JP1 Remotes Forum Index JP1 Remotes


FAQFAQ SearchSearch 7 days of topics7 Days MemberlistMemberlist UsergroupsUsergroups RegisterRegister
ProfileProfile Log in to check your private messagesLog in to check your private messages Log inLog in

Comcast/xfinity XR2 remote hardware

 
Post new topic   Reply to topic    JP1 Remotes Forum Index -> Non-JP1
View previous topic :: View next topic  
Author Message
crosstalk



Joined: 30 Apr 2006
Posts: 45
Location: PA

                    
PostPosted: Tue Mar 14, 2017 11:09 am    Post subject: Comcast/xfinity XR2 remote hardware Reply with quote

Hello. Has anyone hacked this remote? It uses a GreanPeak GP565 communications controller for the IR and RF transmission (zigbee rf4ce). I can't find a datasheet for this IC, but the product brochure shows I2C, SPI and UART interfaces with a XAP5 microcontroller core. The hardware seems interesting, but might not be the best platform for a new JP1 lineup because there are no headers or pads in the battery compartment. Maybe it is programmable via the RF interface?

Taking it apart wasn't too difficult. The upper and lower cases appear to be glued together (no clips), so it will have to be glued back together.



Back to top
View user's profile Send private message
The Robman
Site Owner


Joined: 01 Aug 2003
Posts: 21211
Location: Chicago, IL

                    
PostPosted: Tue Mar 14, 2017 10:17 pm    Post subject: Reply with quote

Hack it to do what? There doesn't appear to be any indication that it's a UEI or JP1 remote, and I don't see an EEPROM chip there. I'm not familiar with the processor so I don't know if it has any flash memory.

The thing that makes JP1 remotes hackable is the fact that they have temporary memory (ie, EEPROM or Flash) that can be programmed, most regular universal remotes don't have that.
_________________
Rob
www.hifi-remote.com
Please don't PM me with remote questions, post them in the forums so all the experts can help!
Back to top
View user's profile Send private message Visit poster's website
crosstalk



Joined: 30 Apr 2006
Posts: 45
Location: PA

                    
PostPosted: Wed Mar 15, 2017 7:59 am    Post subject: Reply with quote

The GP565 includes flash according the block diagram on the product brochure. There seem to be a couple test points that aren't part of other traces--I will try to see if those are TTL UART. It appears to be made by UEI and uses the same codes.

From the web:"Universal supplies Comcast with the XR2 remote that is deployed in the homes of its Xfinity TV subscribers. Comcast has said that Universal is also developing a new remote for its X1 service which contains technology that will allow subscribers to channel surf with voice commands."

http://www.fiercecable.com/cable/universal-electronics-preps-xr8-xr2-aim-anywhere-devices-for-comcast
Back to top
View user's profile Send private message
The Robman
Site Owner


Joined: 01 Aug 2003
Posts: 21211
Location: Chicago, IL

                    
PostPosted: Wed Mar 15, 2017 12:43 pm    Post subject: Reply with quote

Ah, ok, if it's a UEI remote then it's certainly possible that it could be hackable.
_________________
Rob
www.hifi-remote.com
Please don't PM me with remote questions, post them in the forums so all the experts can help!
Back to top
View user's profile Send private message Visit poster's website
3FG
Expert


Joined: 19 May 2009
Posts: 3365

                    
PostPosted: Wed Mar 15, 2017 11:52 pm    Post subject: Reply with quote

I had bought a Xfinity XR11 remote sometime back and was disappointed to find that it had no 6 pin header. But this thread caused me to open it up. The XR11 is also a Zigbee enabled remote, but it uses the TI CC2530 micro. Recall that the URC-7980 uses the CC2541 micro, which communicates via Bluetooth instead of Zigbee. These TI chips use the same 8051 based processor and they share a users guide.
The XR11 uses a 2 sided PCB. Its switches are the clicky diaphragm type, all mounted in a single sheet which is glued to the PCB. BTW, I'm glad this wasn't the first remote that I tried to open or I might have given up.

The XR11 doesn't in my opinion offer much scope for JP1 work; it has cable, TV, and Audio devices, but I suspect that the button maps for TV and especially Audio are very limited. However, should we want to try programming this remote, the PCB has test points which can send/receive to/from the remote. TI sells a programmer called CC Debugger (available on eBay for $15) and also provides the schematics of the programmer. It simply connects the data and clock lines from a USB port to the test points. The CC25xx chip itself handles the USB traffic. Of course we don't know if UEI has protected the flash memory from being read.
Back to top
View user's profile Send private message
porrick



Joined: 07 Apr 2018
Posts: 1

                    
PostPosted: Sat Apr 07, 2018 4:04 pm    Post subject: Progress? Reply with quote

Any update on progress or determining whether the remote stated by the OP can be hacked?
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic       JP1 Remotes Forum Index -> Non-JP1 All times are GMT - 5 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum


 

Powered by phpBB © 2001, 2005 phpBB Group
Top 7 Advantages of Playing Online Slots The Evolution of Remote Control