_self=run ramargs addip addmisc;bootm $(kernel_addr) $(ramdisk_addr)
kernel_addr=BFC40000
u-boot=u-boot.bin
load=tftp 8A100000 $(u-boot)
u_b=protect off 1:0-1;era 1:0-1;cp.b 8A100000 BC400000 $(filesize)
loadfs=tftp 8A100000 root.cramfs
u_fs=era bc540000 bc83ffff;cp.b 8A100000 BC540000 $(filesize)
test_tftp=tftp 8A100000 root.cramfs;run test_tftp
ethact=Eth0 (10/100-M)
SerialNumber=221510K1200BCF
filesize=5c3205
fileaddr=80800000
ipaddr=10.22.22.1
serverip=10.22.22.2
autostart=no
bootfile=Insight_Test_FW_v1.1.bin
bootpart=1
bootargs=console=ttyS1,57600n8 root=/dev/mtdblock4
bootstate=2
check_boot=0
stdin=serial
stdout=serial
stderr=serial
Environment size: 959/4092 bytes
</code></pre></div></div>
<p>The <code class="language-plaintext highlighter-rouge">bootm</code> command is <a href="https://github.com/svenschwermer/wemo/blob/master/target/linux/rt288x/uboot/common/cmd_bootm.c#L197">modified</a> and doesn’t behave like it does in upstream
u-boot. It’s behaviour is dependent on the value of the <code class="language-plaintext highlighter-rouge">bootstate</code> environment
variable. If <code class="language-plaintext highlighter-rouge">bootstate=0</code>, the <code class="language-plaintext highlighter-rouge">bootm</code> command behaves normally—at least if
only one argument (the address) is passed to it.</p>
<p>Unfortunately, it doesn’t seem possible to change the baud rate to anything
faster than 57600 baud. This means that serial downloads take a while.</p>
<h2 id="stock-os">Stock OS</h2>
<p>This is the console log of the Linux OS after the settings had been restored to
the factory defaults. After the device had been powered up, it was connected to
a WiFi network.</p>
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>LINUX started...
THIS IS ASIC
Linux version 2.6.21 (sulfur@irv-wemo-embed) (gcc version 4.3.3 (GCC) ) #1 Mon Feb 13 06:26:47 PST 2017
The CPU frequency set to 360 MHz
CPU revision is: 0001964c
Determined physical RAM map:
memory: 02000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Built 1 zonelists. Total pages: 8128
Kernel command line: console=ttyS1,57600n8 root=/dev/mtdblock4
root_dev_setup: line=[/dev/mtdblock4]
Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 16kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Cache parity protection disabled
cause = 50808000, status = 11000000
PID hash table entries: 128 (order: 7, 512 bytes)
calculating r4koff... 0015f900(1440000)
CPU frequency 360.00 MHz
Using 180.000 MHz high precision timer.
Console: colour dummy device 80x25
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 29736k/32768k available (2130k kernel code, 3032k reserved, 377k data, 124k init, 0k highmem)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
Time: MIPS clocksource has been installed.
deice id : c2 20 18 c2 20 (2018c220)
MX25L12805D(c2 2018c220) (16384 Kbytes)
mtd .name = raspi, .size = 0x01000000 (16M) .erasesize = 0x00010000 (64K) .numeraseregions = 0
Creating 12 MTD partitions on "raspi":
0x00000000-0x00050000 : "uboot"
0x00050000-0x00190000 : "Kernel_1"
0x00190000-0x007c0000 : "rootfs_1"
0x007c0000-0x00900000 : "Kernel_2"
0x00900000-0x00f30000 : "rootfs_2"
mtd: partition "rootfs_2" set to be root filesystem
mtd: partition "rootfs_data" created automatically, ofs=C90000, len=2A0000
0x00c90000-0x00f30000 : "rootfs_data"
0x00fe0000-0x00ff0000 : "nvram"
0x00ff0000-0x01000000 : "User_Factory"
0x00040000-0x00050000 : "Factory"
0x00f30000-0x00fd0000 : "Belkin_settings"
0x00030000-0x00040000 : "Uboot_env"
0x00050000-0x007c0000 : "Firmware_1"
0x007c0000-0x00f30000 : "Firmware_2"
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered
RT3xxx EHCI/OHCI init.
squashfs: version 3.0 (2006/03/15) Phillip Lougher
Registering mini_fo version $Id$
NTFS driver 2.1.28 [Flags: R/O].
EFS: 1.0a - http://aeschi.ch.eu.org/efs/
JFFS2 version 2.2. (NAND) (C) 2001-2006 Red Hat, Inc.
io scheduler noop registered (default)
RALINK_REG_GPIOMODE = [0x004042D5]
################################################
# #
# SDK - BOARD_EVT #
# #
################################################
reg1_gpio_dir before = [0x002DFFFF]
reg1_gpio_dir after = [0x002DFFFF]
Ralink gpio driver initialized
Gemtek LED init...
GPIO_init: registered WeMoProc POWER_BUTTON
GPIO_init: registered WeMoProc POWER_RELAY
GPIO_init: registered WeMoProc RELAY_LED
GPIO_init: registered WeMoProc MIN_OUT_RATE
################## Don't Restore to Factory Defaults ###################
################## restoreValue= 0 ##################
Serial: 8250/16550 driver $Revision: 1.90 $ 2 ports, IRQ sharing disabled
serial8250: ttyS0 at I/O 0xb0000500 (irq = 37) is a 16550A
serial8250: ttyS1 at I/O 0xb0000c00 (irq = 12) is a 16550A
RAMDISK driver initialized: 16 RAM disks of 8192K size 1024 blocksize
loop: loaded (max 8 devices)
block2mtd: version $Revision: 1.30 $
rt3xxx-ehci rt3xxx-ehci: Ralink EHCI Host Controller
rt3xxx-ehci rt3xxx-ehci: new USB bus registered, assigned bus number 1
rt3xxx-ehci rt3xxx-ehci: irq 18, io mem 0x101c0000
rt3xxx-ehci rt3xxx-ehci: USB 0.0 started, EHCI 1.00, driver 10 Dec 2004
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
rt3xxx-ohci rt3xxx-ohci: RT3xxx OHCI Controller
rt3xxx-ohci rt3xxx-ohci: new USB bus registered, assigned bus number 2
rt3xxx-ohci rt3xxx-ohci: irq 18, io mem 0x101c1000
usb usb2: configuration #1 chosen from 1 choice
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
usbcore: registered new interface driver cdc_acm
drivers/usb/class/cdc-acm.c: v0.25:USB Abstract Control Model driver for USB modems and ISDN adapters
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
saved_root_name is [/dev/mtdblock4]
root_device_name is [/dev/mtdblock4]
name is [/dev/root]
fs_names is [squashfs]
fs_names p is [squashfs], flags is 0x8001
VFS: [/dev/root] Mounted root (squashfs filesystem) readonly.
mount_fail 0 is 0
Freeing unused kernel memory: 124k freed
Please be patient, while OpenWrt loads ...
- preinit -
- regular preinit -
switching to jffs2
mini_fo: using base directory: /
mini_fo: using storage directory: /overlay
- init -
(none) login: Jan 1 00:00:10 syslogd started: BusyBox v1.22.1
********************************************************************
Copyright (c) 2013 by Belkin, Inc. All Rights Reserved.
02/13/17 06:19:41
WeMo_WW_2.00.10966.PVT-OWRT-Insight
********************************************************************
nvram/1468/InitSharedMem: Ignoring CRC error (calculated 0x705fe70e, stored 0xffffffff)
nvram/1468/BuildIndex: BuildIndex: Removing garbage string '�����������������������������������������������������������nvram/1468/BuildIndex: 0 variables defined in NVRAM
nvram/1468/InitSharedMem: Returning 0
nvram/1470/NvramCommitCmd: Called
nvram/1471/NvramSetCmd: Set test_nvram=verified
nvram/1471/NvramSet: error - NVRAM full
nvram parition is corrupted reinitializing...
********************************************************************
nvram/1475/NvramResetCmd: Called
nvram/1475/BuildIndex: 0 variables defined in NVRAM
nvram/1475/NvramRestore: Returning 0
nvram/1475/NvramStartDaemon: Called
nvram/1475/NvramStartDaemon: Starting daemon
nvram/1478/NvramDaemon: NVRAM daemon starting - pid 1478
nvram/1478/NvramCommitInternal: Flushing cache to flash
nvram/1478/NvramCommitInternal: Flash write complete
nvram/1478/BuildIndex: 3 variables defined in NVRAM
nvram/1479/NvramSetCmd: Set test_nvram=verified
nvram/1479/NvramStartDaemon: Called
nvram/1479/NvramStartDaemon: Sending SIGHUP to nvramd (1478)
##### nvram SerialNumber :
##### nvram target_country :
##### nvram country_code :
##### nvram wl0_macaddr :
##### nvram cwf_serial_number :
##### nvram hwVersion :
##### factory serial_number : 221710K12001FD
nvram/1497/NvramSetCmd: Set SerialNumber=221710K12001FD
nvram/1497/NvramStartDaemon: Called
##### factory target_country : de
nvram/1499/NvramSetCmd: Set target_country=de
nvram/1499/NvramStartDaemon: Called
##### factory country_code : 0
nvram/1501/NvramSetCmd: Set country_code=0
nvram/1501/NvramStartDaemon: Called
##### factory wl0_macaddr : 60:38:E0:1B:75:A4
nvram/1503/NvramSetCmd: Set wl0_macaddr=60:38:E0:1B:75:A4
nvram/1503/NvramStartDaemon: Called
##### factory cwf_serial_number : 221710K12001FD
nvram/1505/NvramSetCmd: Set cwf_serial_number=221710K12001FD
nvram/1505/NvramStartDaemon: Called
##### factory product.name : WeMo_insight
##### factory hwVersion : 1
nvram/1507/NvramSetCmd: Set hwVersion=1
nvram/1507/NvramStartDaemon: Called
##### WiFi setup for de
MAC_ADRH -- : 0x00000000
MAC_ADRL -- : 0x00000000
Ralink APSoC Ethernet Driver Initilization. v2.0 256 rx/tx descriptors allocated, mtu = 1500!
MAC_ADRH -- : 0x00006238
MAC_ADRL -- : 0xe01b75a4
PROC INIT OK!
nvram/1478/NvramCommitInternal: Flushing cache to flash
phy_tx_ring = 0x01b3d000, tx_ring = 0xa1b3d000
phy_rx_ring0 = 0x01b3e000, rx_ring0 = 0xa1b3e000
RT305x_ESW: Link down
nvram/1478/NvramCommitInternal: Flash write complete
nvram/1478/BuildIndex: 10 variables defined in NVRAM
rt2860v2_ap: module license 'unspecified' taints kernel.
=== pAd = c005c000, size = 925608 ===
<-- RTMPAllocAdapterBlock, Status=0
rdm_major = 253
Software Watchdog Timer: 0.07 initialized. soft_noboot=0 soft_margin=310 sec (nowayout= 0)
insightd sets custom speed on ttyS0. This is deprecated.
RX DESC a1b7b000 size = 2048
<-- RTMPAllocTxRxRingMemory, Status=0
Key2Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
2a:55:44:e4:05:1a:cb:eb:01:93:83:88:b2:c3:4f:8f:
50:b2:65:62:c1:a3:cb:f9:52:8e:b0:b1:79:c9:b6:97:
1. Phy Mode = 9
2. Phy Mode = 9
3. Phy Mode = 9
MCS Set = ff 00 00 00 01
SYNC - BBP R4 to 20MHz.l
SYNC - BBP R4 to 20MHz.l
SYNC - BBP R4 to 20MHz.l
SYNC - BBP R4 to 20MHz.l
SYNC - BBP R4 to 20MHz.l
SYNC - BBP R4 to 20MHz.l
SYNC - BBP R4 to 20MHz.l
SYNC - BBP R4 to 20MHz.l
SYNC - BBP R4 to 20MHz.l
SYNC - BBP R4 to 20MHz.l
SYNC - BBP R4 to 20MHz.l
@@@ ed_monitor_init : ===>
@@@ ed_monitor_init : <===
Main bssid = 60:38:e0:1b:75:a4
<==== rt28xx_init, Status=0
0x1300 = 00064320
@@@ APPeerBeaconAction : BssChannelAPCount=2, ed_ap_threshold=1, go to ed_monitor_exit()!!
@@@ ed_monitor_exit : ===>
@@@ ed_monitor_exit : <===
nvram/1708/NvramSetCmd: Set wl0_currentChannel=11
nvram/1708/NvramStartDaemon: Called
nvram/1708/NvramStartDaemon: Sending SIGHUP to nvramd (1478)
nvram/1478/NvramCommitInternal: Flushing cache to flash
nvram/1478/NvramCommitInternal: Flash write complete
nvram/1478/BuildIndex: 11 variables defined in NVRAM
thready: make_tname_key key now "0"
thready: Setting thread name to "main" (tid:715849728).
SetBelkinParameter - ParameterName = SysLogLevel , ParameterValue = 7
GetLock (1756): Initializing Robust mutex for syslog, et al
nvram/1756/NvramStartDaemon: Called
nvram/1756/NvramStartDaemon: Sending SIGHUP to nvramd (1478)
nvram/1756/NvramStartDaemon: Called
nvram/1756/NvramStartDaemon: Sending SIGHUP to nvramd (1478)
nvram/1478/NvramCommitInternal: Flushing cache to flash
nvram/1756/GetSemaphore: Timeout waiting NVRAM Semaphore owned by tid 1478.
GetLock (1755): Initializing Robust mutex for syslog, et al
nvram/1478/NvramCommitInternal: Flash write complete
nvram/1478/BuildIndex: 12 variables defined in NVRAM
nvram/1755/GetSemaphore: Timeout waiting NVRAM Semaphore owned by tid 1478.
nvram/1756/GetSemaphore: Got semaphore previously owned by pid -1.
nvram/1755/GetSemaphore: Got semaphore previously owned by pid 1478.
thready: make_tname_key key now "0"
thready: Setting thread name to "StartIpcUdsServer" (tid:715849728).
@@@ ed_monitor_init : ===>
@@@ ed_monitor_init : <===
@@@ APPeerBeaconAction : BssChannelAPCount=2, ed_ap_threshold=1, go to ed_monitor_exit()!!
@@@ ed_monitor_exit : ===>
@@@ ed_monitor_exit : <===
SetBelkinParameter - ParameterName = FW_UPGRD_MemThr , ParameterValue = 5600
nvram/1756/NvramStartDaemon: Called
nvram/1756/NvramStartDaemon: Sending SIGHUP to nvramd (1478)
SetBelkinParameter - ParameterName = import_pkey_name , ParameterValue = WeMoPubKey.asc
nvram/1756/NvramStartDaemon: Called
SetBelkinParameter - ParameterName = settime_sec , ParameterValue =
SetBelkinParameter - ParameterName = restore_state , ParameterValue = 0
nvram/1756/NvramStartDaemon: Called
nvram/1756/NvramStartDaemon: Called
nvram/1756/NvramStartDaemon: Sending SIGHUP to nvramd (1478)
nvram/1478/NvramCommitInternal: Flushing cache to flash
thready: Setting thread name to "watchDogTask" (tid:724776224).
watchdog: Device or resource busy
nvram/1756/GetSemaphore: Timeout waiting NVRAM Semaphore owned by tid 1478.
nvram/1756/GetSemaphore: sem_timedwait failed - Interrupted system call
nvram/1478/NvramCommitInternal: Flash write complete
nvram/1478/BuildIndex: 15 variables defined in NVRAM
nvram/1756/GetSemaphore: Got semaphore previously owned by pid 1478.
SetBelkinParameter - ParameterName = NotificationFlag , ParameterValue = 0
nvram/1756/NvramStartDaemon: Called
nvram/1756/NvramStartDaemon: Sending SIGHUP to nvramd (1478)
SetBelkinParameter - ParameterNamGPIO_write_proc: GPIO_PIN_NUM: 0x40000
e = NotificationGPIO_write_proc: GPIO_PIN_NUM: 0x40000 - 0x0
Flag , ParameterGPIO_write_proc: GPIO_PIN_NUM: 0x2
Value = 1
nvram/1756/NvramStartDaemon: Called
SetBelkinParameter - ParameterName = WeMo_version , ParameterValue = 2.00.10966
nvram/1756/NvramStartDaemon: Called
MAC Address: 60:38:E0:1B:75:A4
PLUGIN_LED_GPIO_proc ledcount=5
[Set_SiteSurvey_Proc] g_SiteSurvey_SSID = 1
thready: Setting thread name to "PowerButtonTask" (tid:728970528).
thready: Setting thread name to "ButtonTaskMonitorThread" (tid:731067680).
thready: Setting thread name to "RelayControlTask" (tid:733164832).
thready: Setting thread name to "systemRestore" (tid:735261984).
@@@ ed_monitor_init : ===>
@@@ ed_monitor_init : <===
nvram/1478/NvramCommitInternal: Flushing cache to flash
[Set_SiteSurvey_Proc] g_SiteSurvey_SSID = 1
thready: Setting thread name to "RulesNtpTimeCheckTask" (tid:793982240).
nvram/1756/GetSemaphore: Timeout waiting NVRAM Semaphore owned by tid 1478.
nvram/1478/NvramCommitInternal: Flash write complete
nvram/1478/BuildIndex: 17 variables defined in NVRAM
nvram/1756/GetSemaphore: Got semaphore previously owned by pid 1478.
thready: Setting thread name to "sendRemoteAccessUpdateStatusThread" (tid:796079392).
thready: Setting thread name to "sendRemAccessUpdStatusThdMonitor" (tid:798176544).
thready: Setting thread name to "sendConfigChangeStatusThread" (tid:800273696).
thready: Setting thread name to "rcvSendstatusRspThread" (tid:802370848).
thready: Setting thread name to "ChildFDTask" (tid:722216224).
thready: Setting thread name to "ChildFDTask" (tid:724313376).
thready: Destructor freeing name "ChildFDTask".
thready: Setting thread name to "StartInsightTask" (tid:808662304).
SetBelkinParameter - ParameterName = PowerThreshold , ParameterValue = 8000
nvram/1830/NvramStartDaemon: Called
nvram/1830/NvramStartDaemon: Sending SIGHUP to nvramd (1478)
SetBelkinParameter - ParameterName = PushToAppTime , ParameterValue = 2
nvram/1830/NvramStartDaemon: Called
SetBelkinParameter - ParameterName = PushToCloudTime , ParameterValue = 60
nvram/1830/NvramStartDaemon: Called
SetBelkinParameter - ParameterName = TodayONTime , ParameterValue = 0
nvram/1830/NvramStartDaemon: Called
SetBelkinParameter - ParameterName = TodayONTimeTS , ParameterValue = 0
nvram/1830/NvramStartDaemon: Called
SetBelkinParameter - ParameterName = TodaySBYTime , ParameterValue = 0
nvram/1830/NvramStartDaemon: Called
SetBelkinParameter - ParameterName = TodaySBYTimeTS , ParameterValue = 0
nvram/1830/NvramStartDaemon: Called
SetBelkinParameter - ParameterName = TodayDate , ParameterValue = 1
nvram/1830/NvramStartDaemon: Called
SetBelkinParameter - ParameterName = WriteToFlashTime , ParameterValue = 1800
nvram/1830/NvramStartDaemon: Called
SetBelkinParameter - ParameterName = Currency , ParameterValue = 1
nvram/1830/NvramStartDaemon: Called
SetBelkinParameter - ParameterName = EnergyPerUnitCost , ParameterValue = 111
nvram/1830/NvramStartDaemon: Called
SetBelkinParameter - ParameterName = EnergyPerUnitCostVersion , ParameterValue = 1
nvram/1830/NvramStartDaemon: Called
SetBelkinParameter - ParameterName = DaysCount , ParameterValue = 0
nvram/1830/NvramStartDaemon: Called
SetBelkinParameter - ParameterName = EventEnable , ParameterValue = 0
nvram/1830/NvramStartDaemon: Called
SetBelkinParameter - ParameterName = EventDuration , ParameterValue = 1800
nvram/1830/NvramStartDaemon: Called
SetBelkinParameter - ParameterName = StateLog , ParameterValue = 0
nvram/1830/NvramStartDaemon: Called
nvram/1756/NvramStartDaemon: Called
nvram/1756/NvramStartDaemon: Sending SIGHUP to nvramd (1478)
nvram/1478/NvramCommitInternal: Flushing cache to flash
nvram/1478/NvramCommitInternal: Flash write complete
nvram/1478/BuildIndex: 33 variables defined in NVRAM
@@@ ed_status_read: pAd->false_cca_stat[15]=226, pAd->false_cca_threshold=180 !!
