t-hack.com

Please find attached.

Mick

This is great Mick.  I've been waiting for a doc like this for some-time following the progress here and on other sites.  This should keep me busy for a while having a play.  Well done :)
Cheers
007.4

Looks great!

Fantastic  ;D

Thanks for your work!

cracking update mick well done !

Excellent work lads.

Read through most of the other posts before this guide and gained a much better understanding of whats going on.

Only thing I'm unsure of is the point for the reset. Any chance of a photo of connections (seems to be missing from the pdf file).

Anything I can do to assist let me know. I have access to a  couple of boxes that will be willing volunteers.

Many thanks for this top info.

The photo is in the PDF.

It has all of the wiring on it. you need to zoom into it about 200% the reset wire I have got connected to the reset on the USB chip, it is marked with an orange dot.

Mick

Acrobat reports an error when trying to display the photo under "installing the modchip" heading.  I tried both 7 and 8.1 both reported the same error (insufficient data for image).

Chris

Acrobat reports an error when trying to display the photo under "installing the modchip" heading.  I tried both 7 and 8.1 both reported the same error (insufficient data for image).

Chris

try foxit reader  less bulky than acrobat...

try foxit reader  less bulky than acrobat...

It crashes FoxIt 2.3 ;)

Chris

Works for me... maybe you have a dodgy copy of the pdf...

You were right!  ;D

Thanks for the hint about FoxIt...sems much quicker than Acrobat.

Chris

Tried Foxit and acrobat no joy with photo. Rest of pdf displays fine.

Damn I was hoping my first couple of posts would be a bit more constructive.

EDIT:Sorted after a couple of downloads.

Acrobat 8.1 works for me, too.

"pdf xchange" works too ;)

I'd try downloading again (if you haven't already)....that fixed it for me, and I had exactly the same issue.

Chris

Is it just me or has the MegaUpload download link gone bad? More specifically: -

http://www.megaupload.com/?d=3RSDLGI8

The Files you need that were in that Rar are included with Visual Studio 2008. The file names are as follows

ClientShutdown.exe
CMAccept.exe
ConmanClient2.exe
DeviceAgentTransport.dll
eDbgJit.exe
eDbgTL.dll
TcpConnectionA.dll

Info from the MSDN website on how to use these files and where to find them.

Ah, I thought there was some Pre-patched stuff in it, got a bit confused.

Thanks.

The only stuff that migth have been in there was a couple of XML files to turn on a few fetures.

All i have done with my box is chip it with the extended modchip wiht LEDs and the serial debug interface.
Patched the NK.Bin with ISO-Mick's and Neos Patching tool.
Put the debug files on there and running a partially custom TV2ClientCE.exe that a few of us are working on to get the TV Guide and the DVR stuff runing.

Its going to be a hard slog to get the DVR stuff running as alot of it is reliant on the webservice even loading your stored recordings.

Complete Noob but been given a BT Vision box and was wondering if anyone would recommend me trying this as would love to be able to use the box (as it was a freebie) as a media player to enable me to watch US content via web on my TV?  Or will it be to difficult?!

Without knowing what your abilities are.. it would be hard to comment.

If you can solder, use a PC, and have enough time to read everything, then it will be easier....

We all started somewhere.

Mick

Thank you very much, Mick! You are doing a great job!
Could you please let me know where do I get the patched TV2ClientCE2.exe file? Is it needed anymore? I tried to read everithing and I said that is not needed anymore as TV2Client.exe in Content folder is a dummy.
Thank you!

its very much needed as is the basis of 'tweaked' work going on.  the dummy file is there as the 'normally' executed file lies within the nk.bin file.  However, this is disabled and our 'tweaked' tv2clientce2.exe is placed there and run instead.
Unfortunately, this isnt public but patches and code snippets are as is a hacked copyrighted file and therefore somewhat dubious

Without knowing what your abilities are.. it would be hard to comment.

If you can solder, use a PC, and have enough time to read everything, then it will be easier....

We all started somewhere.

Mick

I'd also have a go but my soldering skills etc are pretty crap but if anyone wants to program the thing i'll happilly install it and mess about thereafter...  ;D



Guess i am really in the position of waitig for somethign i can just 'plug' in so to speak and i feel a bit of a cop-out..but willing to let my bt vision box be experimeneted on...

