I found one of these at my childhood home and thought I remembered this article. I tried to get it running on this frame (vr3) with no luck (the firmware update doesn't seem to persist). So I decided to buy a frame on Ebay and I got that one working. It's a coby_dp152, so it wasn't supported but it was easy enough to get it working. I pushed a repo with all the versions of the code to github, for posterity. https://github.com/Grazfather/st2205tool

bluehash, the phack message writing works on stock. I'm not sure you ever managed to get the custom firmware working at all.

Also have various types including the mentioned AX206 based units. Its worth mentioning that the ones using the 29LV800 theoretically could be swapped out with the pin compatible 29LV640 found in some old routers and thus could be reprogrammed using one of these frames. The trick would be to boot it first then swap the chip. Also worth doing, clone the existing firmware and double the storage capacity.

Hi, I've Rollei KC DPF and I discover it has AppoTech AX206 or something OTP so can not be reprogrammed etc. I find 12c64 EEPROM onboard. What about emulate EEPROM with PIC etc. and when cpu tries read picture data, send any picture (or data screen) emulated? Any idea how cpu reads data and picture format for emulating? Thanx.

I have a ViewSonic frame with a "AML6210DP" prossesor. can I hard wire it to a standart yelow A/V connector or to anything at all?

Does the video function only work if it's streamed to the device or can a file be placed on the device to run by itself?

Nice hack. I've seen in stores another kind of "digital photo frame" which is more advanced than this toy, they cost about $50 Canadian and are ~7", with full colour display and SD card slot. They sit on a shelf and display photos from the SD card. I always figured for the price, they'd be great to hack to function as a monitor... probably not very good refresh rate, and you'd have to rig your own connection (maybe one of those wifi-enabled SD cards?), but great for displaying a terminal or status display, and probably can be hacked by a firmware update file placed on the card once you know how. (Maybe some have USB too, I dunno...)

i forgot to mention the frame is HX8511

my frame is the hanna montanna photo cube. i flashed ut and it displays a white screen and wont show up under lsusb or dmesg |tail. i am looking for a way to restore my backup fw. the processor is Sitronix ST2205U chip. i cant send it messages or anything.

I get this: ./hackfw.sh: line 37: [: : integer expression expected which implies the firmware is different. You may want to change this to add the check to see if this was found at all, as otherwise it could be a completely different firmware. Btw, my device is: Bus 001 Device 005: ID 1403:0001 Sitronix Digital Photo Frame What is your's? Might be a completely different device with the same CPU. Here's my dmesg: [10324.669717] usb 1-1.3: USB disconnect, device number 4 [10334.579213] usb 1-1.3: new full-speed USB device number 5 using ehci-pci [10334.673488] usb 1-1.3: New USB device found, idVendor=1403, idProduct=0001 [10334.673500] usb 1-1.3: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [10334.673508] usb 1-1.3: Product: Flash Disk [10334.673514] usb 1-1.3: Manufacturer: USB [10334.674944] scsi5 : usb-storage 1-1.3:1.0 [10335.673797] scsi 5:0:0:0: Direct-Access SITRONIX MULTIMEDIA 0.09 PQ: 0 ANSI: 0 CCS [10335.675867] sd 5:0:0:0: Attached scsi generic sg2 type 0 [10335.678216] sd 5:0:0:0: [sdb] 4096 512-byte logical blocks: (2.09 MB/2.00 MiB) [10335.682810] sd 5:0:0:0: [sdb] Write Protect is off [10335.682818] sd 5:0:0:0: [sdb] Mode Sense: 0b 00 00 08 [10335.685321] sd 5:0:0:0: [sdb] No Caching mode page present [10335.685326] sd 5:0:0:0: [sdb] Assuming drive cache: write through [10335.690336] sd 5:0:0:0: [sdb] No Caching mode page present [10335.690343] sd 5:0:0:0: [sdb] Assuming drive cache: write through [10335.707158] sdb: unknown partition table [10335.711871] sd 5:0:0:0: [sdb] No Caching mode page present [10335.711886] sd 5:0:0:0: [sdb] Assuming drive cache: write through [10335.711895] sd 5:0:0:0: [sdb] Attached SCSI removable disk

You should check out http://picframe.spritesserver.nl/wiki/index.php/DPF_with_AppoTech_AX206 This chipset runs some nice cheap 320x240 frames!

Works Fine For cvs cheap 10 dollar photo frame, worked otb i has issues only with sending mesages to the frame, .png works fine :D

Hi, first off, nice work. I tried changing my firmware, but I did something stupid. As I was updating the st2205tool folder, I removed my original fwimage.bak. Is there any way to fix this? Or can someone give me the original firmware? My device is a TomTec photoframe.

Has anyone tried to hack the Sweex MM006, a 3.5\" DPF? I\'ve just got two of these.

