Dreambox DM7000, DM7020 and Slingbox

nuvolona · Post by **nuvolona** » Wed Jun 27, 2007 11:07 am

Hi binky,
can you tell me if there's a way to proceed with WinLirc learning procedure also with the slingbox remote, because this remote cannot send a continuos pressed signal, and you know that it's required in a learning phase procedure in winlirc. Thats why I was only able to capture RAW data...

binky123 · Post by **binky123** » Wed Jun 27, 2007 11:41 am

No, there is no way because WinLIRC has a hard time decoding the signal. Thus, you have to use RAW mode to capture the signal and manually decode the signal. That's what we've been discussing in this thread.

nuvolona · Post by **nuvolona** » Wed Jun 27, 2007 3:37 pm

Ok, well... let's start all over again (yesterday I was using another file which is clearly messed up with button layouts).

From now on, for my tests, I am using the file here:
http://www.hifi-remote.com/forums/dload ... le_id=4522
so we know with which file we can work in RM.

Here's what I did: I opened the file with RM and I changed the Remote field to "Slingbox with UEI PL chip", which is the model of Slingbox I have. I exported the file to bin format, without touching anything else, then I loaded the generated file (S1237_PL.bin) in my Slingbox.
I rebooted both Slingbox and Dreambox and then started the Slingplayer. The 0 key (slingbox remote layout) is the only button which works (even if it doesnt make its real function, but instead the other one you know - last visited channel -).

I started WinLirc again, to output a new RAW data.
The output RAW data for the 0 key (working on dreambox) is now this:

"ZERO" button

Now... the output data of a few random buttons (to whom the dreambox doesnt respond)

"MENU" button

"SELECT" button

"CHANNEL UP" button

By the way... I think many people using Slingbox with Dreambox sat receiver are keeping an eye on this thread... I hope they will come out an collaborate actively as well.

binky123 · Post by **binky123** » Wed Jun 27, 2007 6:07 pm

I manually decoded the zero button and the code seems to be
0E 0F 44 1A 00 00 00 00
0E 0F 44 1A 08 80 00 00
0E 0F 44 1A 08 80 00 00
which matches the rmdu file.

The MENU button is
0E 0F 44 1A 08 00 54 00
0E 0F 44 1A 0F 80 54 00
0E 0F 44 1A 0F 80 54 00
but it should be 20 00 according to the rmdu file.

The SELECT button is
0E 0F 44 1A 09 00 25 00
0E 0F 44 1A 01 80 25 00
0E 0F 4x xx 01 80 25 00
which matches the rmdu file.

The CHANNEL+ button is
0E 0F 44 1A 03 00 0D 00
0E 0F 44 1A 0B 80 0D 00
0E 0F 44 1A 0B 80 0D 00
which matches the rmdu file.

Which button on the dreambox executes the LAST/PREVious channel command? Can you record that one using WinLIRC?

nuvolona · Post by **nuvolona** » Wed Jun 27, 2007 11:33 pm

Well, there's not an exact like effect on the real dreambox remote....
but there are the two arrow keys in the dreambox remote: "<" and ">" , the zero button is in the middle between these two.
The function of "<" is history prev (so it brings you to the previous visited channel... but if you press it again more time, it continues the history...so it doesnt switch between only 2 channels like the "0" button in the Slingbox remote). To have this same effect with the dreambox remote, you need to press "<" and then ">" (which is history next).

these are the RAW codes of the two buttons, captured from my dreambox rc
"<" HISTORY PREV BUTTON

">" HISTORY NEXT BUTTON

I also forgot to tell one strange thing: the Slingbox remote "0" key only works after a clean reboot of both dreambox and slingbox... if it happens that then you use the dreamox remote control, the "0" button in slingbox remote refuse to work again, and you need to reboot both devices in order to make it work again.

damir · Post by **damir** » Thu Jun 28, 2007 1:17 am

binky123 wrote:Which button on the dreambox executes the LAST/PREVious channel command?
nuvolona wrote:Well, there's not an exact like effect on the real dreambox remote....

Actually there is, it is zero button.

nuvolona · Post by **nuvolona** » Thu Jun 28, 2007 1:34 am

damir wrote:
binky123 wrote:Which button on the dreambox executes the LAST/PREVious channel command?
nuvolona wrote:Well, there's not an exact like effect on the real dreambox remote....
Actually there is, it is zero button.

ops! sorry, my bad! I didn't even try it.......

I tought it was just a number button like the others! I can't test it now because i'm not home anymore but you must be right!

well, anyway it's better... because at least the 0 key in slingbox has exactly the same function of dreambox remote. We just need to make all other buttons to work

I will capture winlirc raw data of 0 button from dreambox remote control later today

nuvolona · Post by **nuvolona** » Thu Jun 28, 2007 4:55 am

Output raw data "0" button dreambox remote control:

"0" BUTTON DREAMBOX RC

binky123 · Post by **binky123** » Thu Jun 28, 2007 8:46 am

I decoded the Dreambox signals:
LEFT ARROW
0E 0F 44 1A 0B 00 41 00
0E 0F 44 1A 02 80 41 00 should be 03 80 41 00

RIGHT ARROW
0E 0F 44 1A 0C 00 40 00
0E 0F 44 1A 03 80 40 00 should be 04 80 40 00

"0" digit:
0E 0F 44 1A 00 00 00 00
0E 0F 44 1A 08 80 00 00

Can you learn CHANNEL+(BOUQUET+) and the SELECT button on the Dreambox? Also do you know what model Dreambox remote you have? Can you check the battery compartment for any name? You may have to open it up by removing the screw and using a credit card to wedge between the case.

