Has anyone Hacked the RH10 ( so it can record in MD Mode ?)

[Strungup]

We have Volume Hacks , Kanji Hacks , Region Hacks ( there all at the Md forums )

But has Avrin ever figured out how to get the rest of the RH10 to cooperate , He had a Hack for SP recording at the loss of MP3 playback .......... I wonder if there has been any further developement .

The RH10 , should have been the RH1 ......... Just to cool looking , if it could only do ALL the RH1 does .

[Ascariss]

Not sure how you would hack perhaps in service mode but does the devie have a way to record in md mode?

[Guest Delete By ThanksGiving]

Just as an aside (unrelated to the topic)--keep in mind that this is a place holder. Chris M may just overwrite this table and any messages you write will be history. He might accommodate a merge, but with all the other hurdles associated with this data migration I wouldn't depend on it.

[Christopher]

When everything is migrated, I will be able to transfer it here without any problems and this should be one of the most recent topics, if it is still active by then (less than week from now).

[Strungup]

Just as an aside (unrelated to the topic)--keep in mind that this is a place holder. Chris M may just overwrite this table and any messages you write will be history. He might accommodate a merge, but with all the other hurdles associated with this data migration I wouldn't depend on it.

Wow , your , um ..... sooooooo Happy arent you ?

I prefer a Little optimism in my coffee , tastes better to me .

Thank you Chris . Appreciate the Nod

[Guest Delete By ThanksGiving]

Thanks, Chris.

Can't be too careful, TC. I haven't the foggiest idea who you are, so it's too soon to have a fight

[Strungup]

Thanks, Chris.

Can't be too careful, TC. I haven't the foggiest idea who you are, so it's too soon to have a fight

Lets just say I have about 3000 posts at the Md forums ...................... Not starting a fight , but you could be a little more on the bright side , and on Topic .

Lets start these forums off right , and keep them organized , and on topic .

If you wish for a fight , then just leave me alone . not interested .

Negative mark on the side ( For what ??? ) Asking for a positive workflow ?

[Strungup]

Not sure how you would hack perhaps in service mode but does the devie have a way to record in md mode?

Yeah you have to get into service mode , and change some addresses , Avrin over at the md forums , did that and was able to get standard MD Mode , but only SP not LP2 or LP4 , and he lost the MP3 ability .

The Hardware and software is in the RH10 , Mine even accidentally STARTED recording in MD mode once , then 4 seconds later it Changed its mind ( AI at work here ) and started flashing Cannot Record , but there was in Fact 4 seconds of SP mode audio ............

The Firmware is crippled to keep it from doing all the goodies . But the Hardware is there . Go figure ........ I really like the RH10 , It is just a cool looking easy to use piece of gear ( please Refrain from the other Piece of...... phrase ......... all you 40 GB total library toting ........ Video Watching , .........Internet Browsing .......... um ....... crap I am running out of words here .

Negative mark on the side .......... again For WHAT ????

[Avrin]

I wonder if there has been any further developement .

No. Even the SP hack was pure luck. There are lots and lots of possible values for service mode addresses, and it would be impossible to check all of them. E.g., address 0114 may have values 0 to 127, and it was pure luck that anything below 80 gives SP recording. It is still possible that some particular value may give the remaining legacy recording functions. But more probably it is not just a single value, but some unknown combination. But with combinations things get even worse. Just two addresses, 0113 and 0114, each with 128 possible values, give us 128*128 = 16,384 possible combinations to try.

But the remaining legacy recording functions are much less important than SP recording for the RH10, since you can put LP2 and LP4 to legacy discs using SonicStage with great quality.

[Strungup]

No. Even the SP hack was pure luck. There are lots and lots of possible values for service mode addresses, and it would be impossible to check all of them. E.g., address 0114 may have values 0 to 127, and it was pure luck that anything below 80 gives SP recording. It is still possible that some particular value may give the remaining legacy recording functions. But more probably it is not just a single value, but some unknown combination. But with combinations things get even worse. Just two addresses, 0113 and 0114, each with 128 possible values, give us 128*128 = 16,384 possible combinations to try.