@@@ ed_status_read: go to ed_monitor_exit()!!
@@@ ed_monitor_exit : ===>
@@@ ed_monitor_exit : <===
Rcv Wcid(1) AddBAReq
Start Seq = 0000000d
SetBelkinParameter - ParameterName = EnergyPerUnitCost , ParameterValue = 938
nvram/1818/NvramStartDaemon: Called
nvram/1818/NvramStartDaemon: Sending SIGHUP to nvramd (1478)
SetBelkinParameter - ParameterName = Currency , ParameterValue = 19
nvram/1818/NvramStartDaemon: Called
SetBelkinParameter - ParameterName = EnergyPerUnitCostVersion , ParameterValue = 2
nvram/1818/NvramStartDaemon: Called
SetBelkinParameter - ParameterName = FriendlyName , ParameterValue = MyWemo
nvram/1820/NvramStartDaemon: Called
[Set_SiteSurvey_Proc] g_SiteSurvey_SSID = 1
nvram/1756/NvramStartDaemon: Called
nvram/1756/NvramStartDaemon: Sending SIGHUP to nvramd (1478)
nvram/1756/NvramStartDaemon: Called
nvram/1756/NvramStartDaemon: Sending SIGHUP to nvramd (1478)
nvram/1478/NvramCommitInternal: Flushing cache to flash
nvram/1478/NvramCommitInternal: Flash write complete
nvram/1478/BuildIndex: 34 variables defined in NVRAM
thready: Destructor freeing name "".
SetBelkinParameter - ParameterName = DstSupportFlag , ParameterValue = 1
nvram/1816/NvramStartDaemon: Called
nvram/1816/NvramStartDaemon: Sending SIGHUP to nvramd (1478)
SetBelkinParameter - ParameterName = LastTimeZone , ParameterValue = 1.0
nvram/1816/NvramStartDaemon: Called
SetBelkinParameter - ParameterName = DstSupportFlag , ParameterValue = 1
nvram/1756/NvramStartDaemon: Called
nvram/1756/NvramStartDaemon: Sending SIGHUP to nvramd (1478)
nvram/1478/NvramCommitInternal: Flushing cache to flash
thready: Setting thread name to "StartPairAndRegisterThread" (tid:785593632).
nvram/1478/NvramCommitInternal: Flash write complete
nvram/1478/BuildIndex: 36 variables defined in NVRAM
[Set_SiteSurvey_Proc] g_SiteSurvey_SSID = 1
@@@ ed_monitor_init : ===>
@@@ ed_monitor_init : <===
ApCliSsid - SSID string = ApCliSsid=***REDACTED***
@@@ APPeerBeaconAction : BssChannelAPCount=3, ed_ap_threshold=1, go to ed_monitor_exit()!!
@@@ ed_monitor_exit : ===>
@@@ ed_monitor_exit : <===
ApCliSsid - SSID string = ApCliSsid=***REDACTED***
Rcv Wcid(1) AddBAReq
Start Seq = 00000000
===>ERROR!!! CntlEnqueueForRecv: BlockAck Request frame length size = 44 incorrect
===>killall: udhcpc: no process killed
SetBelkinParameter - ParameterName = wan_netmask , ParameterValue = 0.0.0.0
nvram/1895/NvramStartDaemon: Called
nvram/1895/NvramStartDaemon: Sending SIGHUP to nvramd (1478)
SetBelkinParameter - ParameterName = wan_ipaddr , ParameterValue = 0.0.0.0
nvram/1895/NvramStartDaemon: Called
is bootp packet! bootpFlag=0x0
is bootp packet! bootpFlag=0x0
UpdateWanDefaultGateway: line = 192.168.0.1
UpdateWanDefaultGateway: GATEWAY = 192.168.0.1
thready: Setting thread name to "resolveArpRequest" (tid:739456288).
Cached MAC Address = 60:38:E0:1B:75:A4
GetWanDefaultGateway: GATEWAY = 192.168.0.1
thready: Setting thERROR!!! CntlEnqueueForRecv: BlockAck Request frame length size = 44 incorrect
read name to "ntpUpdateThread" (PLUGIN_LED_GPIO_proc ledcount=1
tid:812856608).
route: SIOCDELRT: No such process
SetBelkinParameter - ParameterName = SetupCompleteTS , ParameterValue = 1590521648
nvram/1895/NvramStartDaemon: Called
SetBelkinParameter - ParameterName = ClientSSID , ParameterValue = ***REDACTED***
nvram/1895/NvramStartDaemon: Called
SetBelkinParameter - ParameterName = ClientPass , ParameterValue = ***REDACTED***
190A
nvram/1895/NvramStartDaemon: Called
SetBelkinParameter - ParameterName = ClientAuth , ParameterValue = WPA2PSK
nvram/1895/NvramStartDaemon: Called
SetBelkinParameter - ParameterName = ClientEncryp , ParameterValue = AES
nvram/1895/NvramStartDaemon: Called
SetBelkinParameter - ParameterName = APChannel , ParameterValue = 6
nvram/1895/NvramStartDaemon: Called
thready: Setting thread name to "ledTimerTask" (tid:814953760).
thready: Setting thread name to "checkInetConnectivity" (tid:817050912).
thready: Setting thread name to "InetMonitorTask" (tid:819148064).
killall: ntpclient: no process killed
nvram/1756/NvramStartDaemon: Called
nvram/1756/NvramStartDaemon: Sending SIGHUP to nvramd (1478)
nvram/1478/NvramCommitInternal: Flushing cache to flash
thready: Destructor freeing name "RulesNtpTimeChec".
nvram/1478/NvramCommitInternal: Flash write complete
nvram/1478/BuildIndex: 44 variables defined in NVRAM
thready: Destructor freeing name "StartPairAndRegi".
thready: Setting thread name to "remoteRegThread" (tid:793982240).
5, flush one!
Rcv Wcid(1) AddBAReq
Start Seq = 00000000
ERROR!!! CntlEnqueueForRecv: BlockAck Request frame length size = 44 incorrect
43975 70450.069 81038.0 13.3 906097.8 1083.4 0
thready: Destructor freeing name "ntpUpdateThread".
thready: Destructor freeing name "".
thready: Destructor freeing name "".
thready: Destructor freeing name "".
thready: Destructor freeing name "".
GetWanDefaultGateway: GATEWAY = 192.168.0.1
thready: Destructor freeing name "resolveArpReques".
SetBelkinParameter - ParameterName = SetupCompleteTS , ParameterValue = 1590525250
nvram/1830/NvramStartDaemon: Called
nvram/1830/NvramStartDaemon: Sending SIGHUP to nvramd (1478)
SetBelkinParameter - ParameterName = TodayDate , ParameterValue = 26
nvram/1830/NvramStartDaemon: Called
UpdateWanDefaultGateway: line = 192.168.0.1
UpdateWanDefaultGateway: GATEWAY = 192.168.0.1
thready: Setting thread name to "resolveArpRequest" (tid:739456288).
Cached MAC Address = 60:38:E0:1B:75:A4
GetWanDefaultGateway: GATEWAY = 192.168.0.1
thready: Destructor freeing name "resolveArpReques".
thready: Destructor freeing name "StartInsightTask".
thready: Setting thread name to "InsightGPIOTask" (tid:739456288).
thready: Setting thread name to "InsightEventTask" (tid:766719264).
route: SIOCDELRT: No such process
nvram/1756/NvramStartDaemon: Called
nvram/1756/NvramStartDaemon: Sending SIGHUP to nvramd (1478)
nvram/1478/NvramCommitInternal: Flushing cache to flash
thready: Setting thread name to "CtrlPtRediscoverTask" (tid:825439520).
nvram/1756/GetSemaphore: Timeout waiting NVRAM Semaphore owned by tid 1478.
nvram/1478/NvramCommitInternal: Flash write complete
nvram/1478/BuildIndex: 44 variables defined in NVRAM
nvram/1756/GetSemaphore: Got semaphore previously owned by pid 1478.
> POST /apis/http/plugin/registerPlugin HTTP/1.1
Host: api.xbcs.net:8443
Content-Type: application/xml
Accept: application/xml
Authorization: dummy
X-Belkin-Client-Type-Id: WeMo_WW_2.00.10966.PVT-OWRT-Insight:5e7e-40a7-8bf4-539d1dc2ce42
Content-Length: 817
< HTTP/1.1 200 OK
< Date: Tue, 26 May 2020 19:34:16 GMT
< Content-Type: application/xml;charset=UTF-8
< Content-Length: 1731
< Connection: keep-alive
< X-Wemo-Trace-Id: Self=1-5ecd6f38-133184cb518f2f9afce09827;Root=1-5ecd6f37-e5935bb00d13eb387d40d430
< X-Wemo-Host-Ip: 10.0.61.4
< X-Application-Context: application
< Status: 200 OK
<
SetBelkinParameter - ParameterName = restore_state , ParameterValue = 0
SetBelkinParameter - ParameterName = home_id , ParameterValue = 27501
nvram/1971/NvramStartDaemon: Called
nvram/1971/NvramStartDaemon: Sending SIGHUP to nvramd (1478)
SetBelkinParameter - ParameterName = SmartDeviceId , ParameterValue = df09fec6816459a7e06859671a89ebf90bd2472d
nvram/1971/NvramStartDaemon: Called
SetBelkinParameter - ParameterName = plugin_key , ParameterValue = 545caab0-453c-47ef-8c41-fe628f9c3711
nvram/1971/NvramStartDaemon: Called
SetBelkinParameter - ParameterName = PluginCloudId , ParameterValue = 427156
nvram/1971/NvramStartDaemon: Called
SetBelkinParameter - ParameterName = RouterMac , ParameterValue = 5890435A35F4
nvram/1971/NvramStartDaemon: Called
SetBelkinParameter - ParameterName = RouterSsid , ParameterValue = ***REDACTED***
nvram/1971/NvramStartDaemon: Called
nvram/1756/NvramStartDaemon: Called
nvram/1756/NvramStartDaemon: Sending SIGHUP to nvramd (1478)
nvram/1478/NvramCommitInternal: Flushing cache to flash
thready: Destructor freeing name "remoteRegThread".
thready: Setting thread name to "remoteAccessInitThd" (tid:724313376).
nvram/2016/GetSemaphore: Timeout waiting NVRAM Semaphore owned by tid 1478.
nvram/1478/NvramCommitInternal: Flash write complete
nvram/1478/BuildIndex: 50 variables defined in NVRAM
nvram/2016/GetSemaphore: Got semaphore previously owned by pid 1478.
22:34:19.236 os_core_unix.c pjlib 1.8.10 for POSIX initialized
22:34:19.238 pjlib select() I/O Queue created (0x464814)
22:34:19.240 tcprel0x4658e0 TURN client session created
22:34:19.241 tcprel0x4658e0 Resolving 3.81.166.40 with DNS A
22:34:19.241 tcprel0x4658e0 State changed Null --> Resolving
in turn_sock=0
22:34:19.242 turn_wrapper.c State Null --> Resolving
22:34:19.243 tcprel0x4658e0 State changed Resolving --> Resolved
in turn_sock=0
22:34:19.243 turn_wrapper.c State Resolving --> Resolved
22:34:19.244 tcprel0x4658e0 Connecting to 3.81.166.40:3478
22:34:19.362 tcprel0x4658e0 TCP connected
conn type= TCP
22:34:19.363 tcprel0x4658e0 State changed Resolved --> Allocating
in turn_sock=0
22:34:19.363 turn_wrapper.c State Resolved --> Allocating
22:34:19.364 tcprel0x4658e0 TX 48 bytes STUN message to 3.81.166.40:3478:
--- begin STUN message ---
STUN Allocate request
Hdr: length=28, magic=2112a442, tsx_id=000006db333ab105628c895d
Attributes:
REQUESTED-TRANSPORT: length=4, value=100663296 (0x6000000)
SOFTWARE: length=13, value="pjnath-1.8.10"
--- end of STUN message ---
22:34:19.365 stuntsx0x46978 STUN client transaction created
22:34:19.366 stuntsx0x46978 STUN sending message (transmit count=8)
in func turn_on_send_pkt
dst addr=3.81.166.40 htons.port=3478 ntwk.port=38413
check server_addr.sin_addr=3.81.166.40 .port=38413
22:34:19.484 tcprel0x4658e0 RX 140 bytes STUN message from 3.81.166.40:3478:
--- begin STUN message ---
STUN Allocate error response
Hdr: length=120, magic=2112a442, tsx_id=000006db333ab105628c895d
Attributes:
ERROR-CODE: length=20, err_code=401, reason="Unauthorized"
REALM: length=10, value="belkin.org"
NONCE: length=48, value="5ecd7d4c0000000088b594dea928a930d11328d11b63179a"
SOFTWARE: length=14, value="TurnServer 0.4"
FINGERPRINT: length=4, value=1730986421 (0x672cc1b5)
--- end of STUN message ---
22:34:19.486 tcprel0x4658e0 Retrying request with new authentication
22:34:19.487 tcprel0x4658e0 TX 156 bytes STUN message to 3.81.166.40:3478:
--- begin STUN message ---
STUN Allocate request
Hdr: length=136, magic=2112a442, tsx_id=000006db721da317628c895e
Attributes:
REQUESTED-TRANSPORT: length=4, value=100663296 (0x6000000)
SOFTWARE: length=13, value="pjnath-1.8.10"
USERNAME: length=12, value="6038E01B75A4"
REALM: length=10, value="belkin.org"
NONCE: length=48, value="5ecd7d4c0000000088b594dea928a930d11328d11b63179a"
MESSAGE-INTEGRITY: length=20, data=509d5ffb90ea53e82c9ec50d41e7d4649882f971
--- end of STUN message ---
22:34:19.488 stuntsx0x46998 STUN client transaction created
22:34:19.489 stuntsx0x46998 STUN sending message (transmit count=8)
in func turn_on_send_pkt
dst addr=3.81.166.40 htons.port=3478 ntwk.port=38413
check server_addr.sin_addr=3.81.166.40 .port=38413
22:34:19.654 tcprel0x4658e0 RX 104 bytes STUN message from 3.81.166.40:3478:
--- begin STUN message ---
STUN Allocate success response
Hdr: length=84, magic=2112a442, tsx_id=000006db721da317628c895e
Attributes:
XOR-RELAYED-ADDRESS: length=8, IPv4 addr=10.0.90.108:36433
LIFETIME: length=4, value=330 (0x14a)
XOR-MAPPED-ADDRESS: length=8, IPv4 addr=109.108.210.20:4992
SOFTWARE: length=14, value="TurnServer 0.4"
MESSAGE-INTEGRITY: length=20, data=4548bfae89cc1b167b1274273024a431bc9ba150
FINGERPRINT: length=4, value=735342363 (0x2bd46f1b)
--- end of STUN message ---
22:34:19.654 tcprel0x4658e0 State changed Allocating --> Ready
in turn_sock=0
22:34:19.655 turn_wrapper.c State Allocating --> Ready
22:34:21.493 stuntsx0x46978 STUN client transaction destroyed
22:34:21.656 stuntsx0x46998 STUN client transaction destroyed
> POST /apis/http/dlr/peerAddresses HTTP/1.1
Host: api.xbcs.net:8443
Content-Type: application/xml
Accept: application/xml
Authorization: 6038E01B75A4:Esd56bmeHr3rUyERkY7Tu9XwDgI=:1590525761
X-Belkin-Client-Type-Id: WeMo_WW_2.00.10966.PVT-OWRT-Insight:5e7e-40a7-8bf4-539d1dc2ce42
Content-Length: 242
> POST /apis/http/plugin/sendNotification HTTP/1.1
Host: api.xbcs.net:8443
Content-Type: application/xml
Accept: application/xml
Authorization: 6038E01B75A4:Esd56bmeHr3rUyERkY7Tu9XwDgI=:1590525761
Log-Data: ;TimeZone: 1.00
X-Belkin-Client-Type-Id: WeMo_WW_2.00.10966.PVT-OWRT-Insight:5e7e-40a7-8bf4-539d1dc2ce42
Content-Length: 700
< HTTP/1.1 200 OK
< Date: Tue, 26 May 2020 19:34:23 GMT
< Content-Type: application/xml;charset=UTF-8
< Content-Length: 1263
< Connection: keep-alive
< X-Application-Context: application
<
thready: Destructor freeing name "remoteAccessInit".
thready: Setting thread name to "remoteInitNatClient24" (tid:728507680).