IS there anything i can help with at all here given my poor skills..

Hi,

I have obtained the Atmega8 chips but now need to program them.  Can anyone recommend any hardware programmer? (I'd rather not build one) or can I buy the chips pre-programmed?

I am willing to pay for someone to program the modchip and create the board so that I just have to solder the cables to the board. :-)

Tom

Hi Tom,
to program the chips, you just need four wires and a LPT port on your pc.

The schematic should be included with the chip hex etc in the archive.

Mick

Ah, ok - thought there may be a pre-built programmer.  I presume parallel is the only way to program (not available via USB?).

Will have to dig the old PC out with a parallel port on!

I notice from the schematic that it shows connections to JP1 is that required?  Also, is that a Capacitor between +3 & Gnd?

Tom

Hi Tom,
You can also buy pre-built usb avr programmers, but for me it was simpler and cheaper just to use 4 wires :)

You can get away without using the capacitor, or the jumper.

Mick

Would the following be suitable:
http://cgi.ebay.co.uk/ws/eBayISAPI.dll?ViewItem&item=330299494010&cguid=c7beee7211d0a0aad360ba20ff6e61ff

Also, I have done all the file system changes, except on page 2 it mentions

Copy the patched TV2ClientCE2.exe to the folder \Hard Disk\TV2ClientCE\

I could not find this in any of the files/zips.

Is this still necessary?

Tom

absolutely.
However, a pre compiled exe or zip of this is not freely available as it is copyrighted material.
The 'normal' tv2 exe is in the nk.bin file, but various tweaks have been done to allow a tv2 exe here instead which means a complete new nk.bin doesnt need to be made in order to boot it.

The exe was decompiled in reflector (i think) to source code which can be recompiled to execute. all the modifications (which i think are allowed and documented) are made against this source to make the changes required.

Thanks for the info.  I was looking at printing a PCB to put the chip, resisters and a DB25 port on.  Would this below be suitable before I go through and etch it!

Tom

Yeah, looks OK, although seems a bit extreme for what you actually need.
Just use veroboard?

Personally I just programmed the chip, then just solder a few wires direct to it. Then just hot glue it with the legs in the air to the card reader pcb :) (i've done a few).

I don't think I've updated the firmware since I first got it working.....so no real need to reprogram it again.

Mick

Ah ok, on the DB25 port, do I really need to link 12 to 2 and 11 to 3?

Also are the resisters 330ohm 1/4 watt?

Tom

unsure about the 12 to 2 and 11 to 3 cant quite remember.. its been a while since I needed to program one of these :D

you can proably skip the resistors even, there just there for protection. It worked fine for me without them :P

Mick

This is the board that Pete (DarkNeo) made for my box

(http://peter.notacake.com/gallery/main.php?g2_view=core.DownloadItem&g2_itemId=248&g2_serialNumber=1)

There is a hookup on there for JTAG to the box ISP to the programmer and the last is for the serial port for debugging.

The Schematic is here http://www.t-hack.com/forum/index.php?topic=47.msg1170#msg1170 we used the full modchip one.

I hope Neo doesnt mind me hotlinking the image from his webalbum.

Thanks warrmr - will probably go down the veroboard route.  Just need to work out where to break the track.

Is the serial worth putting on?  What sort of debug does it give?

Tom

The serial was only useful for use on the initial setup as its not used once the modchip is up and running.

We had an issue where it was not patching the box correctly and we couldent work out why. so we hooked it upto the serial and we found out that the modchip wasnt interupting the processor correctly and was getting an incorrect processor ID.

It turned out the box i had the JTAG had been disabled so i wacked it up on EBAY and then baught a older revision that had JTAG enabled.

http://www.t-hack.com/forum/index.php?topic=327.15 that has some info on the problems we had with my box.

Hi,
Do we really need to use a modchip ?

I have a BT Vision box that I will either use to convert or if things go bad will just recover the hard disk.
I currently use a thomson freeview box but it keeps crashing.

Have not got a clue on where to start with making the modchip.

But love attempting to convert things.

