diff -Nuar playusb/dpf.h playusb-ax206/dpf.h
--- playusb/dpf.h	1970-01-01 07:30:00.000000000 +0730
+++ playusb-ax206/dpf.h	2012-04-30 19:53:00.969281946 +0800
@@ -0,0 +1,188 @@
+/** libdpf header file
+ *
+ * (c) 2010, 2011 <hackfin@section5.ch>
+ *
+ */
+
+#include <usb.h>
+#include "usbuser.h"
+#include "spiflash.h"
+
+#define ADDR unsigned int
+
+#define MODE_SG     0x00  ///< generic device mode (original)
+#define MODE_USB    0x01  ///< libusb operation mode (hacked)
+#define MODE_USBHID 0x02  ///< libusb HID boot mode
+
+#define FLAG_CAN_LOCK 0x80  ///< Has the locking feature (new firmware)
+
+enum {
+	DEVERR_FILE = -16,
+	DEVERR_OPEN,
+	DEVERR_HEX,
+	DEVERR_CHK,
+	DEVERR_IO,
+	DEVERR_MALLOC,
+	DEVERR_TIMEOUT,
+	DEVERR_UNSUPP,
+};
+
+/** The DPF context structure */
+struct dpf_context;
+#define DPFHANDLE struct dpf_context *
+
+typedef struct {
+	int (*mem_read)(DPFHANDLE h, unsigned char *buf, ADDR offset, int len);
+	int (*mem_write)(DPFHANDLE h,
+		ADDR dst, const unsigned char *buf, unsigned short n);
+	int (*go)(DPFHANDLE h, ADDR start);
+	int (*bootstrap)(DPFHANDLE h,
+		ADDR dest, unsigned char *src, unsigned short n, ADDR start);
+	int (*flash_probe)(DPFHANDLE h, unsigned char *id);
+	int (*flash_cmd)(DPFHANDLE h, int command, int cmdlen, ADDR addr);
+	int (*flash_status)(DPFHANDLE h, uint8_t *status);
+	int (*flash_read)(DPFHANDLE h, uint8_t *buf, ADDR offset, int len);
+	int (*flash_writechunk)(DPFHANDLE h,
+		const uint8_t *buf, ADDR offset, int len);
+	int (*flash_lock)(DPFHANDLE h, char enable);
+} AccessMethods;
+
+typedef
+struct dpf_context {
+	unsigned char mode;
+	unsigned char flags;
+	union {
+		usb_dev_handle *udev;
+		int fd;
+	} dev;
+	AccessMethods methods;
+	unsigned int width;
+	unsigned int height;
+	int bpp;
+	int proto;
+	char* buff;
+	unsigned char* oldpix;
+	int offx;
+	int offy;
+} DPFContext;
+
+
+/** A value proxy for the property API */
+typedef struct dpf_proxy {
+	union {
+		short	integer;
+		char   *sequence;
+	} value;
+	char type;
+} DPFValue;
+
+enum {
+	TYPE_INTEGER,
+	TYPE_STRING,
+}; 
+
+/**
+ Opens the DPF device. if dev is not NULL, open device, otherwise, look for
+ USB device.
+ */
+int dpf_open(const char *dev, DPFHANDLE *h);
+
+/** Close DPF device */
+void dpf_close(DPFHANDLE h);
+
+/** Set color register
+ * \param rgb     RGB tuple */
+int dpf_setcol(DPFHANDLE h, const unsigned char *rgb);
+
+/** Blit data to screen
+ *
+ * \param buf     buffer to 16 bpp RGB 565 image data
+ * \param rect    rectangle tuple: [x0, y0, x1, y1]
+ */
+
+int dpf_screen_blit(DPFHANDLE h, const unsigned char *buf, short rect[4]);
+
+/** Set property on DPF
+ * \param token       Property token
+ * \param value       Pointer to value
+ */
+int dpf_setproperty(DPFHANDLE h, int token, const DPFValue *value);
+
+/* USB raw */
