ROVA Tools – Alternative programmer, and editor for Realtek based LCD Controllers

If you recognise this, chances are you’be been tinkering with LCD panels too:

RM5451 LCD Controller
RM5451 LCD Controller

The RM3251/RM5451/RM5251 LCD controllers offered hobbyists one of the first ever opportunities to create their own LCD display centric contraptions. Prior to this, the LVDS interface featured by almost all LCD panels was a mystery, with scores of tinkerers wondering how on earth to interface this to something more familiar, i.e. VGA or DVI.

One day, I saw this on eBay:

ROVA USB-TOOLS Programmer
ROVA USB-TOOLS Programmer

I’ve seen a few of these over the years, normally you get one posted to you when you engage with a LCD controller firmware company, right after signing a non-disclosure agreement, and handing over a lump of cash.

But on eBay? This is interesting. I had to hit ‘buy’. The seller, NJYTouch has managed to get their hands on the programmer software for this family of boards, and a whole bunch of firmware images for different panels, and they’re selling it on eBay for hobbyist money.

Disappointingly no source code was included, but this was no surprise to me. I’ve not seen a single line of source code for these controllers in my life. That isn’t to say it’s not out there, there’s plenty of sites flogging off leaked source snapshots of these boards.

The good news is that the CPUs on these boards are almost always 8051s, which is pretty easy to reverse engineer.

Enter ROVATools. My creation of the last few years. I first started on it in 2011, then abandoned it due to lack of time, and picked it up again in 2014.

There are two main programs:

ROVAEdit (The editor)

ROVAEdit GFF LCD Controller firmware editor
ROVAEdit LCD Controller firmware editor

This gives one access to pretty much all of what you’d need to change when creating an image for an unsupported panel. This program can only edit the firmware for supported R.RMxxxx boards.

ROVATool – Alternative programming software

ROVATool – Alternative programmer for R.RMxxxx and PCB800099

The mainstay of my tool suite is descrambling the .GFF files so they can be edited. Because I don’t have a mechanism to re-create .GFF files, this software has to be used to program the controllers.

What’s supported

The following controllers:

  • R.RM3251
  • R.RM3451
  • R.RM5251
  • R.RM5451
  • PCB800099 (Program only, no editing)

The following programmers:

Normally the Parallel programmer is for PCB800099 and ROVA USB-TOOLS is for R.RMxxxx, but with this software, you can use either programmer to program either board. I wouldn’t recommend buying the Parallel programmer (aside from the obvious, how many PCs still have a Parallel port?) – The USB Programmer is just a much cleaner and easier solution.

The ROVA USB-TOOLS is sold by NJYTouch, search eBay for “1PC Programmer for Burning LCD Controller Board DIY USB”

The supported Parallel port programmer. There's more than one design of these, and chances are, they're not all compatible.
The supported Parallel port programmer. There’s more than one design of these, and chances are, they’re not all compatible.
rtd2660ftdi
Programming an RTD2660 based board with the Adafruit FT232H

 

Other benefits

Even if you don’t need to make an image for an unsupported LCD panel, there’s still some benefits of using my tools:

  • Ability to remove OSD popups which can pollute the display output
  • Up-to-date programmer software with 64-bit operating system support
  • No requirement for the ancient DLPortIO driver, for those concerned about the security vulnerabilities exposed by this package
OSD Popup
OSD Popups making your project look unprofessional? Banish them with ROVAEdit ;-)
ROVATool EDID Reader
ROVATools comes with a built in EDID reader to read EDIDs directly from displays over the wire. Handy for the casual screen hacker.

Download

I’ve split the download of this into two files:

  • ROVATool – This is the programmer only, for both RTD2120 and RTD2660 platforms
  • ROVASuite – This is the programmer and editor, for only RTD2120 platforms

76 thoughts on “ROVA Tools – Alternative programmer, and editor for Realtek based LCD Controllers”

  1. Hello Matt,

    great work on Rovatool – seems to be just what I need to get this adapter here to output the correct 24 bits…

    I’d like to try my hand at programming the board with an arduino instead of a parallel port programmer – I really don’t want to get the old box with a parallel port out of storage.
    Would you be willing to elaborate a bit on the I2C programming (Addresses, commands, Datasheets etc?)