Peter

hi there can someone help me with this receiver a friend of mine gave me this bt vision box and i woud like to know with this box i got a dreambox .so can i change the software from the provider?
how?i don't want to chip because i don't know how to do it an my interest is to record filmes and use this for media
many thanks

without modchip you cannot change anything on the boxes, so it is an absolute must-have.

Hi Mick,
Could you please have a look at this board?
It is slightly different from your pdf, I do not have the JTAG connector.
Any idea?
Regards,
Andrzej

Only thing I can think to try is to meter from the pins on the chip
http://www.t-hack.com/wiki/index.php/EJTAG_on_SMP

and see if the points go anywhere on the board...
Is this a BT box? if so what model?

Mick

Thank's Mick,
I will try to follow the paths from the chip and let yoy know.
It's oryginal BT Vision box bought in 11/2008.
This box contain new rev. of the media chip.
In your pdf there is 0711 rev. B mine is 0822 rev.C - is there any difference?


BT Vision
DIT7 421/05

S/N: 0834033....

Regards,
Andrzej

Mick,

Was wondering - did you keep the motherboard in place when soldering or remove it. The USB pad is pretty small. Also, can you still record or do you currently have a "Freeview Receiver" only?

Thanks,

Troffa

Motherboard was in place, no need to remove it. USB pad is fairly small.. not as small as soldering directly to a tsop or whatever tho :D


Freeview only at the moment, I haven't had a lot of time to contribute to the project lately due to family and personal circumstances :(

Mick

Clock Settings Help?
Hi Guys,please can anyone advise on clock settings using Picprog? as I cannot get ponyprog to work.
Thanks in advance

absolutely.
However, a pre compiled exe or zip of this is not freely available as it is copyrighted material.
The 'normal' tv2 exe is in the nk.bin file, but various tweaks have been done to allow a tv2 exe here instead which means a complete new nk.bin doesnt need to be made in order to boot it.

The exe was decompiled in reflector (i think) to source code which can be recompiled to execute. all the modifications (which i think are allowed and documented) are made against this source to make the changes required.

I've not found any documentation about that, someone can give me some news? thanks...

no one as any suggestion about the tv2clientce.exe?

Hello

Is it possible to mod a Kiss KMM3010 with a "bootchip" or is it possible to open the security in it, so i can use it for opening a stream on the network?

Regards
Wolfie

no one as any suggestion about the tv2clientce.exe?

Well I'm now at the same point as Tumpulio, I've connected up the hard drive to the PC and followed the "HOW TO" guide.

*Patched the NK.BIN with the BooterCE2.exe then run the Neo Patch and copied it back to the drive.
*I've replaced the Content files with the patched ones.
*put the "win" directoy on for debugging though not sure how much use it will actually be to a noob like me!

Then I get stuck at "replace the TV2ClientCE2.exe with the patched one".

Can someone either point us to a downloadable file (via PM so the link isn't public?) or point me in the right direction to compile my own? I have various iterations of Visual Studio so if someone can let me know which version I need and where I might get the modified source to compile that will be great.

The only other thing then is to wait for my modchip to arrive!

Plasma 

This is the board that Pete (DarkNeo) made for my box

Any chance of a look at the underside of that board? I'm going to try and build a digital vero board picture with a program I found on the net, I'll post back my results once done but a picture of the underside might make my life a lot easier!

Plasma

If you know your chip is programmed correctly (and you dont want the LED's) you dont actually need any board..

You can just tag the wires straight onto the chip legs, then hot glue the chip direct to the card reader board (legs pointing up over).

Mick

Ok I was just thinking that if I were going to the trouble of modding it, for the sake of a little more time I might as well put the lot in. But I guess what you are saying is, now you guys have done all the hard work, us idiots can follow on with just the "modchipminimal.png".

Just wasn't sure if I was ever going to need the "ISP Connector" or the "Serial Out", so planned to build a board like Neo's with the options there if I ever needed to use them. I have the thing 3/4 drawn in the vero-Board program, so I may shelve it till my chip arrives and see how it goes without it. Then if I have problems go the whole hog and put the LED's etc in there.

Cheers

Plasma

Well its arrived! I've fudged together a programmer and used PonyProg to program the chip. I used an old usb lead for the +5v supply, so my programmer has a Parallel Connector and a USB!

Followed the instructions, but have a few questions...

