Hacking Motorola LS1000W Photoframe

31 10 2010

This short how-to shows you how to use your Motorola LS1000W Photoframe as a cheap and flexible wireless display inside your trusted lan and why you should NEVER EVER use the included FrameChannel account for privacy reasons.

The frame comes with a nice bunch of features: Wifi, usb, sdcard, rss, mp3 and a 10.4" 800x600 Display. 


I had the idea to use it as a cheap wireless display, googled around and found the german Infoframe project, where they use Samsung SPF-83V frames as displays. However, our companys purchasing agent already bought the motos, so I went on with them.


First field test will be a simple cleaning rota system for our mildewed coffee machines, people will register into a webapp, enter their workdays, time availability, vacations, etc, the software calculates every day who the lucky ones are and displays attached to the machines remind everyone not to forget it. Peer pressure FTW! At some point in future I might have the heart to use the milk-spender button again, if it works out fine...


So, the app progressed quickly, and finally I had to draw something to a display. Initially I thought there would be some kind of support for Upnp mediaserver like Twonky, but well, nope. RSS is the way to go, but I had no luck to display image streams inside the frames rss client. Its text+thumbnails only. 


FrameChannel remained the last chance of success. It supports image streams, and it supports autoplay, which is just perfect in conjunction with the frames automatic power-on and power-off feature. 


The big problem is: FrameChannel is a commercial rss-aggregator service, which requires the frame to be online all the time. It collects rss feeds from all over the net, generates an own feed, the frame downloads the new feed and then all included items.


So, basically you can set up your own image server, publish some rss, subscribe to your own stream with FramChannel, and download your own stream back from FrameChannel to your photoframe. Great, isn't it? Yay, no its not. 


Because of the overall stupidity of things and due to the fact that our coffee cleaning schedules are a corporate secret, I started to sniff some traffic and poke a bit around, and this is what I found:



  • FrameChannel protocol ist just simple rss 

  • The frame identifies itself by a short unique id, transferred in http GET request as plain text


Here is a request send by the frame:


http://rss.framechannel.com/\
productId=MOT001/\
frameId=XXXXXXXXXXXX/\
language=en/\
firmware=20090721

The productId parameter identifies the product (there are some other frames which use framechannel), the frameId identifies the frame. Its xxx-ed out here, because if you play with the id, you can easily access other peoples images or frame activation codes of their photoframes and set up some funny feeds for them... However, I have not investigated into that direction, but its clear that this sucks big time.


But back to our goal, the holy quest for offlining of the frame, at least now we know why  ;)


Its pretty simple, as there is virtually no security builtin:


1. Overload the public DNS entry for rss.framechannel.com in your lan and let it point to a local apache. I accomplished this by simply adding the following line to /etc/hosts of our dns server:


192.168.0.2  rss.framechannel.com

This line tells the frame that rss.framechannel.com is ours now. Or you could redirect traffic on port 80 to rss.framechannel.com by iptables as well, its your choice.


2. Now we need a rss file in our servers webroot, and  the following .htaccess file:


RewriteEngine on 
RewriteRule ^productId=MOT001.+$ myfeed.rss

It simply identifies a photoframe by its productId, and replies to every query by sending the contents of the myfeed.rss file. You could match by frameId if you have several frames to serve..


3. The rss files structure is simple:


<?xml version="1.0" encoding="utf-8" ?>
<rss>
<channel>
<ttl>1</ttl>
<item>
<media:content url="http://some/image.jpg" type="image/jpeg" />
</item>
</channel>
</rss>

This is a minimal file, <ttl> is a value in minutes, how often the frame will check rss for changes, every image needs its own <item>.


Using this file, there is no caching at all, the frame will download every image everytime its needed, you can play with guid-tag to enable caching. Frame will reload only if guid changes, and with <description> you could add some description of course^^ 


As far I checked, only jpeg files are supported in stream. sadly no png, gif or mp3 support.


Kommentare

Ansicht der Kommentare: (Linear | Verschachtelt)
15 11 2010
#1 foobar2 (Antwort)

Hi -

perfect! This is a huge step forward fo me using the Motorola as an "infoframe" (see infoframe.org).
I am still having difficulties with caching: frame loads current pictures for a couple of hours, but every now an then an old series of pictures (I have two pictures in my xml file) is shown.

