Differences between revisions 1 and 26 (spanning 25 versions)
⇤ ← Revision 1 as of 2014-07-10 17:10:02 →
Size: 93
Editor: turmio
Comment:
← Revision 26 as of 2016-10-13 20:02:39 → ⇥
Size: 9381
Editor: turmio
Comment:
Deletions are marked like this. Additions are marked like this.
Line 3: Line 3:
   = Hacking Bus Displays =

== Background ==
City of Oulu / Oulun Energia is dumping old bus displays and we got two of those. We promised to do our best to build something from them.

=== Devices ===
 Both are designed for outdoor public use, so they are heavy, metal enclosed, robust boxes.
 * One is larger (1m x 1m) one sided, two 'modules' stacked vertically. Heavy.
 * Second one is smaller two sided, two 'modules' back-to-back. Surprisingly heavier.

Mass media and modem (they used to communicate through 3G) were removed before we got them. Modem was apparently attached to the main card through ethernet. Device shows the IP on display upon boot.

=== Plans ===
 * Figure out how they work
 * Use at least one (larger) as information display. (Twitter? IRC?)
 * Smaller ones for some project.
Line 4: Line 22:
{{attachment:displays.jpg}}

== Generic technical info ==
 * Telnet
 * FTP
 * Web-server

Linux (none) 2.4.17_mvl21-rpxlite #8 Fri Jan 16 16:59:00 EET 2004 ppc unknown

== Posting content ==
It seems that you can POST information to WEB-server and it will be show at display. E.g.

 * Using curl: {{{ curl -d @display_request.xml http://10.2.0.139:8080}}}
 * display_request.xml
  {{{
<?xml version="1.0" encoding="UTF-8"?>
<displayMLRequest xmlns="http://www.peek.se/DisplayML/" version="1.12" dateTime="2001-12-17T09:30:47-05:00">
        <setDisplay template="TimeOutTemplate">
                <textField region="Top" align="center" valign="middle">Tarlab FTW!</textField>
        </setDisplay>
</displayMLRequest>

  }}}

 {{attachment:tarlab-ftw.jpg}}
== Network ==
{{attachment:display2.jpg}}

=== nmap -results ===
{{{
Host is up (0.00088s latency).
Not shown: 65532 closed ports
PORT STATE SERVICE
21/tcp open ftp
23/tcp open telnet
8080/tcp open http-proxy

PORT STATE SERVICE VERSION
21/tcp open ftp Topfield TF7100HDPVRt DVR ftpd 6.4/OpenBSD/Linux-ftpd-0.17
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| -rw------- 1 root root 330 Oct 15 2013 .bash_history
| -rw-r--r-- 1 root root 6011 Oct 12 2006 .xftcache
| -rw-r----- 1 root root 24450 Oct 12 2006 ArialBold-14.bdf_longbus
| drwxr-xr-x 1 root root 0 May 28 2002 bin
| drwxr-xr-x 1 root root 0 May 28 2002 dev
| drwxr-xr-x 1 root root 0 May 28 2002 etc
| drwxr-xr-x 1 root root 0 May 28 2002 lib
| drwxr-xr-x 1 root root 0 May 28 2002 lost+found
| drwxr-xr-x 1 root root 0 May 28 2002 mnt
| drwxr-xr-x 1 root root 0 May 28 2002 opt
| dr-xr-xr-x 28 root root 0 Jul 10 23:55 proc
| drwxr-xr-x 1 root root 0 May 28 2002 root
| drwxr-xr-x 1 root root 0 May 28 2002 sbin
| drwxr-xr-x 1 root root 0 May 28 2002 tmp
| drwxr-xr-x 1 root root 0 May 28 2002 usr
|_drwxr-xr-x 1 root root 0 May 28 2002 var
23/tcp open telnet Linux telnetd
8080/tcp open http-proxy?
|_http-open-proxy: ERROR: Script execution failed (use -d to debug)

}}}

=== WEB-page ===

{{attachment:webpage.png}}


=== telnet ===
Accounts:
{{{
root::0:0:root:/:/bin/sh
ftp::0:0:ftp:/:/bin/sh
nobody::99:99:nobody:/:/bin/sh

