Tinkering With DTV Converter Boxes

In 2009, the FCC mandated that analog over-the-air terrestrial TV broacasts be shut down in favor of digital ATSC broadcasting. This analog shutdown caused many companies to come out of the woodworks to produce digital TV (referred to as DTV) converter boxes, so that consumers with TVs lacking built-in digital ATSC tuners could still enjoy free, over-the-air programming.

From a geek's standpoint, these boxes can be very interesting. Many DTV boxes have serial UART headers on the board, which can allow for an array of interesting activities. I personally have hacked two particular DTV box models - an Apex Digital DT502 and a Digital Stream DTX9950. However, there are plenty of other converter boxes which have UART capabilities, including a Tivax model and an Access HD. I do not own those particular units, but if I ever get ahold of one and decide to hack it, I'll be sure to update this page.

Tools I Used

It goes without saying that should you decide to do this yourself, I do not assume ANY responsibility for your actions or what may come as a result. I am not responsible for any damages or loss of life or property incurred by your own actions. Experiment with electionics at your own risk.

Part 1 - Digital Stream DTX9950

This particular box has been hacked before. However, just for the sake of boredom, I decided to crack my DTX9950 open and have a go at it.

In the above article from the /dev/ttys0 blog, the particular DTX9950 box being tinkered with appeared to have UART pins already soldered in from the factory. How nice of Digital Stream! If only I were that lucky, though. Mine did not come with pins soldered in, just bare solder pads. But that's no biggie, I just soldered some pins on and connected my UART adapter.

Logging into the box with the following settings (courtesy of the /dev/ttys0 blog):

Serial boot output from the DTX9950.

Hooray, we're in! Serial boot output from when the box enters standby mode.

Unfortunately, my soldering iron managed to burn up the RX trace. Perhaps I should invest in a proper soldering station. Anyway, that unfortunate occurrence resulted in me not being able to "talk" to the box or interact with it. Oh well, at least we get to see the box introduce itself to us:

Project CB2. Hmm, I wonder where CB1 is at.

As you can see, it's running the uC/OS-II real-time operating system, and using the LG Electronics LGDT1111 chipset. Finding information on this particular chipset is nearly impossible. However, the /dev/ttys0 blog was able to source a block diagram for the chip.

As much as I'd like to continue our explorations with this box, as I mentioned before, the RX pin got burnt to a crisp. However, we did get to see the box boot up and think, in a very verbose way. Everything that followed the above boot messages was primarily debug and tuner info output as the box searched for and tuned into channels. Overall, reasonably fun!

Part 2 - Apex Digital DT502

I've saved the much more interesting box for last. My idea to try and reverse engineer this box stems from my sudden urge to disassemble every DTV converter box I own in search of UART pins. Sure enough, I found a UART header inside this Apex box, but just as with the Digital Stream, Apex didn't have the kindness in their hearts to solder some pins in from the factory. Oh well - once again, pins soldered on and the UART adapter hooked up. It should be noted that the Apex box uses the exact same serial settings as the DTX9950. So, what do we get?

Pardon my French - holy shit.

Wow, look at that! I wasn't expecting this at all. As you can see, this particular box is running BusyBox v1.0 on top of Linux. Neat!

Even though BusyBox starts up and briefly shows a prompt, the main shell program overtakes it meaning you can't interact with it. However, by pressing and holding down Ctrl-C, you can kill the shell program and keep it from starting up again. Just hold down Ctrl-C until it drops you in a prompt with no output messages. Interestingly, when you kill the main shell program, the video output goes gray, and eventually disappears.

Now that we're into a BusyBox/Linux prompt, we can do Linux-y things, I suppose.

For reference, the SGI Indigo and Nintendo 64 used R3000 processors.

As you can see, it's nothing special. A very barebones install of Linux on a MIPS R3000 processor. Judging by the speed of this processor and the fact that it's only got 8 MB of RAM to go along with it, the MPEG decoding is almost certainly happening on dedicated silicon. I guess that's why it's identifying itself as the Realtek DTV platform.

Digging further into the filesystem, I found a few folders pertaining to on-screen display layout. They're too large to show here in their entirety, but they're XML files that each on-screen menu/dialog uses for, you guessed it, layout. I might update this page later with a few layout files as examples.

Overall, this is probably the single most interesting DTV box I've seen yet. Hacking it and exploring it was definitely lots of fun. I wasn't expecting to see Linux run in a real-time environment such as this, but here we are. Fascinating stuff!


Tinkering with these boxes can be very interesting. It's quite interesting to see one company's take on a single-purpose device, versus another company. Perhaps eventually I can extract the flash storage from one of these units (preferably the Apex) and explore the file system in greater detail.

Thanks for reading!

last modified 10/22/2020 by CathodeRayMan - do not copy without permission