Linksys Wireless Media Appliance [updated]
[update]
As Sean Lincolne pointed out, squishguava, the boot image this thing loads over the network when it boots, is just a simple cramfs image. The "COMPRESSED ROMFS" in my earlier 'strings' is a dead give-away on this. I finally got some time to have a peek at it. It has the following in it:
It is obviously not a full Linux filesystem, as can be seen by looking at files in the scripts directory, this filesystem gets mounted on /guava. I compiled a small statically linked busybox and stuck it in bb/ which among other things had bb/sbin/telnetd in it. Then I hacked up scripts/rio-script and had it launch the telnetd right before it launches the rio. Built a new cramfs squishguava image and booted with it. It actually booted just fine. I was worried they might have some sort of checksum check, or my added 600k would overflow something, but it was fine. The bad news is that I couldn't get in via telnet. So, either, my telnetd didn't start properly, or the port is blocked.
I did notice that the default shell is /bin/ash which also happens to be the default shell in BusyBox and Linksys has used Busybox on other devices in the past. I bet the rom firmware which has the root filesystem for this thing is just a busybox image. So a bit more hacking on that rio-script should let me either somehow get a message out to me by trying various standard busybox commands, or I can run some stuff to try to deblock the port. Any suggestions on what is likely to work right away?
More info. I replaced the rio binary with my arm cross-compiled telnetd binary and it then doesn't get beyond the "Launching remote-IO" message during boot. At least it tells me that what I am doing has some effect. But I still can't get in via telnet. I also tried replacing it with a script that tried to ping out, cat stuff to /dev/dsp and echo stuff to various devices and none of that did anything I could see/hear.
[/update]
This looks like a nifty little box that will make it easy to access mp3's and photos directly from a remote-control TV-displayed interface. Much nicer than needing to stick a PC next to the TV/Stereo in the living room.
This little device showed up today. Had no trouble configuring it and hooking it up once I shuffled the various cables around a bit on the back of the TV and stereo. The music navigator is really nice on it and I like that you can play mp3's while a photo album is cycling through. Will have to try this thing against some Samba shares later on.
No luck on the Samba shares, or any sort of shares at all actually. I did a bit of sniffing of the datastream between the WMA and XP. When it starts up the first thing it does after getting an IP via DHCP is to grab its OS image from the XP box. That image is clearly a Linux 2.4.17 kernel and all communications appear to be via a UPnP A/V Media Renderer SOAP thing. As far as I can tell, when you designate a directory via the Media tool on the XP box, it creates a regular .m3u playlist out of that and serves it up to the WMA when requested. There doesn't appear to be any encryption involved, so getting this thing to work with a Linux box as the server would involve creating a UPnP SOAP server that understood the requests from the WMA. Not that this is a trivial effort, but certainly not impossible and once done this thing would be able to serve files up from anywhere a Linux box could access files from. Frankly I don't see why the heck the SOAP server they provide for XP can't serve up its playlists from a network share. There doesn't appear to be any technical reason for this restriction. I bet that with a bit of hacking and with the help of libupnp this is quite feasible.
Or, alternatively, create a custom image from the sources Linksys is supposed to provide. They have their GPL Page but it doesn't list the WMA11B (yet?). As George notes, SOAP isn't exactly ideal for something as simple as moving mp3s and image files around. An alternate image that was able to mount shares directly, would be cool. It might require sticking a .m3u playlist file in each directory so you wouldn't need to do that on the WMA, but that wouldn't bug me either.
For more info on the technology in this device, have a read through Intel's Digital Home Site or see the extended entry for some nitty-gritty protocol details.
| libc-2.1.3.so* | libm-2.1.3.so* | librms.so* | rio* |
| libdl-2.1.3.so* | libmp3msp.so* | libthreadutil.so* | scripts/ |
| libhttpmsp.so* | libmrdi.so* | libwmamsp.so* | version.txt |
| libiupnp.so* | liboalmsp.so* | mrd* | web/ |
| libixml.so* | libpil.so* | mrdDevice* | |
| libllmsp.so* | libpthread-0.8.so* | pilreg.dat* |
I did notice that the default shell is /bin/ash which also happens to be the default shell in BusyBox and Linksys has used Busybox on other devices in the past. I bet the rom firmware which has the root filesystem for this thing is just a busybox image. So a bit more hacking on that rio-script should let me either somehow get a message out to me by trying various standard busybox commands, or I can run some stuff to try to deblock the port. Any suggestions on what is likely to work right away?
