小米一代网络收音机的APP抓包和BOOT的代码

玛德陛下 · 发表于 2024-12-14 22:59:28

用了手机上的抓包软件

发现APP不是直接发消息给小米收音机
而是APP 发到小米对应的服务器，再由服务器发到小米收音机？
所以找不到对应的控制命令，

实际功耗并不大最大音量下峰值200毫安，
所以3W的扬声器是顶的住了。

在TELNET里面用命令摸索，始终找不到能改写电台网址数据的方法

乱用命令还搞死了几次，不得不刷机来救。

玛德陛下 · 发表于 2024-12-14 22:59:55

本帖最后由玛德陛下于 2024-12-15 00:39 编辑

乱用命令还搞死了几次，不得不刷机来救。

[DOT1X] ra0 is up !
[DOT1X] AuthMode=0, IEEE8021X=0
[DOT1X] Don't need trigger the 1x Daemon
  0 'bootcmd'->'tftp'
  0 'bootdelay'->'0'
  0 'baudrate'->'115200'
  0 'ethaddr'->'"00:AA:BB:CC:DD:10"'
  0 'ipaddr'->'10.10.10.123'
  0 'serverip'->'10.10.10.3'
  0 'flag_last_success'->'0'
  0 'ecos_version'->'1.9.1'
  0 'stdin'->'serial'
  0 'stdout'->'serial'
  0 'stderr'->'serial'
  0 'flag_boot_rootfs'->'0'
start MIIO_FM_VERSION  1.9.1
[D] 000:00:05.980: xobj sys init complete
CFG_save: write 4252 bytes to flash:CFG_CHKSUM=a7922b08, len=4252
CFG_save: old offset=1088, new=211c
..
===>>>Rx Ring 0 queue packets:8
.
===>>>Rx Ring 0 queue packets:20
....
===>>>Rx Ring 0 queue packets:25
start ap mode ssid:SSID=chuangmi-radio-v1_miap417e
MtAsicSetPreTbtt(): bss_idx=0, PreTBTT timeout = 0x0
MtAsicSetPiggyBack(754): Not support for HIF_MT yet!
MtAsicSetRalinkBurstMode(2838): Not support for HIF_MT yet!
MtAsicSetPiggyBack(754): Not support for HIF_MT yet!
MtAsicSetTxPreamble(2817): Not support for HIF_MT yet!
AddTxSType: already registered TxSType (PID = 32, Format = 0
(ApCliCtrlDisconnectReqAction) 2. Before do ApCliLinkDown.
AddTxSType: already registered TxSType (PID = 6, Format = 0
MtAsicSetPreTbtt(): bss_idx=0, PreTBTT timeout = 0xf0
Main bssid = f0:b4:29:a9:41:7e
MtAsicSetPreTbtt(): bss_idx=0, PreTBTT timeout = 0x0
MtAsicSetPiggyBack(754): Not support for HIF_MT yet!
MtAsicSetRalinkBurstMode(2838): Not support for HIF_MT yet!
MtAsicSetPiggyBack(754): Not support for HIF_MT yet!
MtAsicSetTxPreamble(2817): Not support for HIF_MT yet!
AddTxSType: already registered TxSType (PID = 32, Format = 0
AddTxSType: already registered TxSType (PID = 6, Format = 0

[I] 0mum up thread entered ......
00:00:06.170: otn:net bind(54321)
[I] 000:00:06.180: [otn] registed.
[I] 0player starting......
00:00:06.290: otu:[Touch sensor id: 0xff, version: 0xff
No touch sensor found! Try to update firmware...
otu_idle] =>[otu_passive]
[I] 000:00:06.300: ott:cut stop.
Touch sensor update ERROR!
factory test not start
audio inermit init done
ALC5616 Vendor ID: 0x10ec
audio mixer init done

有些乱码，是接触不好的原因，只是压上去的，没有焊接。

大概就是UBOOT 后启动的ZXROUTER的
ZXROUTER 只有1M 的样子，是个ECOS的

我对这个再深入下去太难了

找不到改写电台数据的方法，
做MPLAYER的移植是条路子，但涉及到方面又多又深，算了放弃吧。