How did you do it ChinaSailor? Email me: stealthmedal@live.com

Anyone have any info on the CT952A chip? I recently picked up a Digital Picture frame in Akihabara for 3900-yen, and it has SD card slot, USB, AV-out, Headphones out, and will play movies, and pictures, along with normal calendar, clock & alarm functions. This this has to be capable of booting uCLinux. Thanks

how do you hack a small photo frame so that it acutally displays animated GIFs. does anyone know? xxx kati

Awesome. Great potential. I\'ve always wanted a tiny screen I can pack to run off a box straight from a bag rather than use a laptop which is more expensive to repair, buy parts for, more annoying to dismantle, and is less flexible for upgrades and power. If you\'re going to use a socket, may as well use a box, if you can save tons of space and cash for a portable screen, all the better. A bit more development for better fps (USB3 or Intel Flash maybe? Modded ports?), and you could use it for a lot of things. Always handy having a small screen for other info too, such as PC tmp, fan cycles, etc. Thanks for info ^_^

Wouldn\'t it be great if you could get something like this that was open ? How many people would be interested in something like this I wonder ?

I get: fatal error: gd.h: No such file or directory :-(

Wow man, dit is echt té nice. Wel jammer dat het alleen op linux werkt, ik heb geen zin om van OS te veranderen alleen voor een sleutelhanger ding. Het had nog wel leuk geweest om dit dingetje te gebruiken voor een casemod ofzoiets.

You really should add a link to the wiki, it is getting lost in the comments!

I saw a tetris.asm available from 2008 for these on code.google.com/p/photokeychain i have not tried yet. Would be neat to place in flash inside the menu.

Hi, I was just wondering if you could re-write the software to maybe put games on the keyring or even turn it in to some sort of tamagotchi type thing....

Just how much of the USB protocol does the ST2205U make use of? I was thinking of using an Arduino to run this, but using full USB from in there has always been impractical.

I\'ll get me one and give this a try. I\'ve got a OpenPandora. This could be sort of used to emulate a Nintendo DS. ^_^ For the top screen.. you guys know a good model to try for that..

st2205term - a terminal for your Picframe. http://jeff.doozan.com/debian/lcd/

asd: I hack a worthless picture frame into an even more worthless movie viewer that needs a PC to get any images to it, and you think I\'m weird because of my choice of demonstration video? Dave: instead of bitching and moaning, you could also see if you could write your own code... much more efficient.

lucky star? wtf is wrong with u :/

@Josip, that does nothing for the WinXP users. Thanks for wasting our time.

I created a script to attempt to automatically generate spec+hack for a new device: http://forum.doozan.com/read.php?2,2435 (its in the second post)

For Windows users, ZoneScreen (http://www.zoneos.com/zonescreen.htm) is a great way to extend your desktop with virtual device driver for secondary monitor. I wrote a python script that received bitmaps from ZoneScreen and sent it to display connected on parallel port.

Hi. Do you know the type of display being used in the photo frame?

Cool. I was looking for e device to use as display for an a.c.rian playon! HD media player. This could work I guess. Bought a sweex photo key chain. Wish me luck!!

could this be helpful for the ct952a http://download.ourdev.cn/bbs_upload647900/files_11/ourdev_589664.pdf

u guys are amazing hacking these photo frames. Damn!!!

Ryan: Nope, you would need usb-host for that, which the device doesn\'t have.

Would it be possible to alter the firmware to directly interpret and display the output from a generic webcam?

Is possible to hack a206 digitap photo frame? DPF 3.8.x

Hello ppl. Look at this yubico.com is possible to make similar on this photo frame?

Also, for any questions, please consult the project wiki Sprite_tm made for us: http://picframe.spritesserver.nl/wiki/index.php/Main_Page

PH: For Arduino there is a better solution than interfacing an USB device: http://www.nuelectronics.com/estore/index.php?main_page=product_info&cPath=1&products_id=18

How can i use this secondary display with windows ? is there any supported device on dealextreme.com`? http://www.dealextreme.com/products.dx/category.321 regards

Is there anyone who can write me an application in Delphi (with source code) to do thesame thing as the Linux app? Of course I would pay for your time. djosser AT gmail DOT com

I love Lucky Star.

Nice, but it didn\'t work form me. When i try to hack the firmware i get a response that at /dev/sdb there is no photoframe located. I took a look at the code and found out that in the main.c file in the function \'is_photoframe\' the buffer stays empty. I\'m running Ubuntu 10.04 LTS, USB device show up in lsusb and dmesg says it is at /dev/sdb Any hints would be great. (davy DOT van DOT belle DOT 86 AT gmail DOT com)

Thank you man, what a terrific work! I just started playing with it, and I will try to interface it with Arduino... I know, it\'ll be extremely hard but it\'s a decent challenge, specially with Arduino\'s intrinsic limitations. As soon as I get something working, I will share it with the electronic hackers community. Cheers

Thanks for putting this online! It really gives me somewhere to start! I want to see if it\'s possible to get them to display animated GIFs or similar picture sequences with faster transitions and no transition effects.