}}}

=== ps auxw ===
{{{
[/usr/bin]# ps auxwww
  PID Uid Stat Command
    1 root S init
    2 root S [keventd]
    3 root S [ksoftirqd_CPU0]
    4 root S [kswapd]
    5 root S [bdflush]
    6 root S [kupdated]
    7 root S [mtdblockd]
   14 root S /bin/sh --login
   18 root S /bin/sh /usr/bin/reset_eth.sh
   19 root S /usr/bin/paras
   28 root S [jffs2_gcd_mtd3]
   31 root S /usr/sbin/xinetd
   35 root S /usr/bin/paras
   36 root S /usr/bin/paras
   37 root S /usr/bin/paras
  282 root S in.ftpd: 10.2.0.137: anonymous/NcFTP@: RETR /usr/bin/boot_s
  307 root S in.telnetd: 10.2.0.137
  308 root S -sh
  403 root S /bin/ping -c 3 10.0.0.226
  404 root R ps auxwww


}}}

[[/Dmesg]]
Line 6: Line 129:
== Display menu ==

{{{
Creates configuration files

                    MAIN MENU
                    =========

   Select:
         1 - Change display type
         2 - Change ip-address, netmask and gateway
         3 - Select protocol to use
         4 - Check values
         5 - Save changes and exit
         6 - Save changes and reboot
         0 - Exit, no changes made to the files

         DISPLAY TYPE SELECTION:
         =======================

        Current type : 2M2466

    Select:
          1 - M14118 display with four MO03 glasses
          2 - M24B99 display with three GV74 glasses
          3 - M24BM12132DL display with four GV74 and GV76 glasses
          4 - M24B330 display with ten GV74 glasses
          5 - twoGV74 display with two GV74 glasses
          6 - 2M2466 display with two GV74 glasses in two rows
          0 - Back to main menu

       PROTOCOL SELECTION
        ==================

    Select:
          1 - Krone
          2 - DisplayML
          3 - DisplayML in Vilnius
          0 - Back to main menu


 **NOTE** Not to be used when only one protocol is in use !!!!
  
        VALUES TABLE
          ============

          Display type : 2M2466
          IP-address : 10.2.0.139
          Subnet mask : 255.255.255.248
          Default gateway : 10.2.0.137
          Protocol : paras

          0 - Back to main menu


         NETWORK CONFIGURATION
          =====================

    Choose:
          1 - Change IP-address Current: 10.2.0.139
          2 - Change Subnetmask Current: 255.255.255.248
          3 - Change Default Gateway Current: 10.2.0.137

          0 - Back to main menu


         VALUES TABLE
          ============

          Display type : 2M2466
          IP-address : 10.2.0.139
          Subnet mask : 255.255.255.248
          Default gateway : 10.2.0.137
          Protocol : paras

          0 - Back to main menu


}}}

{{{
[/proc/19]# ls -la fd
dr-x------ 2 root root 0 Oct 14 02:59 .
dr-xr-xr-x 3 root root 0 Oct 14 02:58 ..
lrwx------ 1 root root 64 Oct 14 02:59 0 -> /dev/ttyS0
lrwx------ 1 root root 64 Oct 14 02:59 1 -> /dev/ttyS0
lrwx------ 1 root root 64 Oct 14 02:59 10 -> socket:[64]
lr-x------ 1 root root 64 Oct 14 02:59 11 -> pipe:[65]
l-wx------ 1 root root 64 Oct 14 02:59 12 -> pipe:[65]
lrwx------ 1 root root 64 Oct 14 02:59 13 -> socket:[66]
lr-x------ 1 root root 64 Oct 14 02:59 14 -> /etc/ip.addr
lr-x------ 1 root root 64 Oct 14 02:59 15 -> /lib/ft2fonts/DefaultFont-11.bdf
lr-x------ 1 root root 64 Oct 14 02:59 16 -> /usr/bin/versions.txt
lr-x------ 1 root root 64 Oct 14 02:59 17 -> /proc/version
lr-x------ 1 root root 64 Oct 14 02:59 18 -> /proc/version
lr-x------ 1 root root 64 Oct 14 02:59 19 -> /proc/version
lrwx------ 1 root root 64 Oct 14 02:59 2 -> /dev/ttyS0
lrwx------ 1 root root 64 Oct 14 02:59 20 -> /dev/watchdog
lrwx------ 1 root root 64 Oct 14 02:59 3 -> /dev/ttyS0
lrwx------ 1 root root 64 Oct 14 02:59 4 -> /dev/tty0
lrwx------ 1 root root 64 Oct 14 02:59 5 -> /dev/fb0
lrwx------ 1 root root 64 Oct 14 02:59 6 -> /dev/null
lrwx------ 1 root root 64 Oct 14 02:59 7 -> /dev/spilcd
lrwx------ 1 root root 64 Oct 14 02:59 8 -> /dev/candrv0
lrwx------ 1 root root 64 Oct 14 02:59 9 -> /dev/candrv1

