LG DVD HDD RH1999 Recorder - (Warning - Long Post)

[jimdunn]

Warning - this is a bit of a long post...

Well, I bought a new LG RH1999 DVD HDD Recorder, and I love it.

Here's the problem:

The unit uses NECx1 Dev 45, sub-device 45

But this is also used by my LG V271 DVD/VCR combo - so I have a conflict.

Luckily for me the DVD/VCR combo also responds to NEC1 device 110, and the new gadget doesn't - so I can have an upgrade which ONLY controls the DVD/VCR -

But this leaves me in the position that the upgrade for the RECORDER will control both devices - pretty inconvenient, as they are next to each other.

At the moment, a solution which sort of works is to have the devices toggle - ie only one on at a time, the POWER key turns the RECORDER on, and the DVD/VCR off at the same time, hence it will only control the RECORDER, as the DVD/VCR is off.

This actually works surprisingly well until the 2 devices get "out of sync" and then you have to independently power one up/down to restore the toggle behaviour.


OK - since this wasn't perfect, I trawled the internet for a way to change the protocol responded to by the new RECORDER.

I found a "secret" service menu, which, (along with lots of other settings) has 3 binary bits supposedly reserved for "Remote Control".

In the default state they are "000"

When I change them to anything else, the unit ceases to respond to the OEM remote - so presumably I have changed the protocol it's expecting.

Here's the problem:

I cannot find any way to control the unit with these bits set to any of a number of different settings.

I've tried every LG built in code in the remote. (for TV/VCR/DVD/etc...)

I've tried a search (991) on ALL device types.
(I've done this twice, but I suppose it's still possible I missed out, since it's a pretty clunky procedure - I may have skipped the "golden" code while searching)

I've looked at every LG upgrade in the file section (really - I have...)

Nothing -Nada...

Does anyone have any ideas - or any insight into what I might try next ?

(Incidentally - don't worry - the buttons on the unit can be used to change back to "000" and then the OEM NECx1:45:45 works again... )

(Oh, and it just occurred to me to mention that examination of the OEM remote shows no obvious way of changing it to another "mode")

[The Robman]

I found a "secret" service menu, which, (along with lots of other settings) has 3 binary bits supposedly reserved for "Remote Control".

In the default state they are "000"

When I change them to anything else, the unit ceases to respond to the OEM remote - so presumably I have changed the protocol it's expecting.

Here's the problem: I cannot find any way to control the unit with these bits set to any of a number of different settings.

Just a wild guess, but I would think that it would use the same device code with different sub-device codes.

[jimdunn]

Just a wild guess, but I would think that it would use the same device code with different sub-device codes.

I'll try that - I'd only tried matching device/subdevice till now, because originally it was 45/45- so I've tried 46/46, 47/47 etc...

[The Robman]

Generally devices using NECx1 or NECx2 do have matching dev and sub, but you never know.

Is this the menu that you used (from here) ...

1) Press "Setup" on the remote control
2) go onto the padlock icon without selecting it
3) press 7 8 8 9 and the "Enter"
... and I'll explain you some tips.

or this...

1) Press and hold together the up and down arrows on the recorder (not the remote)
for about 6 seconds.
2) Use the left & right buttons on the remote to move through the op codes
And the up & down buttons to change the codes, press enter to save the changes, then menu/list button to exit. The recorder will switch off.

[jimdunn]

1) Press and hold together the up and down arrows on the recorder (not the remote)
for about 6 seconds.
2) Use the left & right buttons on the remote to move through the op codes
And the up & down buttons to change the codes, press enter to save the changes, then menu/list button to exit. The recorder will switch off.

That one

There's some more info on this site, including a little applet/program which lets you play with what bits do what (as known so far) :

WARNING:
The following material is published only for experimental and studying purposes:
we take no responsabilities for damages caused by using it.
Some of the below solutions or hacks modify original recorder's firmware/hardware
and this would invalidate producer guarantee and vendor warranty.

LG DVDR Service Menu

which indicates that bits 1, 2, 3 of OP2 are for remote control - and they certainly do something - ie it doesn't respond to OEM remote any more when they are changed.

Rob, this next bit is just for anyone else reading this thread - obviously not you:

BUT

YOU HAVE TO READ THIS HEALTH WARNING

The first thing to do on entering the Service Menu is to:

WRITE DOWN THE 8 HEXADECIMAL VALUES IT IS SET TO BEFORE CHANGING THEM

so that you can restore your unit to its original state if you need to.

IT'S VERY EASY TO CHANGE A VALUE BY ACCIDENT SO WRITE THEM DOWN FIRST.

If you end up with your on-screen menus in Venusian, your TV Tuner set to Neptunian SECAM, and your DivX movies in Tallscreen - it is not my fault, nor the fault of the author of that website.

[jimdunn]

Generally devices using NECx1 or NECx2 do have matching dev and sub, but you never know.

I'm up to 4F going from 00 to FF testing subdevice numbers now - so we'll know soon...

Where's the fingers-crossed smiley ?

[The Robman]

From a very quick glance at some of that stuff, it looks like people are hacking the firmware. If that is indeed the case, it's quite possible that one of the firmware hackers has found where the remote stuff gets handled, so maybe there's a hack where you could change which device code and/or sub-device code the unit responds to by editing a byte of data somewhere. Who knows.

[jimdunn]

They are indeed hacking the firmware.

Out of the box, if you set a timer recording, you have to remember to switch the device OFF, or your recording will be missed.

That's annoying - because you often forget to do that.

One of the successful hacks is to make the device turn itself off 5 or 6 minutes before the next recording is due to start.

I've loaded that firmware and it works - so I already have some benefit from their efforts.

Back on topic - no joy with any of the subdevice codes, I'm afraid - so back to physical device-toggling for now.

(Maybe that byte change doesn't select an alternate remote config at all - possibly it just disables the IR receiver)

I'll keep my eye on the hacking effort - who knows what they'll discover ?

[jimdunn]

According to the "guru" on the DTV forums, on the last page of the thread Rob linked to earlier, the suspicion is that the alternative remote protocol may be for a "rebadged" version of this unit, sold as a Hitachi.

I've tried all the Hitachi protocols etc... in the device upgrades yielded by searching for Hitachi in the file section, without getting any response from the unit.

I'm reaching the point where I don't think I'm going to stumble over the right protocol/device by trial and error.

Guess my only hope might be finding someone who owns/sells the rebadged clone and learning from their remote...

[The Robman]

How deep into the firmware have the hackers got? Have they found where the remote signals are processed? If you think about it, there has to be some code in there somewhere that tells the player what codes to respond to, so if you're able to reverse engineer that code, you'll find your answer. Given that we know what the main codeset is, if you find the code don't know how to decipher it, we might be able to help.

[jimdunn]

As far as I can tell, all that is really known is that changing the control bit stops the unit responding to the remote.

It's also known that the unit can be configured as either an LG, NEC, Hitachi, Medion by changing another couple of bits - this changes the screen background logo as appropriate.

The assumption is that the IR sensor is expecting another protocol after altering the relevant bit, and for some reason they believe this is the Hitachi.

It's a bit hard to find out what else they know, because

[a] They don't say

and

A lot of the relevant stuff is in German on another forum - I don't read German, and Google translate makes a huge mash of it...

I'm going to try and dig a bit deeper with them - but it could take a while.