I am playing now with a dynamically generated xml-file which also creates symlinks. Let's see how far this will bring me to a satisfying user experience.

M.
16 11 2010
#1.1 fk (Antwort)

I experienced strange behaviour after some hours, too, but since I generate a random guid every time a new image to display is generated, everything runs fine for a week now.
16 11 2010
#1.1.1 foobar2 (Antwort)

Today things seem to work with randomly generated symlinks to the pictures.
I have also experimented with random guids, but have removed them now.

Let's see when next DSL disconnect occurs, this is when last time the frame had a hick-up.

M.
17 02 2014
#1.2 TazzyUK (Antwort)

Hiya all
I saw your posts on this http://my-fuzzy-logic.de/blog/index.php?/archives/32-Hacking-Motorola-LS1000W-Photoframe.html website and wanted to ask if anyone here has a working copy of the original firmware for the 'Motorola LS1000W' digital photo frame.
My photoframe worked fine though many of the wi-fi features no longer worked like the Shoutcast service, Picasa or Flickr etc which i didn't mind so much.
I decided to look for a firmware update to see if this would correct those issues and found an updated firmware Ver.110118 on this Hama website... https://uk.hama.com/service/download/firmware
After updating to this version, the photoframe no longer switches off. When the power button is pressed either on the frame itself or via the remote, the unit just switches off then powers back up! :-(
There was no option or facility to backup the original firmware (I'm assuming version 1.0) so now i'm stuck with a semi functional expensive digital photo frame.
if I can just get a more legitimate upgraded firmware OR the original older version, then at least that would allow me to be able to turn the photo frame off when needed.
Would anyone here have such a firmware file? or know of where i could get it?
Any help would be greatly appreciated
Pete H (tazmanianuk@gmail.com
03 01 2011
#2 GertD (Antwort)

Hi

thanks for this how-to. I did something similar by using static WLAN settings with hard coded DNS IP-address. Unfortunately during the holiday season the ip-phone forum was down, and hance I didn't have access to the source code of the infoframe data collation scripts. Instead I decided to get Shoutcast working again (the URL of the Shoutcast directory can't be configured, and obviously they don't process actual XML).

Cheers,
Gert
05 01 2011
#2.1 Georgy (Antwort)

Hello Gert,

I have got a Motorola LS1000W as a christmas present and i really like it. Unfortunately i am not able to get the web radio working. Do you have any hint?

Many thanks,

Georgy
26 01 2011
#3 Loewe81 (Antwort)

Hi,
first of all I also want to thank you for this great how-to especially for the workaround with the internal DNS to be independend from the framechannel-website. I'm the one, who wrote the Motorola part on the german infoframe-project website.
I followed all the steps and the rss-requests from the photoframe are now hitting my local webserver (QNAP) directly. But I have a problem with refreshing the image. When I power on the frame the correct and current image from the webserver will be displayed but the no further refresh of the image happens. The image-file on the webserver will be updated correctly every minute by cronjob.
Did I miss something special or do you have any specific configuration on your photoframe? Any ideas how I can troubleshoot this? I also tried to place two files on the webserver and having two items in the xml-file, but this also don't help. Now I will try it using the guid-tag, but I'm afraid that this maybe also don't helps.
Therefore maybe someone else viewing this website can help me with my problem.
Many thx so far.

Ciao Stefan :-)
27 01 2011
#3.1 Loewe81 (Antwort)

I got it now working with updating the image every minute, but I had to use randomized filenames in addition with the guid-tag in the rss-file.
Did anyone from you uses the call-plugin or how get I the image updated in less then 1 minute? The ttl-tag uses minutes and the intervall of the photoframe also doesn't matter.

Ciao Stefan :-)
08 02 2011
#4 fk (Antwort)

Here some people got shoutcast streams running again: http://www.edaboard.com/thread195969.html
14 02 2011
#5 Martin (Antwort)

Hi
I'm getting nuts here.
Got my LS1000W today and tried to set it up. But the frame doesn't even provide the WIFI setup menu. Whatever I do, there's nothing. Just Picture, Musik, Calendar and Setup Menu are shown. Is there something secret I need to know or is it defective? It's actually the only feature I need as I'd like to use it as a InfoFrame.