More info. I replaced the rio binary with my arm cross-compiled telnetd binary and it then doesn't get beyond the "Launching remote-IO" message during boot. At least it tells me that what I am doing has some effect. But I still can't get in via telnet. I also tried replacing it with a script that tried to ping out, cat stuff to /dev/dsp and echo stuff to various devices and none of that did anything I could see/hear.
[/update]
This looks like a nifty little box that will make it easy to access mp3's and photos directly from a remote-control TV-displayed interface. Much nicer than needing to stick a PC next to the TV/Stereo in the living room. This little device showed up today. Had no trouble configuring it and hooking it up once I shuffled the various cables around a bit on the back of the TV and stereo. The music navigator is really nice on it and I like that you can play mp3's while a photo album is cycling through. Will have to try this thing against some Samba shares later on. No luck on the Samba shares, or any sort of shares at all actually. I did a bit of sniffing of the datastream between the WMA and XP. When it starts up the first thing it does after getting an IP via DHCP is to grab its OS image from the XP box. That image is clearly a Linux 2.4.17 kernel and all communications appear to be via a UPnP A/V Media Renderer SOAP thing. As far as I can tell, when you designate a directory via the Media tool on the XP box, it creates a regular .m3u playlist out of that and serves it up to the WMA when requested. There doesn't appear to be any encryption involved, so getting this thing to work with a Linux box as the server would involve creating a UPnP SOAP server that understood the requests from the WMA. Not that this is a trivial effort, but certainly not impossible and once done this thing would be able to serve files up from anywhere a Linux box could access files from. Frankly I don't see why the heck the SOAP server they provide for XP can't serve up its playlists from a network share. There doesn't appear to be any technical reason for this restriction. I bet that with a bit of hacking and with the help of libupnp this is quite feasible.
Or, alternatively, create a custom image from the sources Linksys is supposed to provide. They have their GPL Page but it doesn't list the WMA11B (yet?). As George notes, SOAP isn't exactly ideal for something as simple as moving mp3s and image files around. An alternate image that was able to mount shares directly, would be cool. It might require sticking a .m3u playlist file in each directory so you wouldn't need to do that on the WMA, but that wouldn't bug me either.
For more info on the technology in this device, have a read through Intel's Digital Home Site or see the extended entry for some nitty-gritty protocol details.
Don't ask me why the boot image is called squishguava, but it is. Can't gleam too much out of it other than the fact that it is very likely to be a Linux image.
% strings squishguava Compressed ROMFS 6i8V Compressed version.txt libhttpmsp.so libiupnp.so libixml.so libllmsp.so libmp3msp.so libmrdi.so liboalmsp.so libpil.so librms.so libthreadutil.so libwmamsp.so mrdDevice pilreg.dat libc-2.1.3.so libdl-2.1.3.so libm-2.1.3.so libpthread-0.8.so scripts channelmgrscpd.xml remoteinputscpd.xml riodevicedesc.xml rioscpd.xml ConnectionManager.xml MediaRendererDevDesc.xml RendererControl.xml TCxml.xml Transport.xml rio-script mrd-script
NOTIFY /AdapterInfoService/event HTTP/1.1 HOST: 172.16.10.100:8037 Content-Type: text/xml NT: upnp:event NTS: upnp:propchange SID: uuid:1 SEQ: 0 Content-Length: 324 <?xml version="1.0" encoding="utf-8"?><e:propertyset xmlns:e="urn:schemas-upnp-org:event-1-0"><e:property><BootImageVersion><firmware> <version>Ver. 11 R06</version> <time>09:50:28 AM</time> <date>08/01/03</date> </firmware> </BootImageVersion></e:property></e:propertyset>
NOTIFY /ApplicationTransferService/event HTTP/1.1 HOST: 172.16.10.100:8037 Content-Type: text/xml NT: upnp:event NTS: upnp:propchange SID: uuid:2 SEQ: 0 Content-Length: 177 <?xml version="1.0" encoding="utf-8"?><e:propertyset xmlns:e="urn:schemas-upnp-org:event-1-0"><e:property> <TransferState>NOT_STARTED</TransferState> </e:property></e:propertyset>