< HTTP/1.1 200 OK
< Date: Tue, 26 May 2020 19:34:24 GMT
< Content-Type: application/xml;charset=UTF-8
< Content-Length: 122
< Connection: keep-alive
< X-Wemo-Trace-Id: Self=1-5ecd6f40-dd9e970078226fb068424290;Root=1-5ecd6f3f-54f5c65dc17661517a886917
< X-Wemo-Host-Ip: 10.0.60.12
< X-Application-Context: application
< Status: 200 OK
<
> POST /apis/http/plugin/insight/sendInsightParams HTTP/1.1
Host: api.xbcs.net:8443
Content-Type: application/xml
Accept: application/xml
Authorization: 6038E01B75A4:B2wW5GY2ZL88Mqelj/4ALXoXETI=:1590525763
Log-Data: ;TimeZone: 1.00
X-Belkin-Client-Type-Id: WeMo_WW_2.00.10966.PVT-OWRT-Insight:5e7e-40a7-8bf4-539d1dc2ce42
Content-Length: 215
< HTTP/1.1 200 OK
< Date: Tue, 26 May 2020 19:34:24 GMT
< Content-Type: application/xml;charset=UTF-8
< Content-Length: 217
< Connection: keep-alive
< X-Wemo-Trace-Id: Self=1-5ecd6f40-fa93867e526434d0038244f4;Root=1-5ecd6f40-777b363a28282e633f30645f
< X-Wemo-Host-Ip: 10.0.61.14
< X-Application-Context: application
< Status: 200 OK
<
> POST /apis/http/plugin/insight/insightNotification HTTP/1.1
Host: api.xbcs.net:8443
Content-Type: application/xml
Accept: application/xml
Authorization: 6038E01B75A4:B2wW5GY2ZL88Mqelj/4ALXoXETI=:1590525763
Log-Data: ;TimeZone: 1.00
X-Belkin-Client-Type-Id: WeMo_WW_2.00.10966.PVT-OWRT-Insight:5e7e-40a7-8bf4-539d1dc2ce42
Content-Length: 500
< HTTP/1.1 200 OK
< Date: Tue, 26 May 2020 19:34:24 GMT
< Content-Type: application/xml;charset=UTF-8
< Content-Length: 231
< Connection: keep-alive
< X-Wemo-Trace-Id: Self=1-5ecd6f40-a3835638d1b7d30251872eda;Root=1-5ecd6f40-fa70c78904a986ac653f8698
< X-Wemo-Host-Ip: 10.0.63.5
< X-Application-Context: application
< Status: 200 OK
<
22:34:24.539 tcprel0x4658e0 RX 92 bytes STUN message from 3.81.166.40:3478:
--- begin STUN message ---
STUN ConnectionAttempt indication
Hdr: length=72, magic=2112a442, tsx_id=6626f89fbc9e8826f42d1d7c
Attributes:
SOFTWARE: length=14, value="TurnServer 0.4"
CONNECTION-ID: length=4, value=4038643033 (0xf0b8cd59)
XOR-PEER-ADDRESS: length=8, IPv4 addr=10.0.61.4:39424
MESSAGE-INTEGRITY: length=20, data=41a394d95d2a81547bbd02971acfa11ef9f75a5d
FINGERPRINT: length=4, value=1860324126 (0x6ee24b1e)
--- end of STUN message ---
22:34:24.540 tcprel0x4658e0 Received PJ_STUN_CONNECTION_ATTEMPT_INDICATION indication
22:34:24.542 tcprel0x4658e0 TX 156 bytes STUN message to 3.81.166.40:3478:
--- begin STUN message ---
STUN ConnectionBind request
Hdr: length=136, magic=2112a442, tsx_id=000006db2d1d5ae9628c895f
Attributes:
CONNECTION-ID: length=4, value=4038643033 (0xf0b8cd59)
SOFTWARE: length=13, value="pjnath-1.8.10"
USERNAME: length=12, value="6038E01B75A4"
REALM: length=10, value="belkin.org"
NONCE: length=48, value="5ecd7d4c0000000088b594dea928a930d11328d11b63179a"
MESSAGE-INTEGRITY: length=20, data=7244b883dfd0513386a8b895f61eea5160033205
--- end of STUN message ---
22:34:24.543 stuntsx0x4abb9 STUN client transaction created
22:34:24.544 stuntsx0x4abb9 STUN sending message (transmit count=8)
in func turn_on_send_pkt
dst addr=3.81.166.40 htons.port=3478 ntwk.port=38413
check server_addr.sin_addr=3.81.166.40 .port=38413
data sock fd=10 data_port=0
data_port aftr htons=0
turn_sock->data_sock while setting =10
*********************
this shud print only for CONN BIND
*********************
sending 156 bytes of data to turn server
after senddata status=156
data_channel_recv thread spawned for handling data being received for data_sock=10 successfully
22:34:24.667 tcprel0x4658e0 Leaving Received PJ_STUN_CONNECTION_ATTEMPT_INDICATION indication condition
22:34:24.668 tcprel0x4658e0 Received Data indication with missing attributes
data_channel_recv entry for data_sock = 10
waiting to recv the message header
Received 80 Bytes
this is a response -> method in resp=11
waiting to recv the message header
Received 248 Bytes
hdr recv, msg_type=feed len=240
Copied 240 bytes from recv_data to payload_buffer
in data_channel_recv thread before invoking application handler 22:34:24.907 turn_wrapper.c ***Client received 240 bytes data*** actual data_sock=10
waiting to recv the message header
hdr recv failure, going out of loop=10 setting nodatarcv
data_channel_recv exit
thready: Destructor freeing name "".
PLUGIN_LED_GPIO_proc ledcount=4
thready: Destructor freeing name "ledTimerTask".
> POST /apis/http/dlr/peerLocalAddress HTTP/1.1
Host: api.xbcs.net:8443
Content-Type: application/xml
Accept: application/xml
Authorization: 6038E01B75A4:ruo3rmWRj/FVJlYZi0wXI3X+MUU=:1590525782
X-Belkin-Client-Type-Id: WeMo_WW_2.00.10966.PVT-OWRT-Insight:5e7e-40a7-8bf4-539d1dc2ce42
Content-Length: 275
< HTTP/1.1 200 OK
< Date: Tue, 26 May 2020 19:34:44 GMT
< Content-Type: application/xml;charset=UTF-8
< Content-Length: 466
< Connection: keep-alive
< X-Application-Context: application
<
thready: Destructor freeing name "".
22:35:04.553 stuntsx0x4abb9 STUN timeout waiting for response
22:35:04.553 tcprel0x4658e0 Unexpected STUN 11 response
22:35:06.557 stuntsx0x4abb9 STUN client transaction destroyed
22:35:28.804 tcprel0x4658e0 RX 92 bytes STUN message from 3.81.166.40:3478:
--- begin STUN message ---
STUN ConnectionAttempt indication
Hdr: length=72, magic=2112a442, tsx_id=a08b2c51643bdb760916a129
Attributes:
SOFTWARE: length=14, value="TurnServer 0.4"
CONNECTION-ID: length=4, value=4092930162 (0xf3f52872)
XOR-PEER-ADDRESS: length=8, IPv4 addr=10.0.63.5:40398
MESSAGE-INTEGRITY: length=20, data=9b3527ffd1f89b9cba2605ea92ea2cabcb2af336
FINGERPRINT: length=4, value=1701134437 (0x65654065)
--- end of STUN message ---
22:35:28.804 tcprel0x4658e0 Received PJ_STUN_CONNECTION_ATTEMPT_INDICATION indication
22:35:28.806 tcprel0x4658e0 TX 156 bytes STUN message to 3.81.166.40:3478:
--- begin STUN message ---
STUN ConnectionBind request
Hdr: length=136, magic=2112a442, tsx_id=000006db6763845e628c8960
Attributes:
CONNECTION-ID: length=4, value=4092930162 (0xf3f52872)
SOFTWARE: length=13, value="pjnath-1.8.10"
USERNAME: length=12, value="6038E01B75A4"
REALM: length=10, value="belkin.org"
NONCE: length=48, value="5ecd7d4c0000000088b594dea928a930d11328d11b63179a"
MESSAGE-INTEGRITY: length=20, data=cc20886d4eeb9f0dae1ac29c3430cd501c58f309
--- end of STUN message ---
22:35:28.806 stuntsx0x4abb9 STUN client transaction created
22:35:28.807 stuntsx0x4abb9 STUN sending message (transmit count=8)
in func turn_on_send_pkt
dst addr=3.81.166.40 htons.port=3478 ntwk.port=38413
check server_addr.sin_addr=3.81.166.40 .port=38413
data sock fd=10 data_port=0
data_port aftr htons=0
turn_sock->data_sock while setting =10
*********************
this shud print only for CONN BIND
*********************
sending 156 bytes of data to turn server
after senddata status=156
data_channel_recv thread spawned for handling data being received for data_sock=10 successfully
22:35:28.921 tcprel0x4658e0 Leaving Received PJ_STUN_CONNECTION_ATTEMPT_INDICATION indication condition
22:35:28.922 tcprel0x4658e0 Received Data indicaGPIO_write_proc: GPIO_PIN_NUM: 0x40000
tion with missinGPIO_write_proc: GPIO_PIN_NUM: 0x40000 - 0x1
g attributes
data_channel_recGPIO_write_proc: GPIO_PIN_NUM: 0x2
v entry for data_sock = 10
waiting to recv the message header
Received 80 Bytes
this is a response -> method in resp=11
waiting to recv the message header
Received 328 Bytes
hdr recv, msg_type=feed len=320
Copied 320 bytes from recv_data to payload_buffer
in data_channel_recv thread before invoking application handler 22:35:29.146 turn_wrapper.c ***Client received 320 bytes data*** actual data_sock=10
waiting to recv the message header
hdr recv failure, going out of loop=10 setting nodatarcv
data_channel_recv exit
thready: Destructor freeing name "".
22:35:31.791 tcprel0x4658e0 RX 92 bytes STUN message from 3.81.166.40:3478:
--- begin STUN message ---
STUN ConnectionAttempt indication
Hdr: length=72, magic=2112a442, tsx_id=2f90c81ccd3df1139e16ab7f
Attributes:
SOFTWARE: length=14, value="TurnServer 0.4"
CONNECTION-ID: length=4, value=253717270 (0xf1f6b16)
XOR-PEER-ADDRESS: length=8, IPv4 addr=10.0.60.12:43746
MESSAGE-INTEGRITY: length=20, data=655ab60362587dd79fa1272f7c821024f10451cd
FINGERPRINT: length=4, value=2476244466 (0x93987df2)
--- end of STUN message ---
22:35:31.792 tcprel0x4658e0 Received PJ_STUN_CONNECTION_ATTEMPT_INDICATION indication
22:35:31.794 tcprel0x4658e0 TX 156 bytes STUN message to 3.81.166.40:3478:
--- begin STUN message ---
STUN ConnectionBind request
Hdr: length=136, magic=2112a442, tsx_id=000006db75a2a8d4628c8961
Attributes:
CONNECTION-ID: length=4, value=253717270 (0xf1f6b16)
SOFTWARE: length=13, value="pjnath-1.8.10"
USERNAME: length=12, value="6038E01B75A4"
REALM: length=10, value="belkin.org"
NONCE: length=48, value="5ecd7d4c0000000088b594dea928a930d11328d11b63179a"
MESSAGE-INTEGRITY: length=20, data=93c8100dcafcbe5753dbab46c307517565671ad6
--- end of STUN message ---
22:35:31.794 stuntsx0x485ba STUN client transaction created
22:35:31.795 stuntsx0x485ba STUN sending message (transmit count=8)
in func turn_on_send_pkt
dst addr=3.81.166.40 htons.port=3478 ntwk.port=38413
check server_addr.sin_addr=3.81.166.40 .port=38413
data sock fd=10 data_port=0
data_port aftr htons=0
turn_sock->data_sock while setting =10
*********************
this shud print only for CONN BIND
*********************
sending 156 bytes of data to turn server
after senddata status=156
data_channel_recv thread spawned for handling data being received for data_sock=10 successfully
22:35:31.914 tcprel0x4658e0 Leaving Received PJ_STUN_CONNECTION_ATTEMPT_INDICATION indication condition
22:35:31.914 tcprel0x4658e0 Received Data indication with missing attributes
data_channel_recv entry for data_sock = 10
waiting to recv the message header
Received 80 Bytes
this is a response -> method in resp=11
waiting to recv the message header
Received 200 Bytes
hdr recv, msg_type=feed len=192
Copied 192 bytes from recv_data to payload_buffer
in data_channel_recv thread before invoking application handler 22:35:32.147 turn_wrapper.c ***Client received 192 bytes data*** actual data_sock=10
Cached MAC Address = 60:38:E0:1B:75:A4
SetBelkinParameter - ParameterName = PushToCloudTime , ParameterValue = 6
nvram/1829/NvramStartDaemon: Called
nvram/1829/NvramStartDaemon: Sending SIGHUP to nvramd (1478)
waiting to recv the message header
hdr recv failure, going out of loop=10 setting nodatarcv
data_channel_recv exit
thready: Destructor freeing name "".
> POST /apis/http/plugin/sendNotification HTTP/1.1
Host: api.xbcs.net:8443
Content-Type: application/xml
Accept: application/xml
Authorization: 6038E01B75A4:2k4cfwIO0t/WFo/mfN7qif20j6g=:1590525834
Log-Data: Actuation: Manual - mobile App;Remote: 1;TimeZone: 1.00
X-Belkin-Client-Type-Id: WeMo_WW_2.00.10966.PVT-OWRT-Insight:5e7e-40a7-8bf4-539d1dc2ce42
Content-Length: 709
nvram/1478/NvramCommitInternal: Flushing cache to flash
< HTTP/1.1 200 OK
< Date: Tue, 26 May 2020 19:35:36 GMT
< Content-Type: application/xml;charset=UTF-8
< Content-Length: 122
< Connection: keep-alive
< X-Wemo-Trace-Id: Self=1-5ecd6f88-fb92418929b59ce2d6ab1a51;Root=1-5ecd6f87-710a28a8068d6f7043ab7d80
< X-Wemo-Host-Ip: 10.0.60.12
< X-Application-Context: application
< Status: 200 OK
<
nvram/1822/GetSemaphore: Timeout waiting NVRAM Semaphore owned by tid 1478.
nvram/1478/NvramCommitInternal: Flash write complete
nvram/1478/BuildIndex: 50 variables defined in NVRAM
nvram/1822/GetSemaphore: Got semaphore previously owned by pid 1478.
> POST /apis/http/plugin/insight/insightNotification HTTP/1.1
Host: api.xbcs.net:8443
Content-Type: application/xml
Accept: application/xml
Authorization: 6038E01B75A4:gWnZzirp+l+K/tkYRDxVk2mTV2Q=:1590525835
Log-Data: ;TimeZone: 1.00
X-Belkin-Client-Type-Id: WeMo_WW_2.00.10966.PVT-OWRT-Insight:5e7e-40a7-8bf4-539d1dc2ce42
Content-Length: 500
< HTTP/1.1 200 OK
< Date: Tue, 26 May 2020 19:35:37 GMT
< Content-Type: application/xml;charset=UTF-8
< Content-Length: 231
< Connection: keep-alive
< X-Wemo-Trace-Id: Self=1-5ecd6f89-34aa10c07c938d5030b41ce0;Root=1-5ecd6f88-e3ab19e8cb3735a8a578f1c8
< X-Wemo-Host-Ip: 10.0.63.5
< X-Application-Context: application
< Status: 200 OK
<
> POST /apis/http/plugin/insight/insightNotification HTTP/1.1
Host: api.xbcs.net:8443
Content-Type: application/xml
Accept: application/xml
Authorization: 6038E01B75A4:F2LpOXIcP5g6axCwCvmTRhIA0bo=:1590525866
Log-Data: ;TimeZone: 1.00
X-Belkin-Client-Type-Id: WeMo_WW_2.00.10966.PVT-OWRT-Insight:5e7e-40a7-8bf4-539d1dc2ce42
Content-Length: 501
< HTTP/1.1 200 OK
< Date: Tue, 26 May 2020 19:36:07 GMT
< Content-Type: application/xml;charset=UTF-8
< Content-Length: 231
< Connection: keep-alive
< X-Wemo-Trace-Id: Self=1-5ecd6fa7-ce16218f7ea03a8f3e91e098;Root=1-5ecd6fa7-60ed0da0a212750859771d50
< X-Wemo-Host-Ip: 10.0.63.5
< X-Application-Context: application
< Status: 200 OK
<
> POST /apis/http/plugin/insight/insightNotification HTTP/1.1
Host: api.xbcs.net:8443
Content-Type: application/xml
Accept: application/xml
Authorization: 6038E01B75A4:F2LpOXIcP5g6axCwCvmTRhIA0bo=:1590525866
Log-Data: ;TimeZone: 1.00
X-Belkin-Client-Type-Id: WeMo_WW_2.00.10966.PVT-OWRT-Insight:5e7e-40a7-8bf4-539d1dc2ce42
Content-Length: 501
< HTTP/1.1 200 OK
< Date: Tue, 26 May 2020 19:36:08 GMT
< Content-Type: application/xml;charset=UTF-8
< Content-Length: 231
< Connection: keep-alive
< X-Wemo-Trace-Id: Self=1-5ecd6fa8-e4d58bd45ec1a8d86a38d842;Root=1-5ecd6fa7-4115cd90a2bf44c03654f020
< X-Wemo-Host-Ip: 10.0.60.12
< X-Application-Context: application
< Status: 200 OK
<
22:36:08.808 stuntsx0x4abb9 STUN timeout waiting for response
22:36:08.809 tcprel0x4658e0 Unexpected STUN 11 response
22:36:10.813 stuntsx0x4abb9 STUN client transaction destroyed
22:36:11.050 tcprel0x4658e0 RX 92 bytes STUN message from 3.81.166.40:3478:
--- begin STUN message ---
STUN ConnectionAttempt indication
Hdr: length=72, magic=2112a442, tsx_id=7fd22776b8a6778a5281ef16
Attributes:
SOFTWARE: length=14, value="TurnServer 0.4"
CONNECTION-ID: length=4, value=1859721256 (0x6ed91828)
XOR-PEER-ADDRESS: length=8, IPv4 addr=10.0.61.4:40558
MESSAGE-INTEGRITY: length=20, data=2b9f962446a441ac5daa1d7ba7ad851ba49d66ac
FINGERPRINT: length=4, value=2577094097 (0x999b55d1)
--- end of STUN message ---
22:36:11.051 tcprel0x4658e0 Received PJ_STUN_CONNECTION_ATTEMPT_INDICATION indication
22:36:11.052 tcprel0x4658e0 TX 156 bytes STUN message to 3.81.166.40:3478:
--- begin STUN message ---
STUN ConnectionBind request
Hdr: length=136, magic=2112a442, tsx_id=000006db08edbdab628c8962
Attributes:
CONNECTION-ID: length=4, value=1859721256 (0x6ed91828)
SOFTWARE: length=13, value="pjnath-1.8.10"
USERNAME: length=12, value="6038E01B75A4"
REALM: length=10, value="belkin.org"
NONCE: length=48, value="5ecd7d4c0000000088b594dea928a930d11328d11b63179a"
MESSAGE-INTEGRITY: length=20, data=ef7aa999e18ed10fe8b8866a0cc7e8d7eba0847c
--- end of STUN message ---
22:36:11.053 stuntsx0x49338 STUN client transaction created
22:36:11.054 stuntsx0x49338 STUN sending message (transmit count=8)
in func turn_on_send_pkt
dst addr=3.81.166.40 htons.port=3478 ntwk.port=38413
check server_addr.sin_addr=3.81.166.40 .port=38413
data sock fd=10 data_port=0
data_port aftr htons=0
turn_sock->data_sock while setting =10
*********************
this shud print only for CONN BIND
*********************
sending 156 bytes of data to turn server
after senddata status=156
data_channel_recv thread spawned for handling data being received for data_sock=10 successfully
22:36:11.182 tcprel0x4658e0 Leaving Received PJ_STUN_CONNECTION_ATTEMPT_INDICATION indication condition
22:36:11.183 tcprel0x4658e0 Received Data indication with missing attributes
data_channel_recv entry for data_sock = 10
waiting to recv the message header
Received 80 Bytes
this is a resGPIO_write_proc: GPIO_PIN_NUM: 0x40000
ponse -> method GPIO_write_proc: GPIO_PIN_NUM: 0x40000 - 0x0
in resp=11
waitGPIO_write_proc: GPIO_PIN_NUM: 0x2
ing to recv the message header
Received 328 Bytes
hdr recv, msg_type=feed len=320
Copied 320 bytes from recv_data to payload_buffer
in data_channel_recv thread before invoking application handler 22:36:11.416 turn_wrapper.c ***Client received 320 bytes data*** actual data_sock=10
waiting to recv the message header
hdr recv failure, going out of loop=10 setting nodatarcv
data_channel_recv exit
thready: Destructor freeing name "".