    Thanks!
    Tyberius Prime

  2. Sorry to hear that – there’s several projects to program these boards via a parallel port adapter, but for USB, we’re still stuck with a proprietary Chinese adapter. An expensive one, I might add, for what seems to be a basic USB->I2c interface that any 5 USD arduino clone would suffice. Now, I understand that part of the programmer cost is actually firmware development – but there is a russian open source firmware project for the RTD2662 http://openrtd2662.ru/

    Still, I appreciate what you’ve done.

    So long
    Tyberius Prime

    1. Apperantly you can talk to the I2c port in your vga adapter directly on Linux – that would be more interesting than doing it with an arduino – no additional hardware necessary.

      Perhaps allow me one final question? Do you have a better source for the I2c commands to enter isp mode, etc, than the Postal2 source code? It’s pretty straight forward, but perhaps there’s an additional data sheet that I’ve been missing?

      So long,
      Tyberius Prime

      1. Where did you score the Postal2 source code from? Forget openrtd2662.ru, nothing open about it.

        I managed to reverse engineer how the postal2 reads the flash from the RDT2662 via the VGA DDC lines, it mostly makes sense, however I can not figure out how they calculate the CRC.

  3. Thank you Matt very much for your effort. The tool looks great !!! I understand that I can change virtually any setting of existing configuration and upload it to the controller, but can I change the EDID signature on existing controller ?
    I have R.RM5451 board and ROVA USB programmer. I do not want to change display setting, only the EDID signature. Is it somehow possible to download current settings from the controller, change the EDID and upload it back ? Or change the EDID only ? I am not sure what GFF is used and do not want to screw working panel. Thank you.

    1. You will need to find out what the original GFF file was.

      RTD2120L (which is what’s on RM5451) doesn’t allow the download of its current firmware.

  4. Oh well, I was afraid of that. Thanks for confirmation. Can I one more question ? The programmer has sliding switch on the side. next to the side VGA connector. What is it for ?

    1. It boots the Cypress microcontroller from an alternative flash chip, which contains the firmware for a Novatek USB programmer. It allows both Novatek and Realtek based boards to be programmed.

  5. Matt, interesting read and nice write up of details for these boards. Like Tyberius Prime, I too have been looking into the possibility of flashing via Linux without any special interface board. I’ve managed to make progress in reading information of my current monitor via I2C on my Ubuntu server so I’m on the right track. I’m wondering if you and Tyberius ever got in touch and if they had any success in flashing directly under Linux. I’ve got a PCB800099 board on the way and have a few different LCD panels I’d like to test out. Being able to flash between configurations will be a must. Fallback plan of course is just to invest in the USB programmer (or Parallel port… think I can still dig up a PC that has one) and use your software, or I’ll just see about desoldering the W25X40 chip off the board for SPI programming.

    1. I sent Tyberius an email a while back with the source code of my reverse engineered RTD266x algorithm but haven’t heard anything since.

      Taking that code to a programming solution using just Linux and a VGA port would have required significant time and expertise. I’d have had quite a job figuring out how to do this myself.

      1. Yep, understood. Maybe someone with the programming skills (I can hack around a bit but not much) will get in touch with your or other developers of applications for I2C programming and work something out. It certainly would be nice as it would then (hopefully) be dreadfully easy, maybe needing nothing more than the proper VGA cable, a computer with VGA output, and a bootable Linux disc/thumb drive.

        For right now though I am all set. I continued my searching (and learning for that matter) and found info on doing SPI ISP (Serial Peripheral Interface In-System Programming in case I lost anyone there…) with the Raspberry Pi I already had to attach to my PCB800099. Five wires from the RPi to the W25X40, a couple minor software add-ons to Raspbian and I was good to go. I’ve now got my PCB800099 that was originally flashed to support some 7″ LED LCD screens via FFC interface able to control a Samsung LTN121XF-L01 12.1″ screen that was pulled from a Dell C400. At least it looks like it is controlling it OK, I don’t yet have an inverter for the CCFL of the screen to backlight it. Certainly a cool learning experience. I plan to do a write up either for an RPi forum or Wiki, if I get that done I’ll return here with a link.

        As far as the binary ROMs for these controllers go, can you enlighten me any on the content? In particular when I was flashing my board I first did a read and backup of what was on the W25X40 and got a 512K ROM. All the alternate ROMs I had to flash were 256K. Since the flashrom program I was using required a matching sized ROM I had to experiment a bit. Some poking around in them has led me to believe that the first 256K on the chip is the necessary information for the screen itself (EEID, OSD, etc.) and the second 256K may just be where settings (last selected input, color controls, etc.) get saved. Backing this up is that if I write a 256K ROM I customized to 512K to the chip I can immediately read it back and verify a match, but after using the controller (in which I may or may not have done something like alter the input selection… I forget) if I try to verify the chip contents again it doesn’t match. Your take?