POST /AdapterInfoService/control HTTP/1.1
HOST: 172.16.10.105:62063
SOAPACTION: "urn:schemas-upnp-org:service:AdapterInfoService:1#GetExtDeviceDescription"
CONTENT-TYPE: text/xml ; charset="utf-8"
Content-Length: 303
<?xml version="1.0" encoding="utf-8"?>
<s:Envelope s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/" xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"^gt;
<s:Body>
<u: xmlns:u="urn:schemas-upnp-org:service:AdapterInfoService:1" />
</s:Body>
</s:Envelope>POST /ApplicationTransferService/control HTTP/1.1
HOST: 172.16.10.105:62063
SOAPACTION: "urn:schemas-upnp-org:service:ApplicationTransferService:1#SetApplicationPackageURI"
CONTENT-TYPE: text/xml ; charset="utf-8"
Content-Length: 473
<?xml version="1.0" encoding="utf-8"?>
<s:Envelope s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/" xmlns:s="http://schemas.xmlsoap.org/soap/envelope/">
<s:Body>
<u:SetApplicationPackageURI xmlns:u="urn:schemas-upnp-org:service:ApplicationTransferService:1">
<ApplicationURI>uri://172.16.10.100:49156/squishguava</ApplicationURI>
<ImageLength>2260992</ImageLength>
</u:SetApplicationPackageURI>
</s:Body>
</s:Envelope>SERVER: Linux/2.4.17-rmk3-cot1, UPnP/1.0, Intel SDK for UPnP devices /1.2 <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <s:Body> <s:Fault> <faultcode>s:Client</faultcode> <faultstring>UPnPError</faultstring> <detail> <UPnPError xmlns="urn:schemas-upnp-org:control-1-0"> <errorCode>-1</errorCode> <errorDescription>Invalid Action</errorDescription> </UPnPError> </detail> </s:Fault> </s:Body> </s:Envelope>
<root xmlns="urn:schemas-upnp-org:device-1-0"> <specVersion> <major>1</major> <minor>0</minor> </specVersion> <URLBase>http://172.16.10.105:49152/</URLBase> <device> <deviceType>urn:schemas-upnp-org:device:RemoteIO:1</deviceType> <friendlyName>Linksys Wireless-B Media Adapter</friendlyName> <manufacturer>Linksys Corporation</manufacturer> <manufacturerURL>http://www.linksys.com</manufacturerURL> <modelDescription>UPnP Remote I/O Device 2.0</modelDescription> <modelName>UPnP Remote I/O Device</modelName> <modelNumber>1.0</modelNumber> <modelURL>http://www.linksys.com</modelURL> <serialNumber>1234567890012</serialNumber> <UDN>uuid:0006250DBAA7RemoteIO</UDN> <UPC>1234567891</UPC> <serviceList> <service> <serviceType>urn:schemas-upnp-org:service:RemoteIO:1</serviceType> <serviceId>urn:upnp-org:serviceId:RemoteIO1</serviceId> <controlURL>/upnp/control/RemoteIO1</controlURL> <eventSubURL>/upnp/event/RemoteIO1</eventSubURL> <SCPDURL>/rioscpd.xml</SCPDURL> </service> <service> <serviceType>urn:schemas-upnp-org:service:RemoteInput:1</serviceType> <serviceId>urn:upnp-org:serviceId:RemoteInput1</serviceId> <controlURL>/upnp/control/RemoteInput1</controlURL> <eventSubURL>/upnp/event/RemoteInput1</eventSubURL> <SCPDURL>/remoteinputscpd.xml</SCPDURL> </service> </serviceList> <presentationURL></presentationURL> </device> </root>
<PeerConnection>xrt2://172.16.10.100:52135/jdfkdjfkjdkfjdkjfkdjfkdjfkjdfkjdkfjdkfjiwi18 </PeerConnection>
<Sink>http-get:*:audio/mpeg:*,http-get:*:audio/x-mpeg:*, http-get:*:audio/mp3:*,http-get:*:audio/x-ms-wma:*, http-get:*:audio/mpegurl:*,http-get:*:audio/x-mpegurl:*, http-get:*:audio/m3u:*</Sink>
<Event xmlns="urn:schemas-upnp-org:metadata-1-0/AVT/"> <InstanceID val="1"> <TransportState val="NO_MEDIA_PRESENT"></TransportState> <TransportStatus val="OK"></TransportStatus> <TransportPlaySpeed val="1"></TransportPlaySpeed> <CurrentPlayMode val="NORMAL"></CurrentPlayMode> <CurrentRecordQualityMode val="NOT_IMPLEMENTED"></CurrentRecordQualityMode> <PossiblePlaybackStorageMedia val="NETWORK"></PossiblePlaybackStorageMedia> <PossibleRecordStorageMedia val="NOT_IMPLEMENTED"></PossibleRecordStorageMedia> <PossibleRecordQualityModes val="NOT_IMPLEMENTED"></PossibleRecordQualityModes> <NumberOfTracks val="0"></NumberOfTracks> <CurrentMediaDuration