22:36:11.805 stuntsx0x485ba STUN timeout waiting for response
22:36:11.806 tcprel0x4658e0 Unexpected STUN 11 response
22:36:13.809 stuntsx0x485ba STUN client transaction destroyed
> POST /apis/http/plugin/sendNotification HTTP/1.1
Host: api.xbcs.net:8443
Content-Type: application/xml
Accept: application/xml
Authorization: 6038E01B75A4:n+DnWT/UFhtds7RrPs5fCJuYgzA=:1590525877
Log-Data: Actuation: Manual - mobile App;Remote: 1;TimeZone: 1.00
X-Belkin-Client-Type-Id: WeMo_WW_2.00.10966.PVT-OWRT-Insight:5e7e-40a7-8bf4-539d1dc2ce42
Content-Length: 709
< HTTP/1.1 200 OK
< Date: Tue, 26 May 2020 19:36:19 GMT
< Content-Type: application/xml;charset=UTF-8
< Content-Length: 122
< Connection: keep-alive
< X-Wemo-Trace-Id: Self=1-5ecd6fb3-2124d3b2bba21a967ddc1e50;Root=1-5ecd6fb2-6b0fa468221931e0682691a0
< X-Wemo-Host-Ip: 10.0.60.11
< X-Application-Context: application
< Status: 200 OK
<
22:36:31.837 tcprel0x4658e0 RX 92 bytes STUN message from 3.81.166.40:3478:
--- begin STUN message ---
STUN ConnectionAttempt indication
Hdr: length=72, magic=2112a442, tsx_id=19be61a509d2f74d196c0474
Attributes:
SOFTWARE: length=14, value="TurnServer 0.4"
CONNECTION-ID: length=4, value=966996554 (0x39a3324a)
XOR-PEER-ADDRESS: length=8, IPv4 addr=10.0.61.14:44590
MESSAGE-INTEGRITY: length=20, data=00998c796b19a313b11a55b49c17be8af993d1c2
FINGERPRINT: length=4, value=252332036 (0xf0a4804)
--- end of STUN message ---
22:36:31.838 tcprel0x4658e0 Received PJ_STUN_CONNECTION_ATTEMPT_INDICATION indication
22:36:31.839 tcprel0x4658e0 TX 156 bytes STUN message to 3.81.166.40:3478:
--- begin STUN message ---
STUN ConnectionBind request
Hdr: length=136, magic=2112a442, tsx_id=000006db79838cb2628c8963
Attributes:
CONNECTION-ID: length=4, value=966996554 (0x39a3324a)
SOFTWARE: length=13, value="pjnath-1.8.10"
USERNAME: length=12, value="6038E01B75A4"
REALM: length=10, value="belkin.org"
NONCE: length=48, value="5ecd7d4c0000000088b594dea928a930d11328d11b63179a"
MESSAGE-INTEGRITY: length=20, data=3a582da1dd8084761cacf6b15ccdc618ae7f219d
--- end of STUN message ---
22:36:31.840 stuntsx0x485ba STUN client transaction created
22:36:31.841 stuntsx0x485ba STUN sending message (transmit count=8)
in func turn_on_send_pkt
dst addr=3.81.166.40 htons.port=3478 ntwk.port=38413
check server_addr.sin_addr=3.81.166.40 .port=38413
data sock fd=10 data_port=0
data_port aftr htons=0
turn_sock->data_sock while setting =10
*********************
this shud print only for CONN BIND
*********************
sending 156 bytes of data to turn server
after senddata status=156
data_channel_recv thread spawned for handling data being received for data_sock=10 successfully
22:36:31.951 tcprel0x4658e0 Leaving Received PJ_STUN_CONNECTION_ATTEMPT_INDICATION indication condition
22:36:31.951 tcprel0x4658e0 Received Data indication with missing attributes
data_channel_recv entry for data_sock = 10
waiting to recv the message header
Received 80 Bytes
this is a response -> method in resp=11
waiting to recv the message header
Received 200 Bytes
hdr recv, msg_type=feed len=192
Copied 192 bytes from recv_data to payload_buffer
in data_channel_recv thread before invoking application handler 22:36:32.167 turn_wrapper.c ***Client received 192 bytes data*** actual data_sock=10
Cached MAC Address = 60:38:E0:1B:75:A4
SetBelkinParameter - ParameterName = PushToCloudTime , ParameterValue = 6
waiting to recv the message header
hdr recv failure, going out of loop=10 setting nodatarcv
data_channel_recv exit
thready: Destructor freeing name "".
22:36:51.065 stuntsx0x49338 STUN timeout waiting for response
22:36:51.066 tcprel0x4658e0 Unexpected STUN 11 response
22:36:53.069 stuntsx0x49338 STUN client transaction destroyed
22:37:11.849 stuntsx0x485ba STUN timeout waiting for response
22:37:11.850 tcprel0x4658e0 Unexpected STUN 11 response
22:37:13.853 stuntsx0x485ba STUN client transaction destroyed
22:37:31.790 tcprel0x4658e0 RX 92 bytes STUN message from 3.81.166.40:3478:
--- begin STUN message ---
STUN ConnectionAttempt indication
Hdr: length=72, magic=2112a442, tsx_id=943be6f76c1bc8111517963f
Attributes:
SOFTWARE: length=14, value="TurnServer 0.4"
CONNECTION-ID: length=4, value=1398619039 (0x535d3b9f)
XOR-PEER-ADDRESS: length=8, IPv4 addr=10.0.61.4:41454
MESSAGE-INTEGRITY: length=20, data=f1380fe16b1e60ad73e53e60d18add661f6b02ab
FINGERPRINT: length=4, value=3448016328 (0xcd848dc8)
--- end of STUN message ---
22:37:31.791 tcprel0x4658e0 Received PJ_STUN_CONNECTION_ATTEMPT_INDICATION indication
22:37:31.792 tcprel0x4658e0 TX 156 bytes STUN message to 3.81.166.40:3478:
--- begin STUN message ---
STUN ConnectionBind request
Hdr: length=136, magic=2112a442, tsx_id=000006db4353d0cd628c8964
Attributes:
CONNECTION-ID: length=4, value=1398619039 (0x535d3b9f)
SOFTWARE: length=13, value="pjnath-1.8.10"
USERNAME: length=12, value="6038E01B75A4"
REALM: length=10, value="belkin.org"
NONCE: length=48, value="5ecd7d4c0000000088b594dea928a930d11328d11b63179a"
MESSAGE-INTEGRITY: length=20, data=7d85109ab0f62c7ee684794c15f206d15fb429c4
--- end of STUN message ---
22:37:31.793 stuntsx0x4abb9 STUN client transaction created
22:37:31.794 stuntsx0x4abb9 STUN sending message (transmit count=8)
in func turn_on_send_pkt
dst addr=3.81.166.40 htons.port=3478 ntwk.port=38413
check server_addr.sin_addr=3.81.166.40 .port=38413
data sock fd=10 data_port=0
data_port aftr htons=0
turn_sock->data_sock while setting =10
*********************
this shud print only for CONN BIND
*********************
sending 156 bytes of data to turn server
after senddata status=156
data_channel_recv thread spawned for handling data being received for data_sock=10 successfully
22:37:31.904 tcprel0x4658e0 Leaving Received PJ_STUN_CONNECTION_ATTEMPT_INDICATION indication condition
22:37:31.905 tcprel0x4658e0 Received Data indication with missing attributes
data_channel_recv entry for data_sock = 10
waiting to recv the message header
Received 80 Bytes
this is a response -> method in resp=11
waiting to recv the message header
Received 200 Bytes
hdr recv, msg_type=feed len=192
Copied 192 bytes from recv_data to payload_buffer
in data_channel_recv thread before invoking application handler 22:37:32.119 turn_wrapper.c ***Client received 192 bytes data*** actual data_sock=10
Cached MAC Address = 60:38:E0:1B:75:A4
SetBelkinParameter - ParameterName = PushToCloudTime , ParameterValue = 6
waiting to recv the message header
hdr recv failure, going out of loop=10 setting nodatarcv
data_channel_recv exit
thready: Destructor freeing name "".
22:37:36.261 tcprel0x4658e0 TCP connection closed: End of file (PJ_EEOF)
22:37:36.261 tcprel0x4658e0 State changed Ready --> Deallocated
in turn_sock=0
22:37:36.262 turn_wrapper.c State Ready --> Deallocated
22:37:36.263 turn_wrapper.c Relay shutting down..
22:37:36.263 turn_wrapper.c Relay shutting down..status 0
22:37:36.264 tcprel0x4658e0 Request to shutdown in state Deallocated, cause:0
22:37:36.264 tcprel0x4658e0 State changed Deallocated --> Destroying
in turn_sock=0
22:37:36.265 turn_wrapper.c State Deallocated --> Destroying
22:37:36.266 turn_wrapper.c Destroying..status 0
22:37:36.266 turn_wrapper.c Destroying..status == ..set g.relay=NULL
22:37:36.267 tcprel0x4658e0 Destroying TURN
22:37:36.268 stuntsx0x4abb9 STUN client transaction destroyed
22:37:36.270 tcprel0x4658e0 TURN client session destroyed
thready: Destructor freeing name "".
thready: Setting thread name to "remoteAccessInitThd" (tid:724313376).
22:37:43.605 os_core_unix.c pjlib 1.8.10 for POSIX initialized
22:37:43.606 pjlib select() I/O Queue created (0x4923e4)
22:37:43.608 tcprel0x492e40 TURN client session created
22:37:43.609 tcprel0x492e40 Resolving 35.173.223.183 with DNS A
22:37:43.610 tcprel0x492e40 State changed Null --> Resolving
in turn_sock=0
22:37:43.611 turn_wrapper.c State Null --> Resolving
22:37:43.611 tcprel0x492e40 State changed Resolving --> Resolved
in turn_sock=0
22:37:43.612 turn_wrapper.c State Resolving --> Resolved
22:37:43.613 tcprel0x492e40 Connecting to 35.173.223.183:3478
22:37:43.729 tcprel0x492e40 TCP connected
conn type= TCP
22:37:43.730 tcprel0x492e40 State changed Resolved --> Allocating
in turn_sock=0
22:37:43.730 turn_wrapper.c State Resolved --> Allocating
22:37:43.731 tcprel0x492e40 TX 48 bytes STUN message to 35.173.223.183:3478:
--- begin STUN message ---
STUN Allocate request
Hdr: length=28, magic=2112a442, tsx_id=000006db542289ec628c8965
Attributes:
REQUESTED-TRANSPORT: length=4, value=100663296 (0x6000000)
SOFTWARE: length=13, value="pjnath-1.8.10"
--- end of STUN message ---
22:37:43.732 stuntsx0x4673e STUN client transaction created
22:37:43.732 stuntsx0x4673e STUN sending message (transmit count=8)
in func turn_on_send_pkt
dst addr=35.173.223.183 htons.port=3478 ntwk.port=38413
check server_addr.sin_addr=35.173.223.183 .port=38413
22:37:43.847 tcprel0x492e40 RX 140 bytes STUN message from 35.173.223.183:3478:
--- begin STUN message ---
STUN Allocate error response
Hdr: length=120, magic=2112a442, tsx_id=000006db542289ec628c8965
Attributes:
ERROR-CODE: length=20, err_code=401, reason="Unauthorized"
REALM: length=10, value="belkin.org"
NONCE: length=48, value="5ecd7e1800000000f859a539144fd887f3adcc97f4bbd850"
SOFTWARE: length=14, value="TurnServer 0.4"
FINGERPRINT: length=4, value=913478227 (0x36729253)
--- end of STUN message ---
22:37:43.848 tcprel0x492e40 Retrying request with new authentication
22:37:43.849 tcprel0x492e40 TX 156 bytes STUN message to 35.173.223.183:3478:
--- begin STUN message ---
STUN Allocate request
Hdr: length=136, magic=2112a442, tsx_id=000006db6de91b18628c8966
Attributes:
REQUESTED-TRANSPORT: length=4, value=100663296 (0x6000000)
SOFTWARE: length=13, value="pjnath-1.8.10"
USERNAME: length=12, value="6038E01B75A4"
REALM: length=10, value="belkin.org"
NONCE: length=48, value="5ecd7e1800000000f859a539144fd887f3adcc97f4bbd850"
MESSAGE-INTEGRITY: length=20, data=2b993187f5546eb255772f4ad794b173bbc106f6
--- end of STUN message ---
22:37:43.850 stuntsx0x4675f STUN client transaction created
22:37:43.850 stuntsx0x4675f STUN sending message (transmit count=8)
in func turn_on_send_pkt
dst addr=35.173.223.183 htons.port=3478 ntwk.port=38413
check server_addr.sin_addr=35.173.223.183 .port=38413
22:37:44.001 tcprel0x492e40 RX 104 bytes STUN message from 35.173.223.183:3478:
--- begin STUN message ---
STUN Allocate success response
Hdr: length=84, magic=2112a442, tsx_id=000006db6de91b18628c8966
Attributes:
XOR-RELAYED-ADDRESS: length=8, IPv4 addr=10.0.90.85:10188
LIFETIME: length=4, value=330 (0x14a)
XOR-MAPPED-ADDRESS: length=8, IPv4 addr=109.108.210.20:3869
SOFTWARE: length=14, value="TurnServer 0.4"
MESSAGE-INTEGRITY: length=20, data=a14a082088b2ad4326888193b9aa98e297f243ea
FINGERPRINT: length=4, value=572692860 (0x2222997c)
--- end of STUN message ---
22:37:44.002 tcprel0x492e40 State changed Allocating --> Ready
in turn_sock=0
22:37:44.002 turn_wrapper.c State Allocating --> Ready
22:37:45.857 stuntsx0x4673e STUN client transaction destroyed
22:37:46.013 stuntsx0x4675f STUN client transaction destroyed
> POST /apis/http/dlr/peerAddresses HTTP/1.1
Host: api.xbcs.net:8443
Content-Type: application/xml
Accept: application/xml
Authorization: 6038E01B75A4:7/MkHW4NQgjYM60BsWQTjMyoRGw=:1590525965
X-Belkin-Client-Type-Id: WeMo_WW_2.00.10966.PVT-OWRT-Insight:5e7e-40a7-8bf4-539d1dc2ce42
Content-Length: 241
< HTTP/1.1 200 OK
< Date: Tue, 26 May 2020 19:37:47 GMT
< Content-Type: application/xml;charset=UTF-8
< Content-Length: 1262
< Connection: keep-alive
< X-Application-Context: application
<
thready: Destructor freeing name "remoteInitNatCli".
thready: Destructor freeing name "remoteAccessInit".
thready: Setting thread name to "remoteInitNatClient24" (tid:728507680).
GetWanDefaultGateway: GATEWAY = 192.168.0.1
GetWanDefaultGateway: GATEWAY = 192.168.0.1
GetWanDefaultGateway: GATEWAY = 192.168.0.1
22:42:14.027 tcprel0x492e40 TX 148 bytes STUN message to 35.173.223.183:3478:
--- begin STUN message ---
STUN Refresh request
Hdr: length=128, magic=2112a442, tsx_id=000006db7644a45c628c8967
Attributes:
SOFTWARE: length=13, value="pjnath-1.8.10"
USERNAME: length=12, value="6038E01B75A4"
REALM: length=10, value="belkin.org"
NONCE: length=48, value="5ecd7e1800000000f859a539144fd887f3adcc97f4bbd850"
MESSAGE-INTEGRITY: length=20, data=c6163fde36bef73d33d0c7754a66caa6fd490c3d
--- end of STUN message ---
22:42:14.028 stuntsx0x48471 STUN client transaction created
22:42:14.028 stuntsx0x48471 STUN sending message (transmit count=8)
in func turn_on_send_pkt
dst addr=35.173.223.183 htons.port=3478 ntwk.port=38413
check server_addr.sin_addr=35.173.223.183 .port=38413
22:42:14.140 tcprel0x492e40 RX 80 bytes STUN message from 35.173.223.183:3478:
--- begin STUN message ---
STUN Refresh success response
Hdr: length=60, magic=2112a442, tsx_id=000006db7644a45c628c8967
Attributes:
LIFETIME: length=4, value=330 (0x14a)
SOFTWARE: length=14, value="TurnServer 0.4"
MESSAGE-INTEGRITY: length=20, data=2ac7b7eb0ed5577f16d02896601c3763cbf6cce9
FINGERPRINT: length=4, value=3045209281 (0xb58234c1)
--- end of STUN message ---
22:42:16.145 stuntsx0x48471 STUN client transaction destroyed
GetWanDefaultGateway: GATEWAY = 192.168.0.1
SetBelkinParameter - ParameterName = TodayONTime , ParameterValue = 0
SetBelkinParameter - ParameterName = TodayONTimeTS , ParameterValue = 0
SetBelkinParameter - ParameterName = TodaySBYTime , ParameterValue = 42
nvram/1983/NvramStartDaemon: Called
nvram/1983/NvramStartDaemon: Sending SIGHUP to nvramd (1478)
SetBelkinParameter - ParameterName = TodaySBYTimeTS , ParameterValue = 42
nvram/1983/NvramStartDaemon: Called
SetBelkinParameter - ParameterName = TodayKWH , ParameterValue = 0
nvram/1983/NvramStartDaemon: Called
SetBelkinParameter - ParameterName = TodayKWHON , ParameterValue = 0
nvram/1983/NvramStartDaemon: Called
SetBelkinParameter - ParameterName = TodayKWHSBY , ParameterValue = 0
nvram/1983/NvramStartDaemon: Called
nvram/1756/NvramStartDaemon: Called
nvram/1756/NvramStartDaemon: Sending SIGHUP to nvramd (1478)
nvram/1478/NvramCommitInternal: Flushing cache to flash
nvram/1478/NvramCommitInternal: Flash write complete
nvram/1478/BuildIndex: 53 variables defined in NVRAM
GetWanDefaultGateway: GATEWAY = 192.168.0.1
GetWanDefaultGateway: GATEWAY = 192.168.0.1
GetWanDefaultGateway: GATEWAY = 192.168.0.1
GetWanDefaultGateway: GATEWAY = 192.168.0.1
GetWanDefaultGateway: GATEWAY = 192.168.0.1
GetWanDefaultGateway: GATEWAY = 192.168.0.1
GetWanDefaultGateway: GATEWAY = 192.168.0.1
GetWanDefaultGateway: GATEWAY = 192.168.0.1
GetWanDefaultGateway: GATEWAY = 192.168.0.1
GetWanDefaultGateway: GATEWAY = 192.168.0.1
GetWanDefaultGateway: GATEWAY = 192.168.0.1
GetWanDefaultGateway: GATEWAY = 192.168.0.1
GetWanDefaultGateway: GATEWAY = 192.168.0.1
GetWanDefaultGateway: GATEWAY = 192.168.0.1
GetWanDefaultGateway: GATEWAY = 192.168.0.1
GetWanDefaultGateway: GATEWAY = 192.168.0.1
thready: Destructor freeing name "CtrlPtRediscover".
