Extended Command Console

On the TF5800 (and some firmwares on other models) there is an Extended Command Console hidden in the firmware. The ExtCmdEnable [Gx] patching TAP can enable this console on the serial port. It also integrates the Simple Command Console commands and enables the Memory Monitor (the TF5800 would ordinarily reboot when an exception/crash occurs).

• Commands
• HDD sub-commands
• OSD sub-commands
• XKY strings
• Using the console
• Fun things to try

— Commands —

The following table lists the commands with description and usage. For more detail on argument types, you can use the "?? /a" command. The ones listed with a leading "*" in the description are incomplete — any help with those (or any corrections!) would be gratefully received.

Cmd	Description
??	list commands (use "?? /a" for a detailed listing)
^A	reboot
12V	12V test, NOP on TF5800
22KHZ	22KHz test, NOP on TF5800
AR	audio reset
AVT	set sound level (0..31)
CA	toggles current audio PID between 0x100 and 0x2101, which won't work! (args ignored)
CALL	call firmware function with decimal params
CALLX	call firmware function with hex params
CAS	*sends B2 messages to Front Panel
CD	select folder (change dir) usage: CD folder
CD.	select folder "."
CD..	select folder ".."
CHKREG	times changes to the value at the supplied address (good for use with EMMA registers)
CI	*channel init
CLEAR	clears the scanned svc data (from PAT/SDT/DEMUX)
CLS	outputs EMMA Latched STC (SysTimeClock) value
CM	sets Main to pathA and Sub to pathB? *doesn't really work?*
CSR	NOP on TF5800
CTEST	"encryption" test? connected to CUTEST
CTS	*DevDemux_TsSelCamTs, CAM stuff usage: CTS mode streamRate
CUT	extract data (cut file) usage: CUT path(0,1,2=play) startBlock blocks filename
CUTEST	tests Crypt Unit? for disk accesses? (writes to sector 0x5000000, 42Gb) usage: CUTEST mode(0=reset,1=test)
CVS	stops and restarts main service on currently chosen (scanned) svc usage: CVS size(0=full,1=small)
DBG	controls some limited debug output usage: DBG mode(0=disable,1=enable,N=toggle)
DBIOS	outputs some EMMA TTSD PCR (ProgClockRef), STC (SysTimeClock), PWM (PulseWidthModulator) data
DEL	delete file/dir usage: DEL filename
DELAY	delays (and yields) for the specified ticks usage: DELAY ticks
DEMUX	combined PAT, PMT, SDT and NIT usage: DEMUX path(0,1,2=play)
DF	*debug function, CCAPTION stuff
DIR	outputs detailed dir list info
DISEQC	NOP on TF5800
DISEQCCMD	NOP on TF5800
DMX	*dmx load usage: DMX xpid pid flt0a flt0b flt1a flt1b nSec time
DTS	set path src usage: DTS path(0,1,2) src(0,1=tuners,2=CAM,3=HDD)
FC	closes filename which is open in current dir usage: FC filename
FI	outputs number of current folder entries
FILEINFO	outputs block info on specific path, or block+rate info on all paths (read/write) (requires a fixed stack, e.g. Except64 [Ex] patch) usage: FILEINFO path(0,1,2,-1=all)
FO	opens filename and outputs handle pointer usage: FO filename
FREQ	sets tuner frequency usage: FREQ tuner freq bandwidth streamType
FS	file status, outputs file cluster usage (shows fragmentation) usage: FS filename
GBA	*outputs graphics base addresses?
GDB	returns demux WP (write pointer??) for supplied block
HDD	HDD commands (see below)
HEAPINFO	prints information about the current heap
INB	read byte from addr usage: INB addr
INH	read half-word from addr usage: INH addr
INW	read word from addr usage: INW addr
KILL	removes event processor (see below) usage: KILL idx
LIST	lists scanned svc data (from PAT/SDT/DEMUX), use "/d" to show in decimal format
LNBP	LNB power test, NOP on TF5800
LOAD	*SI load usage: LOAD xpid pid flt0a flt0b flt1a flt1b nSec time
LS	list event processors, shows data: "idx handler desc prev next parent child runCount skip" (see below)
MC	"make captions" enables subtitle track on PathA usage: MC subtitlePID
MCL	clear mem, from arg to 0x82000000
MD	create data on disk usage: MD type(ts,exe,folder) name
MEMCPY	usage: MEMCPY dest src len
MEMSET	usage: MEMSET dest val len
MOVE	move file/dir usage: MOVE from to
NEW	adds/replaces event processor and lists them (see below) usage: NEW handler parent runCount skip
NIT	outputs NIT (Network Information Table) usage: NIT path(0,1,2=play)
NULL	NOP on TF5800
OSD	OSD commands (see below)
OSDI	OSD with different dec/hex param parsing
OSDSTR	OSD draw string (see the note below about col) usage: OSDSTR x y text col
OUTB	write byte to addr usage: OUTB addr val
OUTCH	output character to serial port
OUTH	write half-word to addr usage: OUTH addr val
OUTSTR	output string to serial port
OUTSTRLN	output a new-line terminated string
OUTW	write word to addr usage: OUTW addr val
PAT	outputs PAT (Program Association Table) usage: PAT path(0,1,2=play)
PB	outputs new playback current address
PBSTOP	stops playback and resets service paths (does not work — OPEN cmd not linked)
PIF	produce infinite loop, with interrupts disabled!
PLAY	plays a file (does not work) usage: PLAY cmd(start,stop,filename) (other args not used)
PMT	outputs PMT (Program Map Table), get pmtPID from PAT list usage: PMT path(0,1,2=play) pmtPID
QCMD	adds cmd to queue (if valid) or executes it if queue not running (see below) usage: QCMD cmd
QDELAY	sets queue delay, most useful for setting a start delay (or pausing current run) usage: QDELAY ticks
QEND	stops the queue processor (see below)
QINIT	initialises and disables the queue processor (see below)
QLIST	lists the queue contents (see below)
QSTART	starts the queue processor (see below)
RECORD	record file, using scanned service usage: RECORD cmd(start,stop) path(0,1) svcIdx unused(0,1,2)
REN	rename file/dir
RF	reads max current folder entries from start usage: RF start max
RTC	set Real Time Clock (frontpanel processor) usage: RTC hour min sec
SD	select file for path usage: SD path(0,1,2) filename
SDT	outputs SDT (Service Description Table) usage: SDT path(0,1,2=play)
SERVICE	starts scanned service usage: SERVICE svcIdx mainSub path filter(0,1)
SETS	sets playback speed (factored by 1000) usage: SETS speed
SF	set file info, trims path file to block usage: SF path(0,1,2=play) block
SPCM	*?, usage: spcm mode(0=enable?,1=disable?)
SPOS	sets UHF channel (and sets output to NTSC-M!) usage: SPOS uhfCh
SRVSTART	start main/sub service (doesn't set audio properly?) usage: START mainSub audioPID videoPID pcrPID
SRVSTARTX	same as SRVSTART but with hex PIDs
SRVSTOP	stop main/sub service (or both)
SS	sets screen ratio (LB=Letter Box, CE=Centre Extract) usage: SS aspectRatio(0=4:3,1=16:9,2=raw?) displayFmt(0=LB,1=CE,2=stretch)
STOP	stop file usage: STOP path(0,1,2,N=all)
TESTJPEG	NOP
TESTTTX	test TTX, stops main and sub services, shows TTX PID 0x2e?
TONE	plays a short tone (e.g. "tone 1500 90") usage: TONE freq level
TPES	test PES filter on PathA, like MC except TTX(?) bits unset usage: TPES subtitlePID
TTEST	NOP? just checks disk power status
VA	sets main/sub video alpha usage: VA mainSub(1,0) alpha(0..255)
VF	sets video filter on or off? usage: VF mainSub disable(0=on,1=off)
VFD	*VFD related (TF-5500)
VS	sets main/sub size and position usage: VS mainSub(1,0) x y w h
VST	sets current video standard PAL/NTSC usage: VST std(0=PAL,1=NTSC,2=?)
VTS	animates transition to main/sub size and position usage: VTS mainSub(1,0) x y w h
X	reboot
XDMP	dump memory usage: XDMP addr count
XKY	generate key event (see below)

— HDD sub-commands —

Start with "HDD" then add a sub-command from the following table:

HDD Cmd	Description
status	basic HDD info
id	more HDD info
mode	sets power mode
rs sector num	reads sector(s) and displays result
ws sector num addr	writes sector(s)
rc cluster num	reads sector(s) starting from cluster and displays result
wc cluster num addr	writes sector(s) starting from cluster
format	formats disk (arg is ignored)
scmap	syncs cached FAT and root dir
lcmap	(re-)loads FAT1 and FAT2
cd start end	creates numbered data files in root dir (key press aborts)
del start end	deletes numbered data files in root dir (key press aborts)
record path svcIdx	starts recording scanned svc on path
play	NOP (just displays garbage result)
stop pathset	stops path(s) (bitset, e.g. 5=PathA+PathC)
t-pio	test PIO mode: loops writing/reading/verifying 0x3000 sectors starting from sector 100,000 in 100 sector increments
t-dma	test DMA mode: loops writing/reading/verifying 0x3000 sectors starting from sector 100,000 in 100 sector increments

— OSD sub-commands —

Start with "OSD" then add a sub-command from the following table:

OSD Cmd	Description
init	initialises OSD (unnecessary!)
cntl	NOP
db x y w h col	draw bar
dr x y w h col	draw rectangle
fill	NOP

col is a 16-bit word specified in hex (unless you use OSDI, where it will be decimal!) — remember that the alpha bit is inverted so everything up to 0x7FFF is transparent — 0x8000 is black and 0xFFFF is white.

There are loads more OSD functions defined but not linked into the command, and there are 3 'sizes' of font defined but only the smallest is enabled by default. (A patching TAP could maybe one day add them in.)

— XKY strings —

The next table lists the strings passed to XKY and the corresponding RKEY value (with "=" showing the equivalent TF5800 key if necessary). Some keys are actually NOPs in the firmware, but some of the Cmd_X keys are dangerous (see EMJB's Toppy Key Handling guide).

XKY Arg	RKEY Value		XKY Arg	RKEY Value		XKY Arg	RKEY Value
0	0		VOLUP	VolUp (=Right)		FF	Forward
1	1		RIGHT	VolUp (=Right)		>>	Forward
2	2		GUIDE	Guide		AB	Slow
3	3		EXIT	Exit (=V-)		STOP	Stop
4	4		TVRADIO	TvRadio (=List)		REC	Record
5	5		PAUSE	Pause		CHECK	Ab (=White)
6	6		MENU	Menu		J0	Cmd_0
7	7		CHDOWN	ChDown (=Down)		J1	Cmd_1
8	8		DOWN	ChDown (=Down)		J2	Cmd_2
9	9		OK	Ok		J3	Cmd_3
POWER	NOP		TEXT	NOP		J4	Cmd_4
RECALL	Recall		FAV	Fav (=V+)		J5	Cmd_5
MUTE	Mute		SUBT	Subt (=P+)		J6	Cmd_6
UHF	UHF (=TVRadio)		TVSAT	TvSat		J7	Cmd_7
VOLDOWN	VolDown (=Left)		F1	F1 (=Red)		J8	Cmd_8
LEFT	VolDown (=Left)		F2	F2 (=Green)		J9	Cmd_9
SLEEP	Opt (=Sleep)		F3	F3 (=Yellow)		JA	Cmd_a
EASY	NOP		F4	F4 (=Blue)		JB	Cmd_b
CHUP	ChUp (=Up)		TTX	Teletext (=P-)		JC	Cmd_c
UP	ChUp (=Up)		RW	Rewind		JD	Cmd_d
AUDIOTRK	AudioTrk (=Exit)		<<	Rewind		JE	Cmd_e
INFO	Info		PLAY	Play		JF	Cmd_f
			>	Play

— Using the console —

If a command needs a string argument then you write it without quotes, but using a "&" for a space. There is a nice editing mode which enables copying characters from a previous command (using ">", which obviously stops you using the short versions of the Play and Forward XKY strings!), executing the previous command again (using "." or "!!"), or copying the whole previous command for editing again (using "!"). And while "!n" seems to be intended for a full history mode, the implementation has not been completed.

The command queueing mode is quite clever. Basically, you use "QCMD cmd" to any number of different cmd to the queue, then QSTART to start running this command list over and over. While the queue is being processed (and outputting results) you can still enter direct commands! For example, QDELAY introduces a delay to the queue processing, and this can be used before starting the queue (to give a startup delay), as part of the queued commands (to give a running delay), or from the console while the queue is running (to give an interrupting delay). QEND stops the queue processing, QINIT resets the queue and QLIST shows the current queue contents. See below for an example.

NEW, KILL and LS are related to the main and queue command processing mechanisms. You could add a custom processor, but I'm not sure of the precise point of that.

— Fun things to try —

Some of the commands are dangerous but many are entirely safe. Here are the highlights of fun or interesting things that are safe to try. See above for exact usages.

• VS and VTS change the main or sub (PiP) display size and position, and VA sets the transparency level (e.g. "VTS 1 250 150 250 200" zooms to small screen in the middle, and "VTS 1 0 0 720 576" restores fullscreen)
• SETS changes playback speed (e.g. "SETS -3000" winds backwards at x3)
• TONE generates a beep (e.g. "TONE 1500 90")
• AVT sets the sound level (e.g. "AVT 0" mutes, and "AVT 31" restores full volume)
• DEMUX generates a lot of technical information about the DVB stream
• XKY generates (low-level) key events, as if you had pressed the remote!