val="0:00:00"></CurrentMediaDuration> <AVTransportURI></AVTransportURI> <AVTransportURIMetaData></AVTransportURIMetaData> <NextAVTransportURI></NextAVTransportURI> <NextAVTransportURIMetaData></NextAVTransportURIMetaData> <PlaybackStorageMedium val="NETWORK"></PlaybackStorageMedium> <RecordStorageMedium val="NOT_IMPLEMENTED"></RecordStorageMedium> <RecordMediumWri teStatus val="NOT_IMPLEMENTED"></RecordMediumWriteStatus> <CurrentTrack val="0"></CurrentTrack> <CurrentTrackDuration val="0:00:00"></CurrentTrackDuration> <CurrentTrackMetaData val="NOT_IMPLEMENTED"></CurrentTrackMetaData> <CurrentTrackURI></CurrentTrackURI> <CurrentTransportActions val="Play,Stop,Pause,Seek,Next,Previous"></CurrentTransportActions> </InstanceID> </Event>
HTTP/1.1 206 Partial Content CONTENT-RANGE: bytes 0-2559/245115 CONTENT-TYPE: audio/mpegurl Content-Length: 2560 #EXTM3U #EXTINF:154,Stone Temple Pilots - "Unglued" http://172.16.10.100:54455/-1562803410/Stone%20Temple%20Pilots%20%20-%20%20%22Unglued%22.mp3 #EXTINF:171,Enya - (1)The Celtz.MP3 Track 1 of 15 http://172.16.10.100:54455/1695573734/Enya%20%20-%20%20%281%29The%20Celtz.MP3%20Track%201%20of%2015.mp3
GET /1695573734/Enya%20%20-%20%20%281%29The%20Celtz.MP3%20Track%201%20of%2015.mp3 HTTP/1.0 Host: 172.16.10.100 1
HTTP/1.0 200 OK Content-Type: audio/mpeg Server: Intel CEL / CLR MiniWebServer [mp3 data]
Trackbacks
Turtle Head Studio on : Telnet enabled SquishGuava
Continue reading "Telnet enabled SquishGuava"
Telnet enabled SquishGuava
Turtle Head Studio on : Telnet enabled SquishGuava
Continue reading "Telnet enabled SquishGuava"
I\'ve posted my telnet enabled SquishGuava imaged to my site http://www.turtlehead.co.uk. Enjoy.
Comments
Display comments as Linear | Threaded
Harrison on :
Any confirmation on it working this way?
George Schlossnagle on :
Hey... my sarcasm tags don't render under serednipity, must be a bug.
Sean Lincolne on :
modprobe cramfs ; mkdir /tmp/wma11b ; mount -t cramfs /tmp/squishquava /tmp/wma11b -o ro,loop
Note that these commands are rewrapped by the 'add comment' page - you will need to enter them all on the same line.
Once you have done this you can 'cd' to /tmp/wam11b and poke around at will.
I agree gerarding the GPL issue - I'll be emailing Linksys tonight.
Sterling Hughes on :
which handles mpeg-1/2/4 and AVI, JPEG/GIF/PNG, and MP3/WMA/WAV, and is 802.11G to boot.
Doesn't support Linux client side, but the system OS is Linux...
Mike Down on :
http://www.intel.com/technology/UPnP/download.htm
Also I am starting a website just for hacking these devices www.upnphack.com it should be up in the next few days.
Harry on :
Steve on :
SOAP/UPnP is only used for initiating the connection. The transport is protocol specific (VNC/RTSP, ...)
Andre M Carvalho on :
The XWPCHostService for the media adapter crashes when it tries to run. I have a Windows XP Home Op. System that came with a Dell PC I purchased a couple of months ago.
The error message for the crash seems to be related to .NET : "XWPCHostService - Common Language Runtime Debugging Services - Application generated exception that could not be handled" etc, etc.
I've tried everything, from re-installing the .NET framework (version 1 and 1.1 as well as trying each one separately, running SVC.exe), re-starting the service manually, re-installing Windows XP, and nothing seems to work.
Do you have any idea about what might be happening?
Sam Batschelet on :
Hugo on :
Howto: place it flat with the barcoded silver part upwards, and with the connectors on the left, everything unplugged. Warning - static can kill stuff, do this at your own risk, will probably void your warranty, etc.
Push gently in on the black vents on the far side (ie, the short side nearest the antenna) - whilst gently pulling the lid up. It will start to pop off - work around the case and it'll come off cleanly.
You'll see a PCMCIA network card and other things.
Near the bottom right is an empty chip space, labelled U2. This is for a MAX241 SSOP package serial buffer. If you fit this, J6 on the bottom right next to the power button is a RS232 console port. JP1 is a JTAG connector, should you want one.
