Remote problem

[music5]

Hi everyone,

I am having trouble with my nano 2 remote after converting. I was wondering if I can use my old cnx mini remote? Has anyone else experienced this?

[dishuser]

Hi everyone,

I am having trouble with my nano 2 remote after converting. I was wondering if I can use my old cnx mini remote? Has anyone else experienced this?what problem?
buttons become different after conversion so mini remote would be the same problem

[music5]

Button are not working as the label. It is hard to remember what functions works with what buttons. Is there any fix for this problem?

[dishuser]

Button are not working as the label. It is hard to remember what functions works with what buttons. Is there any fix for this problem?

yup
improve your memory...lol

[northernguy]

I got a universal remote and it worked fine.

[jvvh5897]

Why not investigate modding the code to get the buttons working right?

CNX is Conexant processor based--it is not that hard to work on ARM code. I have a Viewsat box (Conexant processor) that did not come with remote so I reworked the code to let me use a remote that I had sitting around.

[jvvh5897]

Here is what I found in a quick look at the ir2x 2.84 file. There are two sections of glib zipped stuff. Un-packed the 1st of them and loaded it into IDA Pro at RAM base addr 0x580000. Ran the standard IDC for ARM code and found routines directly involved with IR:

006A2E24 ; task create
00639B30 ; init_register_isr
006745D8 ; semaphore install used by FTIR
005A6AFC ; 469 FTIR task handler
0058D484 ; IRPT receive fifo
0059DED4 ; IR FIFO receive
0063C6F4 ; debug message
0062BEE0 ; IR decode
0059E440 ; flash LED in response to remote?

Within one routine:
custom code tests
ROM:0063B308 MOVL R0, 0x3340--standard CNX remote custom code (jp1 file shows 204,2 == 02CC)
ROM:0063B30C CMP R6, R0
ROM:0063B30E BEQ loc_63B338
ROM:0063B310 LDR R0, =0x202
ROM:0063B312 CMP R6, R0

ROM:0063B350 LDR R0, [R4,#4]
ROM:0063B352 LSL R6, R0, #0x10
ROM:0063B354 LSR R6, R6, #0x10
ROM:0063B356 LSL R0, R6, #0x10
ROM:0063B358 LSR R7, R0, #0x18
ROM:0063B35A MOV R0, #0xFF
ROM:0063B35C BIC R0, R6
ROM:0063B35E STR R0, [SP,#0x60+var_54]
ROM:0063B360 LDR R0, [SP,#0x60+var_54]
ROM:0063B362 CMP R7, R0 ; test for button code = not button code--part of the NEC2 format
ROM:0063B364 BEQ loc_63B37E
ROM:0063B366 LDR R1, =aWsNoMatch
ROM:0063B368 SUB R1, #0x28 ; "BAD, restart"
ROM:0063B36A LDR R0, =0x90000400
ROM:0063B36C BL sub_6A9150
ROM:0063B370 LDR R0, =aWsNoMatch
ROM:0063B372 ADD R0, #0x38 ; "IR: Data error, Check failed"

So, somewhere around this section of code, slip in a mod to send the button codes out the serial port--make yourselves a table.
Figure out what button codes need to be swapped--if many use a table, if only a couple then simple swap would work. Either hand code the swaps or build C code and compile it with WinARM gcc compiler. Put it all together, compress it, fix checksum(s)--you might find cw600's cwtool source code of use there. And you end up with your own file that does remote as you want.

If you want help, I'm willing to do a little. But you have to start it up yourselves. Capture serial output of box. Learn to unpack the code. Learn to repack the code. Fix checksums. In all--TEST.