I would like to chat with you about a project i have in mind. I will need hundreds of mini screens that will work the way that this screen works. I believe that this project will be of interest to you. Please contact me at nicholaslaing@hotmail.com

Guys, check out the project wiki! http://picframe.spritesserver.nl/wiki/index.php/Main_Page ... also, the hacked photo frames can be used on Windows, too, but you are required to have some programming language knowledge (e.g. C#)

Still nothing for the Windows users? I\'d be happy to pay you if you can get it to work on Windows. DJOSSER AT GMAIL DOT COM

Any support for windows users soon? email me @ golinux@rocketmail.com

Mine equpment doesn\'t do anything when I select the upating option. I can not delete or update any photo. Please help me !

Oh my email is dave_ml AT hotmail DOT com

Nice hack. Too bad you only have stuff for Linux to download. I\'m not as technical as you (du-uh) and I was looking for a ready-made Windows solution.. Let me know if you ever have that. Greetings from Belgium. (dave AT hotmail DOT com)

I have a smartsource shelfvision unit, i formated the unit now i want to send new information to the unit and have it play, how can i do this ( ops WXP )

I am looking for someone to hack a smartsource shelfvision video. they are free at your local grocery store ;) and i happen to have got one. i cant find any information about them and would like to use it as a mobile video player. any information would be greatly appreciated itsonlytheis@hotmail.com

Very nice! Exactly what i've been searching for :) I brought an LogiLink 7" DPF with an cheertek CT952A Chip and want to use it for my htpc as sec display. Is your tool compatible or which firmware should i use?

i wish someone would turn or hack a cheap 5 inch or 4 inch lcd photo frame into a ebook reader for text and rtf files with 4gb storage from a sdd card. ebook readers cost a much as a laptop at present.what a rip off.

People, you really need to RTFM before asking such questions :-) Of course software is needed, did you think it would just magically work with an external camera like in the movies? It's quite easy pairing up MPlayer (built with st2205) and linux-uvc. You should visit "our" wiki (at http://picframe.spritesserver.nl/wiki/index.php/Main_Page ) - there you'll find every bit of information you need. Also, you *need* some basic Linux shell knowledge, otherwise this project is not for you.

Hey, Is there any way i could hook one of these frames up to an external camera? or is the software needed?? Cheers Ray

What about Windows users ? I can unzip the package, but for me, there are only garbage files because windows doesn't read those.

I'd like to be able to send basic data from a PIC microcontroller to a digital keyring screen - basically using the display instead of an LCD, for a portable pocket device. Can you expand on how you hacked the keyring to get it to display your own content? Many thanks, and excellent work!

Ok I also have one of the Smartsource Shelfvision Video Screens and would love to know how to hack in to it and be able to transfer files to it. Thanks lil_linkin_04@yahoo.com

Nice! Whose frame is this? I believe I've seen them at Target, and online at Amazon.com.

Could this be hooked up to a webcam, to view live video? Just curious, I have a project in mind.

i am going insane trying figure out this smartsource shelfvision video i have and am getting nowhere :/ any info would be very helpful somebizarredude@gmail.com

Nice hack indead. But still searching people who have managed to get vga signals on a photoframe. Dus wie sloopte er een grotere frame en sloot er zijn vga signaal op aan. Lijken me standaard tft schermpjes toch die 7 en groter inch schermpjes?

oops I forgot to say that I wanted to use it as a remote display without a pc. BB

Is there a way to use this to be used as a remote viewer for a digicam (perhaps on a mid sized frame)?

In your disassembly work, did you ever work out the compression scheme used on the regular images stored in flash?

Hey guys, to use this in windows, you gotta extract the file twice. the first time you extract it, you'll get a .TAR file. the second time, you'll get the folder with all the goodies! Enjoy!

that's really really creepy i'm watching lucky star right now

Bedankt voor de link Joseph! Heb jij deze sleutelhanger geprobeerd?

@Edwin Paradigit lijkt ze te verkopen: http://paradigit.nl/info.php?group=4&art=10017374

Great job Sprite! Tanks for your energy put into. I Just tried two frames with no success. The fist one was a TomTec bought from Halfords, but it came out to be a dfp 001. The other one i bought from Intertoys, a DFPMate, but also with no success. This is really a domper. From the outside it is almost impossilble to tell what exactly is in the package, so a wrong buy is easily made. Well, does anyone know were i can buy one with 100% success?

>> chris , you dont even need to try this if your to upid to use a virtual machine or a boot cd , seriously your lazy as h3ll if you cant toast a boot cd ... either that or ignornat

I was partly successful in trying out the hack on a Vu-ME Hannah Montana photo frame (photocube). I was able to verify that it was a ST2205U chip and send string to the lcds. I added a walk through of what I did. It may help someone who wants to get started: http://www.machinegrid.com/2009/02/hacking-the-hannah-montana-photocube/ I however have bricked my cube. It won't even turn on now. Will update if I'm successful. Thanks Sprite for a nice hack!

I was partly successful in trying out the hack on a Vu-ME Hannah Montana photo frame (photocube). I was able to verify that it was a ST2205U chip and send string to the lcds. I added a walk through of what I did. It may help someone who wants to get started: http://www.machinegrid.com/2009/02/hacking-the-hannah-montana-photocube/ I however have bricked my cube. It won't even turn on now. Will update if I'm successful. Thanks Sprite for a nice hack!

