Firmware
Here you will find information about firmware modifications
Players based on Sigma Desings EM8500 processors are in fact computers powered by special Linux edition named uCLinux. Firmwares for this players are ordinary computer programs compiled for EM8500 processor - if we will dig enough we will find Linux kernel, directories, graphics files and decoders prepared as any other application for Linux.
Let's try to extract the important files from firmware disc. You will need Linux to do that. I assume that you have extracted the ISO file from ZIP archive. The first thing is to mount it in Linux:
mount -o loop firmware_file_name.iso directory
Now you can enter to directory - you will see the same files as on burned CD. For example:
¦ fipmodule.o
¦ flash.fuf
¦ khwl.o
¦ loader.bin
¦ logo.png
¦ romfs.bin
¦
+---bin
¦ busybox
¦ init
¦
+---dev
+---fonts
+---proc
As you see, it is Linux filesystem. EM8500 processor executes this programs during firmware update. The most important file here is romfs.bin. This file is a filesystem image. It contains files which are written to the player EEPROM. This filesystem is romfs type - you can find more information on romfs project webpage. Let's mount this filesystem:
mount -o loop romfs.bin new_directory
Now you can inspect the real firmware. You will see something like this:
¦ dvdplayer.bin
¦ fileplayer.bin
¦ fipmodule.o
¦ khwl.o
¦ linux.bin.gz
¦ logontsc.jpg
¦ minimod
¦ mpegplayer.bin
¦
+---bin
¦ sh
¦ init -> ../dvdplayer.bin
+---cdrom
+---dev
+---etc
¦ host.conf
¦ hosts
¦ sashrc
¦ services
¦
+---img
¦ ¦ (many PNG files)
¦ ¦
¦ +---English
¦ ¦ ¦ (many PNG files)
¦ ¦ ¦
¦ ¦ +---lib
¦ ¦ (many PNG files)
¦ ¦
¦ +---French
¦ ¦ ¦ (many PNG files)
¦ ¦ ¦
¦ ¦ +---lib
¦ ¦ (many PNG files)
¦ ¦
¦ +---German
¦ ¦ ¦ (many PNG files)
¦ ¦ ¦
¦ ¦ +---lib
¦ ¦ (many PNG files)
¦ ¦
¦ +---Italiana
¦ ¦ ¦ (many PNG files)
¦ ¦ ¦
¦ ¦ +---lib
¦ ¦ (many PNG files)
¦ ¦
¦ +---lib
¦ ¦ (many PNG files)
¦ ¦
¦ +---Russian
¦ ¦ ¦ (many PNG files)
¦ ¦ ¦
¦ ¦ +---lib
¦ ¦ (many PNG files)
¦ ¦
¦ +---share
¦ ¦ ¦ (many JPEG & PNG files)
¦ ¦ ¦
¦ ¦ +---lib
¦ ¦ (many JPEG & PNG files)
¦ ¦
¦ +---Spanish
¦ ¦ (many PNG files)
¦ ¦
¦ +---lib
¦ (many PNG files)
¦
+---proc
The most important files are in root directory and /bin
directory. In /bin directory
you will find symbolic link init
which points to /dvdplayer.bin
file. /bin/init is executed after
powering the unit up by loader code. Because /bin/init
is only symbolic link, in fact /dvdplayer.bin
is run. This programm initializes the hardware, displays menu, scans for IR
codes from remote contoller and is responsible for CD-Audio playback. When DVD
or CD disc with DivX/XviD movies is inserted /dvdplayer.bin
executes /mpegplayer.bin or /fileplayer.bin.
/linux.bin.gz
is uCLinux kernel,
/logontsc.jpg contains logo,
/img directory contains graphics
files which are displayed during menu navigation and playback.
In the same revision of firmware (for example 1.0.0.6) for different Cosmic players only /dvdplayer.bin and /logontsc.jpg files are different. There are some minor changes in another files, but they are unimportant (minor changes in texts displayed on LCD panel, etc.). In firmwares for the same clones (for example CO-301), only logo is changed.
It means that firmware for, let's say, CO-108 can be flashed to CO-301 unit. Because there are different front panels, the front panel buttons will stop working, but playback, LCD display and remote controller will work. Of course, the unit could be flashed again. Firmwares for clones of the same Cosmic model can be mixed without any side effects (only logo will be changed).
We have unpacked the firmware. Now we can change it. You can make any modification in every file. But modding is not so easy - binary files are in Linux bFLT (binary flat) format which contains no symbols, no debug info, and only a simple small header what makes the programms hard to reverse engeener. More information on reverse engeenering of Sigma Desings EM8500 code can be found here and here and of course don't forget to visit two great user's forums here and here.
