I got bored the other day, so I hacked out the format of the Clie Remote Commander.

Using this format, somebody could actually change not only the definitions for the remotes, but also the number and size of the buttons as well as the graphical display. I've already altered the DVD definitions to use some of the buttons on my DVD remote that weren't on the clie.

I've included the format below. Please see the *** NOTE *** at the bottom.

Format of Sony Clie Commander remote files

Name of the database is not significant.
Database should have IrRm for the creator id and RmDf for the type.

The database is a resource database with the following resources:

tAIN 100
Info:
The type of device (appears in the Category dropdown)
Format:
Variable Length String
Examples:
"DVD"
"TV"

tSTR 9999
Info:
Probably the database version number.
Format:
Variable Length String
Example:
"1.00.011026.1"

tver 1
Info:
Probably the program version number.
Format:
Variable Length String
Example:
"1.0"

tint 99
Info:
Unknown why the specific value, but it is unique per database. Probably assigned by Sony.
Format:
4 byte integer
This need to be unique per database, or else a message telling you that the definition file has changed will come up every time.
For the sony databases:
68 = AMP
67 = DVD
66 = VCR
65 = TV
Examples:
(this is in the TV database)
00 00 00 65

tint 150
Info:
Number of Buttons
Format:
4 byte integer
Example:
(this would mean 31 buttons)
00 00 00 1F

for the following resources, xx = 00, 02, 04, 06, 08, 10, 12, 14, 16 etc. Normally, these are counted in twos, in decimal. The XX corresponds to a button (assigned by the next resource) and refers to the same
button throughout the remainder of the resources.

tint 1xx1
Info:
Assigns button number (1 to Number of Buttons) to the xx value.
Format:
4 byte integer
Example:
(this would assign "02" to button #3)
tint 1021
00 00 00 03

tint 1xx3
Info:
00 00 00 03 if standard button
00 00 10 03 if repeating button
Format:
4 byte integer
Example:
(as above, this would make the "02" button a repeating button)
tint 1023
00 00 10 03

Tbmp 1xx7
Info:
256 color picture of any size (typical is 30x30)
Button up picture
Format:
Bitmap

Tbmp 1xx8
Info:
256 color picture of any size (typical is 30x30)
Button down picture
Format:
Bitmap

tSTR 1xx2
Info:
Button english name
Format:
Variable Length String
Example:
"Power"

tSTR 1xx4
Info:
"Se" (always -- probably the name as the "Se"lected button.)
Format:
Variable Length String
Example:
"Se"

wrdl 1xx5
Info:
00 02 Left Top
where Left is a two byte integer indicating the leftmost position to draw the bitmap, and Top is a two byte integer indicating the topmost position to draw the bitmap.
Format:
6 bytes
Example:
(this would paint the picture at position 130, 262)
00 02 00 82 01 06

wrdl 1xx6
Info:
00 04 Left Top Right Bottom
Where Left, Top, Right, and Bottom define the rectangle in which the button responds to a tap. Left/Top do not appear to be important and seem to always be the same as the Left Top settings of the previous resource.
Format:
8 bytes
Example:
(this would make the area from 130,262 to 160,292 the hot spot)
00 04 00 82 01 06 00 a0 01 24

The following 4 bitmaps define what the background initial screen is. So all buttons need to be already drawn on the background. Keep in mind that the very top row buttons (A B C D and Select) are hard coded and not included on this picture.

Tbmp 110
Info:
256 color picture size 160x160 which is the upper left quadrant of the screen (with buttons shown)
Format:
bitmap

Tbmp 120
Info:
256 color picture size 160x160 which is the upper right quadrant of the screen (with buttons shown)
Format:
bitmap

Tbmp 130
Info:
256 color picture size 160x130 which is the lower left quadrant of the screen (with buttons shown)
Format:
bitmap

Tbmp 140
Info:
256 color picture size 160x130 which is the lower right quadrant of the screen (with buttons shown)
Format:
bitmap

tint 160
Info:
Number of manufacturers
Format:
4 byte Integer
Example:
(this would identify 9 manufacturers)
00 00 00 09

tSTL 50mm
Info:
mm = 00, 05, 10, 15, 20, 25, 30, etc. (might not be required to be in increments of 5)
Identifies the makers, modes, and definition numbers that it corresponds to.
Format:
00 00 ?? Maker Name 00 Num Defs 00 [Definition Number "," Mode Name 00...]

?? = unknown value. ?? = 03 - 07
Maker Name = Text name of device maker (shows in maker dropdown)
Num Defs = Text number of definitions (eg, "2" for 2 types)
Definition Number = Text Definition Number always 3 chars (eg, "002")
Mode Name = Text definition name (eg, "type1") shows in mode dropdown as a type
Example:
hex: 00 00 03 53 6f 6e 79 00 32 00 30 30 31 2c 74 79 70 65 31
00 30 32 32 2c 74 79 70 65 32 00

ascii: S O N Y 2 0 0 1 , t y p e 1
0 2 2 , t y p e 2

Particularly important is to note that the "2" identifies 2 instances of the manufacturer remote types (type1 and type2). The "001" and the "022" refer to the definitions in the tDAT files below (please note that you subtract 1 from the number when selecting the tDAT. That is, "022" refers to tDAT 7021.)

tSTL 170
Info:
Same as above, but appears to be a "blank", possibly the default.
Does not contain any definitions.
Format:
Example:
hex: 00 00 03 41 56 2d 41 4d 50 28 53 6f 6e 79 29 00 30 00 30 00
ascii: A V - A M P ( S o n y ) 0 0

Note that there are "0" definitions, and it still includes a "0" as
a type.


tDAT 7ttt
Info:
ttt = Definition Number (from the tSTL resources)
Identifies what bytes are sent over the IR frequency.