}}}
=== Display device? ===
Paras binary seems to be binding to /dev/fb0
This device could be "Frame buffer" -device, which is an abstraction of the display panel.
It could be used to write raw bitmap data to the display.
More info:
 https://www.kernel.org/doc/Documentation/fb/framebuffer.txt
Result of dump with cat /dev/fb0 > fb0_dump.dat here:
[[attachment:fb0_dump.dat]]


=== Links ===
 * http://www.parasdisplay.com/
 * http://www.parasdisplayboard.com/
 * http://mitron.fi
 * http://displayml.org (defunct)

<<AttachList()>>
= RasPi =
{{{
eth0 Link encap:Ethernet HWaddr b8:27:eb:11:a8:b3
          inet addr:10.2.0.140 Bcast:10.2.0.143 Mask:255.255.255.248
          UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
          RX packets:1259 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:96068 (93.8 KiB) TX bytes:0 (0.0 B)

}}}
 description:: Reverse engineering old BudDisplay from the year 2000 and building something new with it
 started:: 2014-07-10
hacker

turmio

hacker

otter

Hacking Bus Displays

Background

City of Oulu / Oulun Energia is dumping old bus displays and we got two of those. We promised to do our best to build something from them.

Devices

  • Both are designed for outdoor public use, so they are heavy, metal enclosed, robust boxes.
  • One is larger (1m x 1m) one sided, two 'modules' stacked vertically. Heavy.
  • Second one is smaller two sided, two 'modules' back-to-back. Surprisingly heavier.

Mass media and modem (they used to communicate through 3G) were removed before we got them. Modem was apparently attached to the main card through ethernet. Device shows the IP on display upon boot.

Plans

  • Figure out how they work
  • Use at least one (larger) as information display. (Twitter? IRC?)
  • Smaller ones for some project.

displays.jpg

Generic technical info

  • Telnet
  • FTP
  • Web-server

Linux (none) 2.4.17_mvl21-rpxlite #8 Fri Jan 16 16:59:00 EET 2004 ppc unknown

Posting content

It seems that you can POST information to WEB-server and it will be show at display. E.g.

  • Using curl:  curl -d @display_request.xml http://10.2.0.139:8080

  • display_request.xml 
    • <?xml version="1.0" encoding="UTF-8"?>
<displayMLRequest xmlns="http://www.peek.se/DisplayML/" version="1.12" dateTime="2001-12-17T09:30:47-05:00">
        <setDisplay template="TimeOutTemplate">
                <textField region="Top" align="center" valign="middle">Tarlab FTW!</textField>
        </setDisplay>
</displayMLRequest>

    tarlab-ftw.jpg

Network

display2.jpg

nmap -results

Host is up (0.00088s latency).
Not shown: 65532 closed ports
PORT     STATE SERVICE
21/tcp   open  ftp
23/tcp   open  telnet
8080/tcp open  http-proxy