Martin
16 02 2011
#5.1 Martin (Antwort)

Hi Martin,

I had the same problem. Just download the firmware update from reichelt.de and install it.

Martin
21 02 2011
#5.1.1 Martin (Antwort)

Thanks Martin :-)

Worked.

Martin
21 03 2011
#6 vincenz (Antwort)

there is a firmware update at http://www.reichelt.de/?;ACTION=7;LA=28;OPEN=0;INDEX=0;FILENAME=I100%252FMOTOROLA_UPDATE.zip;SID=12TVQ6RH8AAAIAAGyzFHk2e0bcf368746490d4321ae7baf8a8d50

reichelt.de is one of the many eltronic online markets in germany that has sell this DPF, but i can't find this DPF anymore. Inside this firmware is a lot of html files in the upgrade.img file. This pages contains links to amlogic.com. This is a typical chinese B2B site with no usefull information. But they also have a wiki at openlinux.amlogic.com with information and source code downloads( http://openlinux.amlogic.com/download/ ). As far as i have found out by now, the menus are layouted with html and the action is controled by some other text format files(wich looks like animated_logo.0.page in the firmware archive). But i have not found any explanation of this format(mix of tags, qouted tex(references/pointers/functioncalls?) and intigers in decimal format).

Maybe someone have more ideas how this works. But one thing is clear. Motorola violates the GPL(Linux Kenrel, Busybox, ...). But wich of the two motorolas is the one that is the publisher of this device? I have not found this device or any other picture frame on the motorola websites.
21 06 2011
#6.1 frank (Antwort)

Hi,

how did you mount the upgrade.img file - i get stuck here becaus i cannot determine the fs

Thanks,

Frank
01 07 2011
#7 Nighty (Antwort)

Hi, thanx for your how-to. One question.

I have a D-Link (W-Lan) Router DIR-635 where my frame is connected via WLAN. I also have a NAS that is running day by day and holds my pictures.

But how can I configure a fake framechannel redirection (hosts file) on the router? It must point to my PC (with IIS) or NAS (with lighttpd)?

Anybody knows a trick?

I try to define a own DNS in the router. Point the primary DNS to google (8.8.8.8-) and the second to my PC 192.xx.xx.xx for a first test.
Change the hosts on my PC --> 192.xx.xx.xx rss.framechannel.com
My Internet still works :), but nothing happens on my frame, if I connect to framechannel. Still the same "Error.jpg from original framechannel.com

(I have a .htaccess and a myfeed.rss in my IIS root and the IIS is running) and want to see a first picture that I defined in myfeed.rss

Do I need a own DNS Server running on my Win7 PC?

How can I test it without a frame from a WLan connected Laptop?

IIS 7 Problems? I install it from windows components and copy the modified files to the root. Maybe I must do something more to get RSS feeds?
15 01 2013
#8 Andreas (Antwort)

Hi!

Is this hack also for frames which need a framechannel account like the DUAL PV 8? So, can i use this hack without a framechannel account (because framechannel.com is not running anymore)?

THX,
Andreas
15 01 2013
#8.1 FK (Antwort)

that hack should work in a similar manner for your frame, a framechannel account is not needed.
15 01 2013
#9 Andreas (Antwort)

THX :-) In the moment i only have a B1000 LTE Router, so i can't try this hack, but i will give a little notice when ...

Kommentar schreiben


Umschließende Sterne heben ein Wort hervor (*wort*), per _wort_ kann ein Wort unterstrichen werden.
Standard-Text Smilies wie :-) und ;-) werden zu Bildern konvertiert.
Die angegebene E-Mail-Adresse wird nicht dargestellt, sondern nur für eventuelle Benachrichtigungen verwendet.

Um maschinelle und automatische Übertragung von Spamkommentaren zu verhindern, bitte die Zeichenfolge im dargestellten Bild in der Eingabemaske eintragen. Nur wenn die Zeichenfolge richtig eingegeben wurde, kann der Kommentar angenommen werden. Bitte beachten Sie, dass Ihr Browser Cookies unterstützen muss um dieses Verfahren anzuwenden.
CAPTCHA 1CAPTCHA 2CAPTCHA 3CAPTCHA 4CAPTCHA 5