Roku Netflix Player
From Linux Hints
Contents |
About
This page is intended as a collection of information about the Roku Netflix player. The aim is to enhance the player in order to achieve several possible goals:
- Enhance the player to serve additional content other than that provided by Netflix - such as locally served media.
- Interoperate with MythTV, possibly as a frontend, or having MythTV control it.
The goal also is not to interfere with services provided either Roku or Netflix.
This is a wiki. You may edit and add any additional information you have.
Credits and other information
Kudos to Eric Cooper for his examination of the software to date.
In addition, much has been discussed in the Roku forums, particularly in the Roku branded Netflix STB technical thread.
Accessing the Player
The goal is to enable software level access. Like many embedded devices, it is intended to be a black box, with no obvious user access to the internals. However, could it be accessed, modification becomes relatively straightforward. The system is a standard busybox-based embedded MIPS system (it has much in common with the Linux running on Linksys wireless routers).
Software Access
As Eric and others have noted, access is controlled by private keys, so unless these keys are known, or another way in is found, this is perhaps an unlikely access point.
Bootloader Access
As with many embedded Linux systems, the Roku uses the U-boot bootloader, which controls launching of the Linux kernel and control over the onboard flash, etc. Typically, this can be access via a TTL-level serial port on the board. The Roku is no different, and the 10 pin jumper appears to have this pin out:
NC 1 2 NC RTS? 3 4 CTS? RX? 5 6 TX NC 7 8 NC 5V 9 10 GND
You will need a TTL to RS232 (or USB) serial adapter to connect to this. The paramaters are 115200,8N1. This is the result:
-------------------------------------------------------------------- -- Griffin Primary Bootloader v0.1-1091d (17:15:35, Mar 20 2008) -- Andre McCurdy, NXP Semiconductors -------------------------------------------------------------------- Device: PNX8935 M1 Secure boot: enabled, keysel: 13, vid: 6 (expecting 6) Flash config: 7 (omni: 8bit NAND), timing: 0x04 CPU clock: 320 MHz DRAM: DDR400 (CL3), 2 x 2 64MByte 8bit devices: 256 MBytes DRAM: 197 MHz, Bandwidth (MB/s): Rd 94.4, Wr 76.9, Cp 37.7 NAND: Samsung, small-page, 64 MByte (4096 x 16k blocks) aboot exec time: 184581 uSec U-Boot 1.2.0 (NAND or Rescue image - so no hardware configuration) (May 29 2008 - 18:13:11) CPU is PNX8935 M1, CPU speed 320 MHz Secure boot: enabled Flash type is Nand DRAM: 256 MB ## Unknown FLASH on Bank 1 - Size = 0x00000000 = 0 MB Flash: 0 kB NAND: Remapping Bad Blocks: 3728 64 MiB Env: default Splash: done u-boot startup time so far: 1077 msec Image 0: Version 4 Image 1: Version 3 Application image detected ..................................................................................................................................................................s Partition 1: Verify uimage: Success Application image detected ## Booting image at 8f406748 ... Image Name: Linux Kernel Image Image Type: MIPS Linux Kernel Image (gzip compressed) Data Size: 1423637 Bytes = 1.4 MB Load Address: 80001000 Entry Point: 802ed000 Verifying Checksum ... OK Uncompressing Kernel Image ... OK Starting kernel ...
Typically, on such systems, the boot can be interrupted with a key press, but this does not appear to be the case here.
JTAG Access
The 14 pin header on the board is almost certain a MIPS EJTAG header. This may provide a more effective way to control the system. I have a JTAG interface that was originally designed for a LART, and using UrJTAG only made a small amount of progress:
jtag> cable arcom parallel 0x378 Initializing parallel port at 0x378 jtag> detect Warning: TDO seems to be stuck at 1
(Now connect power)
jtag> detect IR length: 5 Chain length: 1 Device Id: 0 (0x0000000000000000) Error: Unable to detect JTAG chain end! chain.c(133) Part 0 without active instruction chain.c(184) Part 0 without active instruction chain.c(133) Part 0 without active instruction jtag>
I'm not sure if UrJTAG fully understands my JTAG interface or if the issue is completely different. Three's some relevant information on the MIPS Wiki. In short, it needs some input from someone who's more of a MIPS and hardware hacker than I am.
Playing Other Content
I had originally thought that it might be straight forward to intercept the HTTP request for playlist queries and add your own content to it. However, it seems that this is mostly over HTTPS, making it much harder (only the movie images are plain HTTP). The actual movie data itself is HTTP (Netflix movies are WMV encoded); what other formats it might play without modification is an open question.
Player Debug Mode
This has been mentioned in the forums to access the debug menu to force the playback speed (reset after reboot). It may take some tries. Press on the remote:
- Home 5 times
- Rewind 3 times
- Fast forward 2 times
Secret Screen Mode
I found other features, press on the remote:
- Home 5 times
- Fast forward 3 times
- Rewind 2 times
Other Information
- Roku Player GPL resources - Most of these archives are just vanilla copies of the original. The real changes are in the stb225_base and mipsutils archives.
