linuxjacques is explaining boot process (with further details by Zorander):

1. The boot loader is called zboot. It is in the first flash partition (mtd1). \\zboot reads hardware settings from something called an XENV block.
   These are things such as memory timings.
   
   
2. zboot then mounts the second flash partition (mtd2) which is a cromfs image.
   mtd2 contains several files, some in bin and some in xrpc xload format.
   The xrpc files are signed and potentially encrypted.
   These are loaded in order, somehow skipping certain images that aren't needed. They are responsible for initializing video output for the first time and displaying the boot logo.
   One of these files is the kernel image, which is apparently signed but not encrypted.
   
   
3. The kernel image is validated (signature checked I guess) and then
   uncompressed to RAM and executed. The kernel image includes an initrd.
   This initrd is very small and limited.
   
   
4. Initrd checks a signature in mtd3 at the end (offset 13893628) and if the signature is “okok” or “f1f1” it will mount the cramfs image stored in mtd3. It then checks the md5sum.txt inside and validates the signatures. If all checks out, it will then pivot_root to the new image.
   
   
5. If signature was not ok, or md5sum.txt failed, then the initrd will then look for a wdtv.bin file on a usb drive attached.
   It uses busybox micro-udev facility to do so: whenever a usb chip is detected it will look for a wdtv.bin file (it does NOT look for a wdtv.ver file).
   Initrd looks for ntfs, vfat, ext2, ext3, hfs, and hfsplus fileystems on every partition of every usb drive attached.
   When it finds a file, it will copy it to memory skipping the first 32 bytes and loop-mount it (it does not specify fs type, nor does it specify read only) and unmounts the usb drive.
   Initrd will attempt to check the md5sum.txt file and validate those signatures, but I suspect that this part is bugged and is always skipped.
   If all checks out, it then pivot_root's into the new firmware.
   
   
6. Normally, the third flash partition (mtd3) contains a cramfs image of the final rootfs.
   This contains the firmware for the video, audio, and demux hardware
   on the SMP8635, as well as the media playing applications.
   This is the part that is upgraded by the firmware upgrade process.
   
   
7. The firmware's /init code is called:
   If the signature was “f1f1” then /init is called by ”/init f1f1”. This is a test mode not normally used.
   If the signature was other than “okok” then /init is called with ”/init upgrade /dev/sda1 wdtv.bin”, with /dev/sda1 replaced with the usb drive that wdtv.bin was found on.
   Otherwise it's just called with ”/init”
   
   
8. Firmware updating actually occurs after initfs has found a wdtv.bin file on a usb drive and mounted that and booted. The new firmware takes the wdtv.bin file and writes it to /dev/mtd3 and sets the signature to “okok” when finished. This occurs within /bin/dmaosd somewhere.
   I'm guessing that the md5sum of the entire wdtv.bin file is only checked during this process. It is NOT checked during boot process anywhere.
   
   
9. During /init, xrpc unloads the irq handler loaded by zboot and starts loading new images for the dsp from /lib/firmware. These images contain the audio and video codecs and a new irq handler. We have not been able to load the firmware from the Popcorn Hour image and have them actually work. (They fail to initialize the hdmi output for one)

Only the final cramfs image (mtd3) is included in the firmware updates we have seen so far. If you want to look at it, download a firmware update, skip the 32 byte header and loop mount the cramfs image as posted earlier in this thread.

I have not been able to interrupt the boot sequence to get a zboot prompt. I'm not even sure there is one. I see other similar devices include YAMON if they want that functionality.

I think running a custom kernel would require somehow creating the signed xrpc xload kernel image and replacing the one in mtd1. This would be rather dangerous because bad flash recovery would be lost and if the kernel didn't work you would have a brick which would require JTAG to fix.

