BT eFrame 1000 dissected – part 2

Posted on by

My quest to unravel the hidden mysteries of the eFrame 1000’s proprietary protocols has been successful and I will start to share my initial findings.

The first significant discovery was that the frame acts as a client and connects to the PC server in response to specially formed broadcast packets or status requests. It also uses standard FTP to retrieve files from the PC.

To discover any photo frames on the network, the PC sends a broadcast UDP message to port 21900 and then waits for a response. The content of the message is as follows:

Search,PF110-PC,PF110-DEV,20021,21901,shuttle,shuttle,PF110,QmitwPF,1,192.168.1.2

  • The 1st parameter (Search) is the command
  • The 2nd & 3rd parameters (PF110) appear to be internal names for the eFrame
  • The 4th parameter (20021) is the port number that the FTP server is listening on
  • The 5th parameter (21901) is the port number that the message server is listening on
  • The 6th & 7th parameters (‘shuttle’ in this case) is the name of the PC server
  • The 8th parameter (PF110) is the FTP username
  • The 9th parameter (QmitwPF) is the FTP password
  • The 10th parameter (192.168.1.2) is the IP address of the server

When the frame receives this message, it responds to the server address and messaging port number with a message similar to the following:

Register,PF110-DEV,PF110,PC,21902,RegisterStatus,20021,21902,0829004123,”000829004123″,PhotoFrame,PhotoFrame,1,192.168.1.3

This message contains the port number of the frame’s messaging service and the device’s unique ID / serial number.

The PC server may also send status request messages:

Read,PF110-PC,PF110-DEV,21901,SystemStatus

To which the frame responds with:

Read-Resp,PF110-DEV,PF110-PC,21902,SystemStatus,0,0829004123,”000829004123″,1.0.0      ,53446460

The response contains the serial number / ID of the frame and the firmware version.

The following status request prompts the frame to report back the amount of free internal storage:

Read,PF110-PC,PF110-DEV,21901,StorageStatus

A typical response from the frame is as follows:

Read-Resp,PF110-DEV,PF110-PC,21902,StorageStatus,0,130990080,128073728

I have written some Perl scripts to automate the frame discovery, registration and file transfer which I will attach shortly.

4 thoughts on “BT eFrame 1000 dissected – part 2”

  1. I have just gotten one of these for a song from dabs myself, and done a quick tear down on the unit:
    http://wiki.getthekettleon.co.uk/doku.php?id=hardware:digiframe:bteframe1000
    I have previously worked on making a similar thing myself from an NSLU2 plus a USB2VGA adaptor. I got quite far with the software, sadly the hardware really wasn’t up to it, so I abandoned it. Perhaps with your scripts Victor, I can ressurect the concept!

    Many Thanks,
    Doug.

    Reply ↓

  2. Hi,
    I got one of these frames last week. I’ve got news and weather feeds working along with a few others using http://www.framechannel.com. I’ve documented my efforts here: http://droza.net/blog/2009/04/07/making-the-eframe-more-interesting/

    I’m very interested in what you’re doing with the protocol. I knocked together a crude Java app last night to send a UDP message to the frame to try to convince it to retrieve images from an ftp server on my network. Sadly the frame just ignored the message so I guess I got something wrong (although the message I sent looked the same as the one from the BT software when I monitored it with Ethereal). Have you had any success with faking the messages sent from the BT software?

    Reply ↓

  3. Thanks for this – look forward to reading more about the protocols as you uncover them – if I get time it’d be nice to knock up a simple app to make more use of them. I wonder if there are further discoveries to be made, e.g. eFrame listing its own filesystem contents, eFrame client uploading files to the server, etc.

    On a final note, you mentioned in your first eFrame posting that the ability to use Framechannel had been removed from the BT firmware. You may be interested to know that this is still possible, see these pages for info on how to set it up:

    http://droza.net/blog/2009/04/07/making-the-eframe-more-interesting/
    http://nonsenseinbasic.blogspot.com/2009/04/eframe-1000-and-picasaweb-now-working.html

    best

    Carl

    Reply ↓

Leave a comment