+
+int emulate_scsi(usb_dev_handle *d, unsigned char *cmd, int cmdlen, char out,
+	unsigned char *data, unsigned long block_len);
+
+const char *dev_errstr(int err);
+
+// Private stuff:
+int dpf_usb_open(int index, usb_dev_handle **u);
+int sgdev_open(const char *portname, int *fd);
+int usb_rawread(usb_dev_handle *dev, unsigned char *buf, int len);
+int usb_rawwrite(usb_dev_handle *dev, const unsigned char *buf, int len);
+int probe(DPFHANDLE h);
+
+////////////////////////////////////////////////////////////////////////////
+// Bootloader functionality
+
+int bl_go(DPFContext *dpf, uint16_t jmpoffset);
+
+////////////////////////////////////////////////////////////////////////////
+// FLASH stuff
+
+// Maximum size for flash_read
+#define MAX_CHUNKSIZE 0x10000
+
+int read_mem(DPFHANDLE h, unsigned char *buf, ADDR src, unsigned short len);
+int write_mem(DPFHANDLE h,
+	ADDR dst, const unsigned char *buf, unsigned short len);
+
+int load_hexfile(DPFHANDLE h, const char *hexfile);
+int code_go(DPFHANDLE h, ADDR start);
+
+int dpf_bootstrap(DPFHANDLE h,
+	ADDR dst, unsigned char *src, unsigned short n, ADDR start);
+
+int flash_cmd(DPFHANDLE h, int command, int cmdlen, ADDR addr);
+int flash_probe(DPFContext *h, unsigned char *id);
+int flash_erase(DPFHANDLE h, ADDR offset);
+int flash_erase_full(DPFHANDLE h);
+int flash_write(DPFHANDLE h, const unsigned char *buf, ADDR offset, int len);
+int flash_read(DPFHANDLE h, unsigned char *buf, ADDR offset, int len);
+
+int load_ihx(DPFHANDLE h, const char *fname, unsigned char *data, 
+	unsigned int *buflen, unsigned int reloc);
+
+int patch_sector(DPFHANDLE h,
+	ADDR reloc, unsigned long addr, const char *hexfile);
+
+////////////////////////////////////////////////////////////////////////////
+/* DPF specific stuff: */
+
+#define RGB565_0(r, g, b) \
+	(( ((r) & 0xf8)		 ) | (((g) & 0xe0) >> 5))
+#define RGB565_1(r, g, b) \
+	(( ((g) & 0x1c) << 3 ) | (((b) & 0xf8) >> 3))
+
+#define RGB565(r, g, b) { RGB565_0(r, g, b), RGB565_1(r, g, b) }
+
+#define RGB565_S(r, g, b) ((RGB565_0(r, g, b) << 8) | RGB565_1(r, g, b))
+
+int dpfcpy(ADDR dst, unsigned char *src, unsigned short n);
+
+// int clr_screen(DPFHANDLE h, const unsigned char *col);
+int write_screen(DPFHANDLE h, const unsigned char *buf, unsigned int len);
+
+
+// Some internal address offsets. They may change, but so far all types
+// seem to have the same
+//
+// w: word, <n>: length, [LE, BE]
+//
+// FIXME: Use packed struct later.
+
+// FIXME: Should be 0x0020, once we have the firmware replaced
+#define OFFSET_PROPS 0x3f0020   ///< w[2]:LE : Resolution X, Y
+
+
+
diff -Nuar playusb/fbgrab.c playusb-ax206/fbgrab.c
--- playusb/fbgrab.c	2010-11-01 00:29:42.000000000 +0800
+++ playusb-ax206/fbgrab.c	2012-05-03 20:17:33.510767884 +0800
@@ -46,6 +46,7 @@
 