A custom rootfs should be much safer and easier.
— linuxjacques

xosPe0 serial#0f5549616b0bdec0a21348098f82138b subid 0x50
xenv cs2 ok
power supply: ok
dram0 ok (9)
dram1 ok (9)
zboot (0) ok
>cl=0, nb_blocks=2
198MHz CL34/34   dram0  12x9    a8888 7777 9cccd   OK
198MHz CL34/34   dram1  10x10   98887 8888 abcba   OK
PASS

**************************************
* SMP863x zboot start ...
* Version: 2.5.0-2.8.3.0
* Started at 0x91000000.
* Configurations (chip revision: 9):
*    Use 8KB DRAM as stack.
*    Support XLoad format.
*    Enabled BIST mode.
*    Enabled memory test mode.
*    Use internal memory for stage0/1.
**************************************
Boot from flash (0x48000000) mapped to 0x8c000000.
Found XENV block at 0x8c000000.
CPU clock frequency: 297.00MHz.
System clock frequency: 198.00MHz.
DRAM0 dunit_cfg/delay0_ctrl (0xf34111ba/0x000a9898).
DRAM1 dunit_cfg/delay0_ctrl (0xe34111ba/0x000a8777).
Using UART port 0 as console.
Board ID.: "SoftBank BB NetTV STB Rev0A0"
Chip Revision: 0x8634:0x86 .. Mismatched (0x8635:0x86 detected).
Setting up H/W from XENV block at 0x8c000000.
  Keeping <SYSCLK premux> to 0x00000203.
  Setting <SYSCLK avclk_mux> to 0x154aa741.
  Setting <SYSCLK hostclk_mux> to 0x00000100.
  Setting <IRQ rise edge trigger lo> to 0xff280a00.
  Setting <IRQ fall edge trigger lo> to 0x0001e000.
  Setting <IRQ rise edge trigger hi> to 0x0000009f.
  Setting <IRQ fall edge trigger hi> to 0x00000000.
  Keeping <IRQ GPIO map> to 0x0b0a0908.
  Setting <PB default timing> to 0x10101010.
  Setting <PB timing0> to 0x10101010.
  Setting <PB Use timing0> to 0x000003fc.
  Setting <PB timing1> to 0x00110101.
  Setting <PB Use timing1> to 0x000003f3.
  PB cs config: 0x000c10c0 (use 0x000c10c0)
  Enabled Devices: 0x00023efe
    BM/IDE PCIHost Ethernet IR FIP I2CM I2CS USB PCIDev1 PCIDev2 PCIDev3 PCIDev4 SCARD
  MAC: 00:80:c8:17:80:ff
  PCI IRQ routing:
    IDSEL 1: INTA(#13) INTB(#13) INTC(#13) INTD(#13) 
    IDSEL 2: INTA(#14) INTB(#14) INTC(#14) INTD(#14) 
    IDSEL 3: INTA(#15) INTB(#15) INTC(#15) INTD(#15) 
    IDSEL 4: INTA(#16) INTB(#16) INTC(#16) INTD(#16) 
    WARNING: suspected IRQ edge trigger settings for PCI.
    WARNING: suspected IRQ edge trigger settings for PCI.
    WARNING: suspected IRQ edge trigger settings for PCI.
    WARNING: suspected IRQ edge trigger settings for PCI.
  Smartcard pin assignments:
    OFF pin = 0
    5V pin = 1
    CMD pin = 2
  Setting up Clean Divider 2 to 96000000Hz.
  Setting up Clean Divider 4 to 33333333Hz.
  Setting up Clean Divider 5 to 25020000Hz.
  Setting up Clean Divider 6 to 20000000Hz.
  Setting up Clean Divider 7 to 20000000Hz.
  Setting up Clean Divider 8 to value 0x1bae147a.
  Setting up Clean Divider 9 to value 0x2c000000.
  Setting up Clean Divider 10 to value 0x2c000000.
type=A, ver=1, id=25 
config file is valid !! 
type=A, ver=1, id=26 
config file is valid !! 
find PAL, addr=8cfe0e37, addr=8cfe0e37 
**** select PAL, CD8=1ba2e8ba 
  GPIO dir/data = 0x1a000003/0x1a000000
  UART0 GPIO mode/dir/data = 0x6e/0x44/0x04
  UART1 GPIO mode/dir/data = 0x6e/0x00/0x00
XENV block processing completed.
Found existing memcfg: DRAM0(0x08000000), DRAM1(0x04000000)
Heap/Temp/Temp1/Dest start at 0x14000000/0x16000000/0x15000000/0x12000000.
Dram size is right, DRAM0(0x08000000), DRAM1(0x04000000) 
Default boot index: 0
Scanning ROMFS image at 0x8c060000 (0x48060000) .. Found.
sign_addr=8cfbfffc *sign=6b6f6b6f
ROMFS found at 0x8c060000, Volume name = PRIMARY_SYSTEM
Found 10 file(s) to be processed in ROMFS.
Processing 30_bootlogo_pal_vsyncparam.zbf (start: 0x8c22a0d0, size: 0x00000372)
  Checking zboot file signature .. OK.
  Decompressing to 0x10001000 .. OK (32696/0x7fb8).
  Load time total 3/13 msec.
Processing 31_bootlogo_bipmap.zbf (start: 0x8c21f110, size: 0x0000af8c)
  Checking zboot file signature .. OK.
  Decompressing to 0x1734e76c .. OK (1231424/0x12ca40).
  Load time total 3/240 msec.
Processing 32xrpc_xload_dviinit_ES4_prod.bin (start: 0x8c078290, size: 0x00001884)
  Checking zboot file signature .. Not found.
  Trying xrpc_xload format .. OK
  Checking zboot file signature at 0x13000000 .. OK
  Decompressing to 0xb0400000 .. OK (11728/0x2dd0).
  Load time total 74/82 msec.
  Execute at 0xb0400000 ..
    **** HDMI/DVI init applet starts ****
    Container addr = 0x8c060000
File dvi.bin found
Copying image from 0x8c079b40 to 0xb0480000, size = 64
    Verify checksum from 0xb0480000, size 64 (0x40).
    Internal HDMI is used
    DVI bin file (dvi.bin) processing completed.
    **** HDMI/DVI init applet ends ****
  Returned result 0.
Processing 50xrpc_xload_vmlinux_8634_ES4_prod.bin (start: 0x8c079bc0, size: 0x00173b84)
  Checking zboot file signature .. Not found.
  Trying xrpc_xload format .. OK
  Checking zboot file signature at 0x13000000 .. OK
  Decompressing to 0x90020000 .. OK (3362497/0x334ec1).
  Load time total 802/1565 msec.
Processing 60xrpc_xload_irq_handler_SMP8634_2.8.3.0_facsprod.mips.bin (start: 0x8c1ed7a0, size: 0x00031934)
  Checking zboot file signature .. Not found.
  Trying xrpc_xload format .. OK
  Checking zboot file signature at 0x00000000 .. OK (but no ZBF header)
Processing dvi.bin (start: 0x8c079b40, size: 0x00000040)
  Checking zboot file signature .. Not found.
  Trying xrpc_xload format .. Failed (not an xrpc_xload file)
Execute final at 0x90316000 ..