[jvvh5897]

Looking at the code in more detail, I found that there are four tables to support lookup already--maybe 6 or so remotes supported. So, I'm thinking that all you need to do is cross ref the buttons that work to the table of the remote that works the best and just move an entry or two in the table for your remote. Here is the table for the trio remote and what button code that remote sends:
0x400 bytes
lookup table:
custom codes 0x3340 or 0xbbc0 (0x02cc or 0x03dd reversed)
ROM:00793600 D1 00 00 00 C8 00 00 00 --returned values for 0 and 1 are D1 and c8 resp
ROM:00793610 C9 00 00 00 CA 00 00 00 CB 00 00 00 CC 00 00 00
ROM:00793620 CD 00 00 00 CE 00 00 00 CF 00 00 00 D0 00 00 00
ROM:00793630 B0 00 00 00 8A 00 00 00 9F 00 00 00 B4 00 00 00
ROM:00793640 8B 00 00 00 C3 00 00 00 87 00 00 00 8E 00 00 00 --0x10 returns 87
ROM:00793650 12 01 00 00 D7 00 00 00 D9 00 00 00 C1 00 00 00
ROM:00793660 C6 00 00 00 10 01 00 00 00 00 00 00 D8 00 00 00
ROM:00793670 8C 00 00 00 1A 00 00 00 C2 00 00 00 DD 00 00 00
ROM:00793680 C5 00 00 00 C4 00 00 00 00 00 00 00 00 00 00 00 --0x20 returns 00
ROM:00793690 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ROM:007936A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ROM:007936B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ROM:007936C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ROM:007936D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ROM:007936E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ROM:007936F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ROM:00793700 00 00 00 00 00 00 00 00 BA 00 00 00 B5 00 00 00 --0x40 returns 0xba
ROM:00793710 8D 00 00 00 13 01 00 00 DA 00 00 00 11 01 00 00
ROM:00793720 09 01 00 00 BD 00 00 00 C0 00 00 00 00 00 00 00
ROM:00793730 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ROM:00793740 00 00 00 00 00 00 00 00 B9 00 00 00 B8 00 00 00 --0x50 returns 0xb9
ROM:00793750 9E 00 00 00 A2 00 00 00 14 01 00 00 15 01 00 00
ROM:00793760 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ROM:00793770 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ROM:00793780 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ROM:00793790 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ROM:007937A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ROM:007937B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ROM:007937C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ROM:007937D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ROM:007937E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ROM:007937F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ROM:00793800 00 00 00 00 00 00 00 00 FF 00 00 00 FF 00 00 00
ROM:00793810 FF 00 00 00 FF 00 00 00 FF 00 00 00 FF 00 00 00
ROM:00793820 FF 00 00 00 FF 00 00 00 FF 00 00 00 FF 00 00 00
ROM:00793830 FF 00 00 00 FF 00 00 00 FF 00 00 00 FF 00 00 00
ROM:00793840 FF 00 00 00 FF 00 00 00 FF 00 00 00 FF 00 00 00
ROM:00793850 FF 00 00 00 FF 00 00 00 FF 00 00 00 FF 00 00 00
ROM:00793860 FF 00 00 00 FF 00 00 00 FF 00 00 00 FF 00 00 00
ROM:00793870 FF 00 00 00 FF 00 00 00 FF 00 00 00 FF 00 00 00
ROM:00793880 FF 00 00 00 FF 00 00 00 FF 00 00 00 FF 00 00 00
ROM:00793890 FF 00 00 00 FF 00 00 00 FF 00 00 00 FF 00 00 00
ROM:007938A0 FF 00 00 00 FF 00 00 00 FF 00 00 00 FF 00 00 00
ROM:007938B0 FF 00 00 00 FF 00 00 00 FF 00 00 00 FF 00 00 00
ROM:007938C0 FF 00 00 00 FF 00 00 00 FF 00 00 00 FF 00 00 00
ROM:007938D0 FF 00 00 00 FF 00 00 00 FF 00 00 00 FF 00 00 00
ROM:007938E0 FF 00 00 00 FF 00 00 00 FF 00 00 00 FF 00 00 00
ROM:007938F0 FF 00 00 00 FF 00 00 00 FF 00 00 00 FF 00 00 00
ROM:00793900 FF 00 00 00 FF 00 00 00 FF 00 00 00 FF 00 00 00
ROM:00793910 FF 00 00 00 FF 00 00 00 FF 00 00 00 FF 00 00 00
ROM:00793920 FF 00 00 00 FF 00 00 00 FF 00 00 00 FF 00 00 00
ROM:00793930 FF 00 00 00 FF 00 00 00 FF 00 00 00 FF 00 00 00
ROM:00793940 FF 00 00 00 FF 00 00 00 FF 00 00 00 FF 00 00 00
ROM:00793950 FF 00 00 00 FF 00 00 00 FF 00 00 00 FF 00 00 00
ROM:00793960 FF 00 00 00 FF 00 00 00 FF 00 00 00 FF 00 00 00
ROM:00793970 FF 00 00 00 FF 00 00 00 FF 00 00 00 FF 00 00 00
ROM:00793980 FF 00 00 00 FF 00 00 00 FF 00 00 00 FF 00 00 00
ROM:00793990 FF 00 00 00 FF 00 00 00 FF 00 00 00 FF 00 00 00
ROM:007939A0 FF 00 00 00 FF 00 00 00 FF 00 00 00 FF 00 00 00
ROM:007939B0 FF 00 00 00 FF 00 00 00 FF 00 00 00 FF 00 00 00
ROM:007939C0 FF 00 00 00 FF 00 00 00 FF 00 00 00 FF 00 00 00
ROM:007939D0 FF 00 00 00 FF 00 00 00 FF 00 00 00 FF 00 00 00
ROM:007939E0 FF 00 00 00 FF 00 00 00 FF 00 00 00 FF 00 00 00
ROM:007939F0 FF 00 00 00 FF 00 00 00 FF 00 00 00 FF 00 00 00
ROM:00793A00 FF 00 00 00 C0 00 00 00

