I-Hacked.com Taking Advantage Of Technology

Home Consumer Electronics Misc Hacking the Roku M500

03 February 2012

Main Menu

- - - - - - -

- - - - - - -

Latest Edge

Vote for us in Top 100 Security Sites

Newsflash

Hacking the Roku M500

Written by dmoltr_blink

Saturday, 12 February 2005

If you have or are thinking of purchasing a Roku SoundBridge Network Music Player you should know of an exciting, yet under-documented feature. The manual has a small paragraph that states:

Geeks — Read This The SoundBridge has a command line interface that you can “telnet” to for piddling about. You will need to telnet to port 4444. Type “?” at the command prompt to see a list of commands. We will be documenting in more detail how to control a SoundBridge in the coming months, as well as updating the software in this area. When documentation is available, it will be posted on the developer section of our web site.

User dmoltr_blink explores this telnet interface for us.

Roku hasn't provided much information regarding this feature, so I will provide as much as I have discovered here. As they have described, you enter the interface using a telnet program. There are many other locations for finding out more information on using Telnet, so I won't go into a primer. Once you are using telnet, you need to communicate with your SoundBridge. If you have setup your Network Music Player, you should know its IP address. Mine is 192.169.1.102. As described by Roku, the port you need is 4444. The easiest way to establish a connection is to select Run from your Windows Start Menu, and type 'telnet 192.168.1.XXX 4444'. Replace XXX with your SoundBridge's specific IP address. It is often 101-103, depending on the number of network devices you have connected.

Once connected you will see:

Welcome to the SoundBridge Shell version 2.1.20 Release Type '?' for help or 'help <command>' for help on <command>. SoundBridge>

Typing '?' or 'help' will display the following:

Valid commands are: ? - displays this list help - provides help on a command clear - clears the terminal window stty - sets shell tty parameters consoleprint - sets consoleprint on or off version - prints out the software version exit - exits the shell cycles - displays a count of processor cycles uptime - reports system uptime reboot - reboots the system ps - lists threads irdump - toggles diagnostic dumping of ir commands audiowarble - generates an audio warble. audiotone - generates an audio tone (help audiotone for more help) audioclocks - Report if the audio clock is running. lcdbr - Allows setting of LCD brightness ifconfig - lists network interface configurations ping - pings an ip address ipset - sets up a manual config mfg - performs mfg tests memstat - prints out memory statistics htplay - plays back audio from a URL using CascadeHTTPStream stop - stops audio playback irwait - Wait for a specific IR command romcheck - Print Rom Sizes displaytype - Print type of currently connected DISplay log - Dump the persistent log logclear - Clear the log attract - attract eyeballs clearsettings - clears CascadeSettings and reboots sketch - draw on the display renameservice - engages rendezvous service renaming for conformance test SoundBridge>

I wish I had ALL the answers, but I don't. I will now go through the commands one at a time, with whatever information I have discovered thus far. All output from the SoundBridge is displayed in yellow. I own the SoundBridge M500. This is the smallest one. There is also the M1000 and the M2000. The largest difference apparently is the display. Mine has a small LCD display, whereas the others have VFDs, or Vacuum Fluorescent Displays. These are brighter so that you can read the display from across the room. I believe the model of the SoundBridge also affects the commands in the telnet shell.

