Taking the DPF-407 apart

The Denver DPF-407
By Rasmus Rohde


The Denver DPF-407 is a nice little digital photo frame available in Denmark for around 65 euros. From the factory it is able to handle almost any image, music and video format you feed to it. This fact of course makes it interesting to take apart and see what hides inside the box.

Identified devices

The PCB with a JTAG attached.

Getting some code running

At the moment it is only possible to get code running using a JTAG device. If you take the DPF apart you will easily locate the JTAG pins, since the nice producer have marked it with names like TDO, TDI, TMS and so on. They have even made 3.3v available.
The memory layout is as follows:

0x0040_0000 - 0x0060_0000: Flash
0x00c0_0000 - 0x0100_0000: RAM
0x003b_7000 - 0x003d_26c0: Display

To upload code you will need dpf-407-jtag.tar.gz which includes a linux program for interfacing with the A4 inside the AML7216 using a JTAG. It also includes a little example on how to write some assembler code that can be uploaded. The JTAG program (arc.c) has the following features:
'arc -d' dumps a couple of registers
'arc -u code.bin' uploads code.bin and executes it
'arc -r 1800 100' reads 256 bytes from memory location 0x1800
'arc -s dump.bin 1800 100' saves 256 bytes from memory location 0x1800 to dump.bin

To build the code example you will need an arc cross-compiler, which can be made from the sources found at ArcLinux.

The original firmware

'arc -s flash.bin 0 200000' should extract the firmware from the flash and put it in flash.bin. The flash is compressed and with unpack.c you can decompress some sections from it. I am sorry for the ugly unpacker but it was a direct translation of the unpacker from the original firmware. Note that if you are on a little-endian system you should fix up the routine endian_swap and endian_swapp to do nothing.

Inside the firmware you can find some interesting strings like:

64bit file, but you've compiled MPlayer without LARGEFILE support!
Contact the author if you have such sample file!
Please contact MPlayer authors, and upload/send this file.

If you ask me it seems like MPlayer is used for video playback. No wonder it handles all formats nicely.

Getting Linux running

ArcLinux is probably a very good place to start for getting linux running on thise device. uClinux 2.4.29 is already ported to the A4 and cross-compilers are available.

Current efforts

At the moment I am trying to figure out how to initialize the display since some kind of stdout will be needed to get linux running. At 0x3b7000 some settings for the display can be found (seems like the first 16 bytes) and after that follows a simple framebuffer. A dump of the first 16 bytes of this area when the original firmware is loaded: 00 44 DE 01 00 00 E9 00 60 DB 08 C0 B8 C5 6A A6
At byte 2 we have a short with value 478.
At byte 6 we have a short with value 233.
At byte 8 we have a short with value 56160 = 240 * 234.

Valid XHTML 1.0!