But the remaining legacy recording functions are much less important than SP recording for the RH10, since you can put LP2 and LP4 to legacy discs using SonicStage with great quality.

0-127 .......... sound almost like a MIdi protocol , all Midi sequence numbers and command lines run in values from 0 - 127 ..........

so Changing the Midi values to hexadecimal ........hmmm interesting thought

[Avrin]

I'm terribly sorry to confuse you. Mea culpa. It's not 0 to 127 for the above addresses (although this range may apply to some other ones, in hex representation). It's 00 to FF hex. So, 256 possible values for each, and 65,536 combinations for the two addresses.

[Avrin]

Some freshly discovered data on some of the effects of address 0113 and 0114 settings in the RH10 for those who are interested:

Address 0113:

First byte:

0 to 7: Custom equalizers enabled; [presumably] full output power.

8 to F: Custom equalizers disabled; [presumably] limited output power.

Second byte:

0, 1, 8, 9: Menu languages: English, French, German, Italian, Spanish; MD & Hi-MD titling: English.

2, 3, A, B: Menu languages: Japanese, English; MD & Hi-MD titling: Katakana, English.

4, 5, C, D: Menu languages: Japanese, English, French, German, Italian, Spanish, Simplified Chinese, Traditional Chinese; MD & Hi-MD titling: English.

6, 7, E, F: Menu languages: Japanese, English, French, German, Italian, Spanish; MD titling: English; Hi-MD titling: CANNOT EDIT.

Address 0114:

First byte:

0 to 7: No MP3 playback or download; SP is displayed when the unit is in MD mode; SP recording can be started when the unit is off.

8 to F: MP3 playback and download; SP not displayed; no SP recording.

Second byte:

Unknown effect.

This is by no means exhaustive.

[Strungup]

Right on Avrin . 0113 gives another area of Power control on the Output , and EQ settings , ? So Sony has all kinds of tricks in there from Country to Country , different settings for Market purposes ............

0114 , Sp mode from OFF to Recording . So a slick enough , or nimble enough set of hands and your codes handy at all times , you could change that , as per need ................ Cool ,

I like the Way the RH10 is built , and the fact that it uses regular Gumsticks , and a Battery sidecar for a AA battery , I really wish they would have made the RH1 like that .

I bet some of the addresses have to do with Upload / Download , and compatibility between machines , I know that the RH10 isnt supposed to upload on Mac , but if I record in my RH1 , or Format the disc first in the RH1 , and record in the RH10 ,........ I can actually use the RH10 for uploading just like the RH1 . Which means it is ABLE to do so ........... begging the question , where is it at in the Service addresses to open those gates .

My suspicions are they put a LOT more capability in the RH10 than it is released with .

[Avrin]

Well, I'd better stop messing around with this service mode stuff. Just made one of my NH600s able to title in Katakana on the unit and show Japanese menus on the RM-MC40ELK. Nice for an absolutely non-Japanese unit, heh? Just by setting address 0113 to 23.

And it already had VPT enabled by resoldering.

[Strungup]

Well, I'd better stop messing around with this service mode stuff. Just made one of my NH600s able to title in Katakana on the unit and show Japanese menus on the RM-MC40ELK. Nice for an absolutely non-Japanese unit, heh? Just by setting address 0113 to 23.

And it already had VPT enabled by resoldering.

The Guru of Get Arounds ................ pretty soon you will have it loaded with A.I. , .................( Now THAT would be interesting )

[Avrin]

Well, the VPT trick was not my idea. It's from a Russian forum. Easily discovered by looking at the service manual for the NH700/NHF800.

[Strungup]

One other idea , would be Which Setting would enable the RH10 to retain its Record Level /Mode settings like the RH1 . That seems to be a Common complaint across the board , I have read a Lot of posts , with that feature as a Wishlist item .

