JP1 Remotes

[mwalle]

Hi there,

I recently bought a URC-7962. Just to find out that the uC on the remote is relatively new. But anyway, your tools worked, thanks.

Unfortunately, there is no linux version of the jp12library version 0.20 and not source code available. So i'm stuck with windows atm. That is where my hacking journey began.. So long story short i have a few questions

Is there any documentation about the communication protocol between the remote and the PC. Although i find much about IR codes and IR protocols here, i find little information about how i communicate with the remote.

What i know from reading the source and some forum posts:

• UART, 38400 baud
  
• pulse RST# for 35ms to enter programming mode
  
• the protocol is request/response
  
• the first two bytes are the length of the datagram, both for transmitting and receiving
  
• the last byte is a checksum (XOR about all bytes of the datagram should be zero)
  
• there are at least the commands listed below
  

commands:

• 0x01 - read block
  
• 0x02 - write block
  
• 0x03 - erase block
  
• 0x50 - read remote information (?)
  
• 0x51 - enter program mode
  
• 0x52 - exit program mode
  

So do you know any more commands?

Where does the MAXQ IR protocol assembly come from (the maxq610.code lines in the protocols.bin)?

Btw, after playing with the communication protocol of the remote (with an attatched bus pirate) my remote seems to be stuck in the programming mode. Eg. it is still reachable on the UART interface but after resetting or powercycling the programming mode is entered automatically. That is, no keys are working and no LEDs will blink. If i manually send "0x00 0x02 0x52 0x50" (eg exit programming mode) the remote seems to react at least to key presses. Although manufacturer reset 9-8-1 does not work or at least does not reset the "always in programming mode" behaviour. Does any of the developers had a similar issue? Or maybe some pointers for me?

-michael

[mwalle]

ok i guess i bricked my remote. At least the "read remote information" command returns 0xffffffff as the base offset for the signature block

[binky123]

I've lost track of the code(v0.20 could be in RMIR?) but there is src for jp12serial v0.19 here http://www.hifi-remote.com/forums/dload.php?action=file&file_id=11218 . You may have to search the forums for what was changed for v0.20.

[mwalle]

yeah i noticed that source. 0.20 was distributed only in an rmir beta release, unfortunately without the source code. rmir 2.02a contains the 0.19 release.

in fact i disassembled the windows dlls of version 0.20 and 0.19 and compared them. the only difference i noticed is code that handles 32 bit addresses. and of course some detection mechanisms that enables this behaviour.

but anyway, i've written my own small library (for jp2 only). i'll publish the code on my github account. just in case someone is interested in it.

btw i've found an additional command '0x04', which seems to accept two 32bit values. eg.
00 0a 04 aa aa aa aa bb bb bb bb csum
don't know what it does, but if a=0, the execution time is linear to b. in fact it seems that the execution time is linear to (b-a). one byte is returned. but i don't know its meaning.

Eg.
a=0, b=0x10000. command takes ~400ms to complete
a=0, b=0x100000. command takes ~6400ms to complete
a=0x10000, b=0x20000. command takes ~400ms to complete

anyone have any idea?

[update]: aah that might be some kind of checksum.

-michael

[mwalle]

ok this command 4 is indeed a checksum.. nice this can be used to dump the whole program of the remote.

unfortunately, the disassembly generated by binutils is not that good to read

-michael

[mwalle]

as promised, here is an initial version of my jp2library. available at
https://github.com/mwalle/jp2library

There is an JNI library which aims to be compatible with jp12serial.{dll,so}. But is almost unusable atm

-michael

[MikeT]

Do you think you can write an extender for the URC-7962?

Michael

[MikeT]

There is a extender for the Atlas 1056 B03 which might be a good start for a URC-7962 extender. Both are JP2 remotes using the MaxQ610/612 mcu.

Michael