t-hack.com - Hack X300T / X301T - User contributions [en]

DIT9719 PCB

2008-03-16T20:43:27Z

Mikeprotts: More description of solder points

See picture [[Image:100_1155.JPG|thumb]]

There are some interesting solder blobs in square C3, left and down from the SMP8634LF chip. Could these be UART (numbered 1300) and Jtag (14 blobs, number looks like 1301)? Could 1304 be the jtag enable jumper?

[[Image:Solderpoints.jpg|thumb|left]]

Further investigation shows there are two jumper positions suitable for fitting pins (4 pin may be 1302 - hard to read, 2 pin 1304), the 7 pin set of blobs (1300), 14 pin (1301 probably, not certain) and then a pair of blobs (1303) which may be spaced for a component. 1300/1301 are cleanly layed out - as though for a component, but maybe just for a connector (maybe ribbon connector as used elsewhere).

There are more points lower in the photo, 1308 looks like a standard 8 pin DIL surface mount, and there is a smaller surface mount connector with 16 pads. These may be related to the space between the scart and audio sockets (not sure what that would be for).

Hardware Images

2008-03-16T20:26:35Z

Mikeprotts: Added picture of bt vision board showing solder points

{| cellpadding="10"
| valign="top" width="30%"|
[[Image:IMG 2239.JPG|thumb|left]]
[[Image:IMG 2241.JPG|thumb|left]]
[[Image:IMG 2242.JPG|thumb|left]]
[[Image:IMG 2245.JPG|thumb|left]]
[[Image:IMG 2246.JPG|thumb|left]]
[[Image:JP_1_without_connection.JPG|thumb|left]]
[[Image:X300-jtag-rev05.jpg|thumb|left]]

| valign="top" width="30%"|
[[Image:IMG 2247.JPG|thumb|left]]
[[Image:IMG 2249.JPG|thumb|left]]
[[Image:IMG 2250.JPG|thumb|left]]
[[Image:IMG 2251.JPG|thumb|left]]
[[Image:IMG 2252.JPG|thumb|left]]
[[Image:Backside_JP_1.jpg|thumb|left]]

| valign="top" width="30%"|
[[Image:IMG 2253.JPG|thumb|left]]
[[Image:IMG 2255.JPG|thumb|left]]
[[Image:IMG 2256.JPG|thumb|left]]
[[Image:IMG 2257.JPG|thumb|left]]
[[Image:IMG 2261.JPG|thumb|left]]
[[Image:JP2.JPG|thumb|left]]

|}

----

From a BT vision box
{| cellpadding="10"
| valign="top" width="30%"|
[[Image:100_1155.JPG|thumb|left]]
[[Image:Solderpoints.jpg|thumb|left]]
|}

File:Solderpoints.jpg

2008-03-16T20:24:21Z

Mikeprotts: Annotation of boarg solder points, possible jtag

Annotation of boarg solder points, possible jtag

Boot Process

2008-03-10T21:25:36Z

Mikeprotts: Thoughts on the CA certificate in bootstrap

=== CPU internal ===
The SMP863x has a security coprocessor ([[XPU]]) that is responsible for controlling the boot process.

It has a bios like bootstrap code ([[XOS]]) in internal flash memory. This bootstrap code cannot be read from outside the CPU.

=== Bootloader in Flash ===
The [[XOS]] tries to find the an [[XENV]] block in the external flash memory.

The [[XENV]] contains a pointer where the flash-boot-partition is located. The boot partition is encrypted and signed in case of the x300t. Therefore the [[XPU]] decrypts the flash-boot-partition and stores the decrypted code in RAM.

The signature of the boot partition is verified, and if it is ok, then the [[XPU]] triggers the CPU to start the code from RAM.

This code is the IPTV Bootloader. It does some hardware inits and downloads the "bootstrap" file via TFTP from discovery.iptv.t-online.de

The content of this file is not important for the boot itself. (On the BT-Vision version the file contains some Certificate information. Maybe this is part of the trust chain - will the box accept any CA cert, i.e. if this is the start of the chain, or is there a cert that verifies this one that is already in flash? I do not recognise the format, but the strings make this look like a BT Vision CA cert signed by the BT root CA.)