I will eventually get some time , after I get these guitar repairs out of my shop , and sit down with the service mode commands to learn them .

The SP mode is of great interest and need , so I can Make copies of things for freinds without wearing out my RH1 , or Teac .

[Avrin]

Recording level is actually saved without any hacks. But the unit switches to Auto Level mode as soon as you press the STOP button. If you switch back to Manual, the previously set level will be used, even after switching the unit off, removing discs, etc. I mostly use the RH10 to record to SP via optical, so I have the level set to 23 (pass through). But each time I record a disc, I need to go through the DISABLE SYNC REC > ENABLE MANUAL LEVEL > ENABLE SYNC REC routine. If you just record from a mic or line in, and don't need SYNC REC, the entire procedure is much simpler.

And I don't think it's possible to prevent the unit from switching to Auto Level without modifying the firmware itself (not just by changing service mode settings). Same may apply to enabling full legacy MD functionality.

Edited September 14, 2009 by Avrin

[Strungup]

hmmm , It just seems that the Legacy modes are in there somewhere , It just wouldnt make sense to make a Non Backwards compatible disc , but then again it IS Sony we are talking about here .

[Avrin]

An interesting point with the RH10 is paragraph 3-5-3 of its service manual, quite vaguely called "Other setting". It describes a procedure of programming address 1113. The procedure is very different from the usual value changing. Usually, an address contains a single value (e.g., 23 (Japan) or A0 (Europe) at address 0113). But address 1113 is successively programmed by entering six (!) different values in groups of three. And no explanation whatsoever is given about the meaning of these values. No name for the address itself is displayed even with the remote connected. The address itself seems to belong to the ChkChg group (1110). But the Charge Function Check is fully described in paragraph 3-3, and contains no references to address 1113 (addresses from group 2000 POWER are used for charge check and calibration).

[Strungup]

This is getting more interesting by the minute ..........

Sounds like Sony had one thing in Mind then at the last stage of design changed their minds , but it was to late to change the design so they changed the programming

[Avrin]

Work in progress:

Addresses 1821 and 1822 are the key. Copying values from the RH1 enables lotsa stuff, but:

Looks like there is no ATRAC3 encoding circuitry in the RH10. Recorded LP2 and LP4 tracks play as silence. MONO is OK.

V-Surround changes the sound, but whether it does it properly - remains to be seen.

SpeedControl doesn't work.

[sfbp]

Work in progress:

Addresses 1821 and 1822 are the key. Copying values from the RH1 enables lotsa stuff, but:

Looks like there is no ATRAC3 encoding circuitry in the RH10. Recorded LP2 and LP4 tracks play as silence. MONO is OK.

V-Surround changes the sound, but whether it does it properly - remains to be seen.

SpeedControl doesn't work.

Right. Manual specifically says you cannot generate recordings in MD mode, but that you CAN download them and (presumably) play them back.

[Avrin]

To hell with the manual. This topic is dedicated to disobeying it. The unit records perfectly in SP and MONO.

The entire problem seems to be caused by the limited amount of memory for the firmware. SONY needed to put MP3 playback code in, so something had to be sacrificed. And they chose to sacrifice MDLP encoding to make room for [crippled] MP3 decoding. While the ATRAC SP codec was probably hardware-based, so it remained. But to avoid confusion, they completely disabled all legacy recording modes through service mode settings.

Later, in the RH1, they simply added more memory, so it has all you may ever want. But the reason for disabling the MONO recording ability (present in the prototype) needs to be investigated.

[Avrin]

Work in progress:

Seems like no "magic combinations" exist. Each byte at each address is responsible for certain functions.

[Avrin]

So, the more or less useless hacking results are here. Many thanks for inspuration to TC- here and VovchikRH10 at www.player.ru/talk , who started all that.

A few comments for a start. SONY disabled some functions on the RH10 menu for a reason. The unit's hardware/firmware does not provide full or any support for them. Legacy MD recording works only for SP and MONO (LP2 and LP4 are recorded as silence), V-Surround does not surround, but just increases the sound level, and SpeedControl has no effect at all.

