Seek Movie Player hack for B650 series

[aquadran]

I just made Movie Player hack which allow override seek time for up/down buttons while movie is played. Original behaviour is seek movie into begin or end of movie. Code actually did seek movie with big+/- values. My hack detect such values and cut it down to 60 secunds seek offset.
Personally I use 3min offset.
Minus thing of this is, it also cut down normal seek movie control (left/right buttons). So better is have at least 60s I think.

I made only info here as I'm too lazy to prepape user end patcher and this hack info is for 2005.0 T-CHL7DEUC firmware.
So here a hack:

offsets in binaries:

exe.img 0x01572DD0
exeDSP 0x00DFFDD0
dissasm 0x00E07DD0

original part:

.text:00E07DD0 FMSR S13, R4
.text:00E07DD4 LDR R1, =aVirtualBool_55
.text:00E07DD8 LDR R2, =619
.text:00E07DDC LDR R0, =aSDFcontrolF ; "@@@@@@ [%s:%d] fControl = %f\n"
.text:00E07DE0 FCVTDS D7, S13
.text:00E07DE4 FSTD D7, [SP,#0x28+var_28]
.text:00E07DE8 BL printf
.text:00E07DEC FMSR S15, R4
.text:00E07DF0 LDR R2, [R5,#0x4FC]
.text:00E07DF4 MOV R0, R2
.text:00E07DF8 FTOSIZS S15, S15 s15 = s15
.text:00E07DFC LDR R3, [R2]
.text:00E07E00 FMRS R1, S15 r1 = s15

rest code will not be replaced:
.text:00E07E04 MOV LR, PC
.text:00E07E08 LDR PC, [R3,#0x30]
.text:00E07E0C MOV R3, #10
.text:00E07E10 MOV R0, #1
.text:00E07E14 STR R3, [R5,#0x18]
.text:00E07E18 B loc_E07CC4


so I replace code from 00E07DD0 to 00E07E00:

FMSR S15, R4 90 4A 07 EE // R4 contain seek time in seconds, float number saved in register
FTOSIZS S15, S15 E7 7A FD EE // convert into integer
FMRS R1, S15 90 1A 17 EE // convert float into decimal register value
MOV R2, #60 3C 20 A2 E3 // 60sec (that 0x3C in opcode max 0xFF) as base value for range
MVN R3, R2 02 30 E0 E1 // negate R2 to have -60sec value
CMP R1, R2 02 00 51 E1 // compare seek time to 60s
MOVGT R1, R2 02 10 A0 C1 // set seek 60s time if bigger than 60s
CMP R1, R3 03 00 51 E1 // compare seek time to -60s
MOVLT R1, R3 03 10 A0 B1 // set seek -60s time if less than -60s
LDR R2, [R5,#0x4FC] FC 24 95 E5 // rest of original code...
MOV R0, R2 02 00 A0 E1
LDR R3, [R2] 00 30 92 E5
MOV R0, R0 00 00 A0 E1 // NOP, I have left 1 opcode spare

[aquadran]

Unfornatelly I noticed now more one side effect, it also affect resume play :/ So thing need to be fixed.

[flo-ogb]

the patch has no effect on my tv (T-CHUCIPDEUC, CI+). there seems to be a debug option in the source, but the file is not created. is it deactivated? since i don't have the toolchain ready, can you post a debug version? is there anything else i can do to help you? i really need this functionality

i do have a debian chroot environment ready to run on the tv, maybe this can help with debuging...

[flo-ogb]

sorry for replying this late, but i have trouble logging in to sf sometimes.

somehow it worked this time. i'm pretty sure i changed the function call to patch_main and put the time parameters in quotation marks, but i copied the injector command from one of my scripts. so maybe inbetween copying back and forth i managed to break it. stupid me

the patch works perfectly now (using offset of 300 for both). finally i'm able to seek properly in movies! is it possible to add more keys to this? at least it should be possible to patch the left and right keys to, if someone wants to change this intervall. but it would be nice to have something to seek maybe 20 minutes or so. color keys? program switcher? or maybe the REW and FF keys that don't work that great anyway. perhaps theese last two are the best option, because they are not used for anything else, that could interfere with other hacks.

[erdem_ua]

I believe CI+ TV's has some different offset for the patch.
Will include this into Firmware Patcher soon.
Thanks for the hack pushad.

[aquadran]

At first, sorry for my english, I do know it's not perfect
At second, this is wrong way to change UP & DOWN seek keys. I have trace it to CWProVideoPlayer::ProcessDirectionKey and found much easiest way

Code: Select all

LDR     R2, [R6,#0xC]       ; onDown
LDR     R4, =0xCE800000   ; float -1073741824.00
MOV     R0, R2

Code: Select all

LDR     R2, [R6,#0xC]       ; onUp
LDR     R4, =0x4D4CCCCD   ; float 214748368.00
MOV     R0, R2

we just need to patch values on offsets with this floats, that's all

nice finding good work !

in this fuction can be also changed values for left, right keys -10/+10s seek times