1) I used the "Write All" after setting the options in the HOW TO. Thought it seems to program ok, Should I be able to verify it? When I do a verify I get .. "Verify FAILED!". Is this expected?

2) Along with the hex there was a picture of the "reset" connection, should I use the one in the picture, or the one with the orange dot on page 4 of the HOW TO?

3) On the "modchipminimal.png" it shows pins 2, 4, 6, and 8 of the JTAG going to ground and pin 14 to +3V3. Do I need to do anything with these? From the pictures on page 4 it looks like I don't but thought I'd check!

Once I have these answered I'll stick it in the box and I should be up and running!

Cheers

Plasma

Well in the absence of a reply and me being too eager to find out if it works I plodded along with the install.

The box now seems to boot a LOT further. But it seems unstable, it gets to the "Scan for channels" screen. I set it scanning for channels, it updates the time as I see it alter in the top right. It gets about 17% though then the box reboots and starts again.

Looks like I'm in business, got the box up and running (I think)!

Note to self - I should really research more before posting with problems!

But I asume as I'm getting to the above screen now it means the Modchip is programmed/installed correctly?

Cheers

Plasma

Yep, if the modchip wasnt running you would immediately get an error NR01 when trying to boot with a modified kernel.

Mick

hi, is it possible to either get the patched TV2client.exe emailed form someone or can I get the source to recompile from anywhere?

thanks, excellent work!!!!

isomick?????  modshack isomick??

thanks, excellent work!!!!

isomick?????  modshack isomick??

:)

Mick

Hi,
Im thinking about embarking on this project and was wondering whether this modification has left the box with all the functions;

tv, recording and epg ?

Hi,
Im thinking about embarking on this project and was wondering whether this modification has left the box with all the functions;

tv, recording and epg ?

Nope you will currently end up with a simple freeview receiver with HDMI out and EPG. The pause / rewind and PVR facilities will not work. I guess the next question you will as is why bother? The majority of us doing this do not have an account / broadband with the right company to get it working at all without modification.

The modifications on the WinCE TV2Client seem very secretive but I guess that's because its copyrighted work. I'm hoping the Linux guys will be able to offer the full freeview and PVR functionality, and will hopefully eb able to properly document and explain it, but I'm not sure where they are with it all.

Plasma

Hi,
Im thinking about embarking on this project and was wondering whether this modification has left the box with all the functions;

tv, recording and epg ?

Maybe you are a C# coder, or linux guru?

Which would be great :) anyways more the merrier so they say...

Many thanks for this excellent guide, hopefully I'll get my box happily modded then I can start playing with some code. I'm a C# developer by trade (distributed control system and data acquisition software) so will hopefully be able to contribute something back once I'm up to speed.

Hi Guys i am finally out of my BT Contract so i currently have a paper weight or door stop! I am looking to do something useful with the box but i am a little unsure what the best way to go is.

Part of the problem is it looks like the Linux guys have gone a fair way and it says on the Front page Audio and Video support is there now BUT i cant see a good "How To" about to even know where to begin to get started.

My Vision Box is fairly old so i don't think i will have a problem setting up the mod chip although the firmware has been updated so if i go the WinCE route i think the exe patch could be a problem and the PDF is quite out of date.

What do you guys think?

DJHope

Hi everyone,

Brand new to this forum (and also to the UK ;) ), I switched from a BT home to a BT business contract and find myself with the brand new box that won't boot (the new model released in dec 09)...

Is the PDF also applicable to this new box ? Or is there any other way for me to make it work as a "simple" freeview player with EPG and HDD capabilities ?

From what I understood from the previous posts (hard to read sometimes when english is not your mothertongue :p ), there are still severe limitations, but I didn't find any info regarding the new version of the box (or missed them)...

