E3C EC168
An USB controller, that also contains an embedded DVB-T demodulator, produced by Tai-Hui and marketed under the brand name e3C Technologies.
This IC is used in many cheap DVB-T USB Sticks. It is currently unsupported under Linux.
EC168 Devices
Known USB IDs are 18b4:1689, 18b4:fffa, 18b4:fffb, 18b4:1001 and 18b4:1002 (for devices with a second tuner).
- DUTV002 Shen Zhen MinTV-DVB-T Stick 18b4:1001
- DUTV007B USB TNT Basic LIGHT from PC-Basic (Graphics) with MXL5003S tuner and has USB ID 18b4:1001.
- DUTV009 SinoVideo 3420A-2 with MXL5003S but no eeprom (has USB ID 18b4:1689/18b4:fffb)
- SKU08309 USB DVB-T TV Dongle with Remote from DealExtreme uses this chip and has USB ID 18b4:1689.
- MM002V2 Sweex MM002V2 Microtune MT2060 silicon tuner 18b4:1689
- Tvisto USB DVB-T with MXL5003S tuner 18b4:fffa
- ZAP DVB-T USB stick with MXL5003S tuner 18b4:1689 and no external eeprom
- WS-DVBTM2 Tevion USB-DVB-T Stick from Hofer/Aldi
Without drivers, ubuntu 8.10 detect the dongle as an USB Keyboard :
[ 8.729023] usb 3-2: new high speed USB device using ehci_hcd and address 2 [ 8.844654] usb 3-2: configuration #1 chosen from 1 choice [ 8.844992] usb 3-2: New USB device found, idVendor=18b4, idProduct=1001 [ 8.844994] usb 3-2: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 8.919832] input: HID 18b4:1001 as /devices/pci0000:00/0000:00:04.1/usb3/3-2/3-2:1.0/input/input5 [ 8.922137] input,hidraw4: USB HID v1.11 Keyboard [HID 18b4:1001] on usb-0000:00:04.1-2
DUTV009 SinoVideo 3420A-2
No eeprom in this one
SKU 08309 USB DVB-T Dongle
SKU 08309 USB DVB-T Dongle requires Firmware-File called EC168BDA.bin contained in Windows Driver TVGo_Genius.rar
DUTV007B USB TNT Basic LIGHT (GRTNTUSBV4)
Same USB descriptors as SinoVideo 3420A-2, but with another PID... IR is detected directly by the hidraw driver (usbhid)
The PC-Basic v4 USB Stick contains following chips :
- EC168 (USB 2.0 µ-controller, could be also a preprogrammed AVR or PIC)
- Maxlinear MXL5003S Tuner [1]
- EEPROM 24C02N I²C 0xA0 (256 Bytes) [2]
The windows driver also upload a 7109-bytes sized firmware (EC168BDA.bin) to get the device working...
WS-DVBTM2 Tevion USB-DVB-T
Cheap offer at Hofer (Aldi) in Austria. Has an EC168 and MXL5003s built in, which refers to the E3C reference design. Reffering to the link, the system only freezes after loading the dvb-usb-ec168.ko module under debian 5.0 unstable. All other modules load fine. Maybe other distros and/or hardware has better success. It's even impossible to load the firmware via dfu-ec168
Uploading Firmware to the device
- EC168 Direct Firmware Upload tool based on libusb by Tanguy Pruvot : dfu-ec168
Something interresting with this device : We can patch USB ID and descriptors included in the firmware and/or device memory...
Known USB requests
#define CMD_EC168_RAM 0x00 //RW- Read/Write RAM (Firmware go to addr 0-0x1EFF)
#define CMD_EC168_GETSTATUS 0x01 //R-- ex: dfu_ctrl_get(device,0x01,0,1,buffer,1);
// to know if firmware is ready
#define CMD_EC168_STREAM 0x03 //R-X ex: dfu_ctrl(device,0x03,0/0x20,0xFF00);
// disable/enable streaming
#define CMD_EC168_SET_POWER 0x04 //R-X ex: ex: dfu_ctrl(device,0x04,0/1,index); dfu_ctrl_get(device,0x04,0,index,buffer,1);
// disable/enable LED : index=8
// indexes seen in trace: 0x8,0x9,0xA,0xB,0x206,0x208 - Not a Binary Mask !
#define CMD_EC168_UNKNOWN 0x10 //--X ???
#define CMD_EC168_READ_BUF 0x20 //R-- ex: dfu_ctrl_get(device,0x20,0x0000,0x01A0,buffer,0x1A);
// read eeprom ?
#define CMD_EC168_WRITE_BUF 0x21 //-W-
#define CMD_EC168_SET 0x30 //--X ex: dfu_ctrl(device, 0x30, 0x0709, 0x1A);
// set IR Key ?
Identification
USB subsytem ID is: 18b4:1001
output of 'lsusb -vv -d 18b4:1001':
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 2.00
bDeviceClass 0 (Defined at Interface level)
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 64
idVendor 0x18b4
idProduct 0x1001
bcdDevice 0.02
iManufacturer 0
iProduct 0
iSerial 0
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 50
bNumInterfaces 2
bConfigurationValue 1
iConfiguration 0
bmAttributes 0x80
(Bus Powered)
MaxPower 100mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 1
bInterfaceClass 3 Human Interface Device
bInterfaceSubClass 1 Boot Interface Subclass
bInterfaceProtocol 1 Keyboard
iInterface 0
HID Device Descriptor:
bLength 9
bDescriptorType 33
bcdHID 1.11
bCountryCode 0 Not supported
bNumDescriptors 1
bDescriptorType 34 Report
wDescriptorLength 63
Report Descriptors:
** UNAVAILABLE **
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0008 1x 8 bytes
bInterval 7
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 1
bAlternateSetting 0
bNumEndpoints 1
bInterfaceClass 255 Vendor Specific Class
bInterfaceSubClass 255 Vendor Specific Subclass
bInterfaceProtocol 255 Vendor Specific Protocol
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x82 EP 2 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Device Qualifier (for other device speed):
bLength 10
bDescriptorType 6
bcdUSB 2.00
bDeviceClass 0 (Defined at Interface level)
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 64
bNumConfigurations 1
Device Status: 0x0001
Self Powered