 void chvt(int num){
   int fd;
+  
   if(!(fd = open("/dev/console", O_RDWR)))
     FatalError("cannot open /dev/console");
   if (ioctl(fd, VT_ACTIVATE, num))
@@ -57,11 +58,12 @@
     sleep (3);
 }
 
-int read_fb(char *device, int vt_num, struct picture *pict){
+int read_fb(char *device, int vt_num, unsigned char *buffer){
   int fd, vt_old, i,j;
   struct fb_fix_screeninfo fb_fixinfo;
   struct fb_var_screeninfo fb_varinfo;
   struct vt_stat vt_info;
+  //char * buffer;
 
   if (vt_num!=-1){
     if ((fd = open("/dev/console", O_RDONLY)) == -1)
@@ -81,35 +83,14 @@
   if (ioctl(fd, FBIOGET_VSCREENINFO, &fb_varinfo))
     FatalError("ioctl FBIOGET_VSCREENINFO");
 
-  pict->xres=fb_varinfo.xres;
-  pict->yres=fb_varinfo.yres;
-  pict->bps=fb_varinfo.bits_per_pixel;
-  pict->gray=fb_varinfo.grayscale;
-
-  if(fb_fixinfo.visual==FB_VISUAL_PSEUDOCOLOR){
-    pict->colormap=(struct fb_cmap*)malloc(sizeof(struct fb_cmap));
-    pict->colormap->red=(__u16*)malloc(sizeof(__u16)*(1<<pict->bps));
-    pict->colormap->green=(__u16*)malloc(sizeof(__u16)*(1<<pict->bps));
-    pict->colormap->blue=(__u16*)malloc(sizeof(__u16)*(1<<pict->bps));
-    pict->colormap->transp=(__u16*)malloc(sizeof(__u16)*(1<<pict->bps));
-    pict->colormap->start=0;
-    pict->colormap->len=1<<pict->bps;
-    if (ioctl(fd, FBIOGETCMAP, pict->colormap))
-      FatalError("ioctl FBIOGETCMAP");
-  }
+  	  
   if (vt_num!=-1)
     chvt(vt_old);
 
-  switch(pict->bps){
-  case 15:
-    i=2;
-    break;
-  default:
-    i=pict->bps>>3;
-  }
+  
 
-  if(!(pict->buffer=malloc(pict->xres*pict->yres*i)))
-    FatalError("couldnt malloc");
+  //if(!(buffer=malloc(fb_varinfo.xres * fb_varinfo.yres * (3))))
+  //  FatalError("couldnt malloc");
 
 #if 0
   fprintf(stdout, "Framebuffer %s is %i bytes.\n", device,
@@ -133,11 +114,12 @@
   if (vt_num!=-1)
     chvt(vt_num);
 
-  j= (read(fd, pict->buffer, ((pict->xres * pict->yres) * i) )!=
-  	(pict->xres * pict->yres *i ));
+  j= (read(fd, buffer, (fb_varinfo.xres * fb_varinfo.yres *(3))) )!=
+  	(fb_varinfo.xres * fb_varinfo.yres *(3));
 #ifdef DEBUG
   printf("to read:%i read:%i\n",(pict->xres* pict->yres * i), j);
 #endif
+  //fwrite (buffer , 1 , fb_varinfo.xres * fb_varinfo.yres *(3) , tmp_file );
   if (vt_num!=-1)
     chvt(vt_old);
 
@@ -272,29 +254,21 @@
 }
 
 
-int grab_from_fb(char *fb_device, FILE *tmp_file)
+int grab_from_fb(char *fb_device, unsigned char * buf)
 {
 	struct picture pict;
 	int vt_num = -1;
 
 
 	/* read framebuffer into pict */
-	read_fb(fb_device, vt_num, &pict);
+	read_fb(fb_device, vt_num, buf);
 
 	/* compress to jpeg */
-	Write_JPG(&pict, tmp_file);
+	// Write_JPG(&pict, tmp_file);
 
 	/* cleanup */
-	if(pict.colormap)
-	{
-		free(pict.colormap->red);
-	    free(pict.colormap->green);
-	    free(pict.colormap->blue);
-	    free(pict.colormap->transp);
-	    free(pict.colormap);
-	}
-	free(pict.buffer);
+	
 
 	/* rewind file */
-	fseek(tmp_file, 0, SEEK_SET);
+	//fseek(tmp_file, 0, SEEK_SET);
 }
diff -Nuar playusb/Makefile playusb-ax206/Makefile
--- playusb/Makefile	2010-10-21 06:14:39.000000000 +0800
+++ playusb-ax206/Makefile	2012-04-30 20:19:24.520445474 +0800
@@ -1,6 +1,6 @@
 CC = gcc
 CFLAGS = -Wall -O2
-LDFLAGS = -lrt -lusb -ljpeg
+LDFLAGS = -lrt -lusb -ljpeg -ldpf
 
