DPF with AppoTech AX203

From ST2205u wiki
Jump to: navigation, search
  • status: unsupported!
  • sold on eBay by many sellers; see eBay page for more details.
  • seems to contain the AppoTech AX203 chipset - I'm guessing this chipset will never be supported since there is no documentation available for it, except for this leaflet
  • it looks like every other generic DPF on this wiki, but it is very different inside :P
  • In case someone missed the above (like me :P): It looks EXACTLY like the one used in sprite's video, but does not work! The internals are superficially similar as well (note the locations of the buttons and the USB Port relative to the black blob) but that seems to be about all they have in common.

Photos: front and back Another photo: front only


I got a Lasonic 'Heart' 1.1 inch keychain frame, which appears to be in this catagory (USB descriptors mention BUILDWIN). The USB ids are 1908:1315 which are mentioned here, looks like a 'no go' under Linux.

More AX203 info [1], basically a souped up 8051.

Under Windows the device presents a MassStorage drive with a ISO9660 image containing the DPFMate.exe software. This normally auto-runs but can be stopped by holding shift down when connecting device. If DPFMate is copied to the PC it can be run locally, if USB-mass storage is disabled the device fails to communicate (implies COMs are over mass-storage in some way).

The USB COMs can be snooped with USB-Snoopy (http://mxhaard.free.fr/snoopy.html), maybe the HUGE logs can be analysed to reverse-engineer the protocol this thing uses..... is it worth it?

Found the bits of the logs which set foreground/background colours, need to understand USB better to re-create these under Linux.

Got a little further, following the suggested patch on the LKML I got the device to mount as a CD-drive and list it's contents (DPFMate.exe, etc.).

  • Could you give some more details on what you did to get that far? I added the UNUSUAL_DEVS lines to drivers/usb/storage/unusual_devs.h but no luck (using, recompiled, rebooted :(

Using LibUSB, and cat '/proc/bus/usb/devices'

T:  Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  9 Spd=12  MxCh= 0
D:  Ver= 1.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 8 #Cfgs=  1
P:  Vendor=1908 ProdID=1315 Rev= 0.00
S:  Manufacturer=BUILDWIN
S:  Product=Photo Frame
C:* #Ifs= 2 Cfg#= 1 Atr=80 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage
E:  Ad=81(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=01(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=03(HID  ) Sub=00 Prot=00 Driver=(none)
E:  Ad=81(I) Atr=03(Int.) MxPS=  64 Ivl=1ms
E:  Ad=01(O) Atr=03(Int.) MxPS=  64 Ivl=1ms

Mungewell. Oct 16, 2008


  • Some Additional Information

I have a nextar n1-508 with the same chipset. The nextar n1-505 also appears to be the same thing.

(nextar sells a lot of different models, some with sitronix, some with buildwin).

Plugging into a USB, it is identified as a "buildwin Photo Frame 1.01" device, and recognized as a cd-rom/cd-rw.

Inside, the markings are: DPF0156C AX203.

I unsoldered the spi flash chip and dumped the contents. It is here

The flash chip is an SST 25VF016B

Looking at it with a hex editor, i see:

0 - 8000 unknown (possibly firmware?? ASCII at 0x70: DPF203_V3.4.7)

8000 - 4bfff ISO9660 image.. The "official" iso9660 image starts at 0, however:

"The first 32768 bytes of the disk are unused by ISO 9660 data structure, and therefore available for other use. For example, a CD-ROM may contain an alternative file system descriptor in this area, as it is often used by Hybrid CDs to offer Mac OS-specific content."

4c000 - 62000 unknown (but looks like image data and or fonts)

62000 - 73fff large contiguous data region (images?) (starts at 60000?)

80000 - all f's

Hopefully someone here can dig a little deeper.

When powering up the unit with no flash chip, the screen remains dark, but the USB works, presenting a CDROM device with no data.