Has anybody tried these hacks using Cygwin?

pit: Check out the wiki: http://picframe.spritesserver.nl/wiki/index.php/Programs

how can i use the code in windows? any suggestions?

Nice thats patato and chicken eat a saxaphone for christmas.

@lepton: Harvey norman have the avlabs AVL969 for $9, picked one up, going to go get a few more tommorrow. How far did you get in getting it working? Box says its got 16mb flash, stores 120 photos. Im going to have a bash at it, at the very least ive got a few friends who'll end up with them.

awww cmon dont be a windoze hater! gimme windows plz :)

Its a great idea, but i have a quick question. I flashed it with the original hacked firmware that came with phack. All seemed to work except it wont display a picture i thought there might be something wrong but it now wont let me flash again saying there is insufficient space. In hind sight i think i should have gone with the generic hk ebay job since i think that's where it came from but i've now lost my back up. Is there any way to clear this area of memory or rest it in some way so i can re-flash it?

Melvin, don't be so lazy and visit the Wiki page: http://picframe.spritesserver.nl/wiki/index.php/Main_Page You will have to learn Linux to use the tools provided, make no mistake :P

Hey mates, I live near Amsterdam in the Netherlands and I'm actually doing a school project (profielwerkstuk) on keychains. My goal is to create a gif smiley animation on a keychain and I don't care how :-P I don't have any knowledge whatsoever about this subject, so any information will help me tremendously. Even if it's just a copy/paste thing :-P A friend of mine has linux though, so I can contact him to install the codes that are necessesary. I don't have a lot of resources to learn at my school and my project teacher also said that I'm kinda on my own on this, but I wanna learn it so can anyone help me out? My msn is thepuboy@hotmail.com and my email is 00melo00@gmail.com Thanks

I had scored on one of those SmartSource Shelfvision video devices myself and was curious if you might know of anything that I could use to access it and put my own video files onto this unit for my own uses. If you or anyone knows anything about them, find me on my messenger at azurusjamesnova. That would be my AIM messenger.

www.mediadirect101.com

wow i have a coby 151sx and i cant wait to try this on my eee it would be awsome if we could get output from conky on this or some wifi sensors i cant help but pack rat lcds and scavanged dvd/laptop screens but good ez cheap mods are hard to find well now im rambleing .....

Would be nice if we could run our own programs/games on this thingy, kinda like your chip8 console :) I could not find it on the wiki, but is there a windows version, to do this stuff? Groetjes... Toffe blog b.t.w :)

I just bought a no-name device that shares a lot of characteristics with what you describe: 1MB, device ID 1403:1000, however hackfw sais: No photoframe found there. Sorry, there doesn't seem to be a device using the ST2205U chipset at /dev/sdf. Any idea how I can see whether this is an st2205U? info AT iivq DOT net.

Is there any chance of this coming to Windows?

What a cool hack process decribed! I see you could use that for a MP3 PC player frontal display so you don't have to use a full screen and full keyboard to run winamp. Too bad I'm looking for a hack to replace the screen of a photo frame and boost the resolution reusing old laptop parts.

The hack work on a shanga model, but not with the automatic shell. Take care because most of devices have only 1mb of memory instead of 2 (default value in code), so trying to upload the full flash content may overwrite the firmware and brick the device. I'm writing a windows version, will be soon finished i hope.

Very cool. Windows users: Grab a copy of VMWare player and an Ubuntu image for it.

Ron, i have the same coby keychain and am hoping to mod it. would also love any help with it. running OS10 but plan on making linux soon. my email is obeybilly [at] gmail.com

Awesome hack. I successfully tested the following one from Amazon: http://www.amazon.com/gp/redirect.html?ie=UTF8&location=http%3A%2F%2Fwww.amazon.com%2FInnovage-1611266-Digital-Photo-Keychain%2Fdp%2FB000S03FK4&tag=anybuzzcom-20&linkCode=ur2&camp=1789&creative=9325 I'll be coding to see if I can get a windows/vb version of this firmware updater/applications going. I also blogged about this: http://www.planetsurfer.net/2008/06/05/use-a-cheap-digital-picture-frame-as-a-secondary-display/ Great work. Keep up the hacking!

I'm very interested in the applications of this hack for hobby model building; there are numerous possibilities for it as miniature model computer lcd screens or as a digital billboard in dioramas. I've been thinking of adapting an old razor cell phone to do this; but a solution using a cheap $15 keychain is a lot more attractive. I have purchased a Coby DP-151 with this in mind but the software it runs on is terrible to say the least. This had killed my hopes for the little device, at least until I found this project. As much as I hate to impose, is there any possibility of making it Coby friendly (or possibly even windows compatible)? Thanks for any feedback on this.