Format:
Unknown what first two bytes represent, although they may correspond to the frequency or possibly may even be a part of the initiation sequence.
The next 6 bytes are the initiation sequence, specific to manufacturer.
The next 2 bytes ("Size bytes") identify the width of the command sequence.
One of the two bytes is always 1, and the other can be 1, 2, etc.
to identify how many command bytes per command.
The next byte is always 00.
The next byte identifies the device type:
1F = DVD
1D = VCR
1A = TV
10 = AMP
Next 4 bytes are always 0.
Command bytes follow as array of the size indicated above, with the total length = size of command bytes * number of buttons.
example:
00 0E 00 00 00 99 00 00 01 02 00 1f 00 00 00 00 01 1F
\___/ \_______________/ \___/ \___/ \_________/ \___/
| | | | | |
| | | | | command #1
| | | | always 0
| | | DVD
| | "Size bytes." commands are 2 bytes.
| initiatory sequence
unknown, probably part of init.


**** NOTE ****
The two unknown parts are the two bytes at the beginning of the 7ttt resource, which may just be a part of the device id, and the 2 byte "size" bytes which identify the length of the command. The unknown part there is why it is sometimes "02 01" and other times "01 02". There does not appear to be any direct relationship from the examples I have studied. Please note that this can also be "01 01" if the command byte is only 1 byte wide, or "04 01" or "01 04" if it is 4 bytes wide (like an Aiwa player).

If somebody has some light to shed on that, it would be much appreciated. If somebody can get one of the other hackers from one of the other groups that might be able to help...

I just love how the spaces got stripped, ruining the formatting... Here's that last example again

example:
00 0E 00 00 00 99 00 00 01 02 00 1f 00 00 00 00 01 1F
\___/ \_______________/ \___/ \___/ \_________/ \___/
..|...........|...........|.....|........|.....cmd #1
..|...........|...........|.....|.....always 0
..|...........|...........|...."DVD"
..|...........|..........Command Size
..|...........initiatory sequence
..part of init?

The starting part of that might have something to do with the frequency.

Jason, try using the preview button. Also if you write font color=white between angular buttons (less then, greater then) then the text will be white and you will not need to preview as much, at the end you just add a /font to go back to normal

like aaaaaaa this aaaaaaa . do an edit post to see what I did if you don't understand.

Ok, I'll remember that for next time.

After playing around with it for a little bit, I found that the first two bytes have something to do with frequency. As I altered it, the frequency changed. There does not appear to be a simple formula for calculating it (ie, the number wasn't linear with the frequency). I suspect they might be preprogrammed transmission methods, so all I can do is document them. Also, I noticed there was another undefined value and that is the one in the tSTL resource -- first 4 bytes. That one is specific to manufacturer (all remotes of that type of device for the manufacturer). As I figure out the last pieces, I'm going to keep a doc updated and get it posted. Any ideas where I could store this doc publicly? I don't have my own website.

Another interesting fact that I just found.

[Link: remotecentral.com]

The codes listed there correspond directly to the codes in the remote commander. Makes sense, of course. Sony's remote division must have shared the information with Sony's PDA division.

New information: The Size Codes have just become more cryptic. I found that the technics AMP type 3 has a 2 and 2 for its size codes. All the other size codes had at least a one.

The resulting actual byte size was 4. I am speculating that the two size codes are multiplied together to come up with the actual size. Perhaps its something like "X occurrences of Y width". Like, for instance, "2 occurrence of 16 bits (2) wide".

I am in the process of creating a program that will allow you to modify the skins and the control codes. I'm hoping that by exposing this I'll be able to generate a little more interest and maybe someone with more knowledge of the IR process can fill in the blanks.

Another tip: for text blocks that use spaces as formatting, use the <PRE>your text</PRE> HTML tags to force your browser to show all spaces (it's your browser and not the forum that eats spaces). For example, here's how your info would look with those:

 00 0E 00 00 00 99 00 00 01 02 00 1f 00 00 00 00 01 1F 
 \___/ \_______________/ \___/ \___/ \_________/ \___/
   |          |            |     |        |        |
   |          |            |     |        | command #1
   |          |            |     |        always 0
   |          |            |     DVD
   |          |   "Size bytes." commands are 2 bytes.
   |         initiatory sequence
   unknown, probably part of init.

I made some interesting discoveries about the format.

The "Unknown" bytes with the maker ends up just being the number of null terminated strings in the resource. For example,

00 00 07 at the beginning of a tSTL resource tells me that there are 7 null terminated strings to follow: The first one is the maker name, then the ascii text number indicating how many modes for the maker (5 in this case), and then the 5 definitions each separated by a null.

The other unknown in the tDAT appears to be a sony defined number identifying the protocol. This is being explored further to determine which protocols correspond to which numbers.

The buttons MUST be in sequential order by twos (00, 02, 04, 06, 08 -- no gaps) and the makers must be in sequential order by fives (000, 005, 010, 015) any gaps cause problems. However, the tDAT resources need not be in any order and there can be gaps.

I have put together a freeware program. Officially its not considered released until tomorrow because I've got just a little more testing to do tonight. But I've already placed it at:

[Link: groups.yahoo.com]

(you have to join the group to get access to the files section)

It will allow you to modify the skins and the definitions -- basically everything above.