S50: Hacking (Not The 'Free Service' Kind)

[droobie]

Whew, what a device! This magical thing is made using the Portalplayer PP5022 chip. As a matter of fact, Portalplayer makes the chipsets for a LOT of players, including all the iPods, all the iRiver units, etc.

A lot of work seems to have been put into the software as well as the hardware of the unit.

Safeguards
Just for the heck of it, I decided to start off with trashing the entire contents of the internal memory, to see if they really considered this. I thought I'd bricked the unit, but I took out the battery, put it back in, and the thing says "DATA CREATION" and the unit works again. Good to know. It does not bring back Channel Logo or Voice Tags, so you'd have to use the RESTORE feature, to bring things back to mint.

The S50 Install CD has a Skeleton of the player in \S50-Restore . This data is already dated purely because of the new Canadian stations if nothing else.

Configuration
Your configuration files are stored in \System\Config. These contain several files with self-explanitory names, such as Sports.cfg for your favorite team settings.

Two files of note, since my S50 is in the car so I can't look at the others.

sysinfo.cfg contains your Sirius hardware ID as well as your firmware version. It seems to have 2 other versions too, and another digit. This is comma-delimited. The Hardware ID section DOES NOT determine what your Hardware ID actually is, so cloning isn't going to happen. This file seems to be regenerated each time the unit is started. Your subscription is stored in the Sirius chipset, that means hacking won't be happening regarding that. Besides, Sirius is a cheap thrill, cheaper than what's on most street corners but less dirty.

channel.cfg has data about the channels. It seems Sirius might be using virtual channel numbers and then mapping to an actual channel number. This information is updated via the satellite at random times, it seems changing this file does nothing, but I haven't dived into it too much. The format seems to be comma-delimited.

Music Storage (and the Love Button)
The music that you 'love button' is readily available as files, but it's stored in PAC format, has no codec (on computer) readily available, and is probably encrypted. Using a PAC file from another unit (even replacing a Love buttoned track out) doesn't work. Smart, I'm glad Sirius put some thought into this to avoid RIAA issues.

Your MP3 files are readily available in \System\Media\MP3
Your WMA files are readily available in \System\Media\WMA
Your My Channels are in \System\Media\Shadow
Your My Songs are in \System\Media\Song (a PAC file and a TAG file for each song)
The Database File For Music is in \System\Media\DB

The database stores information about all music stored on the player. Because of this, you cannot simply copy the song over and it'll work. The My Sirius Studio software edits the Database when uploading mp3/wma files.

Firmware / Tag Updates
Firmware updates are stored on their website and are stored in the drive long enough to update the unit. The beauty is that it can update the firmware in the docks next time you dock the unit. That means things are very flexible and any sort of bugs (like the Acquiring Signal bug that happens when docking the unit while it's on and then starting the vehicle that I had happen) can be ironed out. Undocking and redocking the unit does fix this problem, so they can probably just put in a signal timeout and recycle the link between the dock and the unit automatically to fix the issue.

Firmware and System Update Files are referenced in a XML file, parsed by My Sirius Studio: http://www.sirius.com/s50swupdate .

The Firmware File is: http://download.sirius.speedera.net/...re/S50main.mi4

This means you Mac users can download this file and put it into the ROOT (not the System folder) of the S50.. Once you disconnect it'll tell you that it's rebooting to update the firmware.

The Latest Channel Logos / Voice Tags are at:
http://download.sirius.speedera.net/...are/SYSTEM.zip

You can copy these two folders into your SYSTEM folder if for some reason My Sirius Studio doesn't do this for you. Again, Mac Users should be able to do this as well, since Macs should see this device basically as a USB hard drive formatted with FAT.

Image Storage
The Channel logos are in \System\Images\Clogo
The Demo images are in \System\Images\Demo
The Startup movie is a series of BMPs in \System\Images\Startup
** The Startup SOUND is an MP3 in \System\Spoken\Modes\Startup.mp3
The Icons (Pause, Preset Star, etc.) are in \System\Images\Icon
The Wallpaper Backgrounds are in \System\Images\Wpaper

All Logos appear to be in a weird pallette BMP format with flipped images. It's possible that this is similar to what is used on the iRiver Units, and the hackers for the iRiver units intend to make software to hack images soon. If that's the case, we'll have tools to do so as well.

VoiceTags
The Voicetags are in PAC format \System\Spoken.
\System\Spoken\Menu for the Menu Prompts
\System\Spoken\Modes for the Channel Names
\System\Spoken\Modes\Default in case there is no Channel Name Tag (Generic Phrases such as "Channel 95" "Channel 1", etc.)

---

Needless to say, I'm impressed and will keep looking around some. A very solid unit and it's already getting looks from people that get into my vehicle.

--Droo, @Network

[DAB]

Wow, you are blowing me away... Once again thanks for all your digging around and really checking out the heart of this setup. I am too chicken to do a lot of things that folks like you'll do. LOL

SWEET!!!

[droobie]

^
I have a lot of time on my hands... I do appreciate the fact that the unit assumes the file system can be screwed up though. That means that there isn't a whole lot you can do to brick the thing, except try to flash something that doesn't belong.

It might prevent that as well through checksum. That's one thing I'm not prepared to try since I doubt I have a test clip handy to reflash the chip if I nuke it.

My Sirius Studio goes looking for some stuff when you open it.

The URL that the built in Web media player goes to is http://www.sirius.com/s50mediaplayer.. It passes the USERID and PASSWORD in the URL as well for the auto-login to work.

--Droo, @Network

[ericshmerick]

Ahh, only a matter of time before this thing is hacked to pieces

I, for one, can't wait....