GetWanDefaultGateway: GATEWAY = 192.168.0.1
GetWanDefaultGateway: GATEWAY = 192.168.0.1
GetWanDefaultGateway: GATEWAY = 192.168.0.1
GetWanDefaultGateway: GATEWAY = 192.168.0.1
GetWanDefaultGateway: GATEWAY = 192.168.0.1
GetWanDefaultGateway: GATEWAY = 192.168.0.1
</code></pre></div></div>
<p>The firmware version is <code class="language-plaintext highlighter-rouge">WeMo_WW_2.00.10966.PVT-OWRT-Insight</code>. There is a login
prompt which doesn’t use a trivial password for the <code class="language-plaintext highlighter-rouge">root</code> user. I have been
unable to crack the password using John The Ripper; here’s the salt and MD5
hash: <code class="language-plaintext highlighter-rouge">$1$9CaSVCnb$y1c1i01eMl02W5pTmwehD1</code>.</p>
<h3 id="partitions">Partitions</h3>
<p>The flash partition layout is as follows:</p>
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>MX25L12805D(c2 2018c220) (16384 Kbytes)
mtd .name = raspi, .size = 0x01000000 (16M) .erasesize = 0x00010000 (64K) .numeraseregions = 0
Creating 12 MTD partitions on "raspi":
0x00000000-0x00050000 : "uboot"
0x00050000-0x00190000 : "Kernel_1"
0x00190000-0x007c0000 : "rootfs_1"
0x007c0000-0x00900000 : "Kernel_2"
0x00900000-0x00f30000 : "rootfs_2"
mtd: partition "rootfs_2" set to be root filesystem
mtd: partition "rootfs_data" created automatically, ofs=C90000, len=2A0000
0x00c90000-0x00f30000 : "rootfs_data"
0x00fe0000-0x00ff0000 : "nvram"
0x00ff0000-0x01000000 : "User_Factory"
0x00040000-0x00050000 : "Factory"
0x00f30000-0x00fd0000 : "Belkin_settings"
0x00030000-0x00040000 : "Uboot_env"
0x00050000-0x007c0000 : "Firmware_1"
0x007c0000-0x00f30000 : "Firmware_2"
</code></pre></div></div>
<p>We know furthermore, that the root filesystem is a SquashFS 3.0 with a JFFS2
mini_fo overlay. There are two kernel partitions and two root filesystem
partitions. This is used for firmware updates where the new firmware is written
to the inactive partition set. The <code class="language-plaintext highlighter-rouge">Factory</code> partition seems to hold calibration
data for the WiFi peripheral. <code class="language-plaintext highlighter-rouge">Belkin_settings</code> is a JFFS2 partition with some
application data. <code class="language-plaintext highlighter-rouge">nvram</code> is a key-value store for configuration parameters.
<code class="language-plaintext highlighter-rouge">uboot</code> and <code class="language-plaintext highlighter-rouge">Uboot_env</code> holds the u-boot program and its environment,
respectively. <code class="language-plaintext highlighter-rouge">User_Factory</code> appears to hold static manufacturing data like
serial number, region, country, model and MAC address.</p>
<h2 id="booting-your-own-kernel">Booting your own Kernel</h2>
<p>I’m not sure whether it’s possible to specify kernel command line and device
tree from u-boot, so the safest bet is to use a kernel with baked in command
line and appended device tree. This type of image is built by default when
building RT5350 images with OpenWrt. My initial plan was to mount one of the
existing root filesystem partitions when booting the custom kernel. However,
the device uses SquashFS 3.0 which is incompatible with the current version 4.0.
In order to have a functional root filesystem, we boot an image with initial
RAM disk. This type of image is also built automatically by OpenWrt. The OpenWrt
target <code class="language-plaintext highlighter-rouge">f7c027</code> is close enough to this hardware that it boots the kernel
without problems. However, I have also created a <code class="language-plaintext highlighter-rouge">f7c029</code> <a href="https://github.com/svenschwermer/openwrt/tree/f7c029">target</a> which has
the correct LED and button GPIO mapping.</p>
<p>In order to boot a custom image, run the following in an interactive u-boot
shell:</p>
<div class="language-sh highlighter-rouge"><div class="highlight"><pre class="highlight"><code>setenv bootstate 0<span class="p">;</span> loadb 0x80600000
<span class="c"># Send openwrt-ramips-rt305x-f7c029-initramfs-kernel.bin via kermit</span>
bootm 0x80600000
</code></pre></div></div>
<p>This will take some time but it will get you a Linux shell. Depending on which
packages you built, you can read and transfer (<code class="language-plaintext highlighter-rouge">gkermit</code>) the stock partitions.
You will also be able to transfer the an image permanently to flash which allows
you to boot much faster afterwards. I have written kernel and root filesystem to
the inactive partitions, i.e. the one that doesn’t hold the currently active
stock image. This target partition should be labelled <code class="language-plaintext highlighter-rouge">firmware</code> in the device
tree while the other one should be called <code class="language-plaintext highlighter-rouge">firmware2</code>.</p>
<div class="language-sh highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="nb">cd</span> /tmp
gkermit <span class="nt">-r</span>
<span class="c"># Send openwrt-ramips-rt305x-f7c029-squashfs-sysupgrade.bin via kermit</span>
sysupgrade <span class="nt">-n</span> /tmp/openwrt-ramips-rt305x-f7c029-squashfs-sysupgrade.bin
</code></pre></div></div>
<p>It makes sense to increase the serial baud rate to <code class="language-plaintext highlighter-rouge">230400</code> before these
transfers in order to save some time:</p>
<div class="language-sh highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="nb">stty</span> <span class="nt">-F</span> /dev/ttyS0 230400
</code></pre></div></div>
<p>After a reboot, you’ll be able to boot your kernel and root filesystem by
running the following in the u-boot shell (note, that these values depend
on whether you write your stuff to <code class="language-plaintext highlighter-rouge">Firmware_1</code> or <code class="language-plaintext highlighter-rouge">Firmware_2</code>:</p>
<div class="language-sh highlighter-rouge"><div class="highlight"><pre class="highlight"><code>setenv bootstate 0
bootm 0xBC050000
</code></pre></div></div>
<p>In order to make it permanent, run:</p>
<div class="language-sh highlighter-rouge"><div class="highlight"><pre class="highlight"><code>setenv bootstate 0
setenv bootpart 0
setenv check_boot 0
saveenv
reset
</code></pre></div></div>
<h3 id="excursion-kermit-with-minicom-on-arch-linux">Excursion: kermit with minicom on Arch Linux</h3>
<p>There seems to be a problem with some lock files that ckermit tries to write in
Arch Linux. In order to fix this, modify your <code class="language-plaintext highlighter-rouge">~/.minirc.dfl</code> to contain the
following lines:</p>
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>pu pname7 YUYNNkermit
pu pname8 NDYNNkermit
pu pprog7 /usr/bin/env LOCK_DIR=/tmp /usr/bin/ckermit -i -l %l -b %b -s
pu pprog8 /usr/bin/env LOCK_DIR=/tmp /usr/bin/ckermit -i -l %l -b %b -r
</code></pre></div></div>
<p>Additionally, I have found the <a href="http://ben-collins.blogspot.com/2011/06/setting-up-minicom-and-ckermit-for-u.html">following <code class="language-plaintext highlighter-rouge">~/.kermrc</code></a> to work:</p>
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>set carrier-watch off
set handshake none
set flow-control none
robust
set file type bin
set rec pack 1000
set send pack 1000
set window 5
</code></pre></div></div>
<h2 id="controlling-the-relay">Controlling the relay</h2>
<p>In order to control the relay via HTTP, add the following small CGI script to
<code class="language-plaintext highlighter-rouge">/www/cgi-bin/relay</code> and make it executable:</p>
<div class="language-sh highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="c">#!/bin/sh</span>
<span class="nv">relay_file</span><span class="o">=</span><span class="s2">"/sys/class/leds/f7c029:device:relay/brightness"</span>
bad_request<span class="o">()</span> <span class="o">{</span>
<span class="nb">echo</span> <span class="s2">"Status: 400 Bad Request"</span>
<span class="nb">echo
exit </span>1
<span class="o">}</span>
set_state<span class="o">()</span> <span class="o">{</span>
<span class="nb">echo</span> <span class="s2">"</span><span class="nv">$1</span><span class="s2">"</span> <span class="o">></span> <span class="s2">"</span><span class="nv">$relay_file</span><span class="s2">"</span>
<span class="nb">echo</span> <span class="s2">"</span><span class="nv">$1</span><span class="s2">"</span> <span class="o">></span> <span class="s2">"/sys/class/leds/f7c029:green:power/brightness"</span>
<span class="o">}</span>
<span class="k">if</span> <span class="o">[</span> <span class="s2">"</span><span class="nv">$REQUEST_METHOD</span><span class="s2">"</span> <span class="o">==</span> <span class="s2">"GET"</span> <span class="o">]</span><span class="p">;</span> <span class="k">then
</span><span class="nb">echo
sed</span> <span class="nt">-e</span> s/0/off/ <span class="nt">-e</span> s/1/on/ <span class="s2">"</span><span class="nv">$relay_file</span><span class="s2">"</span>
<span class="k">elif</span> <span class="o">[</span> <span class="s2">"</span><span class="nv">$REQUEST_METHOD</span><span class="s2">"</span> <span class="o">==</span> <span class="s2">"POST"</span> <span class="o">]</span><span class="p">;</span> <span class="k">then
</span><span class="nv">cmd</span><span class="o">=</span><span class="s2">"</span><span class="si">$(</span><span class="nb">cat</span><span class="si">)</span><span class="s2">"</span>
<span class="k">case</span> <span class="s2">"</span><span class="nv">$cmd</span><span class="s2">"</span> <span class="k">in
</span>on<span class="p">)</span>
set_state 1
<span class="p">;;</span>
off<span class="p">)</span>
set_state 0
<span class="p">;;</span>
<span class="k">*</span><span class="p">)</span>
bad_request
<span class="p">;;</span>
<span class="k">esac</span>
<span class="nb">echo
echo</span> <span class="s2">"</span><span class="nv">$cmd</span><span class="s2">"</span>
<span class="k">else
</span>bad_request
<span class="k">fi</span>
</code></pre></div></div>
<p>Now the relay can be controlled e.g. via cURL:</p>
<div class="language-sh highlighter-rouge"><div class="highlight"><pre class="highlight"><code>curl <span class="nt">-d</span> <span class="o">{</span>on,off<span class="o">}</span> OpenWrt.local/cgi-bin/relay
</code></pre></div></div>
<h3 id="manual-control-via-the-touch-button">Manual control via the touch button</h3>
<p>Adding the following executable script to <code class="language-plaintext highlighter-rouge">/etc/rc.button/BTN_1</code> allows to
control the relay using the touch field:</p>
<div class="language-sh highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="c">#!/bin/sh</span>
<span class="nv">relay_file</span><span class="o">=</span><span class="s2">"/sys/class/leds/f7c029:device:relay/brightness"</span>
set_state<span class="o">()</span> <span class="o">{</span>
<span class="nb">echo</span> <span class="s2">"</span><span class="nv">$1</span><span class="s2">"</span> <span class="o">></span> <span class="s2">"</span><span class="nv">$relay_file</span><span class="s2">"</span>
<span class="nb">echo</span> <span class="s2">"</span><span class="nv">$1</span><span class="s2">"</span> <span class="o">></span> <span class="s2">"/sys/class/leds/f7c029:green:power/brightness"</span>
<span class="o">}</span>
<span class="k">if</span> <span class="o">[</span> <span class="s2">"</span><span class="nv">$ACTION</span><span class="s2">"</span> <span class="o">!=</span> <span class="s2">"pressed"</span> <span class="o">]</span><span class="p">;</span> <span class="k">then
</span><span class="nb">exit
</span><span class="k">fi
case</span> <span class="s2">"</span><span class="si">$(</span><span class="nb">cat</span> <span class="s2">"</span><span class="nv">$relay_file</span><span class="s2">"</span><span class="si">)</span><span class="s2">"</span> <span class="k">in
</span>0<span class="p">)</span>
set_state 1
<span class="p">;;</span>
1<span class="p">)</span>
set_state 0
<span class="p">;;</span>
<span class="k">esac</span>
</code></pre></div></div>
<h2 id="interfacing-the-power-sensor">Interfacing the power sensor</h2>
<p>The power sensor reports data periodically via UART. This is a unidirectional
interface. The format is similar but not identical to the format described in
the <a href="https://datasheets.maximintegrated.com/en/ds/78M6610+PSU.pdf">78M6610+PSU datasheet (section 4.1.2 Auto-Reported Data)</a>. There is some
<a href="https://hackaday.io/project/6799-smartee-the-smart-plug/log/21224-some-detective-work">excellent detective work</a> available on the web regarding the power sensor
and the protocol format.</p>
<p>I built a small <a href="https://github.com/svenschwermer/wemo-feed/tree/master/utils/wemo-insight/src">service</a> that listens to the power sensor data coming in
over serial and making it available via OpenWrt’s inter-process communication
bus: ubus. The data can also be accessed via HTTP from outside the device:</p>
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>curl -s wemo.local/cgi-bin/insight | jq
{
"int_temperature": 26.700001,
"ext_temperature": -22.855001,
"rms_voltage": 237.996017,
"rms_current": 4.117907,
"active_power": 980.039978,
"average_power": 981.375,
"power_factor": 1,
"line_frequency": 49.358002,
"active_energy": 0.238
}
</code></pre></div></div>
<p>The temperature data looks jumpy and fishy in general, but that’s arguably not
very important for most applications. I took the information that the first two
words are in fact temperature values from <a href="https://github.com/svenschwermer/wemo/blob/master/package/HalInsight/src/insightd.c#L1671">some Belkin code</a>.</p>
<h2 id="issues">Issues</h2>
<ul>
<li>The RT5350 gets noticeably hotter (60°C vs. 50°C with stock firmware) with the
new kernel. <em>Update: <a href="https://forum.openwrt.org/t/rt5350f-hot-slow-wifi/66161/4">This issue has at least been partially solved</a>.</em></li>
<li>The WiFi throughput seems very low at ~160 kB/s. This shouldn’t be a big
problem for this type of device.</li>
</ul>
<h2 id="remaining-work">Remaining work</h2>
<ul>
<li>Crack the stock firmware password</li>
</ul>
<h2 id="references">References</h2>
<ul>
<li><a href="https://github.com/svenschwermer/openwrt/tree/f7c029">My OpenWrt branch</a></li>
<li><a href="https://github.com/svenschwermer/wemo-feed">My Wemo-related package feed repository</a></li>
<li><a href="https://github.com/svenschwermer/wemo/tree/stock-flash">Stock NOR flash contents</a></li>
<li><a href="https://openwrt.org/toh/belkin/f7c027">Belkin F7C027 in the OpenWrt Table of Hardware</a></li>
<li><a href="https://github.com/svenschwermer/wemo">Some of the source code that is at least very similar to the code running on
the device</a></li>
<li><a href="https://github.com/swiftgeek/ralink-uboot">Some versions (bot not the one used here) of the Ralink SDK u-boot code</a></li>
<li><a href="https://www.realmtech.net/2016-04/openwrt-on-a-belkin-wemo-hard-way">OpenWRT on a Belkin WeMo - The Hard Way</a></li>
<li><a href="https://hackaday.io/project/6799-smartee-the-smart-plug">SmartEE the Smart Plug</a></li>
</ul>Sven SchwermerThe firmware this smart plug (model number: F7C029de) runs doesn’t seem to be particularly stable and the software base seems very dated. Let’s try running our own firmware for fun and profit.Intel Edison: i2c-6 with vanilla Linux2017-10-14T00:00:00+00:002017-10-14T00:00:00+00:00https://svenschwermer.de/2017/10/14/intel-edison-i2c6-with-vanilla-linux<p>Thanks to the amazing work of <a href="https://github.com/andy-shev/">Andy Shevchenko</a>, it’s possible to run recent vanilla Linux kernels on Intel’s discontinued Edison module. There is a nice <a href="https://edison.internet-share.com/wiki/Using_a_vanilla_Linux_kernel_with_Intel_Edison">writeup</a> about this available on the web. One of the drawbacks of this approach, however, is that one of the two user-accessible I2C bus controllers is not available: i2c-6. This is due to the fact, that initially <a href="https://communities.intel.com/message/473791#473791">it’s configured to be used by the SCU</a> and there is no way to change this.</p>
<p>In order to use i2c-6, a pinctrl setting needs to be applied. This can be done using a pinctrl mapping in the board specific initialization code. That makes the pinctrl setting to be applied once the device in question (here i2c-6) is probed. When I did this, however, I could see that the pinmux was claimed by the i2c-6 device but the pins’ mode was still set to 2 which is wrong:</p>
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>$ mount -t debugfs non /sys/kernel/debug/
$ cat /sys/kernel/debug/pinctrl/pinctrl-merrifield/pinmux-pins | grep I2C_6
pin 111 (GP27_I2C_6_SCL): 0000:00:09.1 (GPIO UNCLAIMED) function i2c6 group i2c6_grp
pin 112 (GP28_I2C_6_SDA): 0000:00:09.1 (GPIO UNCLAIMED) function i2c6 group i2c6_grp
$ cat /sys/kernel/debug/pinctrl/pinctrl-merrifield/pins | grep I2C_6
pin 111 (GP27_I2C_6_SCL) mode 2 0x00203512
pin 112 (GP28_I2C_6_SDA) mode 2 0x00203592
</code></pre></div></div>
<p>So I dug a little into the code and looked at the function <code class="language-plaintext highlighter-rouge">mrfld_pinmux_set_mux</code> in particular. The pinctrl settings for the pins in question are write-protected, which means that changing them requires an SCU IPC call, see <code class="language-plaintext highlighter-rouge">mrfld_update_phys</code>. That IPC call, however, returned <code class="language-plaintext highlighter-rouge">-ENODEV</code> because the SCU device is not probed by the time i2c-6 is probed which in turn triggers setting the pinmux.</p>
<p>Both the I2C controller and the SCU are PCI devices with vendor/device ID equal to <code class="language-plaintext highlighter-rouge">8086:1196</code> and <code class="language-plaintext highlighter-rouge">8086:11a0</code>, respectively. Typically, the PCI bus is enumerated in order, which means that the I2C bus devices will be probed before the SCU device since the device ID is smaller. To circumvent this, I configured the I2C bus driver to be built as lodable kernel modules (<code class="language-plaintext highlighter-rouge">CONFIG_I2C_DESIGNWARE_CORE=m</code> and <code class="language-plaintext highlighter-rouge">CONFIG_I2C_DESIGNWARE_PCI=m</code>).</p>
<p>After recompiling the kernel, the LKMs can be inserted using <code class="language-plaintext highlighter-rouge">modprobe</code> or <code class="language-plaintext highlighter-rouge">insmod</code>. Not only will this succeed now, but the pins’ mode will change as well:</p>
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>$ cat /sys/kernel/debug/pinctrl/pinctrl-merrifield/pins | grep I2C_6
pin 111 (GP27_I2C_6_SCL) mode 1 0x00000511
pin 112 (GP28_I2C_6_SDA) mode 1 0x00000591
</code></pre></div></div>
<p>The changes that were required in the Linux kernel can be found in my <a href="https://github.com/svenschwermer/linux/commit/19dc84267614bc94eb953b7c59a12dae59d995e1">GitHub repo</a>.</p>Sven SchwermerThanks to the amazing work of Andy Shevchenko, it’s possible to run recent vanilla Linux kernels on Intel’s discontinued Edison module. There is a nice writeup about this available on the web. One of the drawbacks of this approach, however, is that one of the two user-accessible I2C bus controllers is not available: i2c-6. This is due to the fact, that initially it’s configured to be used by the SCU and there is no way to change this.I²C level shifting gone wrong2017-03-09T22:50:00+00:002017-03-09T22:50:00+00:00https://svenschwermer.de/2017/03/09/i2c-level-shifting-gone-wrong<p>In a recent project I had to connect a 3.3V I²C bus segment to a 1.8V I²C bus.
