Home

Conexant "SuperDVR" TD310x (3100:F200) DVR USB card first run under 2.6.37.6 linux kernel

2011-04-05
Well, playing with developing of device driver, reverse engineering/disassembling of Windows driver TD3101_3104AV.sys, sniffing of usb protocol and extracting firmware got first result under 2.6.37.6 kernel: 
kernel: [10116.711051] usb 1-3: new high speed USB device using ehci_hcd and address 10
kernel: [10116.825450] usb 1-3: New USB device found, idVendor=3100, idProduct=f200
kernel: [10116.825455] usb 1-3: New USB device strings: Mfr=0, Product=0, SerialNumber=0
kernel: [10116.831143] td310x: Firmware CRC ok
kernel: [10116.846223] td310x: Firmware loading complete
kernel: [10116.846252] td310x: Waiting to soft reconnect device
kernel: [10116.876373] usb 1-3: USB disconnect, address 10
kernel: [10116.876416] td310x: Device disconnected
kernel: [10118.634047] usb 1-3: new high speed USB device using ehci_hcd and address 11
kernel: [10118.749853] usb 1-3: New USB device found, idVendor=3100, idProduct=f200
kernel: [10118.749858] usb 1-3: New USB device strings: Mfr=1, Product=2, SerialNumber=0
kernel: [10118.749863] usb 1-3: Product: TD310X
kernel: [10118.749867] usb 1-3: Manufacturer: Conexant
kernel: [10118.783100] td310x: Manufacturer Conexant, product TD310X
kernel: [10118.783108] td310x: Hardware has 6 interfaces
kernel: [10118.783246] td310x: Interface #0 has 3 endpoints
kernel: [10118.783254] td310x: EP #1, type: bulk, dir: <-, packet: 512 bytes
kernel: [10118.783262] td310x: EP #1, type: bulk, dir: ->, packet: 512 bytes
kernel: [10118.783269] td310x: EP #2, type: bulk, dir: <-, packet: 512 bytes
kernel: [10118.783622] td310x: Interface #1 has 3 endpoints
kernel: [10118.783632] td310x: EP #1, type: bulk, dir: <-, packet: 512 bytes
kernel: [10118.783638] td310x: EP #1, type: bulk, dir: ->, packet: 512 bytes
kernel: [10118.783646] td310x: EP #2, type: bulk, dir: <-, packet: 512 bytes
kernel: [10118.784041] td310x: Interface #2 has 3 endpoints
kernel: [10118.784050] td310x: EP #1, type: bulk, dir: <-, packet: 512 bytes
kernel: [10118.784057] td310x: EP #1, type: bulk, dir: ->, packet: 512 bytes
kernel: [10118.784066] td310x: EP #2, type: bulk, dir: <-, packet: 512 bytes
kernel: [10118.784488] td310x: Interface #3 has 3 endpoints
kernel: [10118.784498] td310x: EP #1, type: bulk, dir: <-, packet: 512 bytes
kernel: [10118.784505] td310x: EP #1, type: bulk, dir: ->, packet: 512 bytes
kernel: [10118.784513] td310x: EP #2, type: bulk, dir: <-, packet: 512 bytes
kernel: [10118.784766] td310x: Interface #4 has 3 endpoints
kernel: [10118.784772] td310x: EP #1, type: bulk, dir: <-, packet: 512 bytes
kernel: [10118.784777] td310x: EP #1, type: bulk, dir: ->, packet: 512 bytes
kernel: [10118.784781] td310x: EP #2, type: bulk, dir: <-, packet: 512 bytes
kernel: [10118.785149] td310x: Interface #5 has 3 endpoints
kernel: [10118.785155] td310x: EP #1, type: bulk, dir: <-, packet: 512 bytes
kernel: [10118.785159] td310x: EP #1, type: bulk, dir: ->, packet: 512 bytes
kernel: [10118.785163] td310x: EP #2, type: bulk, dir: <-, packet: 512 bytes
kernel: [10118.786629] td310x: Successfully registered device
This card has 2 audio and 4 video capture channels. Based on CY7C68013A56LFXC and cx25843-24Z chips. Next step is to understand i2c/urb exchange, 0x44 is cx25843 i2c address: 
08 44 03 08 03 03 <- 0x44 i2c write
09 02 01 44 08 03 <- 0x44 i2c read
If someone have any useful info of this board, plz let me know.