 OBJ=playusb
 
diff -Nuar playusb/playusb.c playusb-ax206/playusb.c
--- playusb/playusb.c	2010-11-01 01:32:47.000000000 +0800
+++ playusb-ax206/playusb.c	2012-05-03 20:12:34.555290530 +0800
@@ -13,11 +13,9 @@
 
 #include "playusb.h"
 
-
 void show_help(void)
 {
    printf("./playusb [OPTIONS]\n"\
-          "\t-j \tshow JPEG image\n"\
           "\t-f dev\tread from linux framebuffer\n"\
           "\t-i \tFB refresh interval (in milliseconds)\n"\
           "\t-e \twait for update events from debugfs (for mmap'ed FBs)\n"\
@@ -33,205 +31,67 @@
  * 		   -1 if no frame was found
  * 		   -2 if system rights are too low to work with device
  */
-int find_photo_frame(struct usb_device **new_dev)
-{
-	struct usb_bus *bus;
-	struct usb_device *dev;
-	int i;
-
-
-scan_bus:
-	usb_init();
-	usb_find_busses();
-	usb_find_devices();
-
-	for (bus = usb_busses; bus; bus = bus->next)
-	{
-		for (dev = bus->devices; dev; dev = dev->next)
-		{
-			/* check whether device is a photo frame */
-			for (i = 0; i < num_frames; i++)
-			{
-				if (dev->descriptor.idVendor == photo_frames[i].vendorid)
-				{
-					if (dev->descriptor.idProduct == photo_frames[i].productid_photo)
-					{
-						/* frame in photo mode found */
-						printf("%s in photo mode found.\n", photo_frames[i].name);
-						*new_dev = dev;
-						return 0;
-					}
-					else if (dev->descriptor.idProduct == photo_frames[i].productid_massstorage)
-					{
-						/* frame in mass storage mode found, try to set photo mode */
-						printf("%s in mass storage mode found, try to switch mode.\n", photo_frames[i].name);
-						if (switch_usb_mode(dev) == 0)
-						{
-							printf("Frame succesfully switched to photo mode. Rescan bus ..\n");
-							/* sleep awhile until the new device is set up, then do all this again in order
-							 * to initialize the new usb device */
-							sleep(1);
-							goto scan_bus;
-						}
-
-						/* switch_usb_mode() returned an error, so we might not have the right rights */
-						return -2;
-					}
-					else
-					{
-						/* new frame found? */
-						printf("USB device with product id %d was not found in database.\n", dev->descriptor.idProduct);
-					}
-				}
-			}
-		}
-	}
 
