LKV373A 4.0 - v3l0c1r4pt0r/lkv-wiki GitHub Wiki

The receiver has the following major component chips

• U1 Lenkeng VCT2399 processor [missing datasheet]
• U6 iTE IT66021FN HDMI Receiver datasheet
• U4 Realtek RTL8211F Ethernet chip datasheet
• U3 Winbond W25Q128 128Mbit FLASH chip datasheet

Switching Regulators

• U10/L3 =3.3 Volts
• U9 /L2 =1.2 Volts
• U12/L4 =1.5 Volts

By default the receiver has IP address 192.168.1.220

Web page on default port 80.

RX Server Version: 5.3.2.10.20200827

The transmitter has the following major component chips

• U1 Lenkeng VCT2399 processor [missing datasheet]
• U8 iTE IT66121FN HDMI transmitter datasheet
• U4 Realtek RTL8211F Ethernet chip datasheet
• U3 Winbond W25Q128 128Mbit FLASH chip datasheet

Switching Regulators

• U13/L3 =3.3 Volts
• U12/L2 =1.2 Volts
• U15/L4 =1.5 Volts

By default the transmitter has IP address 192.168.1.210
Responds to Telnet on default 23 port.

user:admin
password:123456
input>list
set_group_id        get_group_id        set_dhcp            get_dhcp
set_uart_baudrate   get_uart_baudrate   set_static_ip       get_static_ip
set_mac_address     get_mac_address     get_lan_status      get_video_lock
get_ip_config       get_session_key     set_session_key     set_device_name
get_device_name     set_video_bitrate   get_video_bitrate   set_downscale_mode
get_downscale_mode  set_video_out_mode  get_video_out_mode  set_streaming_mode
get_streaming_mode  set_low_delay_mode  get_low_delay_mode  set_multicast_mode
get_multicast_mode  get_fw_version      get_company_id      factory_reset
reboot              list                save                exit

Web page on default port 80.

TX Server Version: 5.3.2.10.20200928

By default streams HDMI stream to multicast address 239.255.42.42 port 7777

Both Receiver and Transmitter have a RS232 port provisioned on the PCB

JP1 serial
 o   o   o
TXD RXD GND

TXD via resistor to pin 40 VCT2399
RXD via resistor to pin 39 VCT2399

Unfortunately the serial debugging seems to be turned off by default, no response observed during boot.
UPDATE: There is serial "output only" on connector J2, on the two larger pads surrounded with the small rectangle line. The device boot log can be observed there.

The 16MB FLASH chip on both TX and RX boards is split as follows

• 000000-07FFFF SMEDIA02 chunk
• 080000-2CFFFF SMEDIA02 chunk
• 2D0000-FFFFFF FAT Partition

The SMEDIA chunks of the TX are different from the RX (different firmware)
At offset 070000 there is an 8 byte section consisting of the ASCII characters IT followed by the unit's 6 byte MAC address.
The easiest way to analyze the FAT partition is to dump region 2D0000-FFFFFF into a file, say part.mbr then open it with 7zip, you will see some entries called 0.fat 1.fat 2.fat 3.fat which can in turn be further opened/extracted with 7zip