Skip to content

Linksys Wireless Media Appliance [updated]

[update] As Sean Lincolne pointed out, squishguava, the boot image this thing loads over the network when it boots, is just a simple cramfs image. The "COMPRESSED ROMFS" in my earlier 'strings' is a dead give-away on this. I finally got some time to have a peek at it. It has the following in it:***rio****scripts/***version.txt**mrd*web/**mrdDevice***pilreg.dat*
It is obviously not a full Linux filesystem, as can be seen by looking at files in the scripts directory, this filesystem gets mounted on /guava. I compiled a small statically linked busybox and stuck it in bb/ which among other things had bb/sbin/telnetd in it. Then I hacked up scripts/rio-script and had it launch the telnetd right before it launches the rio. Built a new cramfs squishguava image and booted with it. It actually booted just fine. I was worried they might have some sort of checksum check, or my added 600k would overflow something, but it was fine. The bad news is that I couldn't get in via telnet. So, either, my telnetd didn't start properly, or the port is blocked.

I did notice that the default shell is /bin/ash which also happens to be the default shell in BusyBox and Linksys has used Busybox on other devices in the past. I bet the rom firmware which has the root filesystem for this thing is just a busybox image. So a bit more hacking on that rio-script should let me either somehow get a message out to me by trying various standard busybox commands, or I can run some stuff to try to deblock the port. Any suggestions on what is likely to work right away?

More info. I replaced the rio binary with my arm cross-compiled telnetd binary and it then doesn't get beyond the "Launching remote-IO" message during boot. At least it tells me that what I am doing has some effect. But I still can't get in via telnet. I also tried replacing it with a script that tried to ping out, cat stuff to /dev/dsp and echo stuff to various devices and none of that did anything I could see/hear.

This looks like a nifty little box that will make it easy to access mp3's and photos directly from a remote-control TV-displayed interface. Much nicer than needing to stick a PC next to the TV/Stereo in the living room.

This little device showed up today. Had no trouble configuring it and hooking it up once I shuffled the various cables around a bit on the back of the TV and stereo. The music navigator is really nice on it and I like that you can play mp3's while a photo album is cycling through. Will have to try this thing against some Samba shares later on.

No luck on the Samba shares, or any sort of shares at all actually. I did a bit of sniffing of the datastream between the WMA and XP. When it starts up the first thing it does after getting an IP via DHCP is to grab its OS image from the XP box. That image is clearly a Linux 2.4.17 kernel and all communications appear to be via a UPnP A/V Media Renderer SOAP thing. As far as I can tell, when you designate a directory via the Media tool on the XP box, it creates a regular .m3u playlist out of that and serves it up to the WMA when requested. There doesn't appear to be any encryption involved, so getting this thing to work with a Linux box as the server would involve creating a UPnP SOAP server that understood the requests from the WMA. Not that this is a trivial effort, but certainly not impossible and once done this thing would be able to serve files up from anywhere a Linux box could access files from. Frankly I don't see why the heck the SOAP server they provide for XP can't serve up its playlists from a network share. There doesn't appear to be any technical reason for this restriction. I bet that with a bit of hacking and with the help of libupnp this is quite feasible.

Or, alternatively, create a custom image from the sources Linksys is supposed to provide. They have their GPL Page but it doesn't list the WMA11B (yet?). As George notes, SOAP isn't exactly ideal for something as simple as moving mp3s and image files around. An alternate image that was able to mount shares directly, would be cool. It might require sticking a .m3u playlist file in each directory so you wouldn't need to do that on the WMA, but that wouldn't bug me either.

For more info on the technology in this device, have a read through Intel's Digital Home Site or see the extended entry for some nitty-gritty protocol details.