-	return -1;
-}
-
-int switch_usb_mode(struct usb_device* dev)
+int send_data(DPFHANDLE frame, unsigned char *data, int len)
 {
-	usb_dev_handle *udev;
-	char buf[256];
-	int ret;
-
-
-	/* get usb device handle */
-	udev = usb_open(dev);
-
-	/* try to read manufacturer */
-	if (usb_get_string_simple(udev, dev->descriptor.iManufacturer, buf, sizeof(buf)) == -1)
-	{
-		printf("Error while reading from USB device. Please check your system rights.\n");
-		return -1;
-	}
-
-	/* send control msg and switch to photo mode */
-	if ((ret = usb_control_msg(udev, USB_TYPE_STANDARD | USB_ENDPOINT_IN,
-								USB_REQ_GET_DESCRIPTOR,
-								0xfe, 0xfe, 0x0, 0xfe, 1000)) < 0)
-	{
-		/* usb_control_msg returns -108 in my case, however things seem to work anyway */
-	}
-
-	usb_close(udev);
-
-	return 0;
-}
-
-
-int send_jpeg(usb_dev_handle *dev, FILE *file, char *data, int len)
-{
-	char usb_hdr[USB_HDR_LEN] = {0xa5, 0x5a, 0x18, 0x04, 0xff, 0xff, 0xff, 0xff, 0x48, 0x00, 0x00, 0x00};
-	char buffer[URBBUF_MAX];
-	int usb_timeout = 1000;
-	int usb_endpoint = 0x2;
-	int filesize, offset;
-	int ret;
-
-
-	/* sanity check */
-	if (file && data)
-	{
-		printf("Please specify either file or data input.\n");
-		return -1;
-	}
-
-	if (file)
-	{
+	int ret,m,n;
+	unsigned char r,g,b;
+	//int size=((frame->width)*(frame->height)*3);
+	//unsigned char buffer[size];
+	short rect[4];
+	int filesize,i;
+        unsigned char * pixels=(unsigned char*)malloc((frame->width)*(frame->height)*(2));
+	rect[0]=0;
+	rect[1]=0;
+	rect[2]=frame->width;
+	rect[3]=frame->height;
 		// get file size
-		fseek(file, 0, SEEK_END);
-		filesize = ftell(file);
-		fseek(file, 0, SEEK_SET);
-
-		// insert filesize into command
-		*(int *)(usb_hdr + 4) = filesize;
-	}
-	else
-	{
-		*(int *)(usb_hdr + 4) = len;
-	}
-
-	// copy header into usb buffer
-	memcpy(buffer, usb_hdr, USB_HDR_LEN);
-	offset = USB_HDR_LEN;
-
-	if (file)
-	{
-		while(!feof(file))
-		{
+		//fseek(file, 0, SEEK_END);
+		//filesize = ftell(file);
+		//rewind (file);
+		i=0;
+		memset(pixels,0,(frame->width)*(frame->height)*2);
+		//while(!feof(file)&& ret<(size))
+		//{
 			// read file into buffer
-			if ((ret = fread(buffer + offset, 1, URBBUF_MAX - offset, file)) < 1)
-			{
-				printf("Error while reading file, fread returned: %d\n", ret);
-				break;
-			}
-
-		    // pad bytes
-		    memset(buffer + offset + ret, 0, URBBUF_MAX - offset - ret);
-
-			// send buffer to picture frame
-			if ((ret = usb_bulk_write(dev, usb_endpoint, buffer, URBBUF_MAX, usb_timeout)) < 0)
-			{
-				// error occurred
-				printf("Error while writing to USB device. Please check your system rights.\n");
-				//printf("usb_bulk_write returned: %d\n", ret);
+			//if ((ret = fread(buffer , 1, filesize,file)) < 1){
+                        //        printf("Error while reading file, fread returned: %d\n", ret);
+                        //        break;
+                        //}
+			for (m=0,n=0;m<((frame->width)*(frame->height)*3);){
+				r = data[m++];
+          			g = data[m++];
+                                b = data[m++];
+			        pixels[n++] = (unsigned char)(RGB565_0(r,g,b)); //R (5 bits) + G (upper 3 bits)
+            			pixels[n++] = (unsigned char)(RGB565_1(r,g,b)); //G (lower 3 bits) + B (5 bits)
 			}
-
-			// no header needed on subsequent chunks
-			offset = 0;
-		}
-
-		/* rewind file */
-		fseek(file, 0, SEEK_SET);
-	}
-	else
-	{
-		/* FIXME: that needs to be tested */
-		int bytes_sent = 0;
-		int bytes_to_send = 0;
-
-		printf("total len is %d\n", len);
-
-		while (bytes_sent < len)
-		{
-			// copy chunks into usb_buffer
-			bytes_to_send = min(URBBUF_MAX - offset, len);
-			printf("bytes_to_send: %d, offset: %d\n", bytes_to_send, offset);
-
 			// pad bytes
-			memset(buffer + offset, 0, URBBUF_MAX - offset);
-			memcpy(buffer + offset, data + bytes_sent, bytes_to_send);
-			bytes_sent += bytes_to_send; // these counters are just for the data packets
-
-			printf("bytes_sent: %d, len: %d\n", bytes_sent, len);
-
-			// send chunk
-			if ((ret = usb_bulk_write(dev, usb_endpoint, buffer, URBBUF_MAX, usb_timeout)) < 0)
-			{
-				// error occurred
-				printf("Error occurred while writing data to device.\n");
-				printf("usb_bulk_write returned: %d\n", ret);
-			}
-
-			printf("usb_bulk_write returned: %d\n", ret);
-
-			// no header needed on subsequent chunks
-			offset = 0;
-		}
-	}
+			//break;
+	               // memset(buffer + ret, 0, URBBUF_MAX - ret);
+                        // send buffer to picture frame
+                       
+
+              //}
+		 if ((ret = dpf_screen_blit(frame, pixels, rect)) < 0)
+                        {
+                                // error occurred
+                                printf("Error while writing to USB device. Please check your system rights.\n");
+                        }
+		/* rewind file */
+		//fseek(file, 0, SEEK_SET);
 