Linux version 2.6.15-TvDock (william@SVN-server) (gcc version 4.0.4) #2 PREEMPT Mon Sep 15 20:20:41 CST 2008
Configured for SMP863x (revision ES6+/RevA+), detected SMP8635 (revision ES9/RevC).
Detected CPU/System/DSP Frequencies: 297.00/198.00/297.00MHz
SMP863x/SMP865x Enabled Devices under Linux/XENV 0x48000000 = 0x00023efe
BM/IDE PCIHost Ethernet IR FIP I2CM I2CS USB PCIDev1 PCIDev2 PCIDev3 PCIDev4 SCARD
Valid MEMCFG found at 0x10000fc0.
CPU revision is: 00019069
Determined physical RAM map:
memory: 06fe0000 @ 10020000 (usable)
On node 0 totalpages: 94208
  DMA zone: 94208 pages, LIFO batch:31
  DMA32 zone: 0 pages, LIFO batch:0
  Normal zone: 0 pages, LIFO batch:0
  HighMem zone: 0 pages, LIFO batch:0
Built 1 zonelists
Kernel command line: console=ttyS0
Primary instruction cache 16kB, physically tagged, 2-way, linesize 16 bytes.
Primary data cache 16kB, 2-way, linesize 16 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
PID hash table entries: 2048 (order: 11, 32768 bytes)
Using 148.500 MHz high precision timer.
Console: colour dummy device 80x25
Dentry cache hash table entries: 65536 (order: 6, 262144 bytes)
Inode-cache hash table entries: 32768 (order: 5, 131072 bytes)
Memory: 107776k/114560k available (2635k kernel code, 6776k reserved, 392k data, 252k init, 0k highmem)
Calibrating delay loop... 291.84 BogoMIPS (lpj=145920)