Still, the meaning of addresses 1821 and 1822:

Address 1821:

First byte:

2, 3, 6, 7, A, B, E, F: The V-Surround item appears in the Sound menu.

0, 1, 4, 5, 8, 9, C, D: The V-Surround item is not shown in the Sound menu.

Second byte:

2, 3, 6, 7, A, B, E, F: If the first byte at address 0114 (or 1812) is set to 0-7: the REC Mode selector in the REC Settings menu works for MD mode. MD mode recording can be started with the unit on. Only SP and MONO are recorded properly. If the first byte at address 0114 (or 1812) is set to 8-F: no effect.

0, 1, 4, 5, 8, 9, C, D: The REC Mode selector in the REC Settings menu doesn't work for MD mode. If the first byte at address 0114 (or 1812) is set to 0-7: MD mode recording can only be started with the unit off. Recording is done in SP or the mode previously selected. Only SP and MONO are recorded properly. If the first byte at address 0114 (or 1812) is set to 8-F: no effect.

Address 1822:

First byte:

Unknown effect.

Second byte:

1, 3, 5, 7: The SpeedControl item is shown in the menu, but has no effect on playback.

0, 2, 4, 6: The SpeedControl item is not shown.

And now to torturing the RH1.

Edited September 15, 2009 by Avrin

[Avrin]

A quick analysis of common service mode setting patterns in the RH1 revealed nothing that is not known already.

[Strungup]

This sounds a Lot like a Bicycle Wheel ........

ergo: If you adjust a Spoke on one side of the wheel , it has a direct effect on the opposite side ( across the diameter ) but then also a lesser effect but still noticed at 1/4 radians around the wheel . ( I have built a few bike wheels )

The Adjustments in Spoke tensing have to made made incrementally around the wheel while watching the overall effect of the whole wheel. Achieving perfect center and balance on a Bike wheel takes a a day or two , the build only take a couple hours , but the adjustment and fine tuning take the real time and attention.

You mentioned addresses at TWO different locations 0114 and 1811

Here at this part " Second byte:

2, 3, 6, 7, A, B, E, F: If the first byte at address 0114 (or 1811) is set to 0-7: the REC Mode selector in the REC Settings menu works for MD mode. MD mode recording can be started with the unit on. Only SP and MONO are recorded properly. If the first byte at address 0114 (or 1811) is set to 8-F: no effect."

When you have the SP Mode enabled in this way , Do you still lose MP3 playback ? or .......

And the different addresses being linked together like that , "If at 1821 this , and also at 0114 that " , But you mention 1811 as well ....... !?!?

This is indeed like the architecture of a Bike wheel , ie: Tension at any given point will have an effect at several other points in the balance system .

I wouldnt say that that was a Useless hack Avrin , you have done a great thing for the Board , there are many who can do without MP3 , and just the regular MD is fine .

To sum up : The Ability to have SP , Mono , HiSP ,HiLP , PCM on one machine is getting pretty close to the RH1

Who really needs MdLp ......... Mono has very Definate functions , Meetings and lectures sound best in Mono , less room noise , and better fosus to the Sound .

Also some sound effects , or things like Percussion , and Handdrums should be in mono for a better mix in the Multitrack environment .

You keep this up I will have to build you one of my Mic preamps ......

[Avrin]

You mentioned addresses at TWO different locations 0114 and 1811

And made a horrible typo (already corrected). Sorry.

This is easy. The following addresses are linked together, so setting a value at one of them also sets the same value at the other.

Address 0113 = Address 1811 (DistFL)

Address 0114 = Address 1812 (DistFH)

---

Overall, I think the optimal configuration is as follows:

1811: 23 - no output signal compression, full titling options (you already have this value if your unit is manufactured for the Japanese market).

1812: 7F - one step down from the original value, to enable ATRAC recording at the cost of MP3 playback.