+	
+	
 	return 0;
 }
 
 
 int main(int argc, char *argv[])
 {
-	struct usb_device *dev = NULL;
-	FILE *file_handle;
-	char *filename = NULL;
+	char * dev="usb0";
+	DPFHANDLE picframe;
 	char *fb_device = NULL;
+	FILE *file_handle;
 	struct timespec t;
 	long fb_refresh_interval = 1000; /* 1000ms*/
 	char *tmp_filename;
@@ -240,7 +100,8 @@
 	int opt;
 	enum opmode_t opmode = ONCE;
 	char buf;
-
+	unsigned char * pixels;
+	
 
 	if (argc == 1)
 	{
@@ -248,7 +109,7 @@
 		return -1;
 	}
 
-	while((opt = getopt(argc, argv, "erhi:j:f:")) != -1)
+	while((opt = getopt(argc, argv, "erhi:f:")) != -1)
 	{
 		switch (opt)
 		{
@@ -256,9 +117,6 @@
 				show_help();
 				return 0;
 				break;
-			case 'j':
-				filename = optarg;
-				break;
 			case 'e':
 				opmode = EVENT;
 				break;
@@ -279,19 +137,6 @@
 
 
 	/* sanity checks */
-	if (!filename && !fb_device)
-	{
-		printf("both specified\n");
-		show_help();
-		return -1;
-	}
-
-	if (filename && fb_device)
-	{
-		printf("Choose either to read from file or from a frame buffer device.\n");
-		return -1;
-	}
-
 	if (fb_refresh_interval < 100)
 		printf("WARNING: refresh rates smaller then 100msecs may cause heavy system load\n");
 
@@ -302,7 +147,7 @@
 	signal(SIGINT, sigint);
 
 	/* start */
-	while ((ret = find_photo_frame(&dev)) != 0)
+	while ((ret = dpf_open(dev,&picframe)) != 0)
 	{
 		if (ret == -2)
 		{
@@ -319,31 +164,8 @@
 		sleep(1);
 	}
 
-	if ((dev_handle = usb_open(dev)) == NULL)
-	{
-		printf("Error while creating usb device handle.\n");
-		return -1;
-	}
-
-	if (filename)
-	{
-		printf("displaying %s on photo frame ..\n", filename);
-
-		if ((file_handle = fopen(filename, "r+")) == NULL)
-		{
-			printf("File %s was not found.\n", filename);
-			ret = -1;
-			goto exit;
-		}
-
-		if ((ret = send_jpeg(dev_handle, file_handle, NULL, 0)) != 0)
-		{
-			printf("Error occurred while sending jpeg image to device.\n");
-		}
-
-		fclose(file_handle);
-	}
-	else if (fb_device)
+	pixels=(unsigned char*)malloc((picframe->width)*(picframe->height)*(3));	
+	if (fb_device)
 	{
 		/*
 		 * workflow:
@@ -363,17 +185,17 @@
 		fclose(file_handle);
 
 		/* create and open temporary file */
-		if (!(tmp_filename = tmpnam(NULL)))
-		{
-			printf("error while creating temporary file name.\n");
-			return -1;
-		}
-
-		if (!(tmpfile_handle = fopen(tmp_filename, "w+")))
-		{
-			printf("error while opening temporary file.\n");
-			return -1;
-		}
+		//if (!(tmp_filename = tmpnam(NULL)))
+		//{
+		//	printf("error while creating temporary file name.\n");
+		//	return -1;
+		//}
+
+		//if (!(tmpfile_handle = fopen(tmp_filename, "w+")))
+		//{
+		//	printf("error while opening temporary file.\n");
+		//	return -1;
+		//}
 
 		/* do work depending on operation mode */
 		if (opmode == ONCE)
@@ -381,13 +203,13 @@
 			printf("Writing content of FB device %s to picture frame ..\n", fb_device);
 