        Thanks again for your write ups about these devices and the programming, as well as your input in the comments. It led me down the path where I have both learned some new tricks as well as accomplished something!

          1. Roger, happy to share my knowledge with you by direct contact since I don’t have anything well organized to put out on the ‘net at this time. Drop me a line via the name I’ve used in this comments section, at craftech dot com. Still hope to have something in the future to throw to a forum or blog.

        1. The contents of the flash chip is predominantly compiled 8051 software. Modification requires good tools (i.e. IDA Pro) and lot of skill and patience.

          1. Matt, I can confirm that within the first 256k that may be the case. in the ROMs I was using, since that was the size of each file that was available for flashing. Since under Linux the flashrom program would only write a like-sized (full-chip I assume) file I had to figure out what to do with the second 256k. Since the earlier post I’ve done some more tinkering. I kind seller on eBay that had a Dell C400 laptop for sale worked with me to get some (rough) EDID data for that screen. So I was back into a hex editor to cram that into the 256k ROM I was playing with. After updating the multiple EDID locations I then padded the ROM out to 512k with 0xFF. I don’t believe I’ve modified settings and then read the ROM back but I’ll probably do so in the future. It will be much easier now, I’ve picked up an SOP8 clip. I really expect to find that the trailing 256k of 0xFF now has some alterations to it, but maybe I’m wrong. I am curious to find out!

  6. Hello Matt, this code looks neat!

    I just got a board with the RTD2662 on it, and I’m having fun with it. I am interested in programming it, but I can’t seem to find a suitable programmer on ebay. Do you have any advice?

  7. Can you used this tool to change if the LCD will go to Snow or Blue screen on signal lost? Is that was the “Show No Signal” does?

  8. Hi Matt!
    Your work is great and ROVAtool works perfect, but I have some problems due to my lack of experience. I’m working with PCB800099 board and Keil project RTD2660_AV1_AV2_081015, trying to make some custom firmware. The main problem is that I have no idea how to use the output files after compilation, which are *.h00, *.h01, *.b00, *.b01 and *.gff but there’s nothing like *.bin or *.hex which are accepted by your ROVAtool. I tried to use Gff2Bin and Gff2BinCmd with generated gff file, but this software crashes everytime after opening any gff file.
    So…. I’m stuck and will be very grateful for any help :(

    1. I’ve not looked at that project

      But I suspect h00/01 is hex and b00/01 is bin.

      Not sure why it outputs two though. It’d make sense on RTD2120 as there are two banks of flash, but this is not true for RTD2660.

      1. You were right. In compiler’s options for target, there is checked an option for code banking with set two banks. But when I uncheck it, what suggest compiling without banking, compiler is linking for very long time, ending with billions of errors and target not created.

      1. I’m using uVision4, but it’s unconnected. After my explorations of the “eastern side of the internet” I realised that there are two versions, or rather copies, of this project sharing the same name. “The broken one but easier to get” is missing some files and ending compilation with not finding a file BL.lin. The working one is a bit troublesome to achieve, so I can share a copy with you if you want.

        1. Hello.
          If Could you please post source code that compiles successfully, in my e-mail: maximum-rukzak at yandex.ru
          In advance thank you.

          1. Hello.
            If Could you please post source code that compiles successfully, in my e-mail: viteka32 at gmail.com
            In advance thank you.

    2. Were you able to build working firmware for PCB800099?
      Firmware I build works, but image on screen toggles few ms on and few seconds off…
      There’s also size difference – all internet bins are 256 and source code is made to produce 128kB bin…

  9. OK, I was able to build the (default) target. The end result is a GFF file and in my case gff2bin.exe also crashes on any gff file.
    Clearly (from the build process) the .H00 and .H01 files are hex files for the 2 banks. Still a mystery how to create 256K binary out of it that ROVAtool will take…

  10. Found open source “RTD Programmer” that understands the gff format, but the result is 128K, not 256K as all the available images. Two halves are similar, but not identical. What’s the secret? Anybody?

    1. You won’t gain anything by playing with GFFs. They are nothing more than obfuscated binaries.

      I have noticed that the .BINs supplied with the PCB8000099 kit have almost identical images repeated.