Therefore, I decided to use a
<a href="http://www.ti.com/lit/ds/symlink/pca9306.pdf">PCA9306 Dual Bidirectional I²C Bus and SMBus Voltage-Level Translator</a>
as it is a device specifically designed for the job and PCB space was valuable
in this particular project. Strangely the I²C communication only worked
intermittently. So I got out my oscilloscope and probed the SDA line on the
1.8V side. I could see strange dips during the high phases.</p>
<figure>
<a href="/assets/i2c-level/faulty-sda-line.png">
<img src="/assets/i2c-level/faulty-sda-line.png" alt="The wrong looking trace of SDA on the 1.8V side of the level translator" />
</a>
<figcaption>The wrong looking trace of SDA on the 1.8V side of the level translator</figcaption>
</figure>
<p>The screen capture above shows the wrong looking trace of SDA on the 1.8V side
of the level translator. After probing some more, I found that the dips during
the high phases coincided with the SCL line edges. There had to be some
interaction between SDA and SCL inside the level translator.</p>
<p>It turns out that I just assumed that the PCA9306 had to be wired up the same
way as push-pull level translators such as the
<a href="http://www.ti.com/lit/ds/symlink/txb0104.pdf">TXB0104</a>. Specifically, I hooked
up VREF2 directly to 3.3V. After some rework on the board featuring bodge wire
I shorted VREF2 to EN which in turn is connected to 3.3V through a 200kOhm
resistor. This is the way that the datasheet wants us to use the part.</p>
<p>After this both SDA and SCL looked much more sensible on both sides of the
voltage translator, d’oh!</p>Sven SchwermerIn a recent project I had to connect a 3.3V I²C bus segment to a 1.8V I²C bus. Therefore, I decided to use a PCA9306 Dual Bidirectional I²C Bus and SMBus Voltage-Level Translator as it is a device specifically designed for the job and PCB space was valuable in this particular project. Strangely the I²C communication only worked intermittently. So I got out my oscilloscope and probed the SDA line on the 1.8V side. I could see strange dips during the high phases.Denon iPod dock protocol2017-02-14T19:45:00+00:002017-02-14T19:45:00+00:00https://svenschwermer.de/2017/02/14/denon-ipod-dock-protocol<p>I have recently gotten myself an <a href="http://www.denon.com/asd11r/index-2.html">ASD-11R iPod dock</a> for my Denon DRA-700AE receiver in order to inspect the protocol that is being used for the communication between the two devices. My original intention was to display arbitrary information on the receiver display. Also, controlling an external device using the receiver controls or the remote control would have been nice. To tell you right away: I achieved neither. However, I learned something about the communication protocol along the way.</p>
<p>I did once manage to put the iPod and dock into a mode where the iPod could be controlled using the arrow keys on the remote control without the iPod’s screen being blocked and without the music library being shown on the receiver’s display. Unfortunately, I could never reproduce such a behavior. This mode is partly what I have been after…</p>
<p>The communication is based on an asynchronous serial protocol (UARTs on either side) on the physical layer. The baudrate is specified at 19,200Bd while the voltage level is 5V. On the receiver side a 3.5mm (stereo) jack receptacle is offered to connect to the dock. The pinout seen from the receiver is as follows (starting from the tip): RX, TX, GND. There are service manuals for both the receiver and the dock out there on the internet.</p>
<h2 id="apple-ipod-accessory-protocol">Apple iPod Accessory Protocol</h2>
<p>iPods communicate with external devices using the iPod Accessory Protocol (iAP). When the Denon iPod dock is communicating with the Denon receiver, the iAP is tunneled through the Denon-proprietary protocol by XOR’ing every byte with <code class="language-plaintext highlighter-rouge">0x31</code>. In the following section I will give a very brief summary of the most essential parts of the iAP protocol. Older versions of the specification can be found by searching the web thoroughly. The entire set of commands is partitioned into <em>Lingos</em>. Regular data packets look like this:</p>
<table>
<thead>
<tr>
<th style="text-align: center">Byte #</th>
<th style="text-align: center">Value</th>
<th style="text-align: left">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td style="text-align: center">0</td>
<td style="text-align: center"><code class="language-plaintext highlighter-rouge">0xFF</code></td>
<td style="text-align: left">Sync byte</td>
</tr>
<tr>
<td style="text-align: center">1</td>
<td style="text-align: center"><code class="language-plaintext highlighter-rouge">0x55</code></td>
<td style="text-align: left">Start byte</td>
</tr>
<tr>
<td style="text-align: center">2</td>
<td style="text-align: center">2+N</td>
<td style="text-align: left">Payload length</td>
</tr>
<tr>
<td style="text-align: center">3</td>
<td style="text-align: center"> </td>
<td style="text-align: left">Lingo ID</td>
</tr>
<tr>
<td style="text-align: center">4</td>
<td style="text-align: center"> </td>
<td style="text-align: left">Command ID</td>
</tr>
<tr>
<td style="text-align: center">5…5+N</td>
<td style="text-align: center"> </td>
<td style="text-align: left">Data</td>
</tr>
<tr>
<td style="text-align: center">6+N</td>
<td style="text-align: center"> </td>
<td style="text-align: left">Checksum</td>
</tr>
</tbody>
</table>
<p>The fields <em>Lingo ID</em>, <em>Command ID</em> and <em>Data</em> are considered the payload. The checksum can be verified by accumulating the payload bytes and the checksum byte as 8 bit unsigned integers. If the sum equals 0x00, the packet is likely valid. As the payload’s length is limited to 255 bytes, there is also a large packet format:</p>
<table>
<thead>
<tr>
<th style="text-align: center">Byte #</th>
<th style="text-align: center">Value</th>
<th style="text-align: left">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td style="text-align: center">0</td>
<td style="text-align: center"><code class="language-plaintext highlighter-rouge">0xFF</code></td>
<td style="text-align: left">Sync byte</td>
</tr>
<tr>
<td style="text-align: center">1</td>
<td style="text-align: center"><code class="language-plaintext highlighter-rouge">0x55</code></td>
<td style="text-align: left">Start byte</td>
</tr>
<tr>
<td style="text-align: center">2</td>
<td style="text-align: center"><code class="language-plaintext highlighter-rouge">0x00</code></td>
<td style="text-align: left">Large packet indicator</td>
</tr>
<tr>
<td style="text-align: center">3</td>
<td style="text-align: center">MSB</td>
<td style="text-align: left">Payload length (upper 8 bits of N)</td>
</tr>
<tr>
<td style="text-align: center">4</td>
<td style="text-align: center">LSB</td>
<td style="text-align: left">Payload length (lower 8 bits of N)</td>
</tr>
<tr>
<td style="text-align: center">5</td>
<td style="text-align: center"> </td>
<td style="text-align: left">Lingo ID</td>
</tr>
<tr>
<td style="text-align: center">6</td>
<td style="text-align: center"> </td>
<td style="text-align: left">Command ID</td>
</tr>
<tr>
<td style="text-align: center">7…7+N</td>
<td style="text-align: center"> </td>
<td style="text-align: left">Data</td>
</tr>
<tr>
<td style="text-align: center">8+N</td>
<td style="text-align: center"> </td>
<td style="text-align: left">Checksum</td>
</tr>
</tbody>
</table>
<p>In the following two sections I will summarize the two lingos that are being used in the communication between dock and receiver. I should note that I have used an old iPod Mini in this series of experiments.</p>
<h3 id="general-lingo-id--0x00">General Lingo (ID = 0x00)</h3>
<p>The General Lingo must be spoken by all devices that aim to communicate with an iPod via iAP. The following commands were the ones that I have seen while recording the communication between the receiver and the dock.</p>
<table>
<thead>
<tr>
<th style="text-align: center">ID</th>
<th style="text-align: left">Name</th>
<th style="text-align: left">Direction</th>
<th style="text-align: left">Description</th>
<th style="text-align: left">Data</th>
</tr>
</thead>
<tbody>
<tr>
<td style="text-align: center"><code class="language-plaintext highlighter-rouge">0x01</code></td>
<td style="text-align: left">Identify</td>
<td style="text-align: left">→ iPod</td>
<td style="text-align: left">Notify iPod that a device is attached</td>
<td style="text-align: left">Supported Lingo (1 byte)</td>
</tr>
<tr>
<td style="text-align: center"><code class="language-plaintext highlighter-rouge">0x02</code></td>
<td style="text-align: left">ACK</td>
<td style="text-align: left">← iPod</td>
<td style="text-align: left">Reply to a previously received command</td>
<td style="text-align: left">Result code and ID of the command that is being ack’ed (2 bytes)</td>
</tr>
<tr>
<td style="text-align: center"><code class="language-plaintext highlighter-rouge">0x03</code></td>
<td style="text-align: left">Request Remote UI Mode</td>
<td style="text-align: left">→ iPod</td>
<td style="text-align: left">Request the currently used interface mode</td>
<td style="text-align: left"><em>none</em></td>
</tr>
<tr>
<td style="text-align: center"><code class="language-plaintext highlighter-rouge">0x04</code></td>
<td style="text-align: left">Return Remote UI Mode</td>
<td style="text-align: left">← iPod</td>
<td style="text-align: left">Currently used interface mode</td>
<td style="text-align: left">Nonzero if in Extended Interface Mode/Lingo (1 byte)</td>
</tr>
<tr>
<td style="text-align: center"><code class="language-plaintext highlighter-rouge">0x05</code></td>
<td style="text-align: left">Enter Remote UI Mode</td>
<td style="text-align: left">→ iPod</td>
<td style="text-align: left">Switch to Extended Interface Mode/Lingo</td>
<td style="text-align: left"><em>none</em></td>
</tr>
<tr>
<td style="text-align: center"><code class="language-plaintext highlighter-rouge">0x0F</code></td>
<td style="text-align: left">Request Lingo Protocol Version</td>
<td style="text-align: left">→ iPod</td>
<td style="text-align: left">Query the protocol version for a Lingo</td>
<td style="text-align: left">Lingo ID (1 byte)</td>
</tr>
<tr>
<td style="text-align: center"><code class="language-plaintext highlighter-rouge">0x10</code></td>
<td style="text-align: left">Return Lingo Protocol Version</td>
<td style="text-align: left">← iPod</td>
<td style="text-align: left">Return the protocol version</td>
<td style="text-align: left">Lingo ID, major & minor version (3 bytes)</td>
</tr>
</tbody>
</table>
<h3 id="extended-interface-lingo-id--0x04">Extended Interface Lingo (ID = 0x04)</h3>
<p>The Extended Interface Lingo gives the device controlling the iPod the means to navigate through the music library, perform playback control and obtain status information such as the playback state, names for artist/album/song or meta information about the attached iPod. I don’t want to go into too much detail here as the protocol is thoroughly described out there on the internet.</p>
<h2 id="denon-protocol">Denon Protocol</h2>
<p>As mentioned above, the iAP is encoded by XOR’ing each byte with <code class="language-plaintext highlighter-rouge">0x31</code> between receiver and dock. The usual first two bytes of the iAP <code class="language-plaintext highlighter-rouge">0xFF 0x55</code> become <code class="language-plaintext highlighter-rouge">0xCE 0x64</code>. There are other packets being sent between receiver and dock that look very similar to iAP packets but start with <code class="language-plaintext highlighter-rouge">0xFF 0xA9</code> when decoded in the same way. The packet structure is otherwise the same as with the small packet format in iAP. The Lingo ID field seems to always be equal to <code class="language-plaintext highlighter-rouge">0x00</code>.</p>
<p>I haven’t been able to decode all commands that I have seen on the wire. However, here is what I think I got:</p>
<table>
<thead>
<tr>
<th style="text-align: center">ID</th>
<th style="text-align: left">Name</th>
<th style="text-align: left">Direction</th>
<th style="text-align: left">Description</th>
<th style="text-align: left">Data</th>
</tr>
</thead>
<tbody>
<tr>
<td style="text-align: center"><code class="language-plaintext highlighter-rouge">0x03</code></td>
<td style="text-align: left">Query status</td>
<td style="text-align: left">→ Dock</td>
<td style="text-align: left">Get the iPod status</td>
<td style="text-align: left"><em>none</em></td>
</tr>
<tr>
<td style="text-align: center"><code class="language-plaintext highlighter-rouge">0x01</code></td>
<td style="text-align: left">?</td>
<td style="text-align: left">→ Dock</td>
<td style="text-align: left">I don’t know, but it does get acknowledged</td>
<td style="text-align: left"><code class="language-plaintext highlighter-rouge">0x00</code> (1 byte)</td>
</tr>
<tr>
<td style="text-align: center"><code class="language-plaintext highlighter-rouge">0x05</code></td>
<td style="text-align: left">Deselect iPod</td>
<td style="text-align: left">→ Dock</td>
<td style="text-align: left">iPod input gets deselected</td>
<td style="text-align: left"><em>none</em></td>
</tr>
<tr>
<td style="text-align: center"><code class="language-plaintext highlighter-rouge">0x80</code></td>
<td style="text-align: left">ACK</td>
<td style="text-align: left">← Dock</td>
<td style="text-align: left">Acknowledge command</td>
<td style="text-align: left"><em>see iAP ACK</em></td>
</tr>
<tr>
<td style="text-align: center"><code class="language-plaintext highlighter-rouge">0x81</code></td>
<td style="text-align: left">Report status</td>
<td style="text-align: left">← Dock</td>
<td style="text-align: left">Return the iPod status</td>
<td style="text-align: left">{no iPod, busy, iPod ready} (4 bytes)</td>
</tr>
</tbody>
</table>
<p>The status query is sent periodically by the receiver as soon as the iPod input is selected at a period of 500~600ms. I have seen a few possible replies to these status queries which are summarized in the following table:</p>
<table>
<thead>
<tr>
<th>Data string</th>
<th>potential meaning</th>
</tr>
</thead>
<tbody>
<tr>
<td><code class="language-plaintext highlighter-rouge">0x01 0x01 0x00 0x00</code></td>
<td>No iPod inserted</td>
</tr>
<tr>
<td><code class="language-plaintext highlighter-rouge">0x00 0x01 0x11 0x00</code></td>
<td>iPod ready</td>
</tr>
<tr>
<td><code class="language-plaintext highlighter-rouge">0x01 0x00 0x00 0x00</code></td>
<td>iPod busy (?)</td>
</tr>
<tr>
<td><code class="language-plaintext highlighter-rouge">0x01 0x01 0x11 0x00</code></td>
<td>iPod busy (?)</td>
</tr>
</tbody>
</table>
<p>I haven’t really figured out the meaning of the busy statuses but the occur between the <em>no iPod</em> status and the <em>iPod ready</em> status. It is noticeable that in all eight nibbles of all the possible packets only the least significant bit is only ever set.</p>
<h2 id="sniffing-the-data-between-dock-and-receiver">Sniffing the data between dock and receiver</h2>
<p>Since the protocol is based on a basic asynchronous serial interface, sniffing can be easily done using cheap USB-UART bridges. I have used such bridges that are based on the <a href="http://prolificusa.com/portfolio/pl2303hx-rev-d-usb-to-serial-bridge-controller/">Prolific PL-2303HX</a> controller IC as those bridges are usually the cheapest around. Now, as each of those ICs offers only a single UART, each one of the only has one RX line that can be used for sniffing. Therefore I got myself a couple and hooked their RX lines to both signalling lines of the receiver-dock interface. It should be noted here that while the PL-2303HX is not spec’ed to handle 5V signals on their RX pins they didn’t seem to take any damage.</p>
<p>In software a thread is spawned for each line. The threads read complete packets from the serial devices, interpret them and print them to stdout in a synchronized way. The hacked-together code can be found on <a href="https://github.com/svenschwermer/denon-ipod-dock-protocol">my GitHub page</a>.</p>
<h2 id="whats-flying-over-the-wire">What’s flying over the wire?</h2>
<p>Now let’s have a look at one of my recordings of the where I hooked up a total of four USB-UART bridges to RX and TX between both dock and receiver and iPod and dock. The packets between dock and receiver have been decoded. In the square brackets the first digit is the signal line ID with the legend given as the preamble. The second number is the elapsed time in miliseconds since the first packet was received.</p>
<p>This is a recording of receiver’s input being set to the iPod. No status query is being sent while a different input is selected. No communication takes place between dock and iPod when the iPod is being inserted into the dock while the receiver hasn’t selected the iPod as the input.</p>
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>0: Dock -> iPod
1: iPod -> Dock
2: Dock -> AVR
3: AVR -> Dock
[3| 0] Denon periodic status query
0xff 0xa9 0x02 0x00 0x03 0xfb
[2| 3] Denon status: iPod ready
0xff 0xa9 0x06 0x00 0x81 0x00 0x01 0x11 0x00 0x67
[3| 43] Identify: 0x04
0xff 0x55 0x03 0x00 0x01 0x04 0xf8
[0| 46] Identify: 0x04
0xff 0x55 0x03 0x00 0x01 0x04 0xf8
[3| 623] Denon periodic status query
0xff 0xa9 0x02 0x00 0x03 0xfb
[2| 627] Denon status: iPod ready
0xff 0xa9 0x06 0x00 0x81 0x00 0x01 0x11 0x00 0x67
[3| 678] Denon ??? #1
0xff 0xa9 0x03 0x00 0x01 0x00 0xfc
[2| 682] ACK: ??? #1
0xff 0xa9 0x04 0x00 0x80 0x00 0x01 0x7b
[3| 1247] Denon periodic status query
0xff 0xa9 0x02 0x00 0x03 0xfb
[2| 1251] Denon status: iPod ready
0xff 0xa9 0x06 0x00 0x81 0x00 0x01 0x11 0x00 0x67
[3| 1838] Denon periodic status query
0xff 0xa9 0x02 0x00 0x03 0xfb
[2| 1842] Denon status: iPod ready
0xff 0xa9 0x06 0x00 0x81 0x00 0x01 0x11 0x00 0x67
[3| 1904] Request iPod type
0xff 0x55 0x03 0x04 0x00 0x12 0xe7
[0| 1908] Request iPod type
0xff 0x55 0x03 0x04 0x00 0x12 0xe7
[1| 1921] iPod type: 0x01 0x08
0xff 0x55 0x05 0x04 0x00 0x13 0x01 0x08 0xdb
[2| 1919] iPod type: 0x01 0x08
0xff 0x55 0x05 0x04 0x00 0x13 0x01 0x08 0xdb
[3| 1970] Request Lingo Protocol Version 0x00
0xff 0x55 0x03 0x00 0x0f 0x00 0xee
[0| 1973] Request Lingo Protocol Version 0x00
0xff 0x55 0x03 0x00 0x0f 0x00 0xee
[1| 1984] Lingo Protocol Version: 0x00 0x01 0x02
0xff 0x55 0x05 0x00 0x10 0x00 0x01 0x02 0xe8
[2| 1982] Lingo Protocol Version: 0x00 0x01 0x02
0xff 0x55 0x05 0x00 0x10 0x00 0x01 0x02 0xe8
[3| 2035] Enter Remote UI Mode
0xff 0x55 0x02 0x00 0x05 0xf9
[0| 2039] Enter Remote UI Mode
0xff 0x55 0x02 0x00 0x05 0xf9
[1| 2048] ACK: Success 0x00 0x05
0xff 0x55 0x04 0x00 0x02 0x00 0x05 0xf5
[2| 2047] ACK: Success 0x00 0x05
0xff 0x55 0x04 0x00 0x02 0x00 0x05 0xf5
[3| 2090] Request Remote UI Mode
0xff 0x55 0x02 0x00 0x03 0xfb
[0| 2093] Request Remote UI Mode
0xff 0x55 0x02 0x00 0x03 0xfb
[1| 2102] Return Remote UI Mode: Extended Interface Mode
0xff 0x55 0x03 0x00 0x04 0x01 0xf8
[2| 2101] Return Remote UI Mode: Extended Interface Mode
0xff 0x55 0x03 0x00 0x04 0x01 0xf8
[3| 2145] Request screen resolution
0xff 0x55 0x03 0x04 0x00 0x33 0xc6
[0| 2148] Request screen resolution
0xff 0x55 0x03 0x04 0x00 0x33 0xc6
[1| 2164] Screen resolution: 128x55x1
0x255 0x85 0x08 0x04 0x00 0x52 0x00 0x128 0x00 0x55 0x01 0x08
[2| 2160] Screen resolution: 128x55x1
0x255 0x85 0x08 0x04 0x00 0x52 0x00 0x128 0x00 0x55 0x01 0x08
[3| 2200] Picture block
0xff 0x55 0x00 0x01 0xd0 0x04 0x00 0x32 0x00 0x00 0x01 0x00 0x78 0x00 0x37 0x00 0x00 0x00 0x20 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x29
[0| 2203] Picture block
0xff 0x55 0x00 0x01 0xd0 0x04 0x00 0x32 0x00 0x00 0x01 0x00 0x78 0x00 0x37 0x00 0x00 0x00 0x20 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x29
[1| 2457] Result: success
0xff 0x55 0x06 0x04 0x00 0x01 0x00 0x00 0x32 0xc3
[2| 2455] Result: success
0xff 0x55 0x06 0x04 0x00 0x01 0x00 0x00 0x32 0xc3
[3| 2495] Picture block
0xff 0x55 0x00 0x01 0xc7 0x04 0x00 0x32 0x00 0x01 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x30 0x00 0x00 0x00 0x00 0x00 0xff 0xfc 0x00 0x03 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x03 0xff 0xff 0x00 0x00 0xff 0xff 0xf0 0x3c 0x00 0x00 0x3f 0x00 0x0f 0xff 0xff 0xc0 0x03 0xc0 0x00 0x03 0xf0 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x03 0xff 0xff 0xf0 0x00 0xff 0xff 0xf0 0x3f 0x00 0x00 0x3f 0x00 0x3f 0xff 0xff 0xf0 0x03 0xf0 0x00 0x03 0xf0 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x03 0xff 0xff 0xfc 0x00 0xff 0xff 0xf0 0x3f 0xc0 0x00 0x3f 0x00 0xff 0xf0 0x3f 0xfc 0x03 0xfc 0x00 0x03 0xf0 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x03 0xf0 0x0f 0xff 0x00 0xfc 0x00 0x00 0x3f 0xf0 0x00 0x3f 0x03 0xff 0x00 0x03 0xff 0x03 0xff 0x00 0x03 0xf0 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x03 0xf0 0x00 0xff 0x00 0xfc 0x00 0x00 0x3f 0xfc 0x00 0x3f 0x03 0xfc 0x00 0x00 0xff 0x03 0xff 0xc0 0x03 0xf0 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x03 0xf0 0x00 0x3f 0xc0 0xfc 0x00 0x00 0x3f 0xff 0x00 0x3f 0x0f 0xf0 0x00 0x00 0x3f 0xc3 0xff 0xf0 0x03 0xf0 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x03 0xf0 0x00 0x3f 0xc0 0xfc 0x00 0x00 0x3f 0xff 0xc0 0x3f 0x0f 0xf0 0x00 0x00 0x3f 0xc3 0xff 0xfc 0x03 0xf0 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x03 0xf0 0x00 0x0f 0xc0 0xff 0xff 0x00 0x3f 0x3f 0xf0 0x3f 0x0f 0xc0 0x00 0x00 0x0f 0xc3 0xf3 0xff 0x03 0xf0 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x03 0xf0 0x00 0x0f 0xc0 0xff 0xff 0x00 0x3f 0x0f 0xfc 0x3f 0x0f 0xc0 0x00 0x00 0x0f 0xc3 0xf0 0xff 0xc3 0xf0 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0xcb
[0| 2498] Picture block
