Documentation about Harmony firmware files

[JayFoxRox]

(Note: I have not used concordance yet, but I'm looking for like-minded people, so I'm posting here)

I'm interested in understanding how these remotes work. I'll leave some references here and hope others share their findings / knowledge.

I've already looked at files from:

• https://www.harmonyremoterepair.com/firmware.html#/ - these are partial firmware files, so not that interesting (I did not bother adding these to archive.org yet).
• http://images.harmonyremote.com/EasyZapper/Downloads/Firmware/61/61.7.5.zip (also part of archive.org) which appears to contain a full (?) image, appears to run on QNX with Flash Lite player and some LUA 5.1; the flash files in app/ can actually run in ruffle. There's also some weird graphic in there. I found this URL in the wild, so I'm not sure which remote is compatible with it, but I belive it's Harmony 900.

As a general overview, the regions (from 61.7.5) via file and binwalk:

• Region_1.EzHex: data

  64            0x40            QNX IFS, size: 3359776 bytes, machine-type: 0x28, little endian, UCL-compressed, version: 1

• Region_2.EzHex: data

  64            0x40            QNX IFS, size: 3359776 bytes, machine-type: 0x28, little endian, UCL-compressed, version: 1

• Region_4.EzHex: Zip archive data, at least v1.0 to extract
  • Mentions userconfig
  • Mentions region_7
• Region_12.EzHex: Zip archive data, at least v1.0 to extract
  • Contains the main SFW app/
  • Contains some bin including IR tools
  • Contains LUA scripts which appear to drive the remote
• Region_14.EzHex: Zip archive data, at least v1.0 to extract
  • Contains flash player library
  • Contains fonts
• Region_16.EzHex: Zip archive data, at least v1.0 to extract
  • Contains receiver and blackbox, I'm not sure what they are

Things I'd like to know:

• Are earlier models "simpler"? I feel that the flash player on QNX is overly complicated (and expensive to produce).
• Regarding https://www.phildev.net/concordance/supported_models.shtml; what arch is each of those referring to (is it about the CPU, or simply about remote model or something else) and how were they found?
• Where to find other firmware files (ideally from logitech servers for legal reasons)?
• Are there any board-pics or PCB scans?
• What's known about the IR diodes, which devices could theoretically be supported?

I'm primarily interested in knowledge about Harmony One, but I was unable to find any firmwares for that yet - help would be appreciated. I might make an emulator or custom firmware, depending how hard it is. I'm really bothered by the slowness of the device and the limited set of features.

[jaymzh]

Yeah the embedded QNX is only newer models. As to the older ones they're very simple, but we haven't done much pulling them apart. This project is primarily concerned with giving Linux users a way to configure their remotes.

The best place, frankly, to find information about the internals is the archives of the devel mailing list.

[JayFoxRox]

The best place, frankly, to find information about the internals is the archives of the devel mailing list.

I'm not interested in using or searching through mailing-list in 2021.

This project is primarily concerned with giving Linux users a way to configure their remotes.

If there's no good place to discuss this I'll probably just stop looking into it.

I've also looked at Update.EZHex now and it looks like the config is containing a bunch of 24-bit words; there are also severe file changes with little configuration changes which suggests it's containing code or complicated structures. Given the entropy it's probably not compression; there are also strings and RGB565 graphics which I can dump, so it's likely unencrypted, too. This suggests a rather high complexity to modify/disassemble this, so I don't plan to look further into it.

If anyone else wants to look into this in the future, ping me (contact details on http://jannikvogel.de/)