The Toppy has a Simple Command Console running on its serial port, and when something goes wrong it can also drop into a Memory Monitor (although the TF5800 will normally reboot instead). Both of these are useful for doing a bit of debugging, and the serial port is also a good place to send debug output from TAPs.
To access the Toppy's serial port properly you need to connect a null modem cable and then use a terminal program (e.g. HyperTerminal on Windows) with the serial settings: 115,200 baud, 8-bit, no parity, 1 stop bit ("115200 8N1"). (Note that these are the Toppy's default settings when it starts up — TAPs can change them.)
There is also an Extended Command Console on the TF5800 (and some firmwares on other models) which has a lot more commands.
The following table lists the commands recognised by the Simple Command Console.
Cmd Description ?
helplist commands (but does not include all of them!) key key sends keystrokes to the Toppy, key can be: up, down, left, right, chUp, chDown, volUp, volDown, 0..9, ok, epg, exit, menu, alt (audio menu) or subt (subtitle menu) key mode enters a direct keystroke mode (needs an unbuffered connection!), using: esc→exit, enter→ok, a→menu, i→up, j→left, k→down, l→right, q→ok, s→guide, w→exit and 0-9 pr audio lists the current audio tracks pr eeprom shows the location and size of the "etc" table (simple settings) pr etc shows some of the simple settings pr evt
pr eventlists the current EIT events (caution: there's 14,000 on newer firmwares!) pr extevt
pr exteventNOP on the TF5800 pr flash shows the location and sizes of the TV and Radio service data tables pr gmt prints the current date and time pr lnb (not valid on the TF5800) pr otatest NOP on the TF5800 pr radio lists the Radio services pr scan lists data from a recent channel scan pr subt
pr subtitlelists the current subtitle tracks pr svcname hex dumps the current service name (bugged: shows TV service if TVType is set to Multi, otherwise shows Radio!) pr timer lists the TSR Timers (bugged: values shifted left, and "tsr" is garbage) pr tp lists the transponders: "index, {ChNum, NetID, TSID}" pr ttx
pr teletextlists the current teletext tracks (this is not used in the UK) pr tv lists the TV services pr usbtest NOP on the TF5800 dump flash dumps the contents of the main settings (including timers and services) dump eeprom dumps the contents of the simple settings ("etc") dump addr dumps memory, use a leading $ to specify a hex address, else it will be considered to be decimal(!!) (and it is not validated before use!) port check prints hard-coded serial baud rate based on SysID sysid prints SysID (in raw binary!), followed by an ENQ and lots of NULs settype prints "TWINTUNER" on the TF5800 exec tap loads a TAP from /ProgramFiles (or the current sub-folder selected in the archive) test c sends RKEY_Cmd_N (where N=c+1, if c<16) — these do things like show colour bars, but some are very dangerous (see EMJB's Key guide) rectest starts an instant recording in 10 seconds — this is started again after a few minutes(?) if you stop it (so you can change channel and test another channel?), otherwise it will continue for 10mins and then start again (on the next channel?) suspend n clears "feature flag" n, stopping that low-level task analyzing makes a PID count table for the 100 packets from the current position in the currently playing file (on 5.13.40 this table is at 0x81b4ccc4) playes file plays the file (Elementary Stream?) from /DataFiles (it must be small since it's copied [twice!] into memory), but I don't know what file format works... tuow 1122eeff addr val pokes val into addr (both are hex) — yes, you do need the "magic" first number
Note: ExtCmdEnable [Gx] disables the "key mode" direct key entry and corrects "exec" so that it doesn't lowercase the TAP filename!
When something goes wrong in the code that the Toppy is running (due to a firmware or TAP bug) it will usually be trapped and cause an exception in the processor. On most Toppy models, this exception will make it seem like the Toppy has "frozen", but actually it will have dropped into the Memory Monitor and the exception can be debugged on the serial port. However, on the TF5800 an exception will cause a reboot instead. The ExtCmdEnable [Gx] patching TAP can re-enable the Memory Monitor (as well as enable the Extended Command Console, in normal use).
The Memory Monitor has a quite limited set of commands, specified in the following table. .width can be ".c" (byte), ".s" (word) or ".l" (dword, the default), and range is either "addr++size" or "min..max".
Cmd Description dm[.width] {range|addr} display memory at addr (64 bytes) or range pm[.width] addr val patch memory at addr to val, or list of values on following lines if val is missing (or not all hex) fm[.width] range val fills range of addresses with val sm[.width] range val search range of addresses for val, showing all hits call fp arg... calls routine at fp (as hex) with up to eight byte (!!) value arguments (as hex) reset prints "It is reset by manual in boot loader. Ok. Push reset button or cycle power switch" help prints short help (but doesn't mention info or dumpsm) exit prints "play memory mode is exit in boot loader" and exits info prints registers (at exception) and exception info (bugged: *EPC is SR, and SR is garbage) dumpsm prints same info based on separate copy of the info (and not bugged)
call is very poor code. The other commands use sscanf("%x") loads of times to convert the hex string arguments, but call uses its own special routine which trashes all the arguments down to 8-bits. I suspect that they've 'borrowed' the code for this monitor from somewhere and then adjusted it a bit to fit (probably adding call). This might also explain the double copying of exception info and the two commands for printing the copies.