Wednesday, May 28, 2008

HVR-950 infrared receiver reverse engineered

Since I finally got my Windows XP system working, I was able to run usbsnoop and see how the IR works.

From the trace, I can see that every 93ms the Windows driver reads four bytes out of register 0x45. This register isn't listed in v4l's em28xx-reg.h. This fits well into my belief that the HVR-950 is using the onboard IR receiver provided in the em2883, whereas devices based on earlier Empia designs used an external IR chip accessed via i2c.

The only thing I'm not sure of yet is how the driver detects duplicate keypresses. If the register always contains the last code received, how can you distinguish between "4" and "444"?

I think it has something to do with the format of the 4 byte responses. I believe the first couple of bytes are some sort of rolling counter, while the third byte is the actual key being hit. I don't know what the forth byte does but it always seems to be zero. Perhaps the key value is two bytes, and I just haven't seen any codes over 0xff?

For example, when I hit "2" three times, this is what I get back:

[8223488 ms] 01 1e 02 00
[8223582 ms] 01 1e 02 00
[8223676 ms] 00 1e 02 00
[8223769 ms] 00 1e 02 00
[8223863 ms] 00 1e 02 00
[8223957 ms] 00 1e 02 00
[8224051 ms] 00 1e 02 00
[8224144 ms] 00 1e 02 00
[8224238 ms] 00 1e 02 00
[8224332 ms] 81 1e 02 00
[8224426 ms] 81 1e 02 00

The other thing that will be annoying is that the current devices expect a 1-1 correlation between devices and remote controls. They're using ir-kbd-i2c instead of using lircd and so it's not as easy as defining a different remote profile. In my case in particular, it's really a problem since the HVR-950 can be using the Hauppauge "dog bone" remote or the remote that came with my Elgato EyeTV Hybrid. Fortunately I have one of each, so at least I can experiment...

Since I was up at 4am, I really should have gone to bed early. Crap.