  11. I’m trying to understand the sources. Right now the big mystery is the multiple “panel” definitions in the include files. For example 640×480 and 800×600. Sure every panel has only one native resolution. Why “Panel0″ and “Panel1″?

  12. Was just playing with FTDI based programmer and PCB800099 – worked well. Board got nicely programmed for my LCD type.

    I also got (from ebay) a bit nicer board known as PCB800116 (or VS-TY2668-V1). It uses RTD2668 chip. One advantage of that board (over PCB800099) is that it contains audio support, audio amplifier etc. Firmware files for that board can be found at: http://www.szrcxlcd.net/cn/col.jsp?id=142&m622pageno=3&m623pageno=2#module623

    Unfortunately rovatool is not able to program it ( Info: Attempting program… Error: Device didn’t send ack byte during FTDIUSBInterface::Read).

    Would be it possible to add support for RTD2668 chip?

    Thanks for great work.

    ps. would be great if this project ended up as open source on github.com for example (thinking about possible improvements and contributions from other users)

    1. Tried different approach too. Desoldered Winbond 25x40BVNIG (eeprom) and checked its contents. What is inside seems to be just *.bin for particular LCD panel. But there is a catch…

      Near address 0x7BFF8 there is area that could be checksum or some settings. Fresh *.bin files downloaded from manufacturer page have area filled with FFs there. Trying to program such *.bin with area filled with FFs causes device to not start. Copying that area from original eeprom content to new bin file also doesn’t help.

      Area starting from 0x7C013 also changes when device is running… not sure what is hold there.

      And I’m stuck now. Still trying to somehow get new bin (for my lcd) working.

  13. Hi,
    I have RTD2660 based board with TV tuner and jumpers for setting resolution/panel type. It bluescreens. Searched the web and found three versions of source code for it. All of them are on chinese websites.
    1] KR2660_DMB_AV_TV_VGA_WJ_20100331.part01.rar
    this one actually compiles in Keil, producing BIN but size is over 128k, so I can not fit it to my flash
    2] RTD2660 AD Board.zip
    this one is incomplete, it is missing BL.BIN and other files. But it have far more header files for different panels.
    3] RTD2660_AV1_AV2_08.rar
    RTD2660_AV1_AV2.rar
    RTD2660_AV1_AV2.rar
    RTD2660_AV1_AV2_081015.rar
    one of these should be whole package. I was not able to find place on china internet where this can be downloaded. Could someone please send it to me to spam@kolins.cz ? (this is regular email, do not worry :)

    I have backup of original firmware with multiple panel support. I searched whole internet back and forth and everything I downloaded is here
    https://kolins.cz/share/index.php?folder=UlREMjY2Mg==
    Hope it helps someone.
    Any information on how to compile, upload etc is welcomed.
    Mirek

  14. I was wondering if you could edit the blue screen away completely with your software? I am getting into First Person View (FPV) flying with quadcopters and often LCD monitors will go to blue, or black screen when the quadcopter is far away or behind trees because of a “weak” video signal. While the signal may be “weak” a pilot can still make out some features, and maneuver back to safety if they had a “snow screen”. Snow screens are incredibly hard to come by. Normally in the $200+ range, but from what I understand its all in firmware. Have you ever tried to do this?

  15. I’m trying to get the LM R25 controller (declared as a new version of R3251) working with the AUO B121EW03 V8, haven’t got any result yet. The original dumped firmware (not working) is a BIN-file, the 2nd firmware from njytouch (not working as well) is a GFF-file but ROVAEdit generates parse error when I’m trying to open the XML-file generated by Gff2Bin. So I’m still confused.

  16. I’m trying to flash a PCB800099 board with a Raspberry pi, but have very little clue of how to do it.

    Would you give me some orientations on how to do that ?
    Best regards, thanks !

  17. I want to use the ROVASuite with a RTD2120 based LVDS controller, which is not exactly the same board as the R.RM5451 but has the same hardware (M25L-VDA3). I use a FTDI based interface with the FT2232H chip.

    Now I have the problem that I do not have any working .gff files to start with because I did not buy the USB programmer from njytouch with the CD that contains these files (did not need it because I already have the FTDI interface and currently, it is not even available for sale). I downloaded some other .gff files from various sources and split them with gff2bin but the resulting files can not be opened with ROVAEdit (gives me parse error). Possibly, they would not work anyway even if the editor would be able to open them because they are not for LVDS converter boards with the RTD2120.