?	Displays list of commands. ? The most informative way to get help for a command is to type '<command> ?', as in "stty ?", or "sketch ?".
help	Provides help on a command. help <command> Note: Results vary. Not many of the commands actually respond with any helpful information whatsoever.
clear	Clears the terminal window. clear This command does not affect the SoundBridge. It simply erases the terminal window to make it uncluttered and easier to read.
stty	Sets shell TTY parameters. stty [echo\|crlf] [on\|off] This command does not affect the SoundBridge. It changes the way the shell behaves. Echo causes each character you type to be echoed back, resulting in each typed character showing twice. If you don't see the characters you are typing, then this command will fix that. Simple change the echo to ON. Crlf should not need to be changed either. Turning it off stops the display from automatically going to the next line resulting in all of the text wrapping around the screen.
consoleprint	Prints the text to a line printer. consoleprint [on\|off] This command does not affect the SoundBridge. It will cause any text received to be printed to the computer's default printer. If it is a laser or ink-jet printer, it will not print until a full-page has been sent to the printer.
version	Displays the software version. version This command will display the SoundBridge's current software version number. As updates become available and are installed, this number will change. `version: software version 2.1.20 Release`
exit	Exits the shell. exit `Connection to host lost.`
cycles	Displays a count of processor cycles. cycles I have no idea what usefulness this command has. `cycle count is 274488611565869`
uptime	Reports system uptime. uptime `system uptime is 686276.348 seconds`
reboot	Reboots the Roku SoundBridge. reboot This command will turn the SoundBridge on if it is currently in Standby mode. It will reset the SoundBridge if it is currently on. The terminal connection will be lost as well.
ps	Lists threads. ps I have not discovered the usefulness of this command, but it does appear to list the current processes that the SoundBridge is running. ID PRIO STACK MAX STACK STATUS THREAD NAME --- ---- ----- --------- ---------------- ----------- 001 30 24576 332 SemaphoreBlocked ConsoleShell 003 1 24576 58 SemaphoreBlocked Audonis 002 20 24576 58 SemaphoreBlocked Notifier 004 29 24576 532 Ready CascadeSettings 005 5 16384 272 SemaphoreBlocked kadak_ipstack 006 4 16384 65 Sleeping kadak_timertask 007 16 24576 2474 Sleeping mDNSResponder 008 28 24576 455 Sleeping AllegroNotifier 009 28 24576 506 Ready Allegro 011 28 24576 331 Ready Chooser 012 17 24576 282 Sleeping SlimDiscoMan 013 4 24576 508 MessageBlocked TelnetListener:4444 014 28 24576 293 Ready iTunes main app thread 32778 28 24576 413 Ready ShellTelnet 6
irdump	Toggle diagnostic dumping of IR codes. irdump Gives the command received by use of the remote control. Below are the values received from all of the buttons from top to bottom, left to right. `IrWait got key CK_POWER IrWait got key CK_BRIGHTNESS IrWait got key CK_MENU IrWait got key CK_SEARCH IrWait got key CK_EXIT IrWait got key CK_NORTH IrWait got key CK_WEST IrWait got key CK_SELECT IrWait got key CK_EAST IrWait got key CK_SOUTH IrWait got key CK_PREVIOUS IrWait got key CK_PLAY IrWait got key CK_NEXT IrWait got key CK_PAUSE IrWait got key CK_VOLUME_UP IrWait got key CK_ADD IrWait got key CK_SHUFFLE IrWait got key CK_VOLUME_DOWN IrWait got key CK_REPEAT`
audiowarble	Generates an audio warble. audiowarble Plays a continuous test sequence from your stereo's speakers. The command does not seem to have an OFF setting. `Enabling audio warble tone generation.`
audiotone	Generate an audiotone. audiotone [toneHertz] [sampleFrequency] valid values for sampleFrequency are: 48, 44.1, 32, 24, 22.05 default is 1000Hz at 48Khz Generates an audible "test-tone" from your stereo's speakers. This command does not have an OFF setting. `Enabling audio tone generation 1000Hz at sample rate 48000Hz.`
audioclocks	Report if the audio clock is running. audioclocks Tests the SoundBridge's digital audio out circuit. I don't know if it is used to troubleshoot the digital audio out ports, or if it is used to determine the type of audio output the listener is currently using. `DMA2_XCOUNT is changing, which indicates that the SPDIF clock is still working.`
lcdbr	Allows setting of LCD brightness. lcdbr [0-100] Sets the brightness of the LCD display. Expressed in integers between 0 and 100. `lcdbr: Setting LCD brightness to 100`
ifconfig	Lists network interface configurations. ifconfig Displays detailed information regarding its connection to the network. `ENET Interface: 0 (kEthernet) has a dhcp assigned address MAC Address: 00:0D:4B:03:76:EC IP Address: 192.168.1.102 Netmask: 255.255.255.0 Gateway: 192.168.1.1 DNS 1: 24.92.226.52 DNS 2: 24.92.226.48`
ping	Pings an IP address. ping [xxx.xxx.xxx.xxx] [y] y=Number of repetitions Pings specified IP address for the number of repetitions, or the default which is four times. `Pinging 192.168.1.1... ping: reply from 192.168.1.1: time=4ms ping: reply from 192.168.1.1: time=1ms ping: reply from 192.168.1.1: time=1ms ping: reply from 192.168.1.1: time=1ms`
ipset	Sets up a manual or automatic ethernet configuration. ipset Lets you specify the exact ethernet configuration, or set it back to the default setup. `ipset: Changing configuration for Ethernet interface ipset: (A)utomatic or (M)anual Configuration (A/M)? M ipset: (M)anual Configuration ipset:` `IP Address? 192.168.1.102ipset: Subnet Mask? 255.255.255.0ipset: Default Gateway? 192.168.1.1ipset: DNS Server 1? 24.92.226.52ipset: DNS Server 2? 24.92.226.48 ipset: configuration succeeded and will take effect on next boot`
mfg	Performs manufacturer tests. mfg Does a self test. `all tests passed`
memstat	Prints out memory statistics. memstat Displays current memory usage. `memstat: Total Bytes = 14123007 = 13791k Bytes Used = 10511856 = 10265k Bytes Free = 3611151 = 3526k High Watermark = 13065384 = 12759k Largest Free Block = 2245488 = 2192k`
htplay	Plays back audio from a URL using CascadeHTTPStream htplay http://ipAddress/path I cannot get anything to play no matter what address I type in. `htplay: failed to play http://pri.kts-af.net/redir/index.pls?esid=66ab0989f31524123ce52a67b53e8b93 &url_no=1&client_id=7&uid=68efed4d03ec0989f315241232c107180&clicksrc=xml`
stop	Stops audio playback. stop
irwait	Wait for specific IR command irwait {any\|all} <CK_KEY> [<CK_KEY>] ... Seems to wait until a certain key is pressed. Check the irdump command above for key command codes.
romcheck	Prints ROM sizes. romcheck `Rom 0: Bytes = 524288, Sectors = 8, Bytes per Sector = 65536 Rom 1: Bytes = 2097152, Sectors = 32, Bytes per Sector = 65536`
displaytype	Prints type of currently connected display. displaytype `LCD`
log	Dump the persistent log. log I haven't figured out what data gets logged yet. I just get multiple copies of the following dump: `SoundBridge startup... SoundBridge startup...`
logclear	Clear the log. logclear
attract	Attract eyeballs. attract I have no clue as to what this command does.
clearsettings	Clears CascadeSettings and reboots. clearsettings Seems to clear all settings.
sketch	Draw on the display. sketch [-c command] -c execute command and quit Probably the coolest command of them all! This command enters a special text entry mode where what you type is displayed on the Roku display. Once in the sketch mode, these are the commands: text x y "text" - draws text marquee "text" - slides text across the display clear - clears display quit - quits sketch
renameservice	`Engages rendezvous service renaming for conformance test.` `renameservice` `renameservice: renamed service to "New - Rendezvous Service Name!"`

Note: Because the display is LCD, I cannot get an accurate shot of the color. It is actually bright yellow on brown.

Last Updated ( Saturday, 12 February 2005 )