 			/* just read from fb once and exit */
-			grab_from_fb(fb_device, tmpfile_handle);
+			grab_from_fb(fb_device, pixels);
 
 			/* rewind file, so send_jpeg can read from it straight away */
-			fseek(tmpfile_handle, 0, SEEK_SET);
+		//	fseek(tmpfile_handle, 0, SEEK_SET);
 
 			/* send image to frame */
-			if ((ret = send_jpeg(dev_handle, tmpfile_handle, NULL, 0)) != 0)
+			if ((ret = send_data(picframe, pixels, 0)) != 0)
 			{
 				printf("Error occurred while sending jpeg image to device.\n");
 			}
@@ -406,15 +228,15 @@
 				clock_nanosleep(CLOCK_MONOTONIC, TIMER_ABSTIME, &t, NULL);
 
 				/* get image from fb and compress to jpeg */
-				grab_from_fb(fb_device, tmpfile_handle);
+				grab_from_fb(fb_device, pixels);
 
 				/* rewind file, so send_jpeg can read from it straight away */
-				fseek(tmpfile_handle, 0, SEEK_SET);
+				//fseek(tmpfile_handle, 0, SEEK_SET);
 
 				/* send image to frame */
-				if ((ret = send_jpeg(dev_handle, tmpfile_handle, NULL, 0)) != 0)
+				if ((ret = send_data(picframe, pixels, 0)) != 0)
 				{
-					printf("Error occurred while sending jpeg image to device.\n");
+					printf("Error occurred while sending image to device.\n");
 				}
 
 				/* calculate next shot */
@@ -439,15 +261,15 @@
 			while ((ret = fread(&buf, 1, 1, sysfs_handle)) > -1)
 			{
 				/* get image from fb and compress to jpeg */
-				grab_from_fb(fb_device, tmpfile_handle);
+				grab_from_fb(fb_device, pixels);
 
 				/* rewind file, so send_jpeg can read from it straight away */
-				fseek(tmpfile_handle, 0, SEEK_SET);
+				//fseek(tmpfile_handle, 0, SEEK_SET);
 
 				/* send image to frame */
-				if ((ret = send_jpeg(dev_handle, tmpfile_handle, NULL, 0)) != 0)
+				if ((ret = send_data(picframe, pixels, 0)) != 0)
 				{
-					printf("Error occurred while sending jpeg image to device.\n");
+					printf("Error occurred while sending image to device.\n");
 				}
 
 			}
@@ -456,6 +278,7 @@
 
 			/* in case we reach this point, cleanup */
 			fclose(sysfs_handle);
+			free(pixels);
 		}
 
 		if (tmpfile_handle)
diff -Nuar playusb/playusb.h playusb-ax206/playusb.h
--- playusb/playusb.h	2010-11-01 01:33:08.000000000 +0800
+++ playusb-ax206/playusb.h	2012-05-03 20:18:39.604775628 +0800
@@ -17,6 +17,7 @@
 #include <time.h>
 #include <fcntl.h>
 #include <getopt.h>
+#include "dpf.h"
 
 struct frame_info
 {
@@ -29,49 +30,19 @@
 };
 
 
-static struct frame_info photo_frames[] = {
-	{
-		.name					= "Samsung SPF-85H",
-		.vendorid				= 0x04e8,
-		.productid_massstorage	= 0x2012,
-		.productid_photo		= 0x2013,
-		.xres					= 800,
-		.yres					= 600,
-	},
-	{
-		.name					= "Samsung SPF-87H",
-		.vendorid				= 0x04e8,
-		.productid_massstorage	= 0x2033,
-		.productid_photo		= 0x2034,
-		.xres					= 800,
-		.yres					= 480,
-	},
-	{
-		.name					= "Samsung SPF-107H",
-		.vendorid				= 0x04e8,
-		.productid_massstorage	= 0x2027,
-		.productid_photo		= 0x2028,
-		.xres					= 1024,
-		.yres					= 600,
-	},
-};
-static int num_frames = sizeof(photo_frames) / sizeof(photo_frames[0]);
-
-int find_photo_frame(struct usb_device **new_dev);
-int switch_usb_mode(struct usb_device* dev);
-int send_jpeg(usb_dev_handle *dev, FILE *file, char *data, int len);
+int send_data(DPFHANDLE frame, unsigned char *data, int len);
 void sigint(int signum);
-int grab_from_fb(char *fb_device, FILE *tmp_file);
+int grab_from_fb(char *fb_device, unsigned char * buf);
 