Mount-cache hash table entries: 512
Checking for 'wait' instruction...  available.
NET: Registered protocol family 16

tangox: creating TLB mapping for 0x20000000 at 0xc0000000, size 0x04000000.
PCI: Initializing SMP863x/SMP865x PCI host controller
PCI: Remapped PCI I/O space 0x58000000 to 0xc4020000, size 64 kB
PCI: Remapped PCI config space 0x50000000 to 0xc4004000, size 10 kB
PCI: Configured SMP863x/SMP865x as PCI slave with 128MB PCI memory
PCI: Region size is 16384KB

PCI: Map DMA memory 0x10020000-0x17000000 for PCI at 0x11000000
SCSI subsystem initialized
usbcore: registered new driver usbfs
usbcore: registered new driver hub
Created /proc/cpucache_info entry.
NTFS driver 2.1.25 [Flags: R/O].
fuse init (API version 7.3)
Initializing Cryptographic API
io scheduler noop registered
io scheduler anticipatory registered
io scheduler deadline registered
io scheduler cfq registered
SMP86xx ir (254:0): driver loaded (wait_period = 300ms, buffer_size = 2)
SMP86xx led_rst (253:0): driver loaded.
Serial: 8250/16550 driver $Revision: 1.90 $ 2 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x0 (irq = 9) is a 16550A

serial8250: ttyS1 at MMIO 0x0 (irq = 10) is a 16550A
loop: loaded (max 8 devices)
physmap flash device CS2: 1000000 at 48000000
CS2: Physically mapped flash: Found 1 x16 devices at 0x0 in 16-bit bank
Amd/Fujitsu Extended Query Table at 0x0040
CS2: Physically mapped flash: CFI does not contain boot bank location. Assuming top.
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
Using physmap partition definition
Adding partition #1-#5

Creating 5 MTD partitions on "CS2: Physically mapped flash":
0x00000000-0x00060000 : "CS2-Part1"
0x00060000-0x00280000 : "CS2-Part2"
0x00280000-0x00fc0000 : "CS2-Part3"
0x00fc0000-0x00fe0000 : "CS2-Part4"
0x00fe0000-0x01000000 : "CS2-Part5"
physmap flash device CS3: 4000000 at 4c000000
CFI: Found no CS3: Physically mapped flash device at location zero
driver tangox-ehci-hcd, 10 Dec 2004
TangoX USB initializing...
Tangox-ehci-hcd tangox-ehci-hcd: TangoX USB 2.0
tangox-ehci-hcd tangox-ehci-hcd: new USB bus registered, assigned bus number 1
tangox-ehci-hcd tangox-ehci-hcd: irq 48, io mem 0xa0021500
tangox-ehci-hcd tangox-ehci-hcd: USB 0.0 started, EHCI 1.00, driver 10 Dec 2004
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 2 ports detected
TangoX USB was initialized.
Initializing TangoX USB OHCI Controller Membase=0xa0021500, irq=47
tangox-ohci-hcd tangox-ohci-hcd: USB Host Controller
tangox-ohci-hcd tangox-ohci-hcd: new USB bus registered, assigned bus number 2

