I'm looking at some USB IR blasters, and I see a lot of Sony IRB-BR1 on eBay.
It doesn't seem like it has been RE'd, so I went ahead and ordered one.
This is what I have found so far
Part numbers:
1-845-283-21
1-845-283-12
Product ID PID 2212 / 0x8a4
Vendor ID VID 1356 / 0x54c
054c:08a4
Device name: Sony Corp. IRB0136747
Sony IRB-BR1 reverse enginnering
Moderator: Moderators
It has already been discussed in this forum. Bottom line: probably not worth it.
I extracted the rootfs of the Sony TV that was posted here: https://xdaforums.com/t/sony-android-tv ... 01/page-85
USB serial with custom PID/VID. Not sure if it is generic or cp210x. Definitely not pl2303.
Haven't found how the custom PID/VID gets automatically detected as a USB serial device by a quick grep for the PID/VID in the root filesystem.
Code in IRBlaster.apk (com.sony.dtv.irblaster) and IRBRecommendation.apk (com.sony.dtv.irbrecommendation)
is UI related.
Code in IrbService.apk (com.sony.dtv.irbservice) checks for PID/VID as mentioned above, and the USB serial device to appear in /dev/ttyUSB0 or /dev/ttyUSB1. Baud rate is 19200.
This appears to rely on QuickSetSDK from UEI (QuicksetSDK_EU.apk / com.uei.quicksetsdk.sony). Dalvik binaries are obfuscated and relies on some native armv7 binaries.
These magic bytes appear to be sent to initialize the controller (libqs.so:QS_get_codeset_binary("u_rst", outbuf, outlen)):
00020E64A6C53A780C03573F49D02BE5BA35D31A2E0914BE8CA55AA5
The device appears to be "P5MiniQS".
These magic bytes appear to be sent to get the version after initialization:
4f696e69
USB serial with custom PID/VID. Not sure if it is generic or cp210x. Definitely not pl2303.
Haven't found how the custom PID/VID gets automatically detected as a USB serial device by a quick grep for the PID/VID in the root filesystem.
Code in IRBlaster.apk (com.sony.dtv.irblaster) and IRBRecommendation.apk (com.sony.dtv.irbrecommendation)
is UI related.
Code in IrbService.apk (com.sony.dtv.irbservice) checks for PID/VID as mentioned above, and the USB serial device to appear in /dev/ttyUSB0 or /dev/ttyUSB1. Baud rate is 19200.
This appears to rely on QuickSetSDK from UEI (QuicksetSDK_EU.apk / com.uei.quicksetsdk.sony). Dalvik binaries are obfuscated and relies on some native armv7 binaries.
These magic bytes appear to be sent to initialize the controller (libqs.so:QS_get_codeset_binary("u_rst", outbuf, outlen)):
00020E64A6C53A780C03573F49D02BE5BA35D31A2E0914BE8CA55AA5
The device appears to be "P5MiniQS".
These magic bytes appear to be sent to get the version after initialization:
4f696e69
I destructively took removed the casing by scraping alongside one of the sides until I could put in a spudger, then twist it to remove the casing in a top half and a bottom half.
On one side of the PCB there exists a chip with the marking:
SIL
2104
F2217
1350+
This appears to be the CP2104 (cp210x) based USB to serial interface.
On the other side of the PCB there exists a chip with the marking:
P5X9R
W1402
This appears to be the UEI chip responsible for handling the IR blasting.
On one side of the PCB there exists a chip with the marking:
SIL
2104
F2217
1350+
This appears to be the CP2104 (cp210x) based USB to serial interface.
On the other side of the PCB there exists a chip with the marking:
P5X9R
W1402
This appears to be the UEI chip responsible for handling the IR blasting.
-
louiseravot
- Posts: 1
- Joined: Wed Jul 16, 2025 2:41 am
Nice find! Looks like you're digging into it well — that VID/PID confirms it's a Sony device. Curious to see what you discover once you test it out! Also, if you need postal info, check this out: singapore zip code .