Metz Open Source

As of today, Metz Consumer Electronics GmbH doesn’t publish open source code on its company website, but you may ask their customer support and they’ll send it to you on CD-ROM. I received a disc containing source code for Chassis 610/611/612 LCD-TV models.

The customer support was very cooperative and responsive and kept me informed while preparing the disc. Much appreciated!


libdvbsi++ is an open source C++ library for parsing DVB Service Information and MPEG-2 Program Specific Information.

It may be distributed under the terms of the GNU Lesser General Public License (LGPL) 2.1.

The current version, 0.3.7, was published on 2013-08-23.

There is a Git repository available:

git clone git://

It is used by Engima2, a multimedia framework and user interface for digital television set-top-box environments. Enigma2 gets developed for Dream Property GmbH and its Dreambox line of products. Binaries and Python source code are available in a Git repository:

git clone git://



The ipw2200 device driver limited me to use only 11 channels for wireless LAN, even though I bought my notebook in Germany, where channels 1 to 13 may be used. Although other people on the net faced the same problem, nobody came up with a simple and permanent solution like writing the country code to the card’s EEPROM with just a few commands.

If you want to set the country code to ZZD, which is suitable for 802.11bg in Europe, then first rebuild the ipw2200 driver with the patch above. Afterwards execute the following command:

echo -n ZZD | hd

This tells you the hexadecimal representation of the ASCII characters ZZD (5a 5a 44). If your wireless LAN card is eth1, then follow these additional steps:

# load the patched driver
modprobe ipw2200
# make a backup of the original EEPROM
ethtool -e eth1 raw on > ~/ipw2200_eeprom.bin
# change the three country code letters
ethtool -E eth1 magic 0x2200 offset 0x4c value 0x5a
ethtool -E eth1 magic 0x2200 offset 0x4d value 0x5a
ethtool -E eth1 magic 0x2200 offset 0x4e value 0x44
# reload the driver and repair the checksum
rmmod ipw2200
modprobe ipw2200 repair_eeprom=1

Remember, this is a permanent change. You can render your card unusable. Don’t do this if you don’t know exactly what you’re doing. There is no guarantee that the above steps will work with every card.

For other valid country codes take a look at ipw2200.c included in the driver tarball.


For those of you who operate DNS services using Daniel J. Bernstein’s famous djbdns, autoaxfr “lets you emulate the functionality of bind’s type slave zones with a masters list of IP addresses”.

If your server has multiple IP addresses, then you need to way to specify one of those addresses for outgoing connections or use the default one. To address this I had to create a small patch:


Debian GNU/Linux contains a command line based FTP client, which has been enhanced to understand the AUTH SSL command. This is a good thing, but AUTH SSL has been superseded by AUTH TLS. At least one server, pure-ftpd, only understands the latter, because it does not support encrypted data transfers (which is mandatory for AUTH SSL), but only encrypted control connections. This patch adds AUTH TLS to ftp-ssl.

Bluetooth weaknesses in mobile phones

Once I met Collin R. Mulliner at the university, he told me he was having fun exploring weak bluetooth stacks. I liked the idea, and some days later I bought a bluetooth dongle. It was quite a surprise to me that my phone, a Nokia 6310i, silently accepted AT modem commands on some RFCOMM channels without pairing. Later I discovered that some Ericsson phones had the same kind of vulnerability. This is the C code which I wrote while learning how to use the bluez stack and how to get data from a phone using AT commands.

Linux framebuffer driver for ATI Rage128 M3/M4

For some time I used a notebook, which was equipped with an M4 mobile graphics chipset. Unfortunately the framebuffer driver of Linux refused to work with it. Instead, funny color shapes appeared on the screen every time the notebook booted. Knowing that the XFree86 driver worked, I started to compare both drivers. It turned out that the driver included in Linux 2.4 didn’t have support for flat panels at all. So, with kind help from Andi, who wanted to use it on his Mac and who is an experienced DirectFB developer, I wrote this new framebuffer driver for Linux 2.4. Be warned, it has probably never been tested on something different than M3 and M4 chipsets using flat panels.

I2C monitoring

If you write software for a badly documented or undocumented device, then it is sometimes easier to just sniff some bytes of data sent by the original software instead of using a disassembler. Milk is a great software which can be used to capture I2C traffic. To make its output more verbose I modified it to include register names where available and to calculate some stuff for the devices used in the Nokia dbox2.