tangox-ohci-hcd tangox-ohci-hcd: irq 47, io mem 0xa0021500
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 2 ports detected
Initializing USB Mass Storage driver...
usbcore: registered new driver usb-storage
USB Mass Storage support registered.
NET: Registered protocol family 2
IP route cache hash table entries: 4096 (order: 2, 16384 bytes)
TCP established hash table entries: 16384 (order: 4, 65536 bytes)
TCP bind hash table entries: 16384 (order: 4, 65536 bytes)
TCP: Hash tables configured (established 16384 bind 16384)
TCP reno registered
TCP bic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
Freeing unused kernel memory: 252k freed
4+0 records in
4+0 records out
okok
Find firmware sign in MTDBLOCK3
Mounting application firmware...
Application firmware mounted..
Checking md5sum for all files in application firmware..
All files have been checked for their integrity...
Launch application firmware...
/sbin/ldconfig: can't link /lib/libresolv.so.0 to libresolv-0.9.28.so: Read-only file system
/sbin/ldconfig: can't link /lib/libnsl.so.0 to libnsl-0.9.28.so: Read-only file system
[: upgrade: unknown operand
Inserting the modules...
llad: module license 'LGPL' taints kernel.

open() attempt on /dev/em8xxx0... absent
unload irq handler...
open() attempt on /dev/em8xxx0... absent
zero irq handler api...
config block header is new format. fine!
config block header is new format. fine!
config block header is new format. fine!
F:mkconfig_translate_file_to_config_dir,392: [load config] ret_config=1, i_filename_mirror=/dev/mtdblock5
F:ep_fifo_create_cb:103, readfd:3
flash_monitor_add_task,320, add a new task(/tmp/conf,/dev/mtdblock4)
open() attempt on /dev/em8xxx0... absent
[XRPC map ok] dram_addr=0x17000000 base_addr=0x2adfa000 size=10485760
xrpc succeeded
output = 0000000400000003000000020000000000000000
open() attempt on /dev/em8xxx0... absent
[XRPC map ok] dram_addr=0x17000000 base_addr=0x2adfa000 size=10485760
xrpc succeeded
output = 0000000400000003000000020000000000000001
open() attempt on /dev/em8xxx0... absent
[XRPC map ok] dram_addr=0x17000000 base_addr=0x2adfa000 size=10485760
xrpc succeeded
output = 0000000400000003000000020000000000000002
open() attempt on /dev/em8xxx0... absent
[XRPC map ok] dram_addr=0x17000000 base_addr=0x2adfa000 size=10485760
xrpc succeeded
output = 0000000400000003000000020000000000031500
open() attempt on /dev/em8xxx0... absent
[XRPC map ok] dram_addr=0x17000000 base_addr=0x2adfa000 size=10485760
xrpc succeeded
output = 0000000000000000000000000000000400000002
open() attempt on /dev/em8xxx0... absent
[XRPC map ok] dram_addr=0x17000000 base_addr=0x2adfa000 size=10485760
xrpc succeeded
output = 0000000000000000000000000000000000000001
open() attempt on /dev/em8xxx0... absent
[XRPC map ok] dram_addr=0x17000000 base_addr=0x2adfa000 size=10485760
xrpc succeeded
output = 0000000000000000000000000000000100000001
open() attempt on /dev/em8xxx0... absent
[XRPC map ok] dram_addr=0x17000000 base_addr=0x2adfa000 size=10485760
xrpc succeeded
output = 0000000000000000000000000000000200000000
open() attempt on /dev/em8xxx0... absent
[XRPC map ok] dram_addr=0x17000000 base_addr=0x2adfa000 size=10485760
xrpc succeeded
output = 0000000000000000000000000000000300000000
em8xxx: no version for "llad_open" found: kernel tainted.
em8xxx [/home/william/core_repos/src/libs/2.8.3.0/mrua_SMP8634_2.8.3.0_GCC4_dev.mips/MRUA_src/rua/emhwlib_kernel/kernel_src/krua.c:1463] init_module: begun
em8xxx0 [/home/william/core_repos/src/libs/2.8.3.0/mrua_SMP8634_2.8.3.0_GCC4_dev.mips/MRUA_src/rua/emhwlib_kernel/kernel_src/krua.c:1346] identify: board as unknown subid
em8xxx [/home/william/core_repos/src/libs/2.8.3.0/mrua_SMP8634_2.8.3.0_GCC4_dev.mips/MRUA_src/rua/emhwlib_kernel/kernel_src/krua.c:1449] identify: device 0x8635 0x86 accepted with software tango2revC
mumk_register_tasklet: (0) tasklet c401e000 status @c9285a24
em8xxx [/home/william/core_repos/src/libs/2.8.3.0/mrua_SMP8634_2.8.3.0_GCC4_dev.mips/MRUA_src/rua/emhwlib_kernel/kernel_src/krua.c:1581] init_module: done. Found 1 em8xxx