Would it be possible to capture 30fps live transmission from a cam (assuming no capture), and second, could the memory be used as a buffer to manipulate (algorithms for anaglyph mixing two streams) or are there no operations available add, push, etc.?

please make a windows version if it is not to much effort! These things are so FUCK*NG cheap at the Bartsmit and Intertoys ;-) Greets En blijf zo doorgaan!

i ran into one of these little smartsource shelfvision gadgets and am tired of messing with it. i don't know or have the time to reflash it. it says it has 112mb and there is an expansion card slot. if anyone is interested in it drop me an email. i'm in the states. sta64tle@hotmail.com

Great, but how can I, WinDoZe user, use your software ? Can you put online a Windz version ? Many thanks, and God save the Hack !!

Found why the hack don't work. The memory inside the QPS3 is a 29LV800 a 1MB memory, as Dan wrote earlier, so the patch can't apply correctly.

Here in france I've found a QPS3 same look than your device. Ones opened, it shows the same board. The firmware is identified as hackable. I've applied the hack but I can't download the test.png picture. The phack -m command correctly displays messages, but truncated to 9 letters. The phack -l command returns no message but nothing is displayed. Any idea??

woow, knap, geweldig..i collect watches...maybe there is a possibility to make it to an animated watch...with animated dials like here http://www.aeolab.com/aeolog/index.php?paged=2 ...this would be great...maybe an idea!!

Just managed to fry the firmware on my frame but according to the wiki it's the most awkward to hack with this mod. however, i did manage to pick up one for abou £8GBP that appears to be the same as sprites but unbranded, will try this one and check back. if successful will attempt to write a windows program for the system tray in c#

I just got this working with one I picked up from amazon.com here: http://www.amazon.com/Digital-Photo-Keychain-Viewer-Picture/dp/B000THN1VO/ref=pd_sim_misc?ie=UTF8&qid=1206573617&sr=8-6 Thanks!!

This COOL modification! I from Russia...

Hi, i also have one of these and bought it specificly for this purpose. i've been trying to find exactly the info you have here and am installing linux on a secondary drive to do this as i write this. myquestion is this, could you help, or provide me with a breakdown of everything i need to do to write to 0x4200 in english as i'm unfamilier with C and would like to write an equivilent systray app for windows in C# for building and writing system stats in png format. many thanks. if you want to mail me about this then do so at tim-at-timcolley-d07-com, excuse the odd chars in the address. just sick of being trawled by google ;) again thanks in advance. Tim. (Shiver)

I think I found another use for these maybe as a cheap display for a propeller micro controller using a VNC1L chip or similar to accomplish the USB interfacing. Though if one could bypass the USB somehow and get direct serial it would make things easier.

Hello ! I'm french and i'm totally surprised by this GREAT hack ! I'm toptally newbie with hack but it is possible to convert this photo frame keychain into a mini-race game (with left, right direction steering ? Here is the 2008 version of this keychain : http://img.inkfrog.com/click_enlarge1.php?image=1_5_LCD_WHITE_NEW_jpg.jpg&username=varieties323&aid=63135473 Thanks My email : loopingstar [at] tele2.fr

Cool hack! Watch out though, the devices sold by ebuyer in the UK look similar but only have a 1MB flash, so even writing the image memory dump back to the device overwrites the firmware and kills it (as I just found out).

I finaly got this working and try'd to send a hack to you, but your mailserver returns the email. (i used the mail supplyed in the newhack.txt Where can i mail this hack to?

Supplyer was bart smit

By the way: I do get the message: "baks r ok" on the display

I got a nameless and a tom-tec device, but both give me the this message: Making a working copy... Looking for a known device profile... hack/m_coby_dp151 ... ...nope. hack/m_ebuyer ... ...nope. hack/m_hknameless ... ...nope. hack/m_nextg ... ...nope. hack/m_tomtech ... ...nope. Sorry, I couldn't find a matching device profile.

The best would be to plug in the photoframe into the GPX2 :D or other drives :-? like mobile phones :-?

At SATURN in Hoofddorp you can get them for 10,= euros

As the price of these things fall, it would be great to turn one of them into a colour electronic digital storage scope. Do you have an idea relating to this? Regards Mactitan.

I want to use this display with the Lb00021 / Br6104K(p) I guess i need to cross compile the lcd4linux driver, But i don't get how to do this. Can you post some info in the wiki (or cross compille the driver for adm5120)?

Sorry, Bart Smit (where I got them) has increased the price to E15,-. If you want them cheap, I'd reccoment browsing on Ebay for a bit.

Sprite, Could you please post a link tho your supplier? Found those here in the Netherlands for E 14,95, but not for E 10,- as you say.

For some reason, some of the more up to date information you added and the link to the wiki on page 1 and 3 are now gone :/

another device that uses the same or similar chipset are the "miuchiz" handhelds www.miuchiz.com these have onboard usb, infrared, and coupled with pc software, support using the data and playtime accumulated on the device with the pc client to interact in an online world. hardware enclosure includes 2 action buttons, a d-pad, and a "touch screen" that has buttons at the 4 corners of the screen. seems interesting enough...how adaptable do you believe your software could be to these?

Sebastiaan: please refer to the Wiki for the most up-to-date version of firmware and tools (we're currently at v1.3a).

