Hi Guys,
Got a black BT box today to disect.
Completely different to the other boxes. This one is Broadcom based.
BCM7405.
I think the board could be a reference design, or they designed it for multiple uses.
There are a number of places where unpopulated components would fit, such as another card reader, and also an external power jack (12v type).
There is also a place for a reset switch, and for another sata port.
Pictures attached.
Does anyone have any datasheets (not the 2 page product brief) or ballout for the BCM7405?
Mick
Seem to be having problems attaching photos.
Mick
Here's 196 pages of goodness :)
Cool :) nice one.
Thanks zfeet :)
Mick
:D Glad you have got one of these now.. I am good with pc hardware etc but not so good with things like this black box.. so will be great to see what you can find out about it.. yes i had noticed place for second sata port etc..
Well, looking at the PDF, the secure co processor could do all kinds of nasty stuff, like verify the boot signature from an onboard rom. There is also a mention of secure handshake to access jtag (maybe they didnt implement it?)
I may need to get hold of another box to remove the CPU, then we can trace the jtag pads to see if they go anywhere.
It seems a better build than the sigma box, and a 400mhz cpu (from the data sheet).
Also being sata, and the sigma chip network or ide performance being crap iirc, the box should perform a lot better than the previous one.
However if the secure modes are implemented in the cpu, then a cpu replacement may be the only option :(
Mick
Hoernchen had some more documents about that cpu directly from the broadcom library... unfortunately he has vanished... no idea why.
from what I remembered, he mentioned that the security of the cpu is very similar to the sigma cpu.
about the performance... I have read some user-reviews where they said that the box feels a bit faster but not THAT much.
anyway, it is interesting that broadcom finally managed to get a competitive SoC on the market. up to now I did not see a real product using the chip.
at least the documentation of the chip is way better than this joke that Sigma is providing.
Apparently the Dreambox DM500HD uses the BCM7405 chip too.
Mick
but that box isnt long on the market either... about the same as the pace
Can you provide the BT firmware for that box? I would like to see what changes MS did to tv2client/tv2engine.
Hi Mulder3,
Seems they have done a few changes.
The etc.bin now seems encrypted, so the normal tools don't open it to get to the tv2client.
There also seems to be 3 filters in the NK.BIN and some hash / key file?
I dont have the files to hand at the moment, will send you a PM later.
Just to add, I also have found the jtag pins on the board, which is the connector to the left of the sata ports.
Pin 1 seems to be nTRST, I have tried a few combinations but no ID from the chip..
jtag are pins 1 - 6 (5 is GND).
I'm awaiting another box to remove the CPU to verify the pin assignment.
Mick
Ok, send me a PM later.
About the security, while it could be just another layer of Windows CE security(most likely, i think), i can also be some kind of encryption related to Broadcom's SoC security co-processor. That WinCE filters you referred can use the co-processor to perform the decryption. What do you think?
Way to go guys watching this topic with interest! 8)
Plasma
I have one of these black beauty's winging its way to me, any news on whether they are suceptible to a similar hack?
Plasma
Hi Plasma,
Unfortunately I haven't had time to progress this any further....
Mick
Well mine arrived today, all up an running but with stock BT firmware! :(
Just itching for a reason to tear the "Warranty Void if removed sticker!" on the back! :D
Plasma
tell them its duff, they may just send another free of charge :P
Mick
What is the PKG.DIR URL for the black box firmware? I heard they are updating it at the moment, latest will be 1.6.3063.2844
tell them its duff, they may just send another free of charge :P
Mick
What a crackingly good idea, I might phone them later! I was also pretty disapointed to discover the new box isn't DVB-T2 compatible, also rather odd they advertise HD On Demand Content all over their website but don't give you an HDMI cable! :s
Plasma
What a crackingly good idea, I might phone them later! I was also pretty disapointed to discover the new box isn't DVB-T2 compatible, also rather odd they advertise HD On Demand Content all over their website but don't give you an HDMI cable! :s
Plasma
Tried that and no go, they wanted to send an engineer out, which if it was a customers problem would be about £117!!!! :(
One thing I have discovered is they have disabled the RF Out Modulator so I can no longer feed other TV's in the house via RF! (Thanks for that BT!) There is a menu option that says its off but I can find no way of enabling it, hoping if we get a mod chip to work on this we can restore that feature. Though its a little less pressing now my bedroom TV has freeview built in but still rather annoying!
Also was rather surprised to learn that it doesn't support DVB-T2, but searching around BT have said they are working on a box that does, so maybe we'll see another release of BT Vision in the near future is Freeview HD support.
Plasma
Does anyone want one of these boxes for spares?
I've taken out the 160GB disk and removed the fan, but apart from that it's all there.
I've left the remote and the power lead in the box.
You can have it for nowt, just cover the cost of shipping.
Cheers
Steve.
Hi I have read this thread with interest. I would like to be able to flash the box in order to use it but have visited the PACE website who appear not to publish their firmware. I assume that the box is very similar to other PACE products.
I also noted the comment about the DreamHD box so have downloaded the software from this page:
http://www.dream-multimedia-tv.de/en/dm500-hd-flashing-dreamup (http://www.dream-multimedia-tv.de/en/dm500-hd-flashing-dreamup)
This connects to the box and interogates it enough to discover that it is not a Dream box. A small step forward.
If anyone wants to look at this to see if they can fool the software into thinking it is connected to a Dream box I am willing to risk killing my box to find out if it works or not.