Funtwist Cinema 250 Hacking

(Download the F/W via here 下載韌體，更新方式請看下面說明)

額外增加功能

• 多個中國大陸的在線影音服務，可看電影、影片…
• IMS - Youtube
• IMS - Youku (China)
• IMS - VTS (China)
• IMS - hdpfans (China)
• IMS - HaoIMS (China) 
• IMS - Voole (China)
• 網頁式控制介面，方便 iPAD、電腦遠端搖控
• BT 用戶端軟體，BT Transmission，可針對各別種子做限速、支援 Private tracker、 更方便的操作介面
• HTTP server- lighttpd，支援 PHP, CGI
• FTP server - vsftpd，匿名登入

Funtwist Cinema 250 is a high CPI media player based on the Realtek 1073 chip and MIPS 400 MHZ cpu. Recently, it costs only around NTD $1490, i.e. roughly equal to $50 U.S. dollars.  More and more multimedia embedded systems adopt Realtek's chip as their solution, therefore that's quite easy to find the discussions and documents about how to hack  them on the Internet. Besides the price, the process of customizing my F/W is fun as well.

Let's take a look the spec of it. (Reference from http://www.funtwist.com/web_c/html/03_products/Product_Content.aspx?PID=452)

Hardware Spec

• Video Output: HDMI 1.3 Out, Composite Out
• Audio Out: Audio Out L/R, SPDIF(Optical)
• File transfer port: two USB 2.0 Host ports
• Data transfer with PC: USB 2.0 mini port
• Ethernet: 10/100Mbps RJ-45

Wireless Dongle

MultiMedia

• Video Decoding (Movie): MPEG-1 (MPG/MPEG/DAT up to 1080p), MPEG-2 (MPG/MPEG/VOB/ISO/IFO/TS/TP/M2TS up to 1080p), MPEG-4 (MP4/AVI/MOV up to 1080p), DivX 3/4/5/6, Xvid (AVI/MKV up to 1080p), H.264, AVC (TS/AVI/MKV/MOV/M2TS up to 1080p), WMV 9 (WMV up to 1080p), FLV (FLV up to 1080p), Real Video 8/9/10 (RM/RMVB up to 720p)
• Audio Decoding (Movie): Dolby Digital AC3, DTS (NO Pass Through), MPEG-I Layer 1/2/3, MPEG-II 1/2, Real Audio, AAC, WMA, LPCM HDMI RAW/SPDIF RAW output to Amplifier for decoding 5.1/7.1 audio channels
• Audio Decoding (Music): WMA, MP3, Real Audio (RA), WAV, OGG, AAC, FLAC
• Picture Format: JPEG, BMP, PNG

It's really amazing, isn't it? So what can you do using it? Apparently, a media player is mainly used for video, audio playing. But, it can do more than that. For instance, download files via BitTorrent in the background, hosts as a web server, network sharing (Samba), FTP server. In other words, it's a linux-based system, if you are really good at linux, you can make the best use of it. Moreover, it helps you save electricity due to low power consumption.

Alright, back to our topic about the hacking, the only drawback I think is there is no more F/W update and maintenance for this machine. That's not a big problem because it got a brother machines and it can share the same F/W with them. (Patriot Box Office, Hornettek Phantom MP-2020)

So I base on the F/W and add some more hacking and features to it. It seems so far so good for the hacked F/W on Cinema 250.

The step below is how to upgrade the F/W I hacked. The process takes less than 1 minute. (Download the F/W via here 下載韌體)

0) Hook up composite cable if possible and watch progress over composite connection.
1) download firmware
2) unzip/unrar
3) copy "install.img" file to the ROOT directory of a FAT32 FORMATTED USB drive ONLY.
4) Put USB drive into front usb port of Patriot Box Office
5) Go to SETUP -> SYSTEM -> SYSTEM UPDATE, & select SYSTEM UPGRADE
6) The screen will black out for about a few seconds until the update process initiates.

更新方式

0) 接上螢幕，以便監控韌體的更新進度
1) 下載韌體
2) 將 install.7z 解開
3) 將解開的 install.img 拷貝至姆指碟的根目錄 （格式必須是 FAT32)
4) 將姆指碟插入撥放器前端的 USB
5) 在操作選單中，選擇 "SETUP" -> "SYSTEM" -> "SYSTEM UPDATE" -> "SYSTEM UPGRADE"
6) 等待機器更新韌體，此時螢幕會閃一下變黑，接著顯示更新的進度

Features added and merged from the hackers from China:

• IMS - Youtube
• IMS - Youku (China)
• IMS - VTS (China)
• IMS - hdpfans (China)
• IMS - HaoIMS (China) 
• IMS - Voole (China)
• Interface - Web Control
• Application - BT Transmission (support private tracker), the default BT client BTPD is still alive
• Server - lighttpd (support CGI and PHP )
• Server - vsftpd

 Web Control interface

More details about the hacked F/W

lighttpd

• new added http server for web control
• port: 8080
• document base: /usr/local/etc/www/
• CGI base: /usr/local/etc/www/cgi-bin/

httpd

• original http server
• port: 80
• original bt client

vsftpd

• port: 21

 BT transmission

• Launch it by this command "/opt/bin/transmission-daemon -t -u user -v password -w /tmp/usbmounts/sda1/BT/ -er --dht --peerport 51413 -a "*" --peerlimit-global 60"
• -u: username for login control
• -v: password for login control
• -t: if you want login control , "-t" option is a must
• -w: the directory for downloading torrents
• -a: IP access control, "*" means any IP can connect to the BT management page
•  default port is "9091", you can change it by adding "-p 9000"
• access it via http://your.ip.address:9091/

Web control interface

• access it via http://your.ip.address:8080/webremote.html

Original BT download system

• access it via http://your.ip.address/