As a training you can change the player logo. It is saved in /logontsc.jpg file. To do it, you have to copy the mounted image (it is read only) to another directory. Make sure that you are copying all files and symbolic links. You can alter the logo using any graphics appliaction. Than save it. Remeber that it should be no bigger than about 30 kB. It's time to create new romfs.bin image now. Use genromfs programm:
genromfs -d directory_with_firmware -f new_romfs.bin -a 512 -V 'romfs'
The only thing that has left, is to replace old romfs.bin file in ISO image with the new one. You can do it even in Windows using WinISO appliaction.
How to add national characters support for DivX/XviD subtitles
Subtitles on DivX/XviD movies are displayed using font stored in dvdplayer.bin file. To add your national characters you have to modify it. How this font is stored? It's described in details on the ET's site. Please go there, choose Howto section and read How fonts are stored in the firmware topic. The only difference is that Cosmic Digital players use bigger, 36 pixel font for subtitles.
When you know how fonts are stored in the firmware, take a look at Firmware Pixel Font Editor by Vratislav "Etchie" Babusak. You can find this tool in the Download section. If you need offsets, where fonts are stored inside dvdplayer.bin file, please refer to this file.
How to add national characters support for file and directory names
It's a little bit more complicated. The first thing is to modify the font inside dvdplayer.bin file. Texts in the whole menu system are displayed using smaller, 23 pixel font version
The second thing is to alter Linux kernel. Names of files and directories on CD discs are encoded using Unicode (16 bits per character). uClinux kernel converts these characters to the "classic" 8-bit notation. If we want to see national characters in filenames, we have to change the way this conversion is made. Fortunately, source code of uClinux for Sigma Designs EM8500 is available. Please go to the uClinux website and download the uClinux-2.4-sigma.tar.gz package.
Now, let's inspect the sourcecode. We can guess that characters conversions are made inside the file subsystem (/fs). Here we can find many functions responsible for parsing different file systems. Our burned compact discs use so-called ISO file system, so we go to the /fs/isofs subdirectory. We are close. Now we can see joliet.c file - inside this file, functions for reading the Joliet file system extension are stored. The first function in joliet.c is the code we were looking for: uni16_to_x8 converts Unicode to UTF8 or ASCII. Let's analyze it.
As we can see this function calls another function: uni2char. It's a part of nls (native language support) library located in/fs/nls directory. So, we go to this directory and view nls_base.c file. Of course, body of our uni2char function is located here. We can see that Unicode character is divided into two parts: 8 lower bits are assigned to the cl variable and 8 higher bits are assigned to the ch variable. Then ch is used for addressing a conversion table and cl for addressing a character in the chosen table.
Let's see how page_uni2charset (table of addresses for conversion tables) looks like. Hey! It only contains one address for page00! This page is useful only for Western Europe characters conversion! If we want to convert national characters from Unicode, we need to prepare additional pages with codes specific for different languages.
In /fs/nls directory we can find many ready-made conversion tables. Unfortunately, there is no Windows 1250 page for Central Europe. But nls library is used also in Linux for PC. So, we go to this page and download tables we need. If we analyze nls_cp1250.c file and compare it with Unicode charts published by Unicode Consortium we will notice that only additional page01 is required for proper display of Central European characters.
OK. Now we know how to add support for national characters to the sourcecode. But how to modify the firmware? The answer is simple: we have to put page01 table somewhere inside the firmware, find page_uni2charset table and add to this table the pointer to the page01. As we remember, conversions are made inside uClinux kernel, so we unpack linux.bin.gz file and view it, using any hexeditor. Interesting things are located almost at the end of the file. If we view Linux kernel from official Elta 2.0.4.0 firmware, we will notice these offsets:
page00 - 594964
page_uni2charset - 595220
charset2lower - 596224
charset2upper - 596500.
The question is where to put page01? Space for this table was not allocated during kernel compilation, so we have to overwrite some other data. It seems that charset2lower and charset2upper tables are not used in the firmware, so we can erase them! Let's copy page01 from nls_cp1250.c and write it to the location of charset2upper (offset 596500). Now we have to add pointer to our new page01 to the page_uni2charset table (offset 595220). The pointer to the page00 is already there. It's written as 0x14 0x94 0x09 0x01. What does it mean? It's segment:offset notation. page00 is located at 0109:9414 (hex). We wrote the page01 table 1536 bytes after the page00. So, pointer to the page01 is 0109:9a14 (hex). It means, that we need to write 0x14 0x9a 0x09 0x01 values starting from offset 595224. Finished! Now we pack altered kernel using gzip and build new firmware.