PORT     STATE SERVICE     VERSION
21/tcp   open  ftp         Topfield TF7100HDPVRt DVR ftpd 6.4/OpenBSD/Linux-ftpd-0.17
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| -rw-------    1 root     root          330 Oct 15  2013 .bash_history
| -rw-r--r--    1 root     root         6011 Oct 12  2006 .xftcache
| -rw-r-----    1 root     root        24450 Oct 12  2006 ArialBold-14.bdf_longbus
| drwxr-xr-x    1 root     root            0 May 28  2002 bin
| drwxr-xr-x    1 root     root            0 May 28  2002 dev
| drwxr-xr-x    1 root     root            0 May 28  2002 etc
| drwxr-xr-x    1 root     root            0 May 28  2002 lib
| drwxr-xr-x    1 root     root            0 May 28  2002 lost+found
| drwxr-xr-x    1 root     root            0 May 28  2002 mnt
| drwxr-xr-x    1 root     root            0 May 28  2002 opt
| dr-xr-xr-x   28 root     root            0 Jul 10 23:55 proc
| drwxr-xr-x    1 root     root            0 May 28  2002 root
| drwxr-xr-x    1 root     root            0 May 28  2002 sbin
| drwxr-xr-x    1 root     root            0 May 28  2002 tmp
| drwxr-xr-x    1 root     root            0 May 28  2002 usr
|_drwxr-xr-x    1 root     root            0 May 28  2002 var
23/tcp   open  telnet      Linux telnetd
8080/tcp open  http-proxy?
|_http-open-proxy: ERROR: Script execution failed (use -d to debug)

WEB-page

webpage.png

telnet

Accounts: 

root::0:0:root:/:/bin/sh
ftp::0:0:ftp:/:/bin/sh
nobody::99:99:nobody:/:/bin/sh

ps auxw

[/usr/bin]# ps auxwww
  PID  Uid     Stat Command
    1 root     S    init 
    2 root     S    [keventd]
    3 root     S    [ksoftirqd_CPU0]
    4 root     S    [kswapd]
    5 root     S    [bdflush]
    6 root     S    [kupdated]
    7 root     S    [mtdblockd]
   14 root     S    /bin/sh --login 
   18 root     S    /bin/sh /usr/bin/reset_eth.sh 
   19 root     S    /usr/bin/paras 
   28 root     S    [jffs2_gcd_mtd3]
   31 root     S    /usr/sbin/xinetd 
   35 root     S    /usr/bin/paras 
   36 root     S    /usr/bin/paras 
   37 root     S    /usr/bin/paras 
  282 root     S    in.ftpd: 10.2.0.137: anonymous/NcFTP@: RETR /usr/bin/boot_s
  307 root     S    in.telnetd: 10.2.0.137            
  308 root     S    -sh 
  403 root     S    /bin/ping -c 3 10.0.0.226 
  404 root     R    ps auxwww

/Dmesg

Display menu

Creates configuration files 

                    MAIN MENU 
                    ========= 

   Select: 
         1   - Change display type
         2   - Change ip-address, netmask and gateway
         3   - Select protocol to use
         4   - Check values
         5   - Save changes and exit
         6   - Save changes and reboot
         0   - Exit, no changes made to the files

         DISPLAY TYPE SELECTION: 
         =======================

        Current type : 2M2466

    Select:
          1   - M14118       display with four MO03 glasses
          2   - M24B99       display with three GV74 glasses
          3   - M24BM12132DL display with four GV74 and GV76 glasses
          4   - M24B330      display with ten GV74 glasses
          5   - twoGV74      display with two GV74 glasses
          6   - 2M2466       display with two GV74 glasses in two rows
          0   - Back to main menu

       PROTOCOL SELECTION 
        ==================

    Select:
          1   - Krone
          2   - DisplayML
          3   - DisplayML in Vilnius
          0   - Back to main menu


 **NOTE** Not to be used when only one protocol is in use !!!!
  
        VALUES TABLE 
          ============

          Display type :     2M2466
          IP-address :       10.2.0.139
          Subnet mask :      255.255.255.248
          Default gateway :  10.2.0.137
          Protocol :         paras

          0 - Back to main menu


         NETWORK CONFIGURATION
          =====================

    Choose: 
          1   - Change IP-address            Current: 10.2.0.139
          2   - Change Subnetmask            Current: 255.255.255.248
          3   - Change Default Gateway       Current: 10.2.0.137

          0   - Back to main menu


         VALUES TABLE 
          ============

          Display type :     2M2466
          IP-address :       10.2.0.139
          Subnet mask :      255.255.255.248
          Default gateway :  10.2.0.137
          Protocol :         paras