Nice hack indeed. v1.2 works with my TomTec. But when the original 6 preloaded pictures start showing again, the last one is partly mutilated. Known 'bug'? (feature maybe)

wael: Most photo frame devices (including this one) are usb peripherals. You need a USB master to control them, so to do what you are asking requires a USB webcam, computer, and the photo frame. If you wanted something portable you could go for one of the routers running OpenWrt as the controlling computer. See http://wiki.openwrt.org/TableOfHardware for a list of devices supporting OpenWrt with two USB ports. My favourite is the BR-6104KP. It has a low spec but is extremely cheap. I have setup a site with information: http://linux-adm5120.sourceforge.net/, and I'm sure I will eventually get around to doing something like what you are talking about.

great i have a qustion , it seems stubid but ill write it anyway can i use mp4 instead of this photoframe ? can i use my mp4 screen - the screen alone - in any project which may need a monitor ? can i hack photoframe device or mp4 device by inserting a cam in it and preview live scenes on its screen ? im sorry it seems stubid quistions , but it just quistions with no answers in my mind . thank u , and great done .

Very cool hack! Applied it to my TomTec and works fine! Would it be difficult though to create a (command line) program to upload pictures to the device and store them there?

It looks like my mod sends too little bytes to your device. Interesting. If it displays twice, I guess it wants to receive 24-bit color information, but only uses 12 bits of them? Interesting. Let's continue the work on your Coby device on the wiki. By the way, you could solder a switch to your battery to turn it off easily.

Bert M - very cool of you to do that! FWIW, while it works better than the previous version, it doesn't work properly. When I use phack.sh to upload the supplied test image, the image is displayed twice on the LCD - in the upper-left and upper-right fourths of the display. The image isn't garbled - I can clearly read it - but it appears to be grayscale. The bottom half of the LCD still displays the sample image that came on the Coby. This process seems to confuse the Coby; after the upload, it seemingly resets the USB connection and refuses to accept bus address offers. I have to wait for the battery to discharge so the microcontroller resets before it will behave sensibly again. I tried it twice; same result. Interestingly, I noticed that immediately after the test image is displayed (twice, at quarter size), the backlight dims by roughly 50%.

I have set up a wiki for this project: please visit it at http://picframe.spritesserver.nl . I think we can collaborate on this project a bit easier there than in the comments of this page.

For everyone who has already patched his Tom-Tec device, and wants to play video on it, here's a binary Debian package of MPlayer with ST2205U support (written by Sprite) compiled in (built on Ubuntu, please read the output/mplayer/readme.txt file in the firmware hack file for instructions. http://silenceisdefeat.org/~bertm/mplayer_1.0svn_i386.deb Sprite, thanks for the great work.

r0tw4ng: you'll need to modify the utility. It are only some minor changes. You're lucky, I just modified the code to work with 12 bit, and I think it works (I couldn't test it further than on a hex editor, but it looked nice there and it should work ok). Replace your main.c with http://silenceisdefeat.org/~bertm/main.c and re-compile the sources. Good luck.

Hi, i bought a DPF-001, but i can't seem to get it to work. The fwhack.sh application does'nt recognise it, but it does show up in dmesg. During the fwhack.sh process, it does show "baks r ok" on the Tom-Tec screen. Could you guys help me if i post up a firmwaredump? Thnx!

Pete, thanks for the info. Are you saying that I can simply convert the sample image to 12bpp and the utility should work with the Coby? Or will the utility need to be modified to do 12bpp for the Coby?

Sprite, can I ask what disassembler you used? I looked all over and couldn't find an open source 65c02 disassembler that offered more than the most very basic of features. Understanding the firmware would be so much easier if I could find a disassembler that would use the values from your symbols.def at least :) r0tw4ng: the Coby DP-151 defaults to 12 bits per pixel for the display, and I guess the Tom-Tec that he wrote the hack for originally starts out in 16bpp mode. The hardware is capable of either, I guess the people who wrote the firmwares just chose differently. The options are basically either to put the device into 16bpp mode or to send it 12bpp image data.

Received my Coby DP-151 today. I used the scripts in the v1.2 package linked here. The firmware was backed up successfully, the device was detected and the hacked firmware installed. The test image bit wrote "Eeeeeek!" at the top of the display, leaving part of the original sample image at the bottom. I wasn't sure if this was what it was supposed to do or not. I used the phack script to upload the sample PNG to the unit. The top half of the screen says "T IT IT I" and under that, text goes all the way across. It looks like several words on top of one another; no letters are clearly distinguishable, but I think I see ORK and NG in there. The bottom third of the screen shows part of an example image from Coby. I guess the device is waiting for more data to be written; it's totally unresponsive now. I tried various combinations of buttons, hoping it might reset, but it doesn't. Guess I'll let it sit overnight and run the battery down. If you have any suggestions as to how to proceed, I'm all ears. Thanks for your work on this - it's very cool. I'd like to get it to work.

Sprite_tm : Mine just arrived in the post, tried the v1.2, backed up the firmware but no luck with the patch, no match with the firmwares in 1.2, The unit is branded Next-G see : http://www.next-gadgets.com/product_info.php?cPath=66&products_id=327 Should I send you the firmware image to look at ? I don't really mind if the device gets bricked but microcontroller assembly is a bit beyond me, so i figure theres a better chance for other people with this version of the device if you look at the code.