1821: 97 - one step down from the original value, to enable SP/MONO selection and normal recording start.

1822: 14 - the original value.

---

And now I wonder what these "hardware flag" addresses (1831-1834) are for?

Edited September 14, 2009 by Avrin

[Strungup]

And made a horrible typo (already corrected). Sorry.

This is easy. The following addresses are linked together, so setting a value at one of them also sets the same value at the other.

Address 0113 = Address 1811 (DistFL)

Address 0114 = Address 1812 (DistFH)

Dist FL = Function Low ?

Dist FH = Function High ?

me thinks

Memory allocation as you suggested earlier ...... AT one Address , You have SP mode starting with Unit Off or from NOn Standby mode. Which wouldnt require more memory .

At another Address setting you have SP and MONO from the Rec Menu ....... Which is now "using MORE" memory , so what gets sacrificed ? memory has been reallocated . so SOMETHING had to move out of the Way . ..........MP3 Playback , probably ......correct ?

[Strungup]

---

Overall, I think the optimal configuration is as follows:

1811: 23 - no output signal compression, full titling options (you already have this value if your unit is manufactured for the Japanese market).

1812: 7F - one step down from the original value, to enable ATRAC recording at the cost of MP3 playback.

1821: 97 - one step down from the original value, to enable SP/MONO selection and normal recording start.

1822: 14 - the original value.

OK , I have to Find another RH10 now , I must do this .......... Have one setup this way , and One normal for MP3 's But this would be a cool machine setup like that .

[bobt]

I admire both of you on your perseverance on getting the machine to do what you want, working outside the box as it were. In the end if it achieves what you want, it will be worth it, and to those with an RH10, who use these functions, please thank Avrin and TC for your new capabilities

Bob

[Avrin]

Dist FL = Function Low ?

Dist FH = Function High ?

More probably Distribution Flag Low and Distribution Flag High.

Memory allocation as you suggested earlier ...... AT one Address , You have SP mode starting with Unit Off or from NOn Standby mode. Which wouldnt require more memory .

At another Address setting you have SP and MONO from the Rec Menu ....... Which is now "using MORE" memory , so what gets sacrificed ? memory has been reallocated . so SOMETHING had to move out of the Way . ..........MP3 Playback , probably ......correct ?

This may be exactly the case. The non-volatile memory used to store the firmware is not changed, while the RAM used for data processing may be used differently. E.g., the first byte at address 0114 controls what is actually loaded - the MP3 decoder or MD recording routines. While the second byte at address 1821 simply controls the interface.

[Avrin]

It just occured to me, why exactly SONY had to keep the ATRAC encoder, whatever the implementation (hardware or firmware). It is required for pseudo-SP downloads. The PC sends ATRAC3-encoded files, and they are decoded and encoded to ATRAC on the unit. Removing the ATRAC encoder would have made even pseudo-SP downloads impossible.

And MONO obviously works since it uses the same encoder as SP, with two channels merged into one.

But why SONY disabled MONO recording on the commercial version of the RH1 is beyond me.

Edited September 14, 2009 by Avrin

[Strungup]

But why SONY disabled MONO recording on the commercial version of the RH1 is beyond me.

Oh Man you know what , I have never even tried Mono on my RH1 ( My R50 always got that job .......)

But wow , your right , What the heck ???? Why isnt Mono there , as that it is just a standard Atrac which is already in the Machine >?????

It just occured to me, why exactly SONY had to keep the ATRAC encoder, whatever the implementation (hardware or firmware). It is required for pseudo-SP downloads. The PC sends ATRAC3-encoded files, and they are decoded and encoded to ATRAC on the unit. Removing the ATRAC encoder would have made even pseudo-SP downloads impossible.

Also the RH10 is Playback capable of all legacy discs , so it would need the ATRAC codec for that as well ........ That would have to be there , Which is why I suspect LP2 and 4 are hidden in there somewhere . The Codec is already there

[Strungup]

Checking the Specs on the RH1 it does have Mono . Does yours Not Have it ? hmmmm maybe another Euro Menu mod , like the Volume limitation ?