0xff 0x55 0x00 0x01 0xc7 0x04 0x00 0x32 0x00 0x01 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x30 0x00 0x00 0x00 0x00 0x00 0xff 0xfc 0x00 0x03 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x03 0xff 0xff 0x00 0x00 0xff 0xff 0xf0 0x3c 0x00 0x00 0x3f 0x00 0x0f 0xff 0xff 0xc0 0x03 0xc0 0x00 0x03 0xf0 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x03 0xff 0xff 0xf0 0x00 0xff 0xff 0xf0 0x3f 0x00 0x00 0x3f 0x00 0x3f 0xff 0xff 0xf0 0x03 0xf0 0x00 0x03 0xf0 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x03 0xff 0xff 0xfc 0x00 0xff 0xff 0xf0 0x3f 0xc0 0x00 0x3f 0x00 0xff 0xf0 0x3f 0xfc 0x03 0xfc 0x00 0x03 0xf0 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x03 0xf0 0x0f 0xff 0x00 0xfc 0x00 0x00 0x3f 0xf0 0x00 0x3f 0x03 0xff 0x00 0x03 0xff 0x03 0xff 0x00 0x03 0xf0 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x03 0xf0 0x00 0xff 0x00 0xfc 0x00 0x00 0x3f 0xfc 0x00 0x3f 0x03 0xfc 0x00 0x00 0xff 0x03 0xff 0xc0 0x03 0xf0 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x03 0xf0 0x00 0x3f 0xc0 0xfc 0x00 0x00 0x3f 0xff 0x00 0x3f 0x0f 0xf0 0x00 0x00 0x3f 0xc3 0xff 0xf0 0x03 0xf0 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x03 0xf0 0x00 0x3f 0xc0 0xfc 0x00 0x00 0x3f 0xff 0xc0 0x3f 0x0f 0xf0 0x00 0x00 0x3f 0xc3 0xff 0xfc 0x03 0xf0 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x03 0xf0 0x00 0x0f 0xc0 0xff 0xff 0x00 0x3f 0x3f 0xf0 0x3f 0x0f 0xc0 0x00 0x00 0x0f 0xc3 0xf3 0xff 0x03 0xf0 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x03 0xf0 0x00 0x0f 0xc0 0xff 0xff 0x00 0x3f 0x0f 0xfc 0x3f 0x0f 0xc0 0x00 0x00 0x0f 0xc3 0xf0 0xff 0xc3 0xf0 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0xcb
[1| 2747] Result: success
0xff 0x55 0x06 0x04 0x00 0x01 0x00 0x00 0x32 0xc3
[2| 2745] Result: success
0xff 0x55 0x06 0x04 0x00 0x01 0x00 0x00 0x32 0xc3
[3| 2780] Picture block
0xff 0x55 0x00 0x01 0xc7 0x04 0x00 0x32 0x00 0x02 0x03 0xf0 0x00 0x0f 0xc0 0xff 0xff 0x00 0x3f 0x03 0xff 0x3f 0x0f 0xc0 0x00 0x00 0x0f 0xc3 0xf0 0x3f 0xf3 0xf0 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x03 0xf0 0x00 0x3f 0xc0 0xfc 0x00 0x00 0x3f 0x00 0xff 0xff 0x0f 0xf0 0x00 0x00 0x3f 0xc3 0xf0 0x0f 0xff 0xf0 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x03 0xf0 0x00 0x3f 0xc0 0xfc 0x00 0x00 0x3f 0x00 0x3f 0xff 0x0f 0xf0 0x00 0x00 0x3f 0xc3 0xf0 0x03 0xff 0xf0 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x03 0xf0 0x00 0xff 0x00 0xfc 0x00 0x00 0x3f 0x00 0x0f 0xff 0x03 0xfc 0x00 0x00 0xff 0x03 0xf0 0x00 0xff 0xf0 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x03 0xf0 0x0f 0xff 0x00 0xfc 0x00 0x00 0x3f 0x00 0x03 0xff 0x03 0xff 0x00 0x03 0xff 0x03 0xf0 0x00 0x3f 0xf0 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x03 0xff 0xff 0xfc 0x00 0xff 0xff 0xf0 0x3f 0x00 0x00 0xff 0x00 0xff 0xf0 0x3f 0xfc 0x03 0xf0 0x00 0x0f 0xf0 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x03 0xff 0xff 0xf0 0x00 0xff 0xff 0xf0 0x3f 0x00 0x00 0x3f 0x00 0x3f 0xff 0xff 0xf0 0x03 0xf0 0x00 0x03 0xf0 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x03 0xff 0xff 0x00 0x00 0xff 0xff 0xf0 0x3f 0x00 0x00 0x0f 0x00 0x0f 0xff 0xff 0xc0 0x03 0xf0 0x00 0x00 0xf0 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x03 0x00 0x00 0xff 0xfc 0x00 0x00 0x00 0x00 0x00 0x30 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x56
[0| 2783] Picture block
0xff 0x55 0x00 0x01 0xc7 0x04 0x00 0x32 0x00 0x02 0x03 0xf0 0x00 0x0f 0xc0 0xff 0xff 0x00 0x3f 0x03 0xff 0x3f 0x0f 0xc0 0x00 0x00 0x0f 0xc3 0xf0 0x3f 0xf3 0xf0 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x03 0xf0 0x00 0x3f 0xc0 0xfc 0x00 0x00 0x3f 0x00 0xff 0xff 0x0f 0xf0 0x00 0x00 0x3f 0xc3 0xf0 0x0f 0xff 0xf0 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x03 0xf0 0x00 0x3f 0xc0 0xfc 0x00 0x00 0x3f 0x00 0x3f 0xff 0x0f 0xf0 0x00 0x00 0x3f 0xc3 0xf0 0x03 0xff 0xf0 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x03 0xf0 0x00 0xff 0x00 0xfc 0x00 0x00 0x3f 0x00 0x0f 0xff 0x03 0xfc 0x00 0x00 0xff 0x03 0xf0 0x00 0xff 0xf0 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x03 0xf0 0x0f 0xff 0x00 0xfc 0x00 0x00 0x3f 0x00 0x03 0xff 0x03 0xff 0x00 0x03 0xff 0x03 0xf0 0x00 0x3f 0xf0 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x03 0xff 0xff 0xfc 0x00 0xff 0xff 0xf0 0x3f 0x00 0x00 0xff 0x00 0xff 0xf0 0x3f 0xfc 0x03 0xf0 0x00 0x0f 0xf0 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x03 0xff 0xff 0xf0 0x00 0xff 0xff 0xf0 0x3f 0x00 0x00 0x3f 0x00 0x3f 0xff 0xff 0xf0 0x03 0xf0 0x00 0x03 0xf0 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x03 0xff 0xff 0x00 0x00 0xff 0xff 0xf0 0x3f 0x00 0x00 0x0f 0x00 0x0f 0xff 0xff 0xc0 0x03 0xf0 0x00 0x00 0xf0 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x03 0x00 0x00 0xff 0xfc 0x00 0x00 0x00 0x00 0x00 0x30 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x56
[1| 3032] Result: success
0xff 0x55 0x06 0x04 0x00 0x01 0x00 0x00 0x32 0xc3
[2| 3030] Result: success
0xff 0x55 0x06 0x04 0x00 0x01 0x00 0x00 0x32 0xc3
[3| 3064] Picture block
0xff 0x55 0x00 0x01 0x9f 0x04 0x00 0x32 0x00 0x03 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x27
[0| 3068] Picture block
0xff 0x55 0x00 0x01 0x9f 0x04 0x00 0x32 0x00 0x03 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x27
[1| 3381] Result: success
0xff 0x55 0x06 0x04 0x00 0x01 0x00 0x00 0x32 0xc3
[2| 3379] Result: success
0xff 0x55 0x06 0x04 0x00 0x01 0x00 0x00 0x32 0xc3
[3| 3404] Start polling mode
0xff 0x55 0x04 0x04 0x00 0x26 0x01 0xd1
[0| 3407] Start polling mode
0xff 0x55 0x04 0x04 0x00 0x26 0x01 0xd1
[1| 3422] Result: success
0xff 0x55 0x06 0x04 0x00 0x01 0x00 0x00 0x26 0xcf
[2| 3419] Result: success
0xff 0x55 0x06 0x04 0x00 0x01 0x00 0x00 0x26 0xcf
[3| 3458] Switch to the main library playlist
0xff 0x55 0x03 0x04 0x00 0x16 0xe3
[0| 3461] Switch to the main library playlist
0xff 0x55 0x03 0x04 0x00 0x16 0xe3
[1| 3479] Result: success
0xff 0x55 0x06 0x04 0x00 0x01 0x00 0x00 0x16 0xdf
[2| 3477] Result: success
0xff 0x55 0x06 0x04 0x00 0x01 0x00 0x00 0x16 0xdf
[3| 3513] Request count for element Song
0xff 0x55 0x04 0x04 0x00 0x18 0x05 0xdb
[0| 3516] Request count for element Song
0xff 0x55 0x04 0x04 0x00 0x18 0x05 0xdb
[1| 3546] Count: 693
0x255 0x85 0x07 0x04 0x00 0x25 0x00 0x00 0x02 0x181 0x37
[2| 3543] Count: 693
0x255 0x85 0x07 0x04 0x00 0x25 0x00 0x00 0x02 0x181 0x37
[3| 3568] Switch to the main library playlist
0xff 0x55 0x03 0x04 0x00 0x16 0xe3
[0| 3571] Switch to the main library playlist
0xff 0x55 0x03 0x04 0x00 0x16 0xe3
[1| 3592] Result: success
0xff 0x55 0x06 0x04 0x00 0x01 0x00 0x00 0x16 0xdf
[2| 3589] Result: success
0xff 0x55 0x06 0x04 0x00 0x01 0x00 0x00 0x16 0xdf
[3| 3623] Playback control: Stop
0xff 0x55 0x04 0x04 0x00 0x29 0x02 0xcd
[0| 3626] Playback control: Stop
0xff 0x55 0x04 0x04 0x00 0x29 0x02 0xcd
[1| 3648] Result: success
0xff 0x55 0x06 0x04 0x00 0x01 0x00 0x00 0x29 0xcc
[2| 3646] Result: success
0xff 0x55 0x06 0x04 0x00 0x01 0x00 0x00 0x29 0xcc
[3| 3677] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 3681] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 3700] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 3695] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 3732] Get shuffle mode
0xff 0x55 0x03 0x04 0x00 0x2c 0xcd
[0| 3735] Get shuffle mode
0xff 0x55 0x03 0x04 0x00 0x2c 0xcd
[1| 3749] Shuffle mode: song
0xff 0x55 0x04 0x04 0x00 0x2d 0x01 0xca
[2| 3747] Shuffle mode: song
0xff 0x55 0x04 0x04 0x00 0x2d 0x01 0xca
[3| 3787] Get repeat mode
0xff 0x55 0x03 0x04 0x00 0x2f 0xca
[0| 3790] Get repeat mode
0xff 0x55 0x03 0x04 0x00 0x2f 0xca
[1| 3804] Repeat mode: off
0xff 0x55 0x04 0x04 0x00 0x30 0x00 0xc8
[2| 3802] Repeat mode: off
0xff 0x55 0x04 0x04 0x00 0x30 0x00 0xc8
[3| 3842] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 3845] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 3864] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 3859] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 3929] Denon periodic status query
0xff 0xa9 0x02 0x00 0x03 0xfb
[2| 3933] Denon status: iPod ready
0xff 0xa9 0x06 0x00 0x81 0x00 0x01 0x11 0x00 0x67
[3| 3973] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 3976] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 3996] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 3990] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 4082] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 4086] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 4105] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 4100] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 4192] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 4195] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 4215] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 4209] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 4301] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 4305] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 4324] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 4318] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 4411] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 4414] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 4433] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 4428] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 4520] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 4523] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 4543] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 4537] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 4630] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 4633] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 4652] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 4647] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 4739] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 4743] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 4762] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 4757] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 4783] Denon periodic status query
0xff 0xa9 0x02 0x00 0x03 0xfb
[2| 4787] Denon status: iPod ready
0xff 0xa9 0x06 0x00 0x81 0x00 0x01 0x11 0x00 0x67
[3| 4848] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 4852] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 4872] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 4866] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 4949] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 4952] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 4971] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 4966] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 5057] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 5060] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 5080] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 5074] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 5166] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 5170] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 5189] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 5184] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 5276] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 5279] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 5299] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 5293] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 5385] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 5389] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 5408] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 5402] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 5495] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 5498] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 5518] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 5512] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 5604] Denon periodic status query
0xff 0xa9 0x02 0x00 0x03 0xfb
[2| 5608] Denon status: iPod ready
0xff 0xa9 0x06 0x00 0x81 0x00 0x01 0x11 0x00 0x67
[3| 5648] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 5651] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 5671] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 5665] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 5757] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 5761] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 5781] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 5775] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 5867] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 5870] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 5890] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 5884] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 5976] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 5979] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 5999] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 5993] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 6086] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 6089] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 6109] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 6103] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 6195] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 6199] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 6218] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 6213] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 6305] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 6308] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 6327] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 6322] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 6414] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 6415] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 6435] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 6429] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 6458] Denon periodic status query
0xff 0xa9 0x02 0x00 0x03 0xfb
[2| 6462] Denon status: iPod ready
0xff 0xa9 0x06 0x00 0x81 0x00 0x01 0x11 0x00 0x67
[3| 6524] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 6527] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 6546] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 6541] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 6633] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 6636] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 6656] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 6651] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 6743] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 6746] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 6765] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 6759] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 6852] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 6856] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 6875] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 6870] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 6962] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 6965] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 6985] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 6979] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 7071] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 7074] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 7093] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 7088] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 7180] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 7184] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 7203] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 7198] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 7279] Denon periodic status query
0xff 0xa9 0x02 0x00 0x03 0xfb
[2| 7283] Denon status: iPod ready
0xff 0xa9 0x06 0x00 0x81 0x00 0x01 0x11 0x00 0x67
[3| 7323] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 7326] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 7346] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 7340] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 7432] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 7436] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 7455] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 7450] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 7542] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 7545] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 7565] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 7559] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 7651] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 7654] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 7673] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 7668] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 7761] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 7764] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 7783] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 7778] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 7870] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 7873] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 7893] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 7888] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 7979] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 7981] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 8000] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 7994] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 8089] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 8093] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 8112] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 8106] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 8133] Denon periodic status query
0xff 0xa9 0x02 0x00 0x03 0xfb
[2| 8136] Denon status: iPod ready
0xff 0xa9 0x06 0x00 0x81 0x00 0x01 0x11 0x00 0x67
[3| 8198] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 8202] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 8221] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 8216] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 8308] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 8309] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 8328] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 8323] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 8417] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 8421] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 8440] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 8434] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 8527] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 8530] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 8550] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 8544] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 8636] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 8640] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 8659] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 8654] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 8746] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 8749] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 8781] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 8776] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 8855] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 8858] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 8878] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 8872] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 8954] Denon periodic status query
0xff 0xa9 0x02 0x00 0x03 0xfb
[2| 8957] Denon status: iPod ready
0xff 0xa9 0x06 0x00 0x81 0x00 0x01 0x11 0x00 0x67
[3| 8997] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 9001] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 9020] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 9015] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 9107] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 9110] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 9130] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 9125] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 9216] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 9220] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 9239] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 9234] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 9326] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 9329] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 9348] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 9343] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 9435] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 9439] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 9458] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 9453] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 9545] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 9548] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 9568] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 9562] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 9654] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 9658] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 9677] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 9672] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 9764] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 9767] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 9786] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 9781] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 9807] Denon periodic status query
0xff 0xa9 0x02 0x00 0x03 0xfb
[2| 9811] Denon status: iPod ready
0xff 0xa9 0x06 0x00 0x81 0x00 0x01 0x11 0x00 0x67