[droobie]

Originally Posted by ericshmerick

Ahh, only a matter of time before this thing is hacked to pieces

I, for one, can't wait....

I'm still trying to find a way to open it to take hires photos of the insides.. I think they used internal clips like the iPod.

I checked the FCC site for FCCID O6ZS50-C1, H1, and TK1, but noone has posted the FCC photos of the internals last time I checked... We may never see them there, but they're not marked as proprietary or anything.

--Droo, @Network

[droobie]

Got the S50 Car dock apart no problem, we'll see what I can get for photos.

--Droo, @Network

[DaJoker]

I've kinda kept quiet around here lately about owning an S50, but with the ReGo a NoShow, the bug bit a while back. Anyway, I've been playing with the BMP format a little just to see what was going on. Indeed it has a flipped ordering, but also more interesting is the fact that it doesn't use a standard bitmap header. Any bitmap format file will display on the S50, but like displaying a S50 standard BMP on the PC, the standard BMP on the S50 looks umm.. "interesting". The closest it seems so far is a 24bit 4-4-4 bitmap, but I can't confirm this yet as again, there is a header issue.

[droobie]

Yeah that's an odd one for sure.. MSPaint will open it, but the previewer built into Windows won't.

The opening movie thing is just 26 BMPs stacked together.. I don't know if it'd just do say, 15 or if it'd do 30, or if it wants 26 specifically.

--Droo, @Network

[droobie]

Not a whole lot in the car dock.. Atmel Mega16L microcontroller, PVX3245 Dual-supply chip, and a STMicro STA210.

The STA210 I can't seem to locate online, so it must be a Sirius part, or just not indexed.

I did take photos, I'll find somewhere to stash them some point.

--Droo, @Network

[DAB]

Originally Posted by droobie

The STA210 I can't seem to locate online, so it must be a Sirius part, or just not indexed.

Post the photos if you want, I'd be interesting in seeing them. I think the STA210 is the SIRIUS Chipset. I know STMicro is who makes the chipsets for SIRIUS.

So that means that each cradle kit has a Sirius Chipset. This is why the Media Player runs so cool.

If you need a place to host the photos, you can upload them to the SBS Photos area and just use the link to post them in the thread.

[droobie]

I apologize for blurry in advance.. I took two sets, one with a flash and one without, in most cases with the flash made things more visible.

http://tinypic.com/i6blmd.jpg
This is the rear side of the S50 rear board. The chip is a STA210 from ST Microelectronics.. Unfortunately the ol camera shake was an issue here.

There is a rubberized heatsink material that goes over the chip and the heatsink mounts onto it.

http://tinypic.com/i6bm0x.jpg

Front of the same board.. not much to see here.

http://tinypic.com/i6bm2p.jpg

Rear board with the huge heatsink mounted.

http://tinypic.com/i6bm7m.jpg

Back side of the front board. you can see the Atmega microcontroller.

http://tinypic.com/i6bmea.jpg

Not the most ideal photo, but this is the front board. The upper chip is a LVX3245 dual supply chip.

I'd say the tuner portion is in the cradle, and then the rest is probably in the S50.. I'm not daring enough to open the S50 just yet.

--Droo, @Network

[efudd]

any updates?

droobie since you seem to be the resident hacker-

you figure a way to force it to re-index?

First I'd like to see if we can manually add content and then get it to re-indeex to recongnize it. From there other things could be interesting...

[droobie]

Originally Posted by efudd

you figure a way to force it to re-index?

First I'd like to see if we can manually add content and then get it to re-indeex to recongnize it. From there other things could be interesting...

I haven't had a lot of time since I had to get teeth yanked out of my head yesterday and I have responsiblities as a SI.

The Iriver H10 has some sort of software to screw with the database. I'm not sure if the database is specific to portalplayer or if Sirius has its own database format. If it is just a universal database format, then it's possible we could inject things in using the H10 indexer.

But, you can always use Windows Media or My Sirius Studio. Mac users are a bit out of luck for now, but someone who is a binary file hacker might want to dive into the DB and see if they can make something happen.

Don't mind me, Playboy Miss November Lindsay Vuolo is on FoxNews Fox and Friends. I'm a bit distracted.. :-)

--Droo, @Network

[efudd]

Originally Posted by droobie

I haven't had a lot of time since I had to get teeth yanked out of my head yesterday and I have responsiblities as a SI.

The Iriver H10 has some sort of software to screw with the database. I'm not sure if the database is specific to portalplayer or if Sirius has its own database format. If it is just a universal database format, then it's possible we could inject things in using the H10 indexer.

But, you can always use Windows Media or My Sirius Studio. Mac users are a bit out of luck for now, but someone who is a binary file hacker might want to dive into the DB and see if they can make something happen.

Don't mind me, Playboy Miss November Lindsay Vuolo is on FoxNews Fox and Friends. I'm a bit distracted.. :-)

--Droo, @Network

hope the teeth feel better.

I'm kind of hoping we can figure out a reindex and see if we can slap an AAC or an MPEG4 file on it if it will recognize it and play it. Apparently support for those is built into the chip so if we can get it to notice the file and allow you to select it, I wonder if it would just play?

[droobie]

Originally Posted by efudd

hope the teeth feel better.

I'm kind of hoping we can figure out a reindex and see if we can slap an AAC or an MPEG4 file on it if it will recognize it and play it. Apparently support for those is built into the chip so if we can get it to notice the file and allow you to select it, I wonder if it would just play?

The teeth issue wasn't a real big one, never felt a thing after the novocaine wore off.. I think I'm going to live hopefully :-)

Try renaming one to mp3 or wma and see what happens.. I don't think it'll work but all depends on if it's using the header to determine the file type or the extension.

--Droo, @Network