Many thanks for your help,

Skychan

Hi there and welcome to the forum. If you can help us by posting the Model number of your box and any extra info about it you can I'm sure someone will be able to assist you. Is it one of the new Black boxes? I have a friend who is trialling one of those and i'm trying to talk him in to letting me take it apart for scientific / research purposes! ;)

Plasma

Hi guys, sorry to have to be the latest noob on here but  :-[ does this mod allow me to still access previously recorded programmes.
Desperate to get switch from BT but have over 100 hours to still catchup on !!
Cheers all

Hi guys, sorry to have to be the latest noob on here but  :-[ does this mod allow me to still access previously recorded programmes.
Desperate to get switch from BT but have over 100 hours to still catchup on !!
Cheers all

Unfortunately not, if the stored contect is drm'd it should be encrypted (ppv stuff) i think FTA stuff is stored unencrypted but in its own "filesystem" that is stored within fat32 files. (2gb chunks on the hard drive if I remember).

It should be possible to reverse engineer the filesystem, and extract the FTA recordings, probably in TS format, although no one has done this to data as far as I am aware.

Mick

I have a old grey vision box, the only code which could be model is DIT7421/05. What steps would i have to perform just to use it as a freeview box. More and likley has the latest update as it was last used last mth. Any help would be greatly appreciated.

Not sure if that box has the Jtag port, if so, you'll need a modchip, and an older version of the software...

See if you can get your modchip sorted first tho :)

Mick

Hi, im new to the forum and have been reading all the posts on BT Vision Boxes

This is the box i have, so i am guessing it is the right 1;

Boot ROM: 1.1527
Client: 1.6.25077.830(release)
Version: DIT 9719/05

I have never made a mod chip before but i want to start out now. i have some serial cables and a Serial to LPT1 adapter aswell as lots of old usb cables and a few old serial cables.

My problem is i cant find a definitive answer as to the exact component names and sizes to make the chip.

So i need; and i want to go all out and add the serial and led's

1 x jtag (male or female?)
1 x Vero board (any size?)
3 x LED's (Red, Green and Amber)
1 x ATMEGA8-16PU (DIL 28? DIL 40?)
what else? or does someone have a site were i can get everything in 1 place?

Cheers
d3xt0r

The easiest way, is just to prorgam the chip.

Solder wires direct to the legs, then solder them to the jtag pads.

Then glue the chip upside down next to the card reader.

LED's etc are optional, just so you know whats going on.

The wiring diagram is on the board somewhere....

Mick

How do i program the chip and what do i program it with? i'm happy to just clue it legs up.

Another problem i came across is that i have NK.BIN and ETC.BIN and neither contain BooterCE.exe and i have read somewere about the etc.bin and how to mod it but cant find it now

cheers
d3xt0r

How do i program the chip and what do i program it with? i'm happy to just clue it legs up.

cheers
d3xt0r

Did you actually read the "how to" pdf thats attached in the 1st post of this thread? All of the info, including where to download the programmer, schematic and pinout are there....

Mick

Did you actually read the "how to" pdf thats attached in the 1st post of this thread? All of the info, including where to download the programmer, schematic and pinout are there....

Mick

Sorry i got a little confused(i had already read the full pdf). what i meant to ask was once i have programmed the chip can i just put wires from the chip to the jtag without making a circuit board with components etc?

you do not need a circuit board. all wires can be soldered directly to the chip and also the one capacitor can be easily soldered directly to the chip.

The information you have provided is truly amazing. Many thanks for your help.

Hello
Can anybody send me patched TV2ClientCE2.exe please.
Thanks

Hi all,

I have a X301T Box and I definitely will try the stepps described in the how to PDF. All of the lines there and here in the forum are amazing and I am enjoing the reading too. But unfortunately some of the infos provided are very inaccurate for me.

I have gone that far, that I bought a ATMEGA8 chip, which may be somewhere on the way to my address :)
Reading the how to is really self explaining but i experience problems understanding the lines at this point "Install the modchip (soldering required)".
At this point I should have 4 (actually 5 according to the "Simplified AVR ISP Programmer" picture) cables raging out of the LPT port. They should be connected to the AVR chip, hm, is this the ATMEGA8? Or is it another chip located somewhere inside the box? Well i guessed it is ATMEGA8.

I have to solder the 4 cables directly to the feet of the chip. Well next problem is, that according to the picture of the simplified programmer, there are no cable numbers (like JTAG pin 3, 9, 7 or 5) but their names are MISO, RESET, MOSI, SCK, hm... If i would trace them back to the LPT port, the pin numbers would be 6, 7, 9 and 10.