Don't ask me why the boot image is called squishguava, but it is. Can't gleam too much out of it other than the fact that it is very likely to be a Linux image.
% strings squishguava
Compressed ROMFS
The data stream when you fire this thing up is much more telling. Near the start we see a, "Hey I am Awake" message. is the WinXP box and is the WMA.
NOTIFY /AdapterInfoService/event HTTP/1.1
Content-Type: text/xml
NT: upnp:event
NTS: upnp:propchange
SID: uuid:1
SEQ: 0
Content-Length: 324
<?xml version="1.0" encoding="utf-8"?><e:propertyset xmlns:e="urn:schemas-upnp-org:event-1-0"><e:property><BootImageVersion>&lt;firmware&gt;
 &lt;version&gt;Ver. 11 R06&lt;/version&gt;
 &lt;time&gt;09:50:28 AM&lt;/time&gt;
It also sends a NOT_STARTED message:
NOTIFY /ApplicationTransferService/event HTTP/1.1
Content-Type: text/xml
NT: upnp:event
NTS: upnp:propchange
SID: uuid:2
SEQ: 0
Content-Length: 177
<?xml version="1.0" encoding="utf-8"?><e:propertyset xmlns:e="urn:schemas-upnp-org:event-1-0"><e:property>
And the response back from the WinXP box is:
POST /AdapterInfoService/control HTTP/1.1
SOAPACTION: "urn:schemas-upnp-org:service:AdapterInfoService:1#GetExtDeviceDescription"
CONTENT-TYPE: text/xml ; charset="utf-8"
Content-Length: 303
<?xml version="1.0" encoding="utf-8"?>
<s:Envelope s:encodingStyle="" xmlns:s=""^gt;
      <u: xmlns:u="urn:schemas-upnp-org:service:AdapterInfoService:1" />
These go back and forth a few times with the same questions and answers just to get synched up, I guess. Then after a bunch of other exchanges where the WinXP box is asking the WMA what sort of box it is, it finally tells the WMA where to go and fetch its brain:
POST /ApplicationTransferService/control HTTP/1.1
SOAPACTION: "urn:schemas-upnp-org:service:ApplicationTransferService:1#SetApplicationPackageURI"
CONTENT-TYPE: text/xml ; charset="utf-8"
Content-Length: 473
<?xml version="1.0" encoding="utf-8"?>
<s:Envelope s:encodingStyle="" xmlns:s="">
      <u:SetApplicationPackageURI xmlns:u="urn:schemas-upnp-org:service:ApplicationTransferService:1">
SquishGuava!! The WMA sends back a SERVER_WAIT while it adjusts to its new brain, and then a STARTED followed by a COMPLETED when it is ready. I also see some errors popping up in the stream:
SERVER: Linux/2.4.17-rmk3-cot1, UPnP/1.0, Intel SDK for UPnP devices /1.2
<UPnPError xmlns="urn:schemas-upnp-org:control-1-0">
<errorDescription>Invalid Action</errorDescription>
Nice to see that they aren't filling up my wireless bandwidth with any useless traffic! But eventually the WMA tells the server all about itself:
<root xmlns="urn:schemas-upnp-org:device-1-0">
<friendlyName>Linksys Wireless-B Media Adapter</friendlyName>
<manufacturer>Linksys Corporation</manufacturer>
<modelDescription>UPnP Remote I/O Device 2.0</modelDescription>
<modelName>UPnP Remote I/O Device</modelName>
I haven't touched the serial number in that, by the way. Looks like they aren't using it. Again, nice to see them going out of their way to save bandwidth. After this comes a bunch more crap describing the services. Stuff like this sort of makes me wonder:
And a clue as to what file types the WMA can handle:
And some more interesting bits:
<Event xmlns="urn:schemas-upnp-org:metadata-1-0/AVT/">
<InstanceID val="1">
<TransportState val="NO_MEDIA_PRESENT"></TransportState>
<TransportStatus val="OK"></TransportStatus>
<TransportPlaySpeed val="1"></TransportPlaySpeed>
<CurrentPlayMode val="NORMAL"></CurrentPlayMode>
<CurrentRecordQualityMode val="NOT_IMPLEMENTED"></CurrentRecordQualityMode>
<PossiblePlaybackStorageMedia val="NETWORK"></PossiblePlaybackStorageMedia>
<PossibleRecordStorageMedia val="NOT_IMPLEMENTED"></PossibleRecordStorageMedia>
<PossibleRecordQualityModes val="NOT_IMPLEMENTED"></PossibleRecordQualityModes>
<NumberOfTracks val="0"></NumberOfTracks>
<CurrentMediaDuration val="0:00:00"></CurrentMediaDuration>
<PlaybackStorageMedium val="NETWORK"></PlaybackStorageMedium>
<RecordStorageMedium val="NOT_IMPLEMENTED"></RecordStorageMedium>
teStatus val="NOT_IMPLEMENTED"></RecordMediumWriteStatus>
<CurrentTrack val="0"></CurrentTrack>
<CurrentTrackDuration val="0:00:00"></CurrentTrackDuration>
<CurrentTrackMetaData val="NOT_IMPLEMENTED"></CurrentTrackMetaData>
<CurrentTransportActions val="Play,Stop,Pause,Seek,Next,Previous"></CurrentTransportActions>
Fast-forwarding through oodles of more SOAP stuff and we finally get to the server sending a playlist:
HTTP/1.1 206 Partial Content
CONTENT-RANGE: bytes 0-2559/245115
CONTENT-TYPE: audio/mpegurl
Content-Length: 2560
#EXTINF:154,Stone Temple Pilots - "Unglued"
#EXTINF:171,Enya - (1)The Celtz.MP3 Track 1 of 15
This is in standard M3U format. And finally to actually play a song, the WMA issues this request:
GET /1695573734/Enya%20%20-%20%20%281%29The%20Celtz.MP3%20Track%201%20of%2015.mp3 HTTP/1.0
and gets back:
HTTP/1.0 200 OK
Content-Type: audio/mpeg
Server: Intel CEL / CLR MiniWebServer
[mp3 data]
So, that's the WMA. When I get back from Comdex/Apachecon I'll try messing with libupnp. For now this toy works pretty well and Carl likes it:


Turtle Head Studio on : Telnet enabled SquishGuava

Show preview
I\'ve posted my telnet enabled SquishGuava imaged to my site Enjoy.


Display comments as Linear | Threaded

Harrison on :

Does it work with network shares? I was reading the amazon review of it and according to people there it won't play over network shares. They said that you need to download all of the mp3s and images to the local harddrive on the machine in order to play them. For those of us with larger collections that is kinda inpratical.

Any confirmation on it working this way?

George Schlossnagle on :

Haven't you heard? SOAP is the bomb. Why would you ever use a different protocol, especially for something so custom as sharing files over a network.

Hey... my sarcasm tags don't render under serednipity, must be a bug.

Sean Lincolne on :

The boot image is a 'cramfs' formatted filesystem. To get access to it, copy the 'squishguava' file to '/tmp' and do the following:

modprobe cramfs ; mkdir /tmp/wma11b ; mount -t cramfs /tmp/squishquava /tmp/wma11b -o ro,loop

Note that these commands are rewrapped by the 'add comment' page - you will need to enter them all on the same line.

Once you have done this you can 'cd' to /tmp/wam11b and poke around at will.

I agree gerarding the GPL issue - I'll be emailing Linksys tonight.

Sterling Hughes on :

You might also be interested in
which handles mpeg-1/2/4 and AVI, JPEG/GIF/PNG, and MP3/WMA/WAV, and is 802.11G to boot.

Doesn't support Linux client side, but the system OS is Linux...

Mike Down on :

I did some poking around on intel's website.. and since the chipset linksys is using came from intel. i decided to download the UPnP Tools intel provides for FREE! needless to say it comes with all sorts of goodies.. even an application that will let you control the mp3 aspect of the wma and show you what track ect.. the url is here...

Also I am starting a website just for hacking these devices it should be up in the next few days.

Harry on :

Would it be possible to run the Ilinksys from a PC with a browser rather than the on screen thing on the TV?

Steve on :

@ #2:
SOAP/UPnP is only used for initiating the connection. The transport is protocol specific (VNC/RTSP, ...)

Andre M Carvalho on :

I purchased the linksys media adapter this weekend and still have not been able to use it.

The XWPCHostService for the media adapter crashes when it tries to run. I have a Windows XP Home Op. System that came with a Dell PC I purchased a couple of months ago.

The error message for the crash seems to be related to .NET : "XWPCHostService - Common Language Runtime Debugging Services - Application generated exception that could not be handled" etc, etc.

I've tried everything, from re-installing the .NET framework (version 1 and 1.1 as well as trying each one separately, running SVC.exe), re-starting the service manually, re-installing Windows XP, and nothing seems to work.

Do you have any idea about what might be happening?

Sam Batschelet on :

I am trying to figure out if it is possible to add mpg usability to the embeded os. Has anyone had any luck loggin into the system or possiblities for flashing a newly compiled os. This is a really interesting thread!

