View previous topic :: View next topic |
Author |
Message |
crosstalk
Joined: 30 Apr 2006 Posts: 45 Location: PA |
Posted: Tue Mar 14, 2017 11:09 am Post subject: Comcast/xfinity XR2 remote hardware |
|
|
Hello. Has anyone hacked this remote? It uses a GreanPeak GP565 communications controller for the IR and RF transmission (zigbee rf4ce). I can't find a datasheet for this IC, but the product brochure shows I2C, SPI and UART interfaces with a XAP5 microcontroller core. The hardware seems interesting, but might not be the best platform for a new JP1 lineup because there are no headers or pads in the battery compartment. Maybe it is programmable via the RF interface?
Taking it apart wasn't too difficult. The upper and lower cases appear to be glued together (no clips), so it will have to be glued back together.
|
|
Back to top |
|
|
The Robman Site Owner
Joined: 01 Aug 2003 Posts: 21238 Location: Chicago, IL |
Posted: Tue Mar 14, 2017 10:17 pm Post subject: |
|
|
Hack it to do what? There doesn't appear to be any indication that it's a UEI or JP1 remote, and I don't see an EEPROM chip there. I'm not familiar with the processor so I don't know if it has any flash memory.
The thing that makes JP1 remotes hackable is the fact that they have temporary memory (ie, EEPROM or Flash) that can be programmed, most regular universal remotes don't have that. _________________ Rob
www.hifi-remote.com
Please don't PM me with remote questions, post them in the forums so all the experts can help! |
|
Back to top |
|
|
crosstalk
Joined: 30 Apr 2006 Posts: 45 Location: PA |
Posted: Wed Mar 15, 2017 7:59 am Post subject: |
|
|
The GP565 includes flash according the block diagram on the product brochure. There seem to be a couple test points that aren't part of other traces--I will try to see if those are TTL UART. It appears to be made by UEI and uses the same codes.
From the web:"Universal supplies Comcast with the XR2 remote that is deployed in the homes of its Xfinity TV subscribers. Comcast has said that Universal is also developing a new remote for its X1 service which contains technology that will allow subscribers to channel surf with voice commands."
http://www.fiercecable.com/cable/universal-electronics-preps-xr8-xr2-aim-anywhere-devices-for-comcast |
|
Back to top |
|
|
The Robman Site Owner
Joined: 01 Aug 2003 Posts: 21238 Location: Chicago, IL |
Posted: Wed Mar 15, 2017 12:43 pm Post subject: |
|
|
Ah, ok, if it's a UEI remote then it's certainly possible that it could be hackable. _________________ Rob
www.hifi-remote.com
Please don't PM me with remote questions, post them in the forums so all the experts can help! |
|
Back to top |
|
|
3FG Expert
Joined: 19 May 2009 Posts: 3367
|
Posted: Wed Mar 15, 2017 11:52 pm Post subject: |
|
|
I had bought a Xfinity XR11 remote sometime back and was disappointed to find that it had no 6 pin header. But this thread caused me to open it up. The XR11 is also a Zigbee enabled remote, but it uses the TI CC2530 micro. Recall that the URC-7980 uses the CC2541 micro, which communicates via Bluetooth instead of Zigbee. These TI chips use the same 8051 based processor and they share a users guide.
The XR11 uses a 2 sided PCB. Its switches are the clicky diaphragm type, all mounted in a single sheet which is glued to the PCB. BTW, I'm glad this wasn't the first remote that I tried to open or I might have given up.
The XR11 doesn't in my opinion offer much scope for JP1 work; it has cable, TV, and Audio devices, but I suspect that the button maps for TV and especially Audio are very limited. However, should we want to try programming this remote, the PCB has test points which can send/receive to/from the remote. TI sells a programmer called CC Debugger (available on eBay for $15) and also provides the schematics of the programmer. It simply connects the data and clock lines from a USB port to the test points. The CC25xx chip itself handles the USB traffic. Of course we don't know if UEI has protected the flash memory from being read. |
|
Back to top |
|
|
porrick
Joined: 07 Apr 2018 Posts: 1
|
Posted: Sat Apr 07, 2018 4:04 pm Post subject: Progress? |
|
|
Any update on progress or determining whether the remote stated by the OP can be hacked? |
|
Back to top |
|
|
|