Our great sponsors
-
-
InfluxDB
Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.
As it happens, I've recently undertaken a journey of getting my LG DualUp to have functionality it should have had from the get-go switch inputs and PBP/PIP mode from DDC/CI. I've also pushed all of my work to Github here but it's very much at your own risk, and I can explain why (might be a bit lengthy tho).
In the zip are 3 firmwares, NXP, PD and Scalar. NXP is the USB microcontroller that's used to update the scalar firmware, and PD is for USB-C stuff. The scalar firmware's name was 28MQ780_MSTAR_MST9W00V4_V3.3.0_0x12FBF031_shad4015bb_220317.bin, which already gave me a few more data points, specifically the chip that's used, the MStar MST9W00V4. Eventually I found this extremely annoying post which had the compiler used for the chip and this page telling me that my scalar's CPU architecture was proprietary, but based on OpenRisc. It turned out that the stars had aligned or something and there were no less than 3 people interested in this particular ISA in the last 3 weeks, because someone else had asked about it and apparently a niche disassembler added partial support for it.
In the zip are 3 firmwares, NXP, PD and Scalar. NXP is the USB microcontroller that's used to update the scalar firmware, and PD is for USB-C stuff. The scalar firmware's name was 28MQ780_MSTAR_MST9W00V4_V3.3.0_0x12FBF031_shad4015bb_220317.bin, which already gave me a few more data points, specifically the chip that's used, the MStar MST9W00V4. Eventually I found this extremely annoying post which had the compiler used for the chip and this page telling me that my scalar's CPU architecture was proprietary, but based on OpenRisc. It turned out that the stars had aligned or something and there were no less than 3 people interested in this particular ISA in the last 3 weeks, because someone else had asked about it and apparently a niche disassembler added partial support for it.
I ended up adding support to Ghidra for the ISA (it's still WIP bc there's a handful of unknown/incorrectly guessed instructions left), and with a bit more decompiling and Github scouring I managed to pull apart and decompress the main firmware binary, so I could actually figure out how the DDC/CI commands even worked.