Thanks for the AVI Sprite! You rock dude!

Niels: PA0, PA1 and PA2 are most likely to be pushbutton inputs, according to the info on the datasheet of the controller (available here: http://www.sitronix.com.tw/sitronix/SASpecDoc.nsf/FileDownload/ST2205U734074/$FILE/ST2205U_datasheet_v1.0.pdf): it states PA0~7 are "Keyboard scan signal (return line)". A debug interface should be present at ICE1~6, but I guess there are no PCB lines connected to them. By the way: where is the firmware located? In the external flash chip or in the controller itself? I guess it is located in the flash chip, because the firmware is 64K, and the controller has only 16K of ROM. If that is true, one could quite easily (well, not that easily, ofcourse) modify the firmware in the flash, after bricking, because it does have accessible pins.

Sprite: that's a pretty good idea. I've opened up my device and found some test pads, named VDD, GND and PA0, PA1, PA2. I suspect it's a debug interface, and maybe it'll allow us to flash the firmware directly, giving us a chance to unbrick the thing if we make a mistake :) Picture: http://elektron.ewi.tudelft.nl/~brouwe25/IMG_1942.JPG

Niels: If you do that, you may want to add a switch to the highest address line of the flash so you can choose to make it permanently high. That way, you can use the normal firmware to flash your own code to the locations after 1M into the flash, flick the switch, and reset into your own code. If you mess something up, you still have the original routines to bring the device back from the dead.

For New Zealand readers: it looks like TasTech can order these devices in for you. http://tastech.co.nz/details/103193.htm

I was thinking about modifying the fw to be a bootloader for my own native code. Might be a fun device for demos and shit :)

Thanks for this hack! I got my 2Mb -30 photo- "Tom-Tec" keychain display from the local toy store (Bart Smit, The Netherlands, 15 Eur). Although the manual states 96x64 resolution, a quick count from a macro photo revealed that 128*128 pixels seem more likely. I applied the hack, and then slabbed some existing pycairo code together to transfer a simple animated clock via a png to the keychain, see http://video.google.com/videoplay?docid=1830743604277216502

I would be extremely interest if you could output your windows' display through it. I always wanted a extremely small monitor for my winxp machine.

The AV Labs device is not working (yet).... I disassembled the firmware, and went through it looking for the key parts as described in the newhack.txt file.... Found all of the parts OK, creaded a new spec file, assembled the hack source all looked ok.... Ran the hackfw.sh script again, aborted before uploading, it patched the firmware OK. Disassembled that, and it all appears to make sense. I can see where the new code is inserted, where the diversion is planted, and how it does the old stuff if no new stuff is requested.... So, ran the hackfw.sh script one more time, this time went through with the firmware upload. Device screen goes black, it reboots when disconnected. Reconnect it and choose upload mode, use phack -l to upload an image and it just goes black. It comes back on when disconnected, so it's not a brick, and phack recognizes it as hacked, but the image doesn't display.... BTW, I can put the original firmware back in, and then phack -l has no effect, so I know the hacked firmware is playing with the LCD controller.... Any ideas?... Any chance of putting the other firmwares up for download so I can see if there is another difference with this AV Labs device?

Is there any chance someone would be willing to port this to Windows? *Sigh* I'm such a script-kiddie...

Actually it was my request to hack the keychain. No one has the hacking idea. I bought already 3 pieces and take a look in electronics. But i'm not hacker, and my eletronics skills is a bit low for it. Because the firmware has some bugs, i asked on the GoT forum to hack keychain. I hope the digital keychain has now more possibilities after flashing firmware. Great work, Sprite_tm. And digg more deeper to discover new functions! :P

lepton: Damn, I can't even package a release without there being bugs and errors left :X Well, I just uploaded v1.2, which does handle command-line device names in the hackfw.sh script. Moreover, this one includes a patch to directly use an hacked photoframe as an output device in MPlayer.

Compilmenti!!! Sei un grande! Good job!

Just got one of these, an "AV Labs" brand AVL969 from Harvey Norman for A$28.00. Using the phack command I can display a message on it, and get the firmware out of it. BUT, it doesn't match the tomtec or coby profiles, so the firmware is not patched. OK, I will gas up the disassembler and start playing (aah, 6502 assembly, now that takes me back to the old, old days). A minor issue Sprite_tm, the hackfw.sh script doesn't use the device file name when checking whether the device is accessible. I corrected it as follows (added the $1) if ! ./phack -m "baks r ok" $1; then echo "Sorry, there doesn't seem to be a device using the ST2205U chipset" echo "at $1." exit 1; fi

I just uploaded v1.1, which has experimental support for Coby DP-151 devices too, and fixes a bug patching TomTec-devices: if you have the same problems as Bert, try v1.1. ReNDeR: Please give the software a try, it'll tell you if a device is compatible and if it has a patch for your particular software.

Great work sprite, and by strange coincidence I found this hack (linked from hackaday) immediately after buying a device identical in appearance to yours, with one difference however, it was advertised as having 8Mb memory rather than 2. Assuming all the other hardware is the same Will the hack still work ? and if not is there any way to make it work ?

I own exactly the same keychain, but your hack won't work for me. Firmware flashes OK (well, original firmware was detected OK, and after flashing the new firmware doesn't match the old MD5, so that should be fine), device works fine, messages are displayed perfectly, but images don't show up.

hmm. I obtained an OLED watch with much the same mechanisms but with 2GB storage. What about bypassing the onboard memory entirely and streaming video directly into the screen's memory? this might work. -A

One, you mention that the lcd has its own controller + 8bit bus. Any markings or ic name for the controller or lcd? Two, if all you have is a globbed chip and no software, would you still be able to find a way to use it? I have a screen (A smartsource shelfvision video) that uses either usb or sd card to pass videos to it, and I only have a sd card with a couple of binary files with the videos on them. I do have the name + sheets for some of the ics on there (ram, flash, main usb+sd+lcd+audio driver ic). At the very least, be able to decrypt the video binaries? Or somehow directly access the flash memory (128mb I think, since when I connect the screen with usb, a 128mb disk ""unformatted"" disk shows up). Let me know if your interested, as I can send you more info (or maybe even the screen?)

"Waah weeabo waah." C'mon, if anything, give the guy props that he got it to play a video, not bitch over what it's playing.

Looks remarkably similar to these: http://www.ebuyer.com/product/138532 http://www.amazon.co.uk/inch-Silver-Digital-Photo-Keyring/dp/B00126IT6I http://www.shopmania.co.uk/shopping~online-digital-camera-accessories~buy-coolview-1-5-mini-digital-photo-keyring-8mb~p-1807422.html But in all cases these seem to be 96x64. I wonder if it is the same device. Are you sure that's 128x128?

Super cool. I'd love to hook up two and see if one could make a cheap 3d stereoscopic headset for viewing static images.

Hmm interesting hack, only too bad tomorrow is sunday and the shops are closed. I was just counting... 128x128 pixels = 16384 pixels in total. 2 MB of flash with 4 bytes/pixel means about 32 frames of storage, which I remembered to be the advertized amount of these keychains. Is it possible to address the frame to be shown by your hack? This would mean the (flash)memory could operate as some kind of framebuffer.

Pete: Thanks! Could you drop me a mail please? Address is the link in the copyright underneath this page. I'd like to take a look at that firmware and maybe I can adjust the hack to fit inthere too. Steve & Will: I actually had to look up the word. The reason I choose that particular movie is that anime does have a nice set of contrast-rich images in it which show particularily nice in the movie. The reason I had that particular movie at hand is that I like anime in general and Lucky Star in paricular. If you don't like it, please go ahead and make a movie of a picture frame displaying your choice of movie.

nice work!

"That's cool and all, but what a disgustingly weeaboo video used to demonstrate it. Seriously, wtf?" Exactly my thoughts too

Here's the link to the display in mouse san mentioned: http://metku.net/index.html?path=mods/loginoki/index_eng

Brilliant hack! I bought a similar device myself with the same intentions, but your skills greatly exceed my own. The device I have is a Coby DP-151. I tried your hack on my device, but it reports that the firmware is too different. I have the binary image of the firmware, now, though, which is great! Do you have any advice how to proceed now? How did you locate an appropriately empty space to inject your code?

i read about a hack once in which the guy opened up his logitech mouse and put a similar display inside it.. that was really cool too

Flash is an open standard now, feel free to write a player for whatever OS you're using.

That's cool and all, but what a disgustingly weeaboo video used to demonstrate it. Seriously, wtf?

Blokker also do something similar .

JoeJoe: You're right, I'll post a link to the .avi when I have the time. Thom: I got it from the Bart Smit, a store here in the Netherlands. I heard that Intertoys has a similar model. Sparky: It's a glop-top with not all pins brought out to the exterior of the chip: big chance that the uart pins aren't available. You could however tie up your uC directly to the LCD if you want: it has its own controller with an 8-bit bus.

Any chance of interfacing this with a non-USB microcontroller? This would be nice as a cheap user interface or debugger interface for cheap and simple embedded systems. The datasheet for the ST2205U says it has a UART, so that could be used to interface the microcontroller. This could be a really cheap data logging and display device. Since I live in the Netherlands, I might pick up one or two to fiddle with. Somebody said Intertoys has them?

Oh snap, really good job! Thank you so much!

Exactly what I was thinking when I found them in a shop, so I snagged one as well, but was a bit intimidated by the glob-top package. Thanks a bunch! I'll give it a try!

So it i'm reading this correctly, you have essentially got a really tiny (like maby wristwatch sized) lcd monitor? i can think of some interesting uses for something like that.

Looks nice, where did you actually get it from/what make is it?

Flash isn't nice :( Be fair to Unix users..

Nice job on that one! The 'Intertoys'folder from November contained that thing as well. It caught my attention too ;) Never too old to play with those kind of toys. See you in the STORES!