          0 - Back to main menu

[/proc/19]# ls -la fd       
dr-x------    2 root     root            0 Oct 14 02:59 .
dr-xr-xr-x    3 root     root            0 Oct 14 02:58 ..
lrwx------    1 root     root           64 Oct 14 02:59 0 -> /dev/ttyS0
lrwx------    1 root     root           64 Oct 14 02:59 1 -> /dev/ttyS0
lrwx------    1 root     root           64 Oct 14 02:59 10 -> socket:[64]
lr-x------    1 root     root           64 Oct 14 02:59 11 -> pipe:[65]
l-wx------    1 root     root           64 Oct 14 02:59 12 -> pipe:[65]
lrwx------    1 root     root           64 Oct 14 02:59 13 -> socket:[66]
lr-x------    1 root     root           64 Oct 14 02:59 14 -> /etc/ip.addr
lr-x------    1 root     root           64 Oct 14 02:59 15 -> /lib/ft2fonts/DefaultFont-11.bdf
lr-x------    1 root     root           64 Oct 14 02:59 16 -> /usr/bin/versions.txt
lr-x------    1 root     root           64 Oct 14 02:59 17 -> /proc/version
lr-x------    1 root     root           64 Oct 14 02:59 18 -> /proc/version
lr-x------    1 root     root           64 Oct 14 02:59 19 -> /proc/version
lrwx------    1 root     root           64 Oct 14 02:59 2 -> /dev/ttyS0
lrwx------    1 root     root           64 Oct 14 02:59 20 -> /dev/watchdog
lrwx------    1 root     root           64 Oct 14 02:59 3 -> /dev/ttyS0
lrwx------    1 root     root           64 Oct 14 02:59 4 -> /dev/tty0
lrwx------    1 root     root           64 Oct 14 02:59 5 -> /dev/fb0
lrwx------    1 root     root           64 Oct 14 02:59 6 -> /dev/null
lrwx------    1 root     root           64 Oct 14 02:59 7 -> /dev/spilcd
lrwx------    1 root     root           64 Oct 14 02:59 8 -> /dev/candrv0
lrwx------    1 root     root           64 Oct 14 02:59 9 -> /dev/candrv1

Display device?

Paras binary seems to be binding to /dev/fb0 This device could be "Frame buffer" -device, which is an abstraction of the display panel. It could be used to write raw bitmap data to the display. More info:

Result of dump with cat /dev/fb0 > fb0_dump.dat here: fb0_dump.dat

  • [get | view | diff] (2016-10-13 17:32:45, 732.8 KB) [[attachment:DisplayML_Specification_standard.pdf]]
  • [get | view | diff] (2016-10-13 17:32:45, 912.6 KB) [[attachment:Vedlegg_1_til_Bilag_3_Protokoll.pdf]]
  • [get | view | diff] (2014-07-10 17:12:09, 33.6 KB) [[attachment:display2.jpg]]
  • [get | view | diff] (2014-07-10 17:12:12, 27.0 KB) [[attachment:displays.jpg]]
  • [get | view | diff] (2014-11-06 19:45:23, 632.0 KB) [[attachment:fb0_dump.dat]]
  • [get | view | diff] (2014-07-10 18:57:44, 63.5 KB) [[attachment:tarlab-ftw.jpg]]
  • [get | view | diff] (2014-08-21 13:21:19, 1.3 KB) [[attachment:turmio.xml]]
  • [get | view | diff] (2016-10-13 18:28:09, 1.3 KB) [[attachment:turmionTemplate.xml]]
  • [get | view | diff] (2014-07-10 17:10:51, 49.9 KB) [[attachment:webpage.png]]
 All files | Selected Files: delete move to page
Normal Sort Sort + uniq Sort + uniq + count

RasPi

eth0      Link encap:Ethernet  HWaddr b8:27:eb:11:a8:b3  
          inet addr:10.2.0.140  Bcast:10.2.0.143  Mask:255.255.255.248
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1259 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:96068 (93.8 KiB)  TX bytes:0 (0.0 B)
description

Reverse engineering old ?BudDisplay from the year 2000 and building something new with it

started
2014-07-10

CategoryProjekti