[3| 9873] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 9876] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 9896] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 9890] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 9983] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 9986] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 10006] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 10000] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 10092] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 10095] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 10114] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 10109] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 10201] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 10205] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 10225] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 10219] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 10311] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 10314] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 10334] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 10328] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 10420] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 10424] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 10443] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 10438] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 10530] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 10533] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 10553] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 10547] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 10628] Denon periodic status query
0xff 0xa9 0x02 0x00 0x03 0xfb
[2| 10632] Denon status: iPod ready
0xff 0xa9 0x06 0x00 0x81 0x00 0x01 0x11 0x00 0x67
[3| 10672] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 10673] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 10693] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 10687] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 10782] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 10785] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 10805] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 10799] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 10891] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 10895] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 10914] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 10909] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 11001] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 11004] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 11023] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 11017] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 11110] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 11113] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 11133] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 11128] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 11219] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 11223] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 11243] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 11237] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 11329] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 11332] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 11352] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 11346] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 11438] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 11442] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 11461] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 11456] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 11482] Denon periodic status query
0xff 0xa9 0x02 0x00 0x03 0xfb
[2| 11486] Denon status: iPod ready
0xff 0xa9 0x06 0x00 0x81 0x00 0x01 0x11 0x00 0x67
[3| 11548] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 11551] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 11571] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 11565] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 11657] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[0| 11661] Request time and status info
0xff 0x55 0x03 0x04 0x00 0x1c 0xdd
[1| 11680] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[2| 11675] Track length: 0:00.000; current time: 0:00.000; status: stopped
0x255 0x85 0x12 0x04 0x00 0x29 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x211
[3| 11773] Denon announcement: Deselecting iPod input
0xff 0xa9 0x02 0x00 0x05 0xf9
[2| 11777] ACK: Deselecting iPod input
0xff 0xa9 0x04 0x00 0x80 0x00 0x05 0x77
[3| 11865] Denon announcement: Deselecting iPod input
0xff 0xa9 0x02 0x00 0x05 0xf9
[2| 11869] ACK: Deselecting iPod input
0xff 0xa9 0x04 0x00 0x80 0x00 0x05 0x77
</code></pre></div></div>Sven SchwermerI have recently gotten myself an ASD-11R iPod dock for my Denon DRA-700AE receiver in order to inspect the protocol that is being used for the communication between the two devices. My original intention was to display arbitrary information on the receiver display. Also, controlling an external device using the receiver controls or the remote control would have been nice. To tell you right away: I achieved neither. However, I learned something about the communication protocol along the way.Debugging an OpenWrt/LEDE kernel using KGDB over serial2016-11-02T15:20:00+00:002016-11-02T15:20:00+00:00https://svenschwermer.de/2016/11/02/debugging-openwrt_lede-kernel<p>When trying to get sound output up and running on my <a href="https://labs.mediatek.com/site/global/developer_tools/mediatek_linkit_smart_7688/whatis_7688/index.gsp">LinkIt Smart MT7688</a> I needed to debug the Linux Kernel. I am using the master branch of the <a href="https://openwrt.org/">OpenWrt</a>/<a href="https://www.lede-project.org/">LEDE</a> distribution and therefore wanted to configure the sound card using the <a href="https://www.kernel.org/doc/Documentation/devicetree/bindings/sound/simple-card.txt">simple-card device tree binding</a>.</p>
<p>Since I needed to debug loadable Kernel modules (LKM), the process is a little more involved than it could be. There are three aspects to take care of:</p>
<ol>
<li>The Kernel needs to be compiled with the Kernel debugging backend KGDB and debugging symbols activated.</li>
<li>A suitable GDB front end has to be built. This needs to have Python support enabled in order to make use of the <a href="https://www.kernel.org/doc/html/latest/dev-tools/gdb-kernel-debugging.html">Kernel GDB scripts</a>.</li>
<li>The LKM that need to be debugged have to be built with optimization disabled and debugging symbols enabled.</li>
</ol>
<p>At least one serial (UART) interface is needed on the device under test that will be exclusively used by the debugger. Of course Python needs to be installed on the host machine.</p>
<h2 id="configuring-the-kernel">Configuring the Kernel</h2>
<p>Enter the Kernel configuration command line tool by running <code class="language-plaintext highlighter-rouge">make kernel_menuconfig</code>. Search for and set the following options:</p>
<ul>
<li><code class="language-plaintext highlighter-rouge">CONFIG_DEBUG_INFO=y</code></li>
<li><code class="language-plaintext highlighter-rouge">CONFIG_DEBUG_INFO_DWARF4=y</code></li>
<li><code class="language-plaintext highlighter-rouge"># CONFIG_DEBUG_INFO_REDUCED is not set</code></li>
<li><code class="language-plaintext highlighter-rouge">CONFIG_GDB_SCRIPTS=y</code></li>
<li><code class="language-plaintext highlighter-rouge">CONFIG_KGDB=y</code></li>
<li><code class="language-plaintext highlighter-rouge">CONFIG_KGDB_SERIAL_CONSOLE=y</code></li>
<li>Additionally the Kernel needs to be told what serial interface to use for the debugger. In my case I added <code class="language-plaintext highlighter-rouge">kgdboc=ttyS1,115200</code> to <code class="language-plaintext highlighter-rouge">CONFIG_CMDLINE</code>.</li>
</ul>
<h2 id="configuring-the-gdb-front-end">Configuring the GDB front end</h2>
<p>In the distribution configuration command line tool (<code class="language-plaintext highlighter-rouge">make menuconfig</code>) make sure that the GDB is being built as part of the toolchain. Then in the Makefile for the GDB which can be found at <code class="language-plaintext highlighter-rouge">toolchain/gdb/Makefile</code> the following changes need to be made:</p>
<ul>
<li>Replace <code class="language-plaintext highlighter-rouge">--without-python</code> with <code class="language-plaintext highlighter-rouge">--with-python</code> in the <code class="language-plaintext highlighter-rouge">HOST_CONFIGURE_ARGS</code>.</li>
<li>In the procedure <code class="language-plaintext highlighter-rouge">Host/Install</code> append <code class="language-plaintext highlighter-rouge">$(MAKE) -C $(HOST_BUILD_DIR)/gdb/data-directory install</code> and in the procedure <code class="language-plaintext highlighter-rouge">Host/Clean</code> prepend <code class="language-plaintext highlighter-rouge">$(MAKE) -C $(HOST_BUILD_DIR)/gdb/data-directory uninstall</code>.</li>
</ul>
<p>Now everything needs to be built for the first time using <code class="language-plaintext highlighter-rouge">make</code>.</p>
<h2 id="adjust-the-compile-flags-for-uut">Adjust the compile flags for UUT</h2>
<p>Say the unit under test is the I²C driver for Ralink/Mediatek MIPS SoCs which can be found at <code class="language-plaintext highlighter-rouge">build_dir/target-mipsel_24kc_musl-1.1.15/linux-ramips_mt7688/linux-4.4.24/drivers/i2c/busses/i2c-mt7621.c</code>. Now the Makefile that resides in the same directory as the source file needs to be modified. The line <code class="language-plaintext highlighter-rouge">CFLAGS_i2c-mt7621.o := -O0 -ggdb3</code> is added which disables optimization and enables the most verbose debugging information.</p>
<p>After the modification everything can be compiled again and the device under test can be flashed with the newly generated image.</p>
<h2 id="debugging-procedure">Debugging procedure</h2>
<p>For convenience it makes sense to add the directory that the GDB front end binary resides in to the <code class="language-plaintext highlighter-rouge">PATH</code> variable. In my case this directory is <code class="language-plaintext highlighter-rouge">staging_dir/toolchain-mipsel_24kc_gcc-5.4.0_musl-1.1.15/bin</code>. In a terminal with that variable set we navigate to the Kernel base directory in <code class="language-plaintext highlighter-rouge">build_dir/target-mipsel_24kc_musl-1.1.15/linux-ramips_mt7688/linux-4.4.24</code>. There we start the GDB front end with <code class="language-plaintext highlighter-rouge">vmlinux</code> as the argument. It might be necessary to explicitely allow the GDB front end to load the Python scripts using the command <code class="language-plaintext highlighter-rouge">add-auto-load-safe-path</code>.</p>
<p>On the device under test the Kernel execution needs to be manually interrupted by issuing the command <code class="language-plaintext highlighter-rouge">echo g > /proc/sysrq-trigger</code>. An intervention from the GDB front end is not possible when debugging the Kernel. Now the Kernel is listening on the configured (via Kernel command line) serial interface for the GDB front end.</p>
<p>In the GDB front end session the baudrate needs to be configured using <code class="language-plaintext highlighter-rouge">set serial baud 115200</code>. After that we connect to the target using the command <code class="language-plaintext highlighter-rouge">target remote /dev/ttyXXX</code> where <code class="language-plaintext highlighter-rouge">XXX</code> is the serial interface identifier on the host machine. The serial interface being the one that is connected to the debugging serial interface on the target. Now the GDB front end should be attached to the Kernel debugger and e.g. breakpoints can be placed and excecution continued.</p>
<h3 id="debugging-an-lkm-which-is-not-loaded-yet">Debugging an LKM which is not loaded yet</h3>
<p>The only way to debug the initialization of a module I am aware of is to export the initialization function symbol. This can be done by using the macro <code class="language-plaintext highlighter-rouge">EXPORT_SYMBOL_GPL</code> or <code class="language-plaintext highlighter-rouge">EXPORT_SYMBOL</code>. Of course this requires recompiling of the kernel.</p>
<p>When the GDB front end is attached and the target’s Kernel execution is stopped, the command <code class="language-plaintext highlighter-rouge">lx-symbols</code> is issued which detects all currently loaded modules and loads their symbols. Furthermore we need to assure that pending breakpoints are allowed by executing <code class="language-plaintext highlighter-rouge">set breakpoint pending on</code>. Now the breakpoint itself can be set in the usual way and the Kernel execution can be resumed. When the module is inserted now the execution will stop at the beginning of the init function. The next steps are discussed in the following section.</p>
<h3 id="debugging-an-lkm-which-is-already-loaded">Debugging an LKM which is already loaded</h3>
<p>As I couldn’t find a way to tell the Kernel build system to not strip the LKM binaries (<code class="language-plaintext highlighter-rouge">*.ko</code>), in the next step the object file with all the debug symbols needs to be loaded with the correct address offset which is determined at runtime.</p>
<p>If a new kernel module has been inserted the command <code class="language-plaintext highlighter-rouge">lx-symbols</code> needs to be run again. The command <code class="language-plaintext highlighter-rouge">lx-lsmod</code> lists all the currently loaded Kernel modules with their base addresses. After finding the correct address for our LKM we add the object file as a symbol file using <code class="language-plaintext highlighter-rouge">add-symbol-file path_to_the_object_file address</code>. In my case it boils down to <code class="language-plaintext highlighter-rouge">add-symbol-file drivers/i2c/busses/i2c-mt7621.o 0x12345678</code>. Now all symbols from that object file are known and can be used for setting breakpoints, etc.</p>
<p>One last thing: I found the <a href="https://github.com/cyrus-and/gdb-dashboard">GDB dashboard</a> to be really handy!</p>Sven SchwermerWhen trying to get sound output up and running on my LinkIt Smart MT7688 I needed to debug the Linux Kernel. I am using the master branch of the OpenWrt/LEDE distribution and therefore wanted to configure the sound card using the simple-card device tree binding.Installing Arch Linux with Kodi on a Wandboard Quad2016-09-10T14:20:00+00:002016-09-10T14:20:00+00:00https://svenschwermer.de/2016/09/10/installing-arch-on-wandboard-quad<p>I have been looking into several options to run <a href="https://kodi.tv/">Kodi</a> on a <a href="http://wandboard.org/">Wandboard Quad</a> for some time now. I now have Arch Linux with Kodi running on it quite reliably now. I am writing down the steps here hoping that it helps others to achieve the same thing. This is also a memo for myself ;-)</p>
<p>Disclaimer: I have finished the installing procedure a while ago so there might be newer package versions that could potentially cause problems now.</p>
<p>I started by following <a href="https://archlinuxarm.org/platforms/armv7/freescale/wandboard">the instructions on the Arch Linux ARM site</a> to install the image onto the micro SD card. This will install an upstream Linux kernel.</p>
<p>Since the hardware support in the upstream kernel for the i.MX6 SoC is not as good as in the <a href="https://github.com/archlinuxarm/PKGBUILDs/tree/master/core/linux-imx6">specialized kernel</a> we are going to replace the stock kernel: <code class="language-plaintext highlighter-rouge">pacman -Syu linux-imx6</code>. This will update the repositories and upgrade all installed packages too. After updating the kernel we need to reboot the system: <code class="language-plaintext highlighter-rouge">reboot</code>.</p>
<p>The Linux operating system will not boot up as the U-Boot bootloader assumes a (newer) kernel that comes with device trees for both Wanboard revisions B1 and C1. I have a revision C1 board so in the U-Boot console I entered: <code class="language-plaintext highlighter-rouge">setenv board_name C1</code> and <code class="language-plaintext highlighter-rouge">boot</code> to boot up the Linux system.</p>
<p>In order to not being required to manually modify the U-Boot environment every time the system boots up, we need to do the following: <code class="language-plaintext highlighter-rouge">cd /boot/dtbs && ln -s imx6q-wandboard.dtb imx6q-wandboard-revb1.dtb</code>. Rebooting without manual intervention should work fine now.</p>
<p>In Linux we are going to install the Kodi mediacenter now: <code class="language-plaintext highlighter-rouge">pacman -S kodi-imx imx-gpu-viv-fb</code>. You’ll notice a quite annoying blinking cursor when starting up Kodi. To avoid this, run <code class="language-plaintext highlighter-rouge">echo "optargs=consoleblank=0" > /boot/uEnv.txt</code>. If you want Kodi to start automatically every time the Linux system boots up, run <code class="language-plaintext highlighter-rouge">systemctl enable kodi</code> and reboot.</p>
<p>I have done a <a href="https://project-insanity.org/blog/2014/01/24/wandboard-with-hdmi-cec-and-xbmc/">hardware modification</a> to my Wandboard so the CEC signal line of the HDMI connection is being routed to the SoC. This allows me to control Kodi with the remote control of my TV. We need to create a udev rule so that Kodi can access the CEC device:</p>
<figure class="highlight"><pre><code class="language-bash" data-lang="bash"><span class="nb">cat</span> <span class="o"><<</span> <span class="no">EOF</span><span class="sh"> > /etc/udev/rules.d/99-hdmi-cec.rules
KERNEL=="mxc_hdmi", SUBSYSTEM=="mxc_hdmi", GROUP="video", MODE="0666"
KERNEL=="mxc_hdmi_cec", SUBSYSTEM=="mxc_hdmi_cec", GROUP="video", MODE="0666"
EOF</span></code></pre></figure>
<p>If you are planning to attach a (USB) keyboard to the Wandboard you probably want to be able to type in Kodi’s input fields (search boxes, etc.) using that keyboard. This can either be achieved by following the <a href="https://wiki.archlinux.org/index.php/Kodi#Raspberry_Pi">advice on the Arch wiki</a> or by executing the following commands:</p>
<figure class="highlight"><pre><code class="language-bash" data-lang="bash">usermod <span class="nt">-a</span> <span class="nt">-G</span> <span class="nb">tty </span>kodi
<span class="nb">cat</span> <span class="o"><<</span> <span class="no">EOF</span><span class="sh"> > /etc/udev/rules.d/51-udev-custom.rules
SUBSYSTEM=="tty", KERNEL=="tty0", MODE="0660"
EOF</span></code></pre></figure>
<p>Now you should be all set with a Kodi-activated mediacenter on your Wandboard. You might need to adjust the timezone setting using <code class="language-plaintext highlighter-rouge">timedatectl set-timezone <your_timezone></code>.</p>Sven SchwermerI have been looking into several options to run Kodi on a Wandboard Quad for some time now. I now have Arch Linux with Kodi running on it quite reliably now. I am writing down the steps here hoping that it helps others to achieve the same thing. This is also a memo for myself ;-)Kryptonite U-lock bracket2016-05-16T13:23:00+00:002016-05-16T13:23:00+00:00https://svenschwermer.de/2016/05/16/kryptonite-u-lock-bracket<p>I recently bought a <a href="https://www.kryptonitelock.com/en/products/product-information/current-key/001010.html">Kryptonite Evolution series 4 Standard</a> U-lock for my
bicycle. While I have been quite happy with the lock itself, I had issues with
the bracket. The supplied bracket mounts on the bicycle tube by a strap that
gets tightened with a bolt. That is generally a good idea because this type of
bracket fits several different tube diameters. However, over the course of a few
days the bracket would always come loose as the the strap slipped. At least that
is what happened on my bicycle with its 28.6 mm tube and the lock being mounted
vertically.</p>
<p>As I didn’t see an obvious way to fix the existing bracket I designed my own
bracket. This bracket mounts on the tube by pressing two haves together with
four M4 stainless bolts. The socket part of the original bracket, that accepts
the lock, then mounts onto the bracket using the original M4 stainless bolt.</p>
<p>I got the two parts manufactured from aluminium on a CNC mill. They turned out
quite nice and both the socket for the lock and the bracket itself fit well.</p>
<figure>
<a href="/assets/kryptonite/bracket-parts.jpg">
<img src="/assets/kryptonite/bracket-parts.jpg" alt="The two halves of the new bracket" />
</a>
<figcaption>The two halves of the new bracket</figcaption>
</figure>
<figure>
<a href="/assets/kryptonite/bracket-with-socket.jpg">
<img src="/assets/kryptonite/bracket-with-socket.jpg" alt="The new bracket with bolts and lock socket" />
</a>
<figcaption>The new bracket with bolts and lock socket</figcaption>
</figure>
<p>I have to admit that the new bracket doesn’t look as elegant as the original one
but the fit is rock-solid and I never had it come loose.</p>
<p>You can <a href="/assets/kryptonite/bracket.stp">download a CAD model of the bracket</a> in the STEP file format. Please
note, that threads can not be represented in STEP. All five threads are M4.</p>Sven SchwermerI recently bought a Kryptonite Evolution series 4 Standard U-lock for my bicycle. While I have been quite happy with the lock itself, I had issues with the bracket. The supplied bracket mounts on the bicycle tube by a strap that gets tightened with a bolt. That is generally a good idea because this type of bracket fits several different tube diameters. However, over the course of a few days the bracket would always come loose as the the strap slipped. At least that is what happened on my bicycle with its 28.6 mm tube and the lock being mounted vertically.