MOTOROLA VIP1616T

Started by venomq3a, 06. Jan 2011, 10:47

previous topic - next topic
Go Down

venomq3a

Hi to all the forumers.
I'm a new italian user and i have any questions. ...sorry for my english.
I have a the decoder iptv/dvbt MOTOROLA VIP1616T distribuited by a local provider, the hardware are similar at the Bluewin....kiss kmm ecc.
This is the specification pdf:
http://www.motorola.com/staticfiles/Video-Solutions/Products/TV%20Video%20Distribution/Set-tops/IP%20Set-tops/VIP1616T/_Documents/Static%20Files/1616T-001%20a_5728.pdf
it mounts a SIGMA SMP8634LF processor and now WinCE upgradable only online with the lan by the provider.
it have the uart connector...
now any pics of the motherboard
http://img177.imageshack.us/img177/2311/sdc12257.jpg
http://img684.imageshack.us/img684/5049/43724442.jpg
http://img263.imageshack.us/img263/2263/sdc12267t.jpg
http://img177.imageshack.us/img177/2416/sdc12260.jpg
At the end... it' hackable?! If yes can post the procedure?
tnx so much at all

Danilo

mce2222

hackable... yes sure. how much effort it is depends on the connector port next to the sticker with the barcode.

the 14 pin connector is definately the JTAG port and the 2 pins next to it will be the "jtag enable" pins.
however it looks like some needed components are missing on the board, so the port might not work without them.

venomq3a

Ok, thanks.
sorry....but to proceed for hack i have to follow the BT Vision Modification guide for this box? ... is compatible and still valid?
thanks for any replys

Danilo

mce2222

the process is the same for all SMP 863x based MS-IPTV devices... however there are usually different versions of the bootloader in the flash, so it is required to dump the decrypted bootloader with the dump-tool from the wiki.
if you post the dump, someone could check if it is a known version, and if it isn't then the patch has to be updated.

JackTheVendicator

I confirm that the 14 pin connector it's a JTAG port, but R199 and R230 must be bridged for it to work; JTAG pin 1 (TRST_N) must be connected to 3.3V.
For some reason, the port is incompatible with my xilinx interface, and even using a 74HC244 buffer doesn't help. So i built a "USB->serial->JTAG" interface using an arduino, and I'm currently dumping the bootloader at 0x93600000 (length 0x100000) :) - I'll post the file later.

I've got also a backup of XENV if necessary...

JackTheVendicator

Dumps at http://repofulm.dyndns.org/index.php?dir=jackthevendicator/vip1616t/

Variables defined in xenv.bin:
Code: [Select]
francesco@Spartan:~/Sviluppo/Sigma/vip1616t$ ../xenv
org. sha1: ee 07 8e 07 eb cb 74 89 5d 55 d5 1a e7 85 45 d4 69 63 19 93
calc sha1: ee 07 8e 07 eb cb 74 89 5d 55 d5 1a e7 85 45 d4 69 63 19 93

idx: offset      type key                  value
-----------------------------------------------------
  0: 0x00000006   xos.boot                 0x00008000
  1: 0x00000011   xos.ds                   0x00010040
  2: 0x00000020   xos.d0.cfg               0xe34111ba
  3: 0x0000002f   xos.d1.cfg               0xe34111ba
  4: 0x0000003a   xos.dt                   0x00000001
  5: 0x00000046   xos.csf                  0x00000002
  6: 0x00000054   xos.l2rzc                0x0000000c
  7: 0x00000061   xos.l2xz                 0x00000015


Is there someone that can calculate the addresses for the patch? :)

blakenick

I think MOTOROLA is good company..
A baby is an inestimable blessing and bother.
Mark Twain

Cheap Baby Favors

Go Up