[: f1f1: unknown operand


BusyBox v1.10.0 (2008-09-15 20:09:55 CST) built-in shell (msh)
Enter 'help' for a list of built-in commands.

root:/dev> udn is a8af5494-0000-0000-0000-cec78a16fc05
friendly name is My Media Player
udn is 0c992d40-0000-0000-0000-b8bffc2e9c8c
friendly name is My Media Player
MediaLogic: listenfd=4
.................................................
em8620__open_device:206, pid = 237,rendere type = 0
em8620__open_device:259, pRUA=0x666640 
em8620_set_vol:1030, gs_volume=50
set_vol:615, right=50,left=50
Volume = 0x11f59ac4
MediaLogic: listenfd=4
.................................................
em8620__open_device:206, pid = 240,rendere type = 1
em8620__open_device:259, pRUA=0x569648 
ir: Enable NEC decoder (0x00000000)

ir: Enable RC5 decoder (0x00000000)

em8620__open_device:206, pid = 245,rendere type = 2
em8620__open_device:259, pRUA=0xa6b348 
em8620_open_dcc:300, Open DCC for player is_pic = 0
********************* em8620_open_dcc:328, DCC is  opening.
securesoho_ntsc_pal_get_inner[1179], PAL
	 argv0 : -f 
	 argv1 : PAL_BG 
	 argv2 : -f 
	 argv3 : edid 
	 argv4 : -hdmi2c 
	 argv5 : 2 
	 argv6 : -o 
	 argv7 : dvi_24 
	 argv8 : -dvi_hdmi 
	 argv9 : siI9030 
	 argv10 : -asp 
	 argv11 : 16 
	 argv12 : 9 
	 argv13 : -cgmsa 
	 argv14 : 0 
	 argv15 : -agc 
	 argv16 : 0 
[HDMI] ========================== creating pDH ==========================
[HDMI] Detected part at I2C device address 0x72: vendor 0x0001, device 9253, rev.0x02 (Silicon Image)
[HDMI] Using the part: SiI9030 (4), Vendor ID is 0x0001 / 0x9253
[HDMI]    ***   Clock changed, is now STABLE



Selecting HDMI chip #0 of 1



[HDMI] Did not find any known CEC parts!
[HDMI] Using the CEC part: direct (0), Vendor ID is 0x0000 / 0x0000
parse_display_cmdline.c: Application did not specify HDCP SRM, providing empty SRM!
[HDMI] DHCancelHDCP()

  HH  HH  HHHHH   HH   HH  HHHH      HHHH   HHHHHH  HHHHHH
  HH  HH  HH  HH  HHH HHH   HH      HH  HH  HH      HH    
  HHHHHH  HH  HH  HH H HH   HH      HH  HH  HHHHH   HHHHH 
  HH  HH  HH  HH  HH   HH   HH      HH  HH  HH      HH    
  HH  HH  HHHHH   HH   HH  HHHH      HHHH   HH      HH    