Next step is the Desaster-Recovery check. On the 1st partition on the harddrive there is the file "BOOT.PRF". This file contains a boot counter that is increased on each boot attempt by the IPTV Bootloader. If the BOOT.PRF file is not found or if the boot counter is at least 4, then a Desaster-Recovery is triggered.

=== Disaster-Recovery ===
For Disaster-Recovery the Bootloader downloads the files "sync" and "dra" from discovery.iptv.t-online.de also via TFTP. (On the BT-Vision version the file sync contains the dns name of the server to download dra from, and a some Certificate information).

dra contains a WinCE kernel (NK.BIN) and a signed hash for the kernel. If the signature is correct, then the kernel is started.

The NK.BIN is a stripped down WinCE 5.0 kernel, with some SMP863x drivers, DotNet Compact 2.0 and a Boot application (TV2DRACE.exe)

The WinCE initializes the hardware and starts the TV2DRACE.exe (a C# application)

The TV2DRACE.exe will download the IPTV application with all its data files from the t-online server, same way as the regular [[IPTV application update]] takes place.

After all the files are extracted to harddisk, the box will reboot because there is also a new NK.BIN included in the application files.

The Bootloader will detect that there is a NK.BIN on the harddrive and it will check the signature that is in the boot.sig file.

If the signatur is ok, and the hash and size of the NK.BIN matches as well, then it will start the new NK.BIN.

The new NK.BIN is similar to the one that is in the "dra" but it has much more files, and instead of a TV2DRACE.exe it contains a BooterCE.exe

=== BooterCE ===
The BooterCE.exe autostarts and will check if there is an update available on the bootstrap server of t-online. If this is true the [[IPTV application update]] is started.

Next the BooterCE.exe searches the harddrive for *.sig files and processes them. Any file that is not listed in a .sig file will be deleted. If an incorrect hash is found, then the system will be rebooted... which will finally result in a desaster recovery.

The file check takes quite some time as it is recursively checking all files on the first partition. If no problems were found then the TV2Client.exe (C#) is started. The TV2Client.exe is now embedded in the NK.BIN (in earlier version it was stored on the harddrive)

The TV2Client.exe is the application that handles all the communication with the IPTV server and it also creates the GUI that is seen on TV.

Boot Process

2008-03-10T21:14:13Z

Mikeprotts: /* Bootloader in Flash */

=== CPU internal ===
The SMP863x has a security coprocessor ([[XPU]]) that is responsible for controlling the boot process.

It has a bios like bootstrap code ([[XOS]]) in internal flash memory. This bootstrap code cannot be read from outside the CPU.

=== Bootloader in Flash ===
The [[XOS]] tries to find the an [[XENV]] block in the external flash memory.

The [[XENV]] contains a pointer where the flash-boot-partition is located. The boot partition is encrypted and signed in case of the x300t. Therefore the [[XPU]] decrypts the flash-boot-partition and stores the decrypted code in RAM.

The signature of the boot partition is verified, and if it is ok, then the [[XPU]] triggers the CPU to start the code from RAM.

This code is the IPTV Bootloader. It does some hardware inits and downloads the "bootstrap" file via TFTP from discovery.iptv.t-online.de

The content of this file is not important for the boot itself. (On the BT-Vision version the file contains some Certificate information).

Next step is the Desaster-Recovery check. On the 1st partition on the harddrive there is the file "BOOT.PRF". This file contains a boot counter that is increased on each boot attempt by the IPTV Bootloader. If the BOOT.PRF file is not found or if the boot counter is at least 4, then a Desaster-Recovery is triggered.

=== Disaster-Recovery ===
For Disaster-Recovery the Bootloader downloads the files "sync" and "dra" from discovery.iptv.t-online.de also via TFTP. (On the BT-Vision version the file sync contains the dns name of the server to download dra from, and a some Certificate information).

dra contains a WinCE kernel (NK.BIN) and a signed hash for the kernel. If the signature is correct, then the kernel is started.

The NK.BIN is a stripped down WinCE 5.0 kernel, with some SMP863x drivers, DotNet Compact 2.0 and a Boot application (TV2DRACE.exe)

The WinCE initializes the hardware and starts the TV2DRACE.exe (a C# application)

The TV2DRACE.exe will download the IPTV application with all its data files from the t-online server, same way as the regular [[IPTV application update]] takes place.

After all the files are extracted to harddisk, the box will reboot because there is also a new NK.BIN included in the application files.

The Bootloader will detect that there is a NK.BIN on the harddrive and it will check the signature that is in the boot.sig file.

If the signatur is ok, and the hash and size of the NK.BIN matches as well, then it will start the new NK.BIN.

The new NK.BIN is similar to the one that is in the "dra" but it has much more files, and instead of a TV2DRACE.exe it contains a BooterCE.exe

=== BooterCE ===
The BooterCE.exe autostarts and will check if there is an update available on the bootstrap server of t-online. If this is true the [[IPTV application update]] is started.

Next the BooterCE.exe searches the harddrive for *.sig files and processes them. Any file that is not listed in a .sig file will be deleted. If an incorrect hash is found, then the system will be rebooted... which will finally result in a desaster recovery.

The file check takes quite some time as it is recursively checking all files on the first partition. If no problems were found then the TV2Client.exe (C#) is started. The TV2Client.exe is now embedded in the NK.BIN (in earlier version it was stored on the harddrive)

The TV2Client.exe is the application that handles all the communication with the IPTV server and it also creates the GUI that is seen on TV.

Main Page

2008-03-08T13:29:22Z

Mikeprotts: Added an intro in English referring to the BT-Vistion Philips DIT9719 box.

__NOTOC__

<big>'''Willkommen zum Wiki von t-hack.com'''</big>

Das t-hack.com - Projekt wurde am 14. Dezember 2007 ins Leben gerufen, um eine alternative Software für die Multimedia-Box X300T bzw. X301T zu entwickeln bzw. die originale zu verbessern ;)

'''Das Wiki ist zum Schutz vor Spambots nur von registrierten Usern nutzbar.'''

'''You are able to upload files with following extension:
png, gif, jpg, jpeg, zip, rar, pdf, ace'''

Besuchen Sie auch das [http://www.t-hack.com/forum t-hack-Forum]

The hardware seems very similar to the Philips DIT9719, which is widely available in the UK as the BT Vision box. With luck a bit of common effort will get a usable system.

== Hardware ==
*[[Versions X300T/X301T]]
*[[SMP8634]]
*[[Picture]]
*[[Schematic/Boardlayout]]
*[[eJTAG|eJTAG on PCB]]
*[[eJTAG on SMP]]
*[[UART0|Serial Debug Port]]

==Software==
*[[Tools]]
**[[Dump X300T Bootloader]]
**[[Disable X300T Signature Check]]
**[[Upload YAMON]]
**[[NK.BIN_toolset]]
**[[MakeNK]]
**[[Download Update Files]]
*[[Boot Process]]
*[[Bootstrap-Message]]
*[[HDD-Layout]]
*[[Network-Bootstrap]]
*[[TV2ClientCE.exe]]
*[[BooterCE.exe]]
*[[TFTP]]

===Linux===
*[[Howto boot Linux]]
*[[Setup NFS-Root-Filesystem]]
<br>
*[[some additional output regarding Linux]]

==Filesystem==
*[[NK.BIN]]

==Unsorted information==
*[[Bootlog??|Bootload of Beta X300T]]
*[[PKG.DIR]]

TV2ClientCE args

2008-03-05T20:25:18Z

Mikeprotts: serverauth parm hidden due to wiki use of logical or symbol (vertical bar) for on off

{| border="1" class="wikitable"
|+ command line parameters of the TV2ClientCE.exe application
|-
! parameter !! description !! default value
|-
| -pal || sets default resolution to 768x576i || 640x480i
|-
| -pinsize [byte] || PIN length || 4 chars
|-
| -disablevideoonstandby || turns off video output when in standby || false
|-
| -vodextraprograminfo || shows categories || false
|-
| -debugseekbartimeout [int] || ?? || 60000
|-
| -vodassetloadbatchsize [int] || ?? || 40
|-
| -enableh4nks || allow HDMI when there are no HDCP Keys || false
|-
| -hdcpallowdisable || allow to disable HDCP || false
|-
| -enablevps || ?? || false
|-
| -celog || starts the oscapture2.exe which creates a log file || false
|-
| -clockstartframedelay [byte] || ?? || 10
|-
| -burstpercentsd [byte] || ?? || 20
|-
| -burstpercenthd [byte] || ?? || 10
|-
| -maxbitratesd [uint] || Max Bitrate of SD content || 6000000
|-
| -maxholesizems [byte] || ?? || 150
|-
| -eurostyleon || || false
|-
| -nocc || disable closed caption || false
|-
| -serverauth [on off] || check server certificates || on
|-
| -diskreserve [uint] || ?? || none
|-
| -burstcompleteackdelay [ushort] || ?? || 0ms
|-
| -burstcompletetimeout [ushort] || ?? || 60000ms
|-
| -enablecalllettersearch || ?? || false
|-
| -muteapplicationsoundsdefault [bool] || control application sounds || true
|-
| -displaymetadataprices [bool] || ?? || false
|-
| -unlockpconinbadstate [bool] || ?? || false
|-
| -dialogtimeoutseconds [int] || ?? || 5
|-
| -universe || ?? ||
|-
| -requirevaliduniverse || ?? || true
|-
| -universedemo || ?? ||
|-
| -displaymetadataprices [bool] || ?? || false
|-
| -eastextredisplayinterval [int] || Emergency Alert Systems messages redisplay || 30
|-
| -eascrawlspeed [int] || Emergency Alert Systems messages speed || 15
|-
| -easpostcrawlpause [int] || Emergency Alert Systems messages pause || 7
|-
| -disablecolorkeydefaults || disable Teletext color buttons || false
|-
| -allowadultpinforautoblock || ?? || false
|-
| -blockonmissingguidedata [bool] || ?? || true
|-
| -asyncpiptuneon || ?? || true
|-
| -asyncpiptuneoff || ?? || true
|-
| -lastchanneltunedwaitseconds || ?? || 300
|-
| -disabledvb || turn off DVB-Tuners || false
|-
| -dvbvhfscan || enable DVB-T scan in VHF range || false
|-
| -dvbminfreq || minimum frequency for UHF || 470000000
|-
| -dvbmaxfreq || maximum frequency for UHF || 854000000
|-
| -dvbbw || DVB-T bandwidth used in UHF || 8000000
|-
| -dvbvhfminfreq || minimum frequency for VHF || 174000000
|-
| -dvbvhfmaxfreq || maximum frequency for VHF || 230000000
|-
| -dvbvhfbw || DVB-T bandwidth used in VHF || 7000000
|-
| -dttautoscanmode || ?? || true
|-
| -bootstrapretryminwait [int] || retry delay for box login error (min) || 10
|-
| -boostrapretrymaxwait [int] || retry delay for box login error (max) || 60
|-
| -enterbuttonforzoom || ?? || false
|-
| -enablepipprogressbar || ?? || false
|-
| -showunlockperiodminutes [uint] || ?? || 1440
|-
| -rfremodchannel [short] || ?? || 3
|-

|}

Hardware-versions

2008-03-03T20:36:12Z

Mikeprotts: Added Philips DIT9719 placeholder

=== X300T ===

{| cellpadding="5" cellspacing="0" border="1"
! Box Revision
! Date
! SMP Revision
! Bootloader Version
! JTAG works
! reported by
|-
| Rev 05
| U7
| Rev A
| 1039
| YES
| Asgard
|-
| Rev 05
| U8
| Rev A
| 1039
| YES
| Sumo
|-
| Rev 05
| U10
| Rev A C0
| 1051
| YES
| mce2222
|-
| Rev 05
| U10
| Rev A C0
| 1051
| YES
| guteseite
|-
| Rev 0D
| U11
| Rev A C0
| 1051
| NO
| guteseite
|-
| Rev 0D
| U12
| Rev A C0
| 1051
| NO
| Karlheinz
|-
| Rev 0J
| ??
| Rev B
| 1051
| NO
| Paul
|-
| Rev 0L
| ??
| Rev B
| ??
| NO
| smplasma
|}

=== X301T ===

{| cellpadding="5" cellspacing="0" border="1"
! Box Revision
! Date
! SMP Revision
! Bootloader Version
! JTAG works
! reported by
|-
| ??
| ??
| Rev B
| 1053
| NO
| robert_s
|}

=== Philips DIT9719 ===

{| cellpadding="5" cellspacing="0" border="1"
! Box Revision
! Date
! SMP Revision
! Bootloader Version
! JTAG works
! reported by
|-
| ??
| ??
| ??
| ??
| ??
| ??
|}

Boot Process

2008-03-02T22:00:46Z

Mikeprotts: /* Bootloader in Flash */

=== CPU internal ===
The SMP863x has a security coprocessor ([[XPU]]) that is responsible for controlling the boot process.

It has a bios like bootstrap code ([[XOS]]) in internal flash memory. This bootstrap code cannot be read from outside the CPU.

=== Bootloader in Flash ===
The [[XOS]] tries to find the an [[XENV]] block in the external flash memory.

The [[XENV]] contains a pointer where the flash-boot-partition is located. The boot partition is encrypted and signed in case of the x300t. Therefore the [[XPU]] decrypts the flash-boot-partition and stores the decrypted code in RAM.

The signature of the boot partition is verified, and if it is ok, then the [[XPU]] triggers the CPU to start the code from RAM.

This code is the IPTV Bootloader. It does some hardware inits and downloads the "bootstrap" file via TFTP from discovery.iptv.t-online.de

The content of this file is not important for the boot itself. (On the BT-Vision version the file sync contains some Certificate information).

Next step is the Desaster-Recovery check. On the 1st partition on the harddrive there is the file "BOOT.PRF". This file contains a boot counter that is increased on each boot attempt by the IPTV Bootloader. If the BOOT.PRF file is not found or if the boot counter is at least 4, then a Desaster-Recovery is triggered.

=== Disaster-Recovery ===
For Disaster-Recovery the Bootloader downloads the files "sync" and "dra" from discovery.iptv.t-online.de also via TFTP. (On the BT-Vision version the file sync contains the dns name of the server to download dra from, and a some Certificate information).

dra contains a WinCE kernel (NK.BIN) and a signed hash for the kernel. If the signature is correct, then the kernel is started.

The NK.BIN is a stripped down WinCE 5.0 kernel, with some SMP863x drivers, DotNet Compact 2.0 and a Boot application (TV2DRACE.exe)

The WinCE initializes the hardware and starts the TV2DRACE.exe (a C# application)

The TV2DRACE.exe will download the IPTV application with all its data files from the t-online server, same way as the regular [[IPTV application update]] takes place.

After all the files are extracted to harddisk, the box will reboot because there is also a new NK.BIN included in the application files.

The Bootloader will detect that there is a NK.BIN on the harddrive and it will check the signature that is in the boot.sig file.

If the signatur is ok, and the hash and size of the NK.BIN matches as well, then it will start the new NK.BIN.

The new NK.BIN is similar to the one that is in the "dra" but it has much more files, and instead of a TV2DRACE.exe it contains a BooterCE.exe

=== BooterCE ===
The BooterCE.exe autostarts and will check if there is an update available on the bootstrap server of t-online. If this is true the [[IPTV application update]] is started.

Next the BooterCE.exe searches the harddrive for *.sig files and processes them. Any file that is not listed in a .sig file will be deleted. If an incorrect hash is found, then the system will be rebooted... which will finally result in a desaster recovery.

The file check takes quite some time as it is recursively checking all files on the first partition. If no problems were found then the TV2Client.exe (C#) is started. The TV2Client.exe is now embedded in the NK.BIN (in earlier version it was stored on the harddrive)

The TV2Client.exe is the application that handles all the communication with the IPTV server and it also creates the GUI that is seen on TV.

Boot Process

2008-03-02T22:00:17Z

Mikeprotts: /* Disaster-Recovery */

=== CPU internal ===
The SMP863x has a security coprocessor ([[XPU]]) that is responsible for controlling the boot process.

It has a bios like bootstrap code ([[XOS]]) in internal flash memory. This bootstrap code cannot be read from outside the CPU.

=== Bootloader in Flash ===
The [[XOS]] tries to find the an [[