Hugo on :

Just got one of these. If you're looking for a console, the thing just pops apart (no screws).

Howto: place it flat with the barcoded silver part upwards, and with the connectors on the left, everything unplugged. Warning - static can kill stuff, do this at your own risk, will probably void your warranty, etc.

Push gently in on the black vents on the far side (ie, the short side nearest the antenna) - whilst gently pulling the lid up. It will start to pop off - work around the case and it'll come off cleanly.

You'll see a PCMCIA network card and other things.

Near the bottom right is an empty chip space, labelled U2. This is for a MAX241 SSOP package serial buffer. If you fit this, J6 on the bottom right next to the power button is a RS232 console port. JP1 is a JTAG connector, should you want one.

It boots the whole way to busybox, with the rest of the system running in the background. Fun, eh?

Ryan on :

I'm still trying to get my samba shares to connect to this thing with no luck. Has anyone found any tools that will 'map' a smaba share to a winXP drive that may be able to fake the SOAP server into thinking the files are local?

Secondly, how about flashing the box and putting on something comparable to the Xbox Media Center or OpenMC (both available at

Mike on :

I managed to run my own code on the wma11b. Here's how:

- Put your program files in the cramfs image 'squishguava'.

- Replace /guava/rio with a script to kick-off your process. The scripts in the scripts folder are not called at bootup. That's why nothing works when those are modified.

- Change the image size in the server file "\Linksys Wireless-B Media Adapter\bin\ProgDirData.xml" If the size is not correct, the system will not boot.

- Restart the "Digital Media Adapter Application Loader Service" service whenever you update the ProgDirData.xml file.

Cool find on the serial console Hugo!

I've been using netcat, spawning ash, to get a pseudo console over the network.

I'd like to know if anyone figures out how to use the IR remote driver.

Laurent on :

There is an Intel UPnP forum here:

They seem quite responsive and willing to help.

I just posted a question there but I'd also ask here if someone has an answer:

I'd love to broadcast what my Linksys WMA11B is playing on other PCs.

This requires some kind of synchronization between the WMA renderer and
(for example) the AV Media Renderer.

Is it possible?
I'm obviously able to start 2 or more renderers (including the WMA) but I've not figured out how to broadcast ONE unique content to all of them.

Any idea?

I'll post any positive answer I get from the forum.


Betwap on :

No problem with Samba shares here. I mapped my samba drive to Z:/ on my XP laptop. Then added Z:/ to the folder list. Opened right up on the TV GUI and played. If someone who has Samba NOT working wants to e-mail me I'll be happy to go though our smb.conf files and figure out what it is that this thing doesn't like. My Samba server is a Sun Ultra5, but I doubt that is the critical difference.

Jim on :

Well, at last I can say I've got my own code running on this thing. Just written a silly little webserver for it and I've got the shell running remotely.

Anyone know how to reflash it so I can boot it via tftp and not the silly upnp garbage it's running?

Jim on :

I thought I'd update you all on my progress hacking this thing apart.

I've now got my tool chain running smoothly cross compiling for the wma. And I've managed to port a decent mp3 player to it. You'll be surprised at how bad the intel mp3 player on the wma really is quality and stability wise once you start running another one on there. The quality from the output is pretty good.

I've also done some simple stuff with the screen / framebuffer.

My next task is to write a server app so I can send the mp3s from my server much easier than upnp. Shoutcast streams should be no issue either, so I'm looking forward to web radio enabling it.. ;-p

In essence the wma is really an intel pxa255 development board.

Jim on :

I've setup a little webpage detailing what I've manged so far with this device. I've also added a new bootimage to enable telnet. You can download it from Have fun with it and keep checking my page for a new player soon.

Fras on :

I'm afraid I can't access the new webpage. Firefox gives "Connection was refused" message.

Jim on :

It should be working, try again..

Android on :

Looking forward to your findings. I have just purchased 11b and would like to have it streaming internet radio

desau on :

I'd like to get you smb.conf file if possible -- I've tried with no luck to get a samba share mounted with the WinXP server app.


bpearse on :

I loaded the Telnet enabled squishguava, and sure enough was able to telnet into my box! Very cool. However, the system will no longer play music. Does photos fine, and the music shows up, but just will not play (shows 'stopped' and no music info when you select a song to play)

ANyone else run into this issue?