I do see a difference in the signals from the dreambox rc and the slingbox as the 5th byte seems to be off by 1.

nuvolona · Post by **nuvolona** » Thu Jun 28, 2007 11:47 am

Here's the raw data you requested

DREAMBOX BOUQUET+ (CHANNEL+)

DREAMBOX OK (SELECT)

Thanks for the tip about the credit card! I could open the dreambox rc very easily. The inside reports this:

Code: Select all

39710-003-0013
REV:01
2002-10-24
URC-39730B00-00
UEIS-10312

While on the batteries back side label its written:

Code: Select all

URC-39730 B02-00
S3C80E7ZKM-SOB7
SIO 1448-KM

johnsfine · Post by **johnsfine** » Thu Jun 28, 2007 1:18 pm

binky123 wrote:I decoded the Dreambox signals:

Which signals do you mean? Do you mean these?

nuvolona wrote:these are the RAW codes of the two buttons, captured from my dreambox rc
"<" HISTORY PREV BUTTON

">" HISTORY NEXT BUTTON

Code: Select all

LEFT ARROW
0E 0F 44 1A 0B 00 41 00
0E 0F 44 1A 02 80 41 00 should be 03 80 41 00

RIGHT ARROW
0E 0F 44 1A 0C 00 40 00
0E 0F 44 1A 03 80 40 00 should be 04 80 40 00

If we're talking about the above signals, I decode them as

HISTORY PREV BUTTON
0E 0F 44 1A 0A 00 51 00
0E 0F 44 1A 02 80 51 00

HISTORY NEXT BUTTON
0E 0F 44 1A 0B 00 50 00
0E 0F 44 1A 03 80 50 00

How are you decoding? I used the method I described above. I copied the data to excel, removed the words "space" and "pulse", summed to burst durations, and find the best fit for timing.

However, notice that the pulse lengths are nominally all the same. I expect the transmitted signal really does have them pretty much identical. But LIRC sees pulses in that first signal varying from 199 to 349. That is too much error for a protocol this sensitive. I'm pretty sure THAT error is in LIRC, not in the sending remote. So when you use LIRC to measure the error in the signal generated by the Slingbox, you can't take the direct results at face value. You must assume LIRC is introducing significant error, so you must look at various averages and patterns to infer the error that the Slingbox is generating.

binky123 wrote:I do see a difference in the signals from the dreambox rc and the slingbox as the 5th byte seems to be off by 1.

I'm sure the real issue won't be anything like that. I'm sure we don't have a bug like that in the executor, nor would any difference between a Slingbox and a JP1 remote behave that way.

I expect there is some difference in time scale between the Slingbox and our assumptions about the Slingbox. Most IR protocols will ignore a moderate size difference in time scale, especially if it is consistent. But the XMP (Dreambox) protocol is probably sensitive to as little as a 2% error in time scale. If we know how much the time scale is off, we can tweak the executor to compensate.

So I imported to excel the menu signal from this post:
http://www.hifi-remote.com/forums/viewt ... 8311#58311

Then I crunched it a little in Excel to try to average out the LIRC errors and leave the original time scale error. If I did that right, the Slingbox signal is 2.5% too slow.

johnsfine · Post by **johnsfine** » Thu Jun 28, 2007 1:32 pm

What executor is being used for this?

The .rmdu file doesn't seem to include a custom executor. The RDF's and protocols.ini that I'm using say there isn't one built-in.

I wanted to look at it and see which bytes should be changed to make it about 2.5% faster.

binky123 · Post by **binky123** » Thu Jun 28, 2007 2:48 pm

Yes, you are right. I was hand decoding it. The 5th byte is a checksum byte based on the original 5th thru 8th bytes and I was trying to see if they matched.

The 016C protocol notes is here. PB file is here.

The 4 Slingbox RDF files in the latest RDF ZIP file here all have the 016C listed in the [Protocols] section.

So is the time scale issue the clock frequency that the S3C80 chip is running on?

binky123 · Post by **binky123** » Sat Jun 30, 2007 8:51 am

nuvolona, can you capture the Slingbox "< HISTORY PREV" button and the "> HISTORY NEXT" button? I want to compare those to the above Dreambox RC signals.

It seems from a rough visual comparison that WinLIRC samples(at 115200 serial baud rate) the Dreambox RC pulse length longer and the space length shorter than what is captured for the Slingbox signals.

nuvolona · Post by **nuvolona** » Sat Jun 30, 2007 9:41 am

hmm I can't see the 2 buttons "<" and ">" in the slingbox remote layout...
but if it's okay I captured you the two buttons "CURSOR LEFT" and "CURSOR RIGHT" for both Slingbox and Dreambox, so you can compare instead these buttons:

CURSOR LEFT SLINGBOX REMOTE
CURSOR LEFT DREAMBOX REMOTE

CURSOR RIGHT SLINGBOX REMOTE
CURSOR RIGHT DREAMBOX REMOTE

Also, how can you explain the fact that if you push any button on the dreambox remote, then the slinbox one stops completely to work, and you need to reboot the dreambox?