Skip to content

Instantly share code, notes, and snippets.

Show Gist options
  • Save ErkHal/3dba911b96705c9c4b7b78b943ceccc1 to your computer and use it in GitHub Desktop.
Save ErkHal/3dba911b96705c9c4b7b78b943ceccc1 to your computer and use it in GitHub Desktop.
Some of my own notes about opening and accessing a terminal of a photoframe CFrame DPF-2073

Gaining shell access to a generic digital picture frame using UART

I used this website http://domoticx.com/digitale-fotolijst-merkloos/ to get some reference into accessing the photoframe. Wanted to translate some of it as well as add some of my own notes.

Brand: CFrame

Model: DPF-2073 (16:10)

Serial: 1011201572

Specs:

  • Uses 5v power
  • Has 7 buttons on the right-side of the unit
  • Can read USB sticks and SD/MMC/MS Cards

Tools you need

  • PC, Mac or Linux
  • Cheap FTDI serial adapter, try to get one that can do 3.3V and 5V both
  • Guitar picks
  • Breakout cables (preferably with Dupont connectors)

Disassembly

You can pop out the backside by using guitar picks. After that I will advice you to unplug the ribbon cable to the display, as well as other wires going into the buttons inputs and power into the screen unit.

Console access

First, plug power back into the photo frame, and measure the voltage between VCC and GND. Adjust your serial adapter to 3.3v or 5v accordingly. My measures showed somewhere around 3.3v, so that is the logic level that I'm going to use with the serial adapter.

Disconnect the power to the photo frame at this point.

The UART pins on my board are visible on the right side of the USB port. I connected the serial pins like this:

FTDI Pins Picture frame pins
GND GND
TX RX
RX TX
  • Connect your PC to your serial adapter
  • Start a new screen session with the serial adapter, baud rate 115200
  • Plug power back into the photo frame

Boot logs:

BOOT SPI
.B(128)P(1)D(1)M(0)
..
------------ [0x0(F1) Socket Power On               ] ------------
------------ [0x5(F2) Socket Power Gpio Number      ] ------------
------------ [0x0(F3) Socket Power Gpio Group Number] ------------
------------ [0x0(F4) Detect Mode                   ] ------------
------------ [SPMF28XX Boot Loader] ------------
VERSION 5865
=========>new buddy system<============
new buddy system start_addr=0xA02FF000, size=0x100000
BOOT SPI
..Using LZO firmware
.......... buf=B0001000,size=16
EXEC round=1
   0 | 00;00;00;00;00;20;06;00;00;00;00;00;00;00;01;00;
Power Key Counter (1)
2800 sysAppInit run
Module[Evm Board Config] init
BoardConfig init
MS Card Function Open
Module[A070FW05 Display Driver] init
Module[Evm RC Driver] init
Module[Evm Key Driver] init
Total Dev [5]
 manu ID = 20
 Device ID 1= 20
 Device ID 2= 15
Disable write protection, Status = 0

RSV Disk A mount SUCCESS
[Jfs_findLastBlock:168] block=1
[Jfs_findLastSector:200] sector=129
[Jfs_mount:428] sector=129
[Jfs_findLastBlock:168] block=1
RSV Disk B mount SUCCESS
No [DI[ERR rtc]timer read tiERROR !!! rtc reliable code not matERROR !!! rtc reliable code not match : 0
USB BIG MEMLOCK SIZE [8192]
After Create2 [usbMemCreate], ptr = A01C56C8, size = 8096
[USB HOST] Initial
[hostDrvMsdcDriverInit]
[USB HOST] Enable
SD Revision: 7505
MS Revision: 5988
USB HOST Revision: 7379
SPGUI Revision: 0
Module[3D Flip Effect] init
Module[3D Circle Effect] init
Module[3D Float Effect] init
Module[3D Cube Effect] init
Module[Shutter Effect] init
Module[Boxing Shutter Effect] init
Module[Cross Comb Effect] init
Module[Insert Effect] init
Module[News Effect] init
Module[Plus Sign Effect] init
Module[Flabellate Effect] init
Module[Fade Effect] init
Module[Shrink Effect] init
[USB HOST] Power On1
[USB HOST] Initial
[hostDrvMsdcDriverInit]
[USB HOST] Enable
sysAppInit OK
******************************
* Press 'Enter' to continue  *
******************************
cmd>spGuiTask thread start!
 AUO a070fw05 INITIAL
reconstruct display region
CPU update sync with sof !!
open [A:\res\COLOR.BIN]
MatrixA[0]=[133][   307]
MatrixA[1]=[FFFFFFE6][-   26]
MatrixA[2]=[FFFFFFE6][-   26]
MatrixA[3]=[FFFFFFCD][-   51]
MatrixA[4]=[166][   358]
MatrixA[5]=[FFFFFFCD][-   51]
MatrixA[6]=[FFFFFFDA][-   38]
MatrixA[7]=[FFFFFFDA][-   38]
MatrixA[8]=[14D][   333]
MatrixB[0]=[0][     0]
MatrixB[1]=[0][     0]
MatrixB[2]=[0][     0]
[Jfs_findLastBlock:168] block=1
[Jfs_findFile:232] file=B:\settings.dat sector=129
[Jfs_open:484] pFile=-2146711024
[Jfs_read:563] fd=1, nbytes=756
[Jfs_close:533] fd=1
bri=[FFFFFFF6] con=[FF] sat=[100] hue=[0]
con=[FF],bri=[FFFFFFF6],hue=[0],sat=[100]
MatrixB[0]=-  80 MatrixB[1]=-  80 MatrixB[2]=-  80
[_jpegReaderLoad]  4 mini second, ret=0
open dev /dev/input0  00000000
spGuiInputTask thread start!
open dev /dev/input1  00000001
spGuiInputTask thread start!
Load Image A:\res\logo.jpg
[_jpegReaderLoad]  84 mini second, ret=0
[4097][jpegReaderLoad]  4 mini second, ret=0
[4128][jpegReaderLoad] 5 mini second, ret=0
decodeWithoutGpe : outRect 0, 0, 432, 234
ERROR !!! rtc reliable code not match : 0
Load Image A:\res\source_bg.jpg
[_jpegReaderLoad]  97 mini second, ret=0
[4097][jpegReaderLoad]  4 mini second, ret=0
[4128][jpegReaderLoad] 5 mini second, ret=0
decodeWithoutGpe : outRect 0, 0, 432, 234
spFontLoad A:\font\arial16.fnt
spFontLoad 0x801D7490

You can browse the filesystem using the "cd" command as usual. However, "ls" doesn't work, use "dir" instead.
You can also type "help" to display all of the commands.

cmd>help
cd                cmd               copy              cpdir
del               dir               dump              fill
fmt               help              hw                info
lua               mkdir             os                pintest
read              rmdir             search            ui
write

SD Cards and USB memory is mounted like this

Storage type Drive letter
USB Stick I:
SD Card D:

You can copy different directories or files into these storage devices by using
cpdir to copy directories
copy to copy single files

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment