Pirelli STB HY100 - Pictures

2009-02-26T20:33:42Z

Mce2222: added uart1 pinout

2008-04-18T19:22:12Z

Mce2222: New page: '''Flash contents of a beta x300t''' thanks to Mikhail for providing the dump :) this dump has a zboot loader and a YAMON romfs partiion. both signed with the ...

'''[[Media:Beta rom img.zip|Flash contents of a beta x300t]]'''

thanks to Mikhail for providing the dump :)

this dump has a zboot loader and a YAMON romfs partiion. both signed with the standard SDK certificate.

the rom will work on any SMP863x without a certificate binding (like the popcorn hour)

Main Page

2008-04-18T19:19:13Z

Mce2222: /* Unsorted information */

File:Beta rom img.zip

2008-04-18T19:17:25Z

Mce2222: Flash contents of a beta x300t

Flash contents of a beta x300t

Debrick SMP863x Device

2008-04-10T23:10:24Z

Mce2222: debrick tool for recovering smp863x devices

This is almost the original WRT debrick tool, with only some modifications and bugfixes (this one really works with a Wiggler cable).

flashing is very slow ! expect 3 hours for 512kB.

the rom dump has to be named CUSTOM.BIN

the flash memory starts at 0xAC000000

'''[[Media:Wrt54g2.zip|Download the debrick tool]]'''

File:Wrt54g2.zip

2008-04-10T23:03:16Z

Mce2222: Debrick tool for SMP863x devices

Debrick tool for SMP863x devices

Tools

2008-04-10T23:01:55Z

Mce2222:

At this Point,you can download some tools to edit/modify/create/extract files of the X30xT:

'''[[Dump X300T Bootloader]]'''<br>
With this tool, you are able to dump the bootloader of the X300T. It's not been tested, if you can dump the bootloader of the X301T, too. So someone should test it!

'''[[Debrick SMP863x Device]]'''<br>
This is a modified version of the WRT-Debrick Tool. It recognizes the SMP863x CPU and allows to flash even when the device does not boot up any more.

'''[[Disable X300T Signature Check]]'''<br>
This tool can disable the signature check, so you'r able to boot a Linux-Kernel or something else.
Currently there is nothing else to boot than the WinCE 5.0.

'''[[NK.BIN toolset]]'''<br>
These tools are used to view, modify and dump the NK.BIN

'''[[MakeNK|Fake NK.BIN creator]]'''<br>
This small GUI tool allows to package a Linux Kernel and/or other binary memory dumps into a NK.BIN file that will be accepted by the MS IPTV Bootloader. Of course this will only work if the signature check is disabled :)

IPTV application update

2008-03-02T19:26:31Z

Mce2222: updated link to pkg file

First step is to download an index file that contains information about the latest application version and the filenames of the
application package:

for T-Home it is found here:
:<s>http://cgbf01001.iptv.t-online.de/upgrade/upgrade-files/STB%20Sub-CA%20003/PKG.DIR</s> (not used any more)
:http://cgbf01003.iptv.t-online.de/upgrade/upgrade-files/003/PKG.DIR
:http://cgbf01003.iptv.t-online.de/upgrade/upgrade-files/002/PKG.DIR

for BT-Vision it is found here:
:http://ref-bootstrap.nevis.btopenworld.com/upgrade/upgrade-files/005/PKG.DIR

<pre>
NAME: Production_Package_1.2.2099.2
BUILD: 00000833 00040000 DEV DEV
DATE: 10/18/2007
PARTITION: 02000000
0109 0307
014C9A58
01757796
PART000.DAT 7BB65704 C760BD76 01066D95 4EF0AA8E 1B9C2 1FE48 2
PART001.DAT 7EBFA0BD 101F6104 17AEFD07 2D0445A7 1BD81 1FE48 2
....
PART264.DAT 0745D14D E1D1DC08 70C5A81A 7ED3F9FF 0F22B 177EA 2
#000040B4 4C964F44 48B2E2E8 4E1D5A57 69E9828D
</pre>

the PARTxxx.DAT files are located in the same directory as the PKG.DIR file.
All the PARTxxx.DAT files are downloaded from the server and Zlib-decompressed if the last number in the row is "2".

the decompressed parts are encrypted with a lame XOR and bitshifting algorithm.
after decryption, all the parts are concatenated and the result is a large Archive file similar to a Zip file.

this Archive is then extracted onto the harddisk.

A tool to decompress, decrypt, join and extract the PART files can be found [[Download Update Files|here]].

here is the java code to decompress and decrypt PART files:

<pre>InputStream in = new FileInputStream("data/"+part.getName());
if (part.isZlib())
{
in = new InflaterInputStream(in);
}

int len = -1;
int partLength = 0;
while ( (len=in.read(buffer)) != -1)
{
for (int i = 0; i < len; i++)
{
byte a = (byte) ( (((int)buffer[i]) >> 5) & 0x07);
byte b = (byte) ( (((int)buffer[i]) << 3) & 0xF8);
byte c = (byte) (a | b);
byte d = (byte) (c ^ (partLength++ & 0xff));
buffer[i] = d;
}
out.write(buffer, 0, len);
}</pre>

Boot Process

2008-03-02T19:18:51Z

Mce2222: /* Disaster-Recovery */

=== CPU internal ===
The SMP863x has a security coprocessor ([[XPU]]) that is responsible for controlling the boot process.

It has a bios like bootstrap code ([[XOS]]) in internal flash memory. This bootstrap code cannot be read from outside the CPU.

=== Bootloader in Flash ===
The [[XOS]] tries to find the an [[XENV]] block in the external flash memory.

The [[XENV]] contains a pointer where the flash-boot-partition is located. The boot partition is encrypted and signed in case of the x300t. Therefore the [[XPU]] decrypts the flash-boot-partition and stores the decrypted code in RAM.

The signature of the boot partition is verified, and if it is ok, then the [[XPU]] triggers the CPU to start the code from RAM.

This code is the IPTV Bootloader. It does some hardware inits and downloads the "bootstrap" file via TFTP from discovery.iptv.t-online.de

The content of this file is not important for the boot itself.

Next step is the Desaster-Recovery check. On the 1st partition on the harddrive there is the file "BOOT.PRF". This file contains a boot counter that is increased on each boot attempt by the IPTV Bootloader. If the BOOT.PRF file is not found or if the boot counter is at least 4, then a Desaster-Recovery is triggered.

=== Disaster-Recovery ===
For Disaster-Recovery the Bootloader downloads the files "sync" and "dra" from discovery.iptv.t-online.de also via TFTP.

dra contains a WinCE kernel (NK.BIN) and a signed hash for the kernel. If the signature is correct, then the kernel is started.

The NK.BIN is a stripped down WinCE 5.0 kernel, with some SMP863x drivers, DotNet Compact 2.0 and a Boot application (TV2DRACE.exe)

The WinCE initializes the hardware and starts the TV2DRACE.exe (a C# application)

The TV2DRACE.exe will download the IPTV application with all its data files from the t-online server, same way as the regular [[IPTV application update]] takes place.

After all the files are extracted to harddisk, the box will reboot because there is also a new NK.BIN included in the application files.

The Bootloader will detect that there is a NK.BIN on the harddrive and it will check the signature that is in the boot.sig file.

If the signatur is ok, and the hash and size of the NK.BIN matches as well, then it will start the new NK.BIN.

The new NK.BIN is similar to the one that is in the "dra" but it has much more files, and instead of a TV2DRACE.exe it contains a BooterCE.exe

=== BooterCE ===
The BooterCE.exe autostarts and will check if there is an update available on the bootstrap server of t-online. If this is true the [[IPTV application update]] is started.

Next the BooterCE.exe searches the harddrive for *.sig files and processes them. Any file that is not listed in a .sig file will be deleted. If an incorrect hash is found, then the system will be rebooted... which will finally result in a desaster recovery.

The file check takes quite some time as it is recursively checking all files on the first partition. If no problems were found then the TV2Client.exe (C#) is started. The TV2Client.exe is now embedded in the NK.BIN (in earlier version it was stored on the harddrive)

The TV2Client.exe is the application that handles all the communication with the IPTV server and it also creates the GUI that is seen on TV.

Setup NFS-Root-Filesystem

2008-03-02T00:11:10Z

Mce2222: /* setup nfs server */

this is a howto that only works partially, since I don't managed to get a login-console so far.
however, at least we can mount a nfsroot ;-)

===setup nfs server===

*install nfs server

e.g. in debian based distributions that should do the trick:
apt-get install nfs-kernel-server

*setup exports
/some/dir/nfsroot 192.168.1.*(rw,sync,subtree_check)

*reconfigure nfsd
exportfs -a

===kernel cmd-line parameter===

*start yamon
*change kernel cmd line parameter, we need ip kernel configuration!!
setxenv a.linux_cmd "console=ttyS0 root=/dev/nfs nfsroot=(nfs_server_ip):/some/dir/nfsroot ip=(my_ip_addr):(server_ip_addr):(gateway):(netmask):(hostname)"

*ok, here is an example without placeholders:
x300t_ip: 192.168.1.20<br/>
nfs_server_ip: 192.168.1.30<br/>
gateway: 192.168.1.1<br/>
netmask: 255.255.255.0<br/>

setxenv a.linux_cmd "console=ttyS0 root=/dev/nfs nfsroot=192.168.1.30:/some/dir/nfsroot ip=192.168.1.20:192.168.1.30:192.168.1.1:255.255.255.0:x300t"

===boot kernel (and linux?)===

ok, the above settings should let the box mount a rootfs via nfs!
however, at the moment, we don't have a working rootfs. so this howto stops at this point.
<br/><br/>
.. to be continued ;-)

Howto boot Linux

2008-02-27T22:35:43Z

Mce2222:

Requirements:
* working JTAG interface
* working Serial connection

ok, lets start.

First download the Yamon boot image from '''[[Media:Ya.zip|here]]''' and the Linux boot image from '''[[Media:Lx.zip|here]]'''.

extract both files to the first partition of the x300t hard disk. (either upload it with FTP, or connect the drive to a PC)

now grab the latest x300t patch tool from '''[[Media:X300tpatch3.zip|here]]'''

use the patch tool as usual, but add the /yamon parameter when starting the tool.
as soon as you press the OK button of the x300t you should see the YAMON prompt in the terminal window.

the YAMON is only required once to set the Linux kernel parameter

use the setxenv command to display the current xenv parameters.

usually there should not be a parameter "a.linux_cmd" .. so we have to create one like this

'''setxenv a.linux_cmd "console=ttyS0 root=/dev/hda3"'''

this command will write the new parameter to the flash.

now reboot the x300t and use the patch too again, but now add the /linux parameter when starting.

after some seconds you should the the Linux Kernel booting up.

please note that you need a Linux root partition on a NFS share, USB stick or hard disk to really use the Linux.

Howto boot Linux

2008-02-27T22:35:09Z

Mce2222: Linux boot instructions

Requirements:
* working JTAG interface
* working Serial connection

ok, lets start.

First download the Yamon boot image from '''[[Media:Ya.zip|here]]''' and the Linux boot image from '''[[Media:Lx.zip|here]]'''.

extract both files to the first partition of the x300t hard disk. (either upload it with FTP, or connect the drive to a PC)

now grab the latest x300t patch tool from '''[[Media:X300tpatch3.zip|here]]'''

use the patch tool as usual, but add the /yamon parameter when starting the tool.
as soon as you press the OK button of the x300t you should see the YAMON prompt in the terminal window.

the YAMON is only required once to set the Linux kernel parameter

use the setxenv command to display the current xenv parameters.

usually there should not be a parameter "a.linux_cmd" .. so we have to create one like this

setxenv a.linux_cmd "console=ttyS0 root/dev/hda3"

this command will write the new parameter to the flash.

now reboot the x300t and use the patch too again, but now add the /linux parameter when starting.

after some seconds you should the the Linux Kernel booting up.

please note that you need a Linux root partition on a NFS share, USB stick or hard disk to really use the Linux.

Main Page

2008-02-27T22:20:57Z

Mce2222: /* Software */

File:Ya.zip

2008-02-27T22:20:03Z

Mce2222: Yamon as NK.BIN

Yamon as NK.BIN

File:Lx.zip

2008-02-27T22:01:58Z

Mce2222: Linux 2.6 Kernel for x300t

Linux 2.6 Kernel for x300t

File:X300tpatch3.zip

2008-02-27T21:58:04Z

Mce2222: uploaded a new version of "Image:X300tpatch3.zip": source included

improved version with linux and yamon load option

Disable X300T Signature Check

2008-02-27T21:56:42Z

Mce2222: new patch tool uploaded

The signature check on the bootloader itself cannot be removed, since it happens inside the SMP8634. However it is possible to disable the signature check of the NK.BIN so that a modified kernel can be booted.

This modified kernel can be even a Linux kernel that is hidden inside a special NK.BIN.

Please note that this only works if there is a JTAG connection between a PC and the X300T.

'''[[Media:X300tpatch.zip|download the patch tool v1]]''' ---
'''[[Media:X300tpatch-src.zip|download the source v1]]'''

'''[[Media:X300tpatch2.zip|download the patch tool v2 (src included)]]'''

'''[[Media:X300tpatch3.zip|download the patch tool v3 (src included)]]'''

File:X300tpatch3.zip

2008-02-27T21:55:25Z

Mce2222: improved version with linux and yamon load option

improved version with linux and yamon load option

MakeNK

2008-02-20T21:35:55Z

Mce2222: zboot dump added

MakeNK is a C# GUI application that allows to create a NK.BIN file that contains several memory dumps.

This can be used to let the Bootloader load a Linux Kernel and start it :)

the archive does not include any memory dumps.

'''[[Media:MakeNK.zip|Download MakeNK]]'''

----

here is a zboot dump that has to be loaded to 0x91200000.

the zboot will try to process a romfs located at 0x90800000, if this does not exist or no bootable xload was found in the romfs, it will jump to 0x90020000.

'''[[Media:Zboot-forLinux9120.zip|Download zboot dump]]'''

File:Zboot-forLinux9120.zip

2008-02-20T21:26:46Z

Mce2222: modified zboot dump that starts a linux kernel regardless of romfs processing

modified zboot dump that starts a linux kernel regardless of romfs processing

Main Page

2008-02-03T19:55:16Z

Mce2222: /* Software */ added MakeNK

File:MakeNK.zip

2008-02-03T19:54:22Z

Mce2222: Create Fake NK.BIN files to load and start Linux or other binaries.

Create Fake NK.BIN files to load and start Linux or other binaries.

MakeNK

2008-02-03T19:53:26Z

Mce2222: New page: MakeNK is a C# GUI application that allows to create a NK.BIN file that contains several memory dumps. This can be used to let the Bootloader load a Linux Kernel and start it :) the arc...

Tools

2008-02-03T19:49:29Z

Mce2222:

At this Point,you can download some tools to edit/modify/create/extract files of the X30xT:

'''[[Dump X300T Bootloader]]'''<br>
With this tool, you'r able to dump the bootloader of the X300T. It's not been tested, if you can dump the bootloader of the X301T, too. So someone should test it!

'''[[Disable X300T Signature Check]]'''<br>
This tool can disable the signature check, so you'r able to boot a Linux-Kernel or something else.
Currently there is nothing else to boot than the WinCE 5.0.

'''[[NK.BIN toolset]]'''<br>
These tools are used to view, modify and dump the NK.BIN

'''[[MakeNK|Fake NK.BIN creator]]'''<br>
This small GUI tool allows to package a Linux Kernel and/or other binary memory dumps into a NK.BIN file that will be accepted by the MS IPTV Bootloader. Of course this will only work if the signature check is disabled :)