 
 #define min( a, b ) ( ((a) < (b)) ? (a) : (b) )
-#define URBBUF_MAX 0x20000
+#define URBBUF_MAX (128*128*3)
 #define USB_HDR_LEN 12
 #define MAX_JPEG_SIZE (2 * 1024 * 1024)
 #define NSEC_PER_SEC    1000000000 /* The number of nsecs per sec. */
 #define USEC_PER_SEC    1000000
 
-#define DEBUGFS_ENTRY "/sys/kernel/debug/spfb"
+#define DEBUGFS_ENTRY "/sys/kernel/debug/ax206fb"
 #define PLAYUSB_TEMPLATE "/tmp/playusb"
 
 
diff -Nuar playusb/spiflash.h playusb-ax206/spiflash.h
--- playusb/spiflash.h	1970-01-01 07:30:00.000000000 +0730
+++ playusb-ax206/spiflash.h	2012-04-30 19:53:12.612948785 +0800
@@ -0,0 +1,30 @@
+/** \file flashcmd_st.h
+ *
+ * ST compatible flash cmds
+ *
+ */
+
+
+#define SPM_RDID              0x9f    // Read Id
+#define SPM_NO_CMD            0x00    // No command
+
+#define SPM_WREN              0x06    // Write enable
+#define SPM_WRDI              0x04    // Write disable
+#define SPM_RDSR              0x05    // Read status register
+#define SPM_WRSR              0x01    // Write status register
+#define SPM_READ              0x03    // Read data bytes
+#define SPM_PP                0x02    // Page program
+#define SPM_DP                0xb9    // Deep power down
+#define SPM_RES               0xab    // Release from deep power down
+                                      // and read signature
+#define SPM_FLASH_SE          0xd8    // Sector erase
+#define SPM_FLASH_BE          0xc7    // Bulk erase
+#define SPM_FLASH_FAST_READ   0x0B    // Read data bytes fast
+
+#define SPM_SR_SRWD           0x80    // SR write protection (HW)
+
+// Status register bit definitions
+#define SPS_WIP 0x01       // write in progress
+#define SPS_WEL 0x02       // write enable latch
+
+
diff -Nuar playusb/usbuser.h playusb-ax206/usbuser.h
--- playusb/usbuser.h	1970-01-01 07:30:00.000000000 +0730
+++ playusb-ax206/usbuser.h	2012-04-30 19:53:09.725031418 +0800
@@ -0,0 +1,29 @@
+/* USB user commands
+ *
+ * Only temporary. Should move to dpflib or into a dclib configuration.
+ *
+ */
+
+#define PROTOCOL_VERSION  1
+
+/** Our vendor specific USB commands to do stuff on the DPF */
+
+#define USBCMD_GETPROPERTY  0x00    ///< Get property
+#define USBCMD_SETPROPERTY  0x01    ///< Set property
+#define USBCMD_MEMREAD      0x04    ///< Memory read
+#define USBCMD_APPLOAD      0x05    ///< Load and run applet
+#define USBCMD_FILLRECT     0x11    ///< Fill screen rectangle
+#define USBCMD_BLIT         0x12    ///< Blit to screen
+#define USBCMD_COPYRECT     0x13    ///< Copy screen rectangle
+#define USBCMD_FLASHLOCK    0x20    ///< Lock USB for flash access
+#define USBCMD_PROBE        0xff    ///< Get version code (probe)
+
+/* Some special return codes */
+#define USB_IN_SEQUENCE     0x7f    ///< We're inside a command sequence
+
+// Property handling:
+
+#define PROPERTY_BRIGHTNESS  0x01
+#define PROPERTY_FGCOLOR     0x02
+#define PROPERTY_BGCOLOR     0x03
+#define PROPERTY_ORIENTATION 0x10