Featurewise, the AX203 is a very good MCU, it even has a UART and an ADC, as well as full-speed USB 2.0. Here is more detail on the chip:


This chip is suspiciously similar to the CPF5102. The datasheets nearly match, except the Appotech datasheet has all the details removed: http://www.sintech.com.tw/modules/sections/datasheet/Jaztek/CFP5102-V0.1.pdf

The LCD controller is a TianMa TM128128A4KFWG4:


The best way I have found to tell the difference between Sitronix/ST2205 (good) and BuildWin/Appotech (bad) devices is to check to see if the LCD keychain comes bundled with CD software. If it does, it's likely an ST2205 unit, if not, BuildWin/Appotech. The Appotech units put their software on the keychain's flash.

bchafy AT ccs DOT neu DOT edu


If AX203 MCU is actually the CPF5102, code can only be in OTP internal memory or in an external memory, but not in a serial flash (see CPF5102 datasheet). Since there's not other memory chip in the PCB apart from the serial flash, code must be in OTP. If that's true there's no way to access or change code so this kind of device can't be modified.

david DOT manso AT epistolae DOT com

  • Agreed. If the chip was something else than an 8051, we could go and look for buffer overflows, but having and abusing a buffer overflow in an 8051 seems a bit unlikeky... --Sprite_tm

Feb 6, 2009 ---

Poked around inside the EXE file (DPFMate.exe) found the chips that are supported by this (in flashlib.dat) if you press right click on the title bar DPFMate and select about it will bring and about window with Flash type, Firmware version, Flash Size, Flash ID ?? and other info. [[2]]. -- BinM 2009-04-23


Gembird PF-15 belongs into this family too. It shows up in USB Viewer under Linux as a product of Buildwin. The controller runs ith 24 MHz and the flash chip is 25L1606A-12C (vendor logo unrecognizable, produced in Taiwan). It might be interesting to mention that the file flashlib.dat does not contain this flash chip's name, but it seems to be this one.-- wincent, 22.07.2009


Bought yesterday one pic keychain with a 0,96" LCD. After popping it open, i found a A25L080M-F Serial Flash Memory ship with the following datasheet: http://www.semiconductorstore.com/pdf/newsite/amic/A25L080.pdf

On the other and, dmesg states the keychain as scsi 18:0:0:0: CD-ROM buildwin Photo Frame 1.01 PQ: 0 ANSI: 2

Is it possible to work directly over SPI on the flash reading/writing addressing?

Here's a pic of the one i bought: http://img.kakaku.com/images/productimage/l/K0000033642.jpg

Here's some pics of the inwards: http://nmj.sumomo.ne.jp/suz-avr/KDPDK/KDPDK15V2_003.jpg and http://nmj.sumomo.ne.jp/suz-avr/KDPDK/KDPDK15V2_002.jpg

All these pics came from http://suz-avr.sblo.jp/category/799475-1.html -- J_Palito 2009-10-02

  • While you could probably read/write the flash by tapping the lines, this won't be of much help since the executable code isn't on it. If you simply want to display an image on the screen, I assume it would be simpler to directly control the display module. From what I gather, it uses a ST7637 chip that can be controlled using a standard 68000 or 8080 8-bit bus. -- Gyrbo

Other DPFMate.EXE Devices

Found another digital picture frame in the same family? Why not add it to the list so that Google can find it here. Even if we don't get a driver working, at least this page will serve as a warning to anyone wondering if a device is compatible with Linux.

This is a list of DPFMate.EXE Devices At this time there is no known method to hack them and upload pictures from USB directly to the LCD screen

  • Lasonic Heart Keychain
P: Vendor=1908 ProdID=1315 Rev= 0.00
S: Manufacturer=BUILDWIN
S: Product=Photo Frame
  • Nextar n1-508 and n1-501,
  • Nextar n1-510
idVendor 0x1908
idProduct 0x1320
bcdDevice 0.00
iManufacturer 1 BUILDWIN
iProduct 2 Photo Frame
  • Gembird PF-15
  • Mr. Christmas (brand) Digital Photo Display Ornament
New USB device found, idVendor=1908, idProduct=1320
New USB device strings: Mfr=1, Product=2, SerialNumber=0
Product: Photo Frame
Manufacturer: BUILDWIN
  • Sweex 1.5" Digital Photo Key Chain (Model MM004V5)
New USB device found, idVendor=177f, idProduct=0004
New USB device strings: Mfr=2, Product=3, SerialNumber=0
Product: MM004V5 1.5" Digital Photo Key Chain
Manufacturer: Sweex
Personal tools