0 0
1 1
2 2
3 3
4 4
5 5
6 6
7 7
8 8
9 9
A Power
B up
C Fn
D OK
E down
F mute
10 left
11 right
12 prev
13 Red
14 Yellow
15 vol up
16 info
17 setup
18 sat
19 Green
1A Pg up
1B subt
1C vol down
1E ch down
1F ch up
40 menu
41 Exit
42 Pg down
43 seek
44 Blue
45 Fav
46 TV out
47 display
48 divx
50 stop
51 play
52 pause
53 rec
54 rewind
55 F forward

The other tables are at:
ROM:0063B54C off_63B54C DCD unk_793608 --shown above
ROM:0063B550 off_63B550 DCD unk_793A08
ROM:0063B554 off_63B554 DCD unk_6FA570
ROM:0063B558 off_63B558 DCD unk_793E08

----------------------------------------------------------------------------
I can offer a tool to extract the main sw from the ups file, a tool to recompress it and fix most checksums but you still have to put the file back together by yourselves (just a matter of cut and paste in a hexeditor and inserting a crc32 at the end of the file).

You will have to find what remote you have and which table is used for it--you could just mod table to swap number 0 and number 1, or actually try to mod a table for the specific buttons you are having trouble with.

I would think it would be a one day project if you work at it--maybe two if you have trouble with the tools. But it is largely cut and paste and mouse drops. You might want to pick up hexeditor like XVI32 or some other freeware hexeditor.

[jvvh5897]

So, should I post the three tools that extract main sw, fix internal checksum, and re-compress it into something that you can paste back into files? Any interest?

[jvvh5897]

Well, that is sad. What if I point out that the tools would allow exploration of CNX files as well? Likely one could find a single file load that allowed one to change from using CNX file to the box bing a converted one and then back again. Or maybe add the function that you want of the converted box to a CNX file.

[unclesonny]

Hi Northernguy,

I am also from the North.. Could you let me know what brand\model remote you purchased so I can get this box of my friends working.
Thanks!