Mark on :

Mine had the same problem. It turned out to be some sort of conflict with ZoneAlarm, if I close down ZA it works fine.

dude on :

Can this device be made to do video? Like a conduit or such? Is it powerful enough or has anyone tried yet? I would suppose a tv/video driver would be needed for the tv chip.

bill on :

I instaled the media adapter, but it will only play my sample list of music that came with my cpu. my file names of my other cd's saved to my c /drive come up but when i select them to play theM system promts: "PLEASE WAIT" AND NOTHING HAPPENS. The files are all saved in my windows media player but i just cant seem to play them any suggestions?

laurac on :

I noticed you work with UPNP. We’re working on a project that can help UPNP developers and users.

Pluto is a new, open source smart home solution that seamlessly integrates: 1) media with a server for music, movies and tv shows, plus a PVR and DVD Player, 2) a home automation system with touch-screen tablet and Bluetooth mobile phone controllers, 3) a phone system with video conferencing, 4) a security system that feeds you live video on your mobile phone when there are interruptions, and lets you speak to visitors through your stereos, and 5) a home PC solution. Check it out at

We also posted a page at explaining how we can help promote the established standards, like UPNP, while we focus on delivering a consumer-friendly experience. If you’re working on UPNP devices and would like a freely distributable whole house solution to showcase your device, we have forums, or you can send an email to aaron.b [at]

rich holman on :

Linksys have made the GPL code available now!

robbie gibbon on :

Is there any way to run an esound daemon on this thing? If it's a linux boot image it should be possible, in which case I can stream anything to it from any pc. There is an esound driver for windows nt I've been using for a while kicking about on the web that works ok with xp. I've put the zip on my site:

j. buck on :

here's some more possibly useful (or useless) wma11b ideas...

-use pcmcia to cf converter + cf card to increase storage space (lose wireless, gain 32,64,128+ mb flash mem.)
-use pcmcia to usb converter (could use usb flash + usb wi-fi?)

not sure if either would fly w/linux, you make the call!

gus kramer on :

Any idea if the video standard can be changed from PAL to NTSC. I'm thinking that most newer video cards can be switched, it might me possible to do the same here. Of course you would have to no where to look and what to do!

jan on :

The video comes from a Phocus TV-FS450 IC with a multiple output standard: NTSC, NTSC-EIAJ, PAL-B/D/G/H/I/M/N.
Andrew Wild has composed a list of the hardware with photos and references at
All the parameters of the FS450 are programmable, so e.g. access to the 2D flicker filter for improved text output is also possible.

gus kramer on :

Thanks for the info.

I was hoping there was a simple way to do it, something along the lines of an undocumented menu. As I see it then, there are two ways I could do this. The first would be to reprogram the firmware using a North American ROM image, assuming I can find one; the second would be to modify the image the WMA 11 downloads from the host computer to include instructions to change the approprite register in the FS450.

Unfortunately time is short these days so I may have to shelve this for (quite) a while.

Mike on :

I scanned the link you posted and saw that SPDIF output might also be possible with a couple of mods. Anybody play with this yet? And does it look like video output is dead b/c of lack of decent hardware?

Josh on :

Thanks to this thread, I have been messing for awhile with the WMA11B. I don't know if this would be of interest to anyone, but I didn't particularly want to attach the unit to my TV, and am quite fond of my squeezebox from slim devices.

I managed to cross-compile a command-line slave for the slimserver software, which along with madplay, now allows me to stream mp3s to the unit from the slim web-gui. I have relied heavily on this thread, as well as wmaloader and wmamp to point me in the right direction -- thanks again.

Roland on :

Does anyone think it would be possible to upload some sort of software such as geexbox (or a limited version of geexbox) that does not require streaming software? It would be easier to set up if the software could directly access a samba share and just play music from the files there, like geexbox.

Also, I am curious to know if anyone has ever successfully re-flashed the drive on this unit? I have found some documentation, but it seems like every time someone has tried, it killed the unit. Also, it seems like it would require some sort of soldering/cable and could not be done over the network. Is true?

The author does not allow comments to this entry

Add Comment

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
E-Mail addresses will not be displayed and will only be used for E-Mail notifications.
Form options

Submitted comments will be subject to moderation before being displayed.