I2C disassembled subroutine

Submitted by Dima on Sat, 04/09/2011 - 09:01.
As disassembling is just my hobby, process going not fast. Anyway I have full disassembled windows driver to analyze system calls. 
.text:00019366 aTuneri2caddres db 'TunerI2CAddress',0  ; DATA XREF: sub_19386+30
.text:00019376 aTuner2ifaddres db 'Tuner2IFAddress',0  ; DATA XREF: sub_19386+41
.text:00019386
.text:00019386 ; =============== S U B R O U T I N E =======================================
.text:00019386
.text:00019386 ; Attributes: bp-based frame
.text:00019386
.text:00019386 sub_19386       proc near               ; CODE XREF: sub_19A9E+67
.text:00019386                                         ; sub_19A9E+8A
.text:00019386
.text:00019386 var_C           = byte ptr -0Ch
.text:00019386 var_4           = dword ptr -4
.text:00019386 arg_0           = dword ptr  8
.text:00019386 arg_4           = dword ptr  0Ch
.text:00019386
.text:00019386                 push    ebp
.text:00019387                 mov     ebp, esp
.text:00019389                 sub     esp, 0Ch
.text:0001938C                 push    esi
.text:0001938D                 mov     esi, [ebp+arg_0]
.text:00019390                 push    edi
.text:00019391                 mov     ecx, esi
.text:00019393                 call    sub_10A30
.text:00019398                 mov     edi, eax
.text:0001939A                 mov     eax, [esi+188h]
.text:000193A0                 mov     [ebp+var_4], 0C0h
.text:000193A7                 push    dword ptr [eax+10h]
.text:000193AA                 lea     ecx, [ebp+var_C]
.text:000193AD                 call    sub_1844E
.text:000193B2                 lea     eax, [ebp+var_4]
.text:000193B5                 push    eax
.text:000193B6                 push    offset aTuneri2caddres ; "TunerI2CAddress"
.text:000193BB                 lea     ecx, [ebp+var_C]
.text:000193BE                 call    sub_185F2
.text:000193C3                 lea     eax, [ebp+arg_0]
.text:000193C6                 push    eax
.text:000193C7                 push    offset aTuner2ifaddres ; "Tuner2IFAddress"
.text:000193CC                 lea     ecx, [ebp+var_C]
.text:000193CF                 mov     [ebp+arg_0], 86h
.text:000193D6                 call    sub_185F2
.text:000193DB                 cmp     [ebp+arg_4], 13h
.text:000193DF                 jz      short loc_1941F
.text:000193E1                 push    98h
.text:000193E6                 call    sub_187AE
.text:000193EB                 cmp     [ebp+arg_4], 17h
.text:000193EF                 pop     ecx
.text:000193F0                 jz      short loc_19409
.text:000193F2                 test    eax, eax
.text:000193F4                 jz      short loc_19437
.text:000193F6                 push    [ebp+arg_0]
.text:000193F9                 mov     ecx, eax
.text:000193FB                 push    [ebp+var_4]
.text:000193FE                 push    [ebp+arg_4]
.text:00019401                 push    edi
.text:00019402                 call    sub_1A2B6
.text:00019407                 jmp     short loc_19433
.text:00019409 ; ---------------------------------------------------------------------------
.text:00019409
.text:00019409 loc_19409:                              ; CODE XREF: sub_19386+6A▒j
.text:00019409                 test    eax, eax
.text:0001940B                 jz      short loc_19437
.text:0001940D                 push    [ebp+arg_0]
.text:00019410                 mov     ecx, eax
.text:00019412                 push    [ebp+var_4]
.text:00019415                 push    17h
.text:00019417                 push    edi
.text:00019418                 call    sub_19DC7
.text:0001941D                 jmp     short loc_19433
.text:0001941F ; ---------------------------------------------------------------------------
.text:0001941F
.text:0001941F loc_1941F:                              ; CODE XREF: sub_19386+59▒j
.text:0001941F                 push    8
.text:00019421                 call    sub_187AE
.text:00019426                 test    eax, eax
.text:00019428                 pop     ecx
.text:00019429                 jz      short loc_19437
.text:0001942B                 push    edi
.text:0001942C                 mov     ecx, eax
.text:0001942E                 call    sub_19D88
.text:00019433
.text:00019433 loc_19433:                              ; CODE XREF: sub_19386+81▒j
.text:00019433                                         ; sub_19386+97▒j
.text:00019433                 mov     esi, eax
.text:00019435                 jmp     short loc_19439
.text:00019437 ; ---------------------------------------------------------------------------
.text:00019437
.text:00019437 loc_19437:                              ; CODE XREF: sub_19386+6E▒j
.text:00019437                                         ; sub_19386+85▒j ...
.text:00019437                 xor     esi, esi
.text:00019439
.text:00019439 loc_19439:                              ; CODE XREF: sub_19386+AF▒j
.text:00019439                 lea     ecx, [ebp+var_C]
.text:0001943C                 call    nullsub_1
.text:00019441                 pop     edi
.text:00019442                 mov     eax, esi
.text:00019444                 pop     esi
.text:00019445                 leave
.text:00019446                 retn    8
.text:00019446 sub_19386       endp

Playing with the same toy

Submitted by CoYoTe on Wed, 06/29/2011 - 05:51.

checking "easycap" compatibility, looks like same chipset. or am i wrong?

Playing around with the same toy

Submitted by CoYoTe on Wed, 06/29/2011 - 05:52.

Looking for compatibility with easycap linux driver. Looks like same chipset. or am i wrong?

Easycap looking similar to my device

Submitted by Dima on Thu, 06/30/2011 - 14:46.

Yes, look like this is twins

Home