    I have created a backup of the original firmware with the postal2 software that was also mentioned in the comments here but I do not know how to convert these files (1x 96K binary, 1x 266K hex) to the format that ROVAEdit needs (might not work at all). Could you please upload (or send me an email with) at least one of the gff files for the R.RM5451 from the CD that came with the USB programmer so that I have a file that the editor can work with? As far as I understand, one file would be enough to create all kind of different resolutions with the editor and the EDID designer. Is that correct?

  18. I’m probably blind and just can’t see the option, but does the RovaTools suite allow for downloading firmware from the PCB800099 – RTD2660 controller? I have a working controller panel combo and couple of loose controller boards. I want to try cloning the good firmware to one of the loose boards so I can experiment with changing EDID values, testing alternate firmware and such without bricking the good board. If it makes a difference, I’m using the Adafruit FT232H as my programmer.

    1. According to another reader it can be done on RTD2660 but I did not know it was possible when I wrote ROVATool.

      It isn’t presently implemented.

      1. Thanks for the heads up. I’ve managed to get what I needed from Ghent’s project. I kludged together a python port of his/her source using Adafruit’s python library for the FT232H. Using that I was able to pull down the firmware and successfully match it against one of the known images. I flashed it with your tool to the other board and now Bob’s my uncle.

  19. Excellent software and resources, thank you.

    @el-sahef:
    I’m also having problems with the M25l-VDA3 board in that my backup of the board has been lost (long story), and I currently have a blank board (no firmware at all). Does anyone have access to the firmware for this board that they would be willing to share? Or, does anyone know if there is an alternative firmware (such as one for a R.RM5451 board) that might get this working again?

    Thanks in advance.

  20. I’ve been using this successfully with an RTD2660/PCB800099, but I’ve recently bought more boards and now I get “Error: Unsupported memory device: 0xEF134014″ every time I try to program them. I can program the old board over and over, but if I try to program new boards it never works – even despite trying new boards 3 times… Has anyone any ideas what this might be? Or what this error means?

    1. Every once in a while a new board comes along with an unsupported memory device

      Can you please tell me what flash chip is on your board? I will add support for it.

          1. Dear Admin,
            I bricked my NT68676 board. It was w25x40 memory.
            Can you tell me whitch status register bits are turned on on any RTD board?
            Thanks in advance!
            Dave

        1. I spent quite some time years ago trying to add support for this. The NovaTek does some pretty ugly stuff during programming which rules out the use of I2C protocol programming, it has to be PIO/bitbang, frustrating my attempts to make progress on it.

          Additionally, last time I looked at this there was no known documentation or example of an algorithm for these chips. I did some USBSnoop analysis using the Novatek EasyWriter tool, suffice to say that it is totally and utterly alien / different to the protocol used by Realtek chips. Very significant undertaking indeed.

          If you know something I don’t, I am always prepared to work with others to enhance the capability of this tool, including handing out the source code in these cases!

          Another thing to consider, is that the NovaTek writer tool isn’t *that* bad. In my view there was no real need to undertake this effort.

          1. Thanks for reply.
            I will buy a FTDI adapter for Novatek EasyWriter because with your LPT adapter don’t work.
            And I will develop the LPT programmer’s program.

          2. Thank you!
            I downloaded, and I found a lot of useful thing.
            For you the LPT adapter worked with the EasyWriter?

          3. I did not ever attempt LPT. I was using FTDI (MStar programmer)

            In theory LPT may work, EasyWriter can be configured for LPT adapters with pretty much any wiring scheme.

            LPT Would have been useless anyway as I would not have been able to intercept communications.

  21. Hello Matt, may ask a question? You may know.
    I have R.RM5451 board and 5.6″ 1280×800 LCD panels – Toshiba LTD056EV7F and older HYDIS HV056WX1-100. They do have LED backlights. Toshiba panel has slightly slower response, but the colors and black is great. The black on HYDIS panel with the same R.RM5451 firmware/configuration is really not black, but somehow grayish. Brightness setting can make the “black” even less black and yellowish, with values above 50 (from 0 to 100 range) but does not seem to have any visible impact at lower values.
    Are you aware of any configuration or even HW cable modification that could improve the black with the LCD?
    Thank you!

Leave a Reply to Roger Cancel reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>