It boots the whole way to busybox, with the rest of the system running in the background. Fun, eh?
Ryan on :
Secondly, how about flashing the box and putting on something comparable to the Xbox Media Center or OpenMC (both available at sourceforge.net)?
Mike on :
- Put your program files in the cramfs image 'squishguava'.
- Replace /guava/rio with a script to kick-off your process. The scripts in the scripts folder are not called at bootup. That's why nothing works when those are modified.
- Change the image size in the server file "\Linksys Wireless-B Media Adapter\bin\ProgDirData.xml" If the size is not correct, the system will not boot.
- Restart the "Digital Media Adapter Application Loader Service" service whenever you update the ProgDirData.xml file.
Cool find on the serial console Hugo!
I've been using netcat, spawning ash, to get a pseudo console over the network.
I'd like to know if anyone figures out how to use the IR remote driver.
Laurent on :
http://softwareforums.intel.com/ids/board?board.id=70
They seem quite responsive and willing to help.
I just posted a question there but I'd also ask here if someone has an answer:
I'd love to broadcast what my Linksys WMA11B is playing on other PCs.
This requires some kind of synchronization between the WMA renderer and
(for example) the AV Media Renderer.
Is it possible?
I'm obviously able to start 2 or more renderers (including the WMA) but I've not figured out how to broadcast ONE unique content to all of them.
Any idea?
I'll post any positive answer I get from the forum.
Laurent
Betwap on :
Jim on :
Anyone know how to reflash it so I can boot it via tftp and not the silly upnp garbage it's running?
Jim on :
I've now got my tool chain running smoothly cross compiling for the wma. And I've managed to port a decent mp3 player to it. You'll be surprised at how bad the intel mp3 player on the wma really is quality and stability wise once you start running another one on there. The quality from the output is pretty good.
I've also done some simple stuff with the screen / framebuffer.
My next task is to write a server app so I can send the mp3s from my server much easier than upnp. Shoutcast streams should be no issue either, so I'm looking forward to web radio enabling it.. ;-p
In essence the wma is really an intel pxa255 development board.
Jim on :
Fras on :
Jim on :
Android on :
desau on :
Thanks,
d
bpearse on :
ANyone else run into this issue?
Mark on :
dude on :
bill on :
laurac on :
Pluto is a new, open source smart home solution that seamlessly integrates: 1) media with a server for music, movies and tv shows, plus a PVR and DVD Player, 2) a home automation system with touch-screen tablet and Bluetooth mobile phone controllers, 3) a phone system with video conferencing, 4) a security system that feeds you live video on your mobile phone when there are interruptions, and lets you speak to visitors through your stereos, and 5) a home PC solution. Check it out at www.plutohome.com.
We also posted a page at www.plutohome.com/dce.php explaining how we can help promote the established standards, like UPNP, while we focus on delivering a consumer-friendly experience. If you’re working on UPNP devices and would like a freely distributable whole house solution to showcase your device, we have forums, or you can send an email to aaron.b [at] plutohome.com.
rich holman on :
robbie gibbon on :
j. buck on :
-use pcmcia to cf converter + cf card to increase storage space (lose wireless, gain 32,64,128+ mb flash mem.)
-use pcmcia to usb converter (could use usb flash + usb wi-fi?)
not sure if either would fly w/linux, you make the call!
gus kramer on :
jan on :
Andrew Wild has composed a list of the hardware with photos and references at http://www-jcsu.jesus.cam.ac.uk/~acw43/projects/wma11b/hardware.html
All the parameters of the FS450 are programmable, so e.g. access to the 2D flicker filter for improved text output is also possible.
gus kramer on :
I was hoping there was a simple way to do it, something along the lines of an undocumented menu. As I see it then, there are two ways I could do this. The first would be to reprogram the firmware using a North American ROM image, assuming I can find one; the second would be to modify the image the WMA 11 downloads from the host computer to include instructions to change the approprite register in the FS450.
Unfortunately time is short these days so I may have to shelve this for (quite) a while.
Mike on :
Josh on :
I managed to cross-compile a command-line slave for the slimserver software, which along with madplay, now allows me to stream mp3s to the unit from the slim web-gui. I have relied heavily on this thread, as well as wmaloader and wmamp to point me in the right direction -- thanks again.
Roland on :
Also, I am curious to know if anyone has ever successfully re-flashed the drive on this unit? I have found some documentation, but it seems like every time someone has tried, it killed the unit. Also, it seems like it would require some sort of soldering/cable and could not be done over the network. Is true?