SamyGO

While looking for a convenient way to get the debug console (without opening the unit), I found the following thing :

If you connect a 'USB to serial adapter' to the front panel USB plug, you can remote control your unit with FANet (as you would do with a true exlink connector).
[EDIT] It also work with the rear USB connector

To do that, I used 2 FTDI cables (http://www.ftdichip.com/Support/Documen ... CABLES.pdf) :
- USB connector of the first cable to the PC
- USB connector of the second cable to the BD front pannel ([EDIT] or rear pannel)
- The TTL signal of the cables connected together (RX and TX crossed of course)

Configure your RS232 port to 9600 bds, 8 bits, 1 stop and no parity.
You can now send FANet commands (for example, hexa 08 22 00 00 00 01 D5 will turn off the unit)
Pronto users can use this to control their BD by RS232 with a pronto extender RFX9600.

Here is an example that turns off the unit (type the commands in a windows command prompt window) :
mode COM7:9600,n,8,1,p
copy /b off.bin COM7

I didn't find any cheat code to get the debug console or a shell on this port
I also did'nt find any FANet command to display the setup menu

The following off.bin file contains the following hex bytes : 08 22 00 00 00 01 D5 corresponding the the PowerOff FANet command

Nice find! Looks like ftdi_sio.ko kernel module is included in great many recent Samsung BDP/DTV products; I hope it will work for B-FIR* Samsung BD player models too (and perhaps for some TV sets as well ?).

oga83 wrote: I didn't find any cheat code to get the debug console or a shell on this port

I think there may be some real hope for shell access. E.g., in exeDSP from B-FIRHTDEUC firmware there is a method named SsBDFANet::t_ExecuteShell()...

oga83 wrote:
I also did'nt find any FANet command to display the setup menu

AFAIRC, it's possible to send "remote" keycodes via ExLink, with the following command:

0x08 0x22 0x0d 0x00 0x00 KEY_CODE CHECKSUM

I never tested this feature myself (not sure it will work with any given keycodes, perhaps only limited subset is supported).
I think I've seen keycodes for FACTORY and 3SPEED keys posted somewhere in this forum (?), but I'm unable to find them right now .

Yes, ftdi_sio.ko is loaded when the USB cable is plugged (message on the console).

I already digged into class SsBDFANet without any success (No cheat code to get a shell).
According to me, SsBDFANet::t_ExecuteShell() is only used on init to load 'usbserial.ko'

SsBDFANet::t_ConvertKeyToRemocon lists the keys that can be sent with FAnet... No FACTORY of 3SPEDD keys here
Anyway, I will try the frame you gave; I hope I missed something in the code !

It is possible to send whatever key you want with FaNet.
Use the index (not the code) of the key shown at http://wiki.samygo.tv/index.php5/Key_codes
For example, if you want to send key 1, the index is 4; Send 08220D000004C (XX is the CRC)

In particular, this works for the following keys
KEY_INFO 08220D00001FAA
KEY_FACTORY 08220D00003B8E
KEY_3SPEED 08220D00003C8D
You can use them enter Service menu

To make it simple, I wrote a small app for Windows. You can send a FaNet frame of your own, or just click on INFOS, FACTORY, 3SPEED.
To enter Service Menu, click INFOS, and FACTORY
To exit Service Menu, click FACTORY (you are now in Aging mode), and FACTORY again

Let me know how it works for you !

Thanks to sbav1 for the key frame hint !

[Edit]You can also see wiki http://wiki.samygo.tv/index.php5/Enteri ... Setup_Menu

and for those who prefer the dos copy method described above, here are the files for KEY_INFO, KEY_FACTORY, KEY_3SPEED :

Do you think it will work on BD-E6X00?

Yes, I think so, because it has USB.
However, I did not test it on this unit.

Hi Guys,
jumping in at the end here I am trying to hack my bd-e6100, (see my thread) and have come across this attack using fanet, would someone please explain the steps needed to use fanet,
at present when i go into a win7 64bit cmd window I get an error stating fanet cannot find the correct .NET frame work, which version should I be running?
cheers
Ian