Where do the 4 cables from the Programmer actually have to lead to? ATMEGA chip or JTAG Port? This is quite missleading "Connect the 4 wires to the JTAG port." as in the detailed description the JTAG pins have to be connected with the ATMEGA feet.  8)

By the way, where do I connect the extra 5V power supply? which pins?

Obviously I am missing some point. Thus I started to draw some basic scheme. I d be very thankfull if somebody could fill in the missing parts  ;) And please dont laugh at my artistic skills....

Where do the 4 cables from the Programmer actually have to lead to? ATMEGA chip or JTAG Port? This is quite missleading "Connect the 4 wires to the JTAG port." as in the detailed description the JTAG pins have to be connected with the ATMEGA feet.  8)

By the way, where do I connect the extra 5V power supply? which pins?

Obviously I am missing some point. Thus I started to draw some basic scheme. I d be very thankfull if somebody could fill in the missing parts  ;) And please dont laugh at my artistic skills....

The 4 wires from the programmer will be to the ATmega8 chip. The names of the wires corresponding to the ATmega8 chip pin names instead of numbers but you can easily work this out.
So,
MISO -> pin18(ATmega8)
RESET -> pin1(ATmega8)
MOSI -> pin17(ATmega8)
SCK -> pin19(ATmega8)

The extra 5v supply is needed for the powering the ATmega chip whilst programming it. This would be connected to
+5 -> VCC (pin7)
0v(GND) -> (GND) pin8

Would be interested to know how you get on as, I have just switch ISP and now have a unusable BT Vision box.

lastly, you would program the chip(ATmega) before connecting it to the JTAG. So basically your burning a program to the chip then connecting the chip to the JTAG.

Hello!
I'm from hungary!

I have got a little problem:
I've a got a programmed modchip,I patched a nk.bin, copied xml-s.
But, what about an tv2clientce2.exe?
Where can i download this?
Must copy tv2clientce2 exe to hard disk?
Plese help me.
Thanx, Joe (joe.szabo@freemail.hu)

hi everybody,

There is a little problem I wouldlike to download the files what the manual said, but the megauplod does not exist.
Please send me the working link.

thx a lot!

hi everybody,

There is a little problem I wouldlike to download the files what the manual said, but the megauplod does not exist.
Please send me the working link.

thx a lot!

hy ppl
I wouldlike to download this files to

Hi !
Atmel supplier told me there are ATMEGA8L-8PU or ATMEGA8-16PU circuits available. Which one is suitable ? (8PU is 8Mhz and 3...5V, 16PU is 16Mhz 5V)
Thanks for the great work !
mreg

Quote from: creative.hu on 22. Feb 2012, 18:49

hi everybody,

There is a little problem I wouldlike to download the files what the manual said, but the megauplod does not exist.
Please send me the working link.

thx a lot!

hy ppl


I wouldlike to download this files to

Looks like this thread is well and truly necro'd.  :'(

There's no PDF in the first post here and nothing exists in the way of files or downloads.  :-\

Megaupload was shut down last year due to the owners being tried and convicted of running an illegal service.   ;)

Now I'm at a complete loss, just like many others reading here,  as to how to get these (three) BT Vision (old silver version) boxes reprogrammed.

Is there anywhere else we can get info on re-flashing these "Microsoft IPTV" units so that we can use them as Freeview HD and LAN connected media players and HD PVRs on Linux?

Registered here as I found this thread in relation to the BT Vision Box I've acquired.

There is a PDF on post #1 of this thread, ok but the PC support files linked to megaupload are no more as the host is gone.

Can someone else on here make these available somehow?

Thanks  8)

hi everyone i am new here as i have just aquired a BT Vision PACE DIT7431/05 with the bt vision card still in it although i do not have bt broadband and never will.. sooo i would like to hop on board and blow this little box apart :)

i have extensive experiance in jtagging xbox360's and mobile phones but i have never done a box like this before.. i have done a lot of reading but i am still a little confused on how to get the ATMEGA8 chip hooked up?? i have the pdf from the first post although that pcb board is different to my box?

i have found this image which is0-mick here on the forums has kindly made available..

(http://www.t-hack.com/forum/index.php?action=dlattach;topic=709.0;attach=425;image)

could someone help me with connecting this up to the chip and jtag ltp port?

thanks in advance..