Also Avrin , when you mentioned the RH10 Service settings ( "Other Settings" ) I started thinking about a website that I had seen about the MD Transfer Software for Mac being hacked ...... and that there was more Mac functionality in the RH10 than was let on .. As in the Software on the Computer had Blacklisted the RH10 and others , to keep them from UPLOADING , but that the functionality was already there in the MD units Someone even wrote a Cracked version of the MD Transfer2.0

I Have noticed that , ( again ) when I format a disc in the RH1 first , I can use the RH10 to upload whatever I record afterwards .

So maybe those OTHER settings might refer to an Identification system , or Callback system for the Software to recognize the unit , I would guess then that we would have to be quite careful with all other settings , as they might change values elsewhere we dont know about . I believe you mentioned several thousand combinations were available .............

Just a thought

[Avrin]

Currently recording Phil Spector's "Back to Mono" 4-CD box set to MONO on the RH10.

As for codecs, don't forget that they consist of two independent parts - the encoder and the decoder. The manufacturer may remove the encoder, but still keep the decoder. That's exactly what is done in the RH10 - they removed the ATRAC3 encoder, but the unit is still able to decode ATRAC3. Similarly, they put an MP3 decoder in, so the unit plays MP3s (in whatever quality), but is unable to record (encode) to that format. And again, Hi-MD recorders contain only 64 kbit/s and 256 kbit/s encoders for ATRAC3plus, but many more (while still not all) decoders for the format.

As for "Other setting" from the service manual, I’ve checked the entire group of addresses around 1113. The group (1110) is called ChkChg, and contains three addresses - 1111 Power, 1112 Servo, and 1113 SrvSys. The addresses actually contain much more capacity than others:

In the NH600 address 1111 stores 41 two-byte hex values, address 1112 stores 13 two-byte hex values, and address 1113 stores 27 two-byte hex values. The values are mostly zeroes, though some are set.

In the RH10 address 1111 stores 41 pairs of two-byte hex values, address 1112 stores 13 pairs of two-byte hex values, and address 1113 stores 27 pairs of two-byte hex values. Again, these are mostly zeroes, but some are set. Values specified in the service manual were not set in my unit (the respective pairs contained zeroes), setting them manually according to the manual changed nothing.

In the RH1 each of these addresses stores 125 two-byte values, and most of them are actually programmed with non-zero values.

All this doesn't look to me like power or charge calibration settings at all. I looks more like some microcode or patches written to the units. But to understand those, one needs to know the assembly language (machine code) used for such units.

As for recording to MONO on the RH1 - the commercial version doesn't do it, and it is not specified in the manual. Only SP, LP2, and LP4 are available. But the prototype with firmware version 0.960 was actually able to record in MONO. Probably that's how MONO got to the specification page.

Edited September 15, 2009 by Avrin

[Strungup]

Avrin you rock dude .

This will inspire others with the same knowledge ...... I would think . also the Fact that we can at least get SP and Mono ( which some audiophiles will insist is the purest form )

And have the unit function more like a True Md machine should .

This is worth something .

[Strungup]

Avrin I just checked MY RH1 , and your right ,.......no Mono ..... SP LP2 LP4 but no Mono

I had never even checked it .......... very interesting indeed . This makes me suspect there is a LOT more hidden in the Programming and Commands that are embedded in all the HiMD units

Not just RH10 , but what if a lot of others had MP3 , or Other things hidden by means of a General Programming Standard , that Sony could use and Modify according to the need for each unit .

[Avrin]

I don't think that any first-generation SONY units have MP3. As I've said above, putting an MP3 decoder in requires something to be removed, e.g. the ATRAC3 encoder. Even the first ever Hi-MD MP3-playing unit, the BUFFALO MD-HUSB, was only a downloader, so the unused ATRAC3 encoder was probaly also removed to enable MP3 playback.