Kolbu

Computers, Gadgets and Beyond!
Subscribe


Hacking the Popcorn Hour NMT A-100

I was going to write a really long reply to a reader comment on the main PCH page here, but I figured it was better to write it all down on a new page instead. This isn't really much help for people trying to teach their NMT to do new tricks, but it may give save some from reinventing the wheel.

 
There are two pieces of software available from NMT, one is the appliance firmware, and the other is a set of applications that gets installed if you have installed an internal hard drive. The latter includes applications like FTP/NFS/SMB server and the bittorrent client.

 Taking these two files apart requires a few tricks, and there are still a lot of unknowns. This is a quick write up of most of what I've found out so far. I haven't really made a proper effort here, just spent an hour or two poking around to see what could be done.

Main firmware image 

 The main firmware image downloadable from PCH consists of 76 bytes of unknown stuff (presumably checksumming info), then a romfs-image which you can look at using a romfs-driver, followed by a large chunk of unknown. To look at the romfs image, do the following. Modify accordingly if you're on a Windows box.

-- Remove 76 bytes from start of image
 $ dd if=01-15-080201-14-POP-402-000.bin bs=76 skip=1 >ost.romfs
254450+1 records in
254450+1 records out
19338201 bytes (19 MB) copied, 3.56504 s, 5.4 MB/s
--  mount the rest
$ sudo mount -o loop ost.romfs romfs/
-- Look
$ ls
10xrpc_xload_audio_ucode_SMP8634_2.7.176sybs1.7972x_GCC4_facsprod.bin
11xrpc_xload_video_ucode_SMP8634_2.7.176sybs1.7972x_GCC4_facsprod.bin
12xrpc_xload_demux_ucode_SMP8634_2.7.176sybs1.7972x_GCC4_facsprod.bin
30vsyncparam_SMP8634_2.7.176sybs1.7972x_GCC4_facsprod.zbf
31bitmap_SMP8634_2.7.176sybs1.7972x_GCC4_facsprod.zbf
32xrpc_xload_dviinit_prod.bin
33xrpc_xload_irq_handler_SMP8634_2.7.176sybs1.7972x_GCC4_facsprod.bin
50xrpc_xload_vmlinux_ES4_prod.bin
dvi.bin

Some of these files again you can further decode and have a look at the content, as they're gzipped files with, again, some number of bytes in front of the actual content. Presumably to try to hide the content as well as they can. One contains the kernel, another contains a few applications etc.

 NMT Applications bundle

The other file you can download is more accessible. It is basically a gzipped tar archive after 60 bytes of what presumably is a checksum system to tell the player if someone has tampered with the file. I haven't tried to change something and then see if the player minds, I'll get around to that.

The tar archive has about 700 files in it. I won't bother listing all of them here, but these are the first 20ish from the most recent update:

drwxr-xr-x chkong/firmware   0 2008-01-10 02:46 syb8634/
drwxr-xr-x chkong/firmware   0 2007-12-06 11:23 syb8634/etc/
-rwxr-xr-- chkong/firmware 2176 2007-12-06 04:21 syb8634/etc/pureftpd.pdb
-rwxr-xr-x chkong/firmware  965 2007-10-24 08:16 syb8634/etc/btpd-nvram.sh
-rwxr-xr-x chkong/firmware 1641 2008-01-02 09:27 syb8634/etc/btpd.sh
-rwxr-xr-x chkong/firmware  718 2007-11-29 04:37 syb8634/etc/smb.sh
-rwxr-xr-x chkong/firmware  575 2007-12-06 10:52 syb8634/etc/btpd-env.sh
-rwxr-xr-- chkong/firmware 2422 2008-01-09 10:29 syb8634/etc/nfsserver.sh
-rwxr-xr-x chkong/firmware  203 2007-10-24 08:16 syb8634/etc/btpd_get_setting.sh
-rwxr-xr-x chkong/firmware  495 2007-12-06 04:21 syb8634/etc/ftpserver.sh
-rwxr-xr-- chkong/firmware  110 2007-12-06 04:21 syb8634/etc/pureftpd.passwd
drwxr-xr-x chkong/firmware    0 2007-10-24 08:16 syb8634/server/
-rwxr-xr-x chkong/firmware 5038556 2007-10-24 08:16 syb8634/server/php
-rwxr-xr-x chkong/firmware    2701 2007-10-24 08:16 syb8634/server/server
-rwxr-xr-x chkong/firmware    3071 2007-10-24 08:16 syb8634/server/nas_on48.jpg
-rwxr-xr-x chkong/firmware   33131 2007-10-24 08:16 syb8634/server/httpd.conf
-rwxr-xr-x chkong/firmware    4867 2007-10-24 08:16 syb8634/server/apachectl
-rwxr-xr-x chkong/firmware   10138 2007-10-24 08:16 syb8634/server/nas_on120.jpg
-rwxr-xr-x chkong/firmware  860968 2007-10-24 08:16 syb8634/server/mDNSrespd-mips
-rwxr-xr-- chkong/firmware 6088733 2007-10-24 08:16 syb8634/server/mscanner
-rwxr-xr-x chkong/firmware    6336 2007-10-24 08:16 syb8634/server/nas_on120.png
-rwxr-xr-x chkong/firmware     598 2007-10-24 08:16 syb8634/server/ms

etc etc.

There are loads of php-files etc, but they're all encoded with Turck Mmcache. Decode is most likely possible, but not easy.


Cute stuff you learn by looking around here. Try setting up a Web Service to go to "http://127.0.0.1:8883/start.cgi"...


2 Comments to “Hacking the Popcorn Hour NMT A-100”


  1. Christian B says:

    The hardware for A-100 and A-110 should be the same for the most part, with the exception that A-110 decodes DTS. Since this is purely a license issue I would like to see if anyone was able to hack the DTS decode feature into the A-100 firmware.

    1
  2. Peperfus says:

    Hi

    Anyone knows if it’s possible to install an Operating System like ubuntu (linux) or Windows and a basic howto, just like if it were a typical computer?

    Thanks

    2


Leave a Reply

  • Hit me

  • Current Poll

    Which sub-note are you getting?
    View Results
  • Default test