###../player/EM86xx/2.8.3.0/sal_disp_opt.c:411, HDMI is off##########
[HDMI] DHGetVideoModeFromEDID(): Looking for 16:9 mode in YCbCr
[HDMI] DHLoadEDIDBlock() failed to read EDID block 0
[HDMI] DHLoadEDIDVersion1() failed to read EDID block 0
[HDMI] DHLoadEDIDBlock() failed to read EDID block 0
[HDMI] DHLoadEDIDVersion1() failed to read EDID block 0
[HDMI] DHGetVideoModeFromEDID(): returning color space: RGB full range
[HDMI] DHGetVideoModeFromEDID(): returning emhwlib TVStandard: HDMI_640x480p59
HDMI TVStandard from EDID: HDMI_640x480p59, 4x3
Monitor is DVI / VGA
[HDMI] DHSetHDMIMode(FALSE)
[HDMI] DHUpdateVideoPixelClock(25174825)
[HDMI] DHSetHDMIMode(FALSE)
[HDMI] DHCancelHDCP()
HDMI Colorspace is now: RGB 0..255
No HDMI monitor, can not send AVI info frames!
*****sal_hdmi_apply_audio_options_nolock(): Monitor is DVI / VGA
[HDMI]    ***   Clock changed, is now STABLE
########################Sigma86_Init:1228, osd_scaler_id=0x00000004##########
Sigma86_Init:1324 osd.buf_addr=(nil), get osd surface = 0x1747b5b4, surf addr=0x7fa27bc0
[HDMI] DHLoadEDIDBlock() failed to read EDID block 0
freetype2_createfont...
freetype2_face_requester: file
Nano-X-Freetype2: Freetype 2 error 1 trying to load font.
freetype2_createfont: System,0 not found
securesoho_ntsc_pal_get_inner[1179], PAL
[HDMI] DHSetHDMIMode(FALSE)
	 argv0 : -f 
	 argv1 : PAL_BG 
	 argv2 : -o 
	 argv3 : composite 
	 argv4 : -asp 
	 argv5 : 16 
	 argv6 : 9 
	 argv7 : -cgmsa 
	 argv8 : 0 
	 argv9 : -agc 
	 argv10 : 0 
gfxcontext = 0x2abd36ec, gfxcontext->pic_addr[0] = 0x1747bbf4, gfxcontext->pic_addr[1] = 0x0, gfxcontext->pic_index = 0
The 1nd connection received, connfd=9!
Error: timeString is NULL at F:utils/utils.c L:38 
LGActions command is received
Action:r
LGActions command is received
Action:h
The 1nd connection received, connfd=9!
LGActions command is received
Action:r
LGActions command is received
Action:h
Error: timeString is NULL at F:utils/utils.c L:38 
 fontutl_load_file, 109, Load font full path is : /osd/font//R01_EGBJK.vcp  
freetype2_createfont...
freetype2_face_requester: file
freetype2_createfont...
freetype2_createfont...
freetype2_createfont...
freetype2_createfont...
freetype2_createfont...
freetype2_createfont...
freetype2_createfont...
freetype2_createfont...
F:server_descriptions_init, 109
F:server_descriptions_init, 109
F:server_descriptions_init, 109
F:server_descriptions_init, 109
F:server_descriptions_init, 109
flash_monitor_add_task,320, add a new task(/tmp/conf,/dev/mtdblock4)
killall: scan_manager: no process killed
mlp_init
The 2nd connection received, connfd=10!
We have got a connection from MediaLogic, sockfd=22
reset dns daemon!

VERSION: 0.0.17
--- scan_manager.c:56 [ readfd:4 ]
Entering create_usb_app_plugin_cas:75
F:osd_volume_init:27, init volume(100, 0)
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx can't	 get transparency 
Render: My Media Player:a8af5494-0000-0000-0000-cec78a16fc05
Render: My Media Player:0c992d40-0000-0000-0000-b8bffc2e9c8c
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx can't	 get transparency 
For page(welcome.xml) numkey = 15, conflict_key = 1, conflict_total = 1
F:RNDDeviceFindExpired, (http://127.0.0.1:64784/,a8af5494-0000-0000-0000-cec78a16fc05)=>(-1,-1), 0xab4a28
F:RNDDeviceFindExpired, (http://127.0.0.1:54173/,0c992d40-0000-0000-0000-b8bffc2e9c8c)=>(-1,-1), 0xab1518