Taking it apart wasn't too difficult. The upper and lower cases appear to be glued together (no clips), so it will have to be glued back together.
Comcast/xfinity XR2 remote hardware
Moderator: Moderators
Comcast/xfinity XR2 remote hardware
Hello. Has anyone hacked this remote? It uses a GreanPeak GP565 communications controller for the IR and RF transmission (zigbee rf4ce). I can't find a datasheet for this IC, but the product brochure shows I2C, SPI and UART interfaces with a XAP5 microcontroller core. The hardware seems interesting, but might not be the best platform for a new JP1 lineup because there are no headers or pads in the battery compartment. Maybe it is programmable via the RF interface?
Taking it apart wasn't too difficult. The upper and lower cases appear to be glued together (no clips), so it will have to be glued back together.
Taking it apart wasn't too difficult. The upper and lower cases appear to be glued together (no clips), so it will have to be glued back together.
-
The Robman
- Site Owner
- Posts: 21886
- Joined: Fri Aug 01, 2003 9:37 am
- Location: Chicago, IL
- Contact:
Hack it to do what? There doesn't appear to be any indication that it's a UEI or JP1 remote, and I don't see an EEPROM chip there. I'm not familiar with the processor so I don't know if it has any flash memory.
The thing that makes JP1 remotes hackable is the fact that they have temporary memory (ie, EEPROM or Flash) that can be programmed, most regular universal remotes don't have that.
The thing that makes JP1 remotes hackable is the fact that they have temporary memory (ie, EEPROM or Flash) that can be programmed, most regular universal remotes don't have that.
Rob
www.hifi-remote.com
Please don't PM me with remote questions, post them in the forums so all the experts can help!
www.hifi-remote.com
Please don't PM me with remote questions, post them in the forums so all the experts can help!
The GP565 includes flash according the block diagram on the product brochure. There seem to be a couple test points that aren't part of other traces--I will try to see if those are TTL UART. It appears to be made by UEI and uses the same codes.
From the web:"Universal supplies Comcast with the XR2 remote that is deployed in the homes of its Xfinity TV subscribers. Comcast has said that Universal is also developing a new remote for its X1 service which contains technology that will allow subscribers to channel surf with voice commands."
http://www.fiercecable.com/cable/universal-electronics-preps-xr8-xr2-aim-anywhere-devices-for-comcast
From the web:"Universal supplies Comcast with the XR2 remote that is deployed in the homes of its Xfinity TV subscribers. Comcast has said that Universal is also developing a new remote for its X1 service which contains technology that will allow subscribers to channel surf with voice commands."
http://www.fiercecable.com/cable/universal-electronics-preps-xr8-xr2-aim-anywhere-devices-for-comcast
-
The Robman
- Site Owner
- Posts: 21886
- Joined: Fri Aug 01, 2003 9:37 am
- Location: Chicago, IL
- Contact:
Ah, ok, if it's a UEI remote then it's certainly possible that it could be hackable.
Rob
www.hifi-remote.com
Please don't PM me with remote questions, post them in the forums so all the experts can help!
www.hifi-remote.com
Please don't PM me with remote questions, post them in the forums so all the experts can help!
I had bought a Xfinity XR11 remote sometime back and was disappointed to find that it had no 6 pin header. But this thread caused me to open it up. The XR11 is also a Zigbee enabled remote, but it uses the TI CC2530 micro. Recall that the URC-7980 uses the CC2541 micro, which communicates via Bluetooth instead of Zigbee. These TI chips use the same 8051 based processor and they share a users guide.
The XR11 uses a 2 sided PCB. Its switches are the clicky diaphragm type, all mounted in a single sheet which is glued to the PCB. BTW, I'm glad this wasn't the first remote that I tried to open or I might have given up.
The XR11 doesn't in my opinion offer much scope for JP1 work; it has cable, TV, and Audio devices, but I suspect that the button maps for TV and especially Audio are very limited. However, should we want to try programming this remote, the PCB has test points which can send/receive to/from the remote. TI sells a programmer called CC Debugger (available on eBay for $15) and also provides the schematics of the programmer. It simply connects the data and clock lines from a USB port to the test points. The CC25xx chip itself handles the USB traffic. Of course we don't know if UEI has protected the flash memory from being read.
The XR11 uses a 2 sided PCB. Its switches are the clicky diaphragm type, all mounted in a single sheet which is glued to the PCB. BTW, I'm glad this wasn't the first remote that I tried to open or I might have given up.
The XR11 doesn't in my opinion offer much scope for JP1 work; it has cable, TV, and Audio devices, but I suspect that the button maps for TV and especially Audio are very limited. However, should we want to try programming this remote, the PCB has test points which can send/receive to/from the remote. TI sells a programmer called CC Debugger (available on eBay for $15) and also provides the schematics of the programmer. It simply connects the data and clock lines from a USB port to the test points. The CC25xx chip itself handles the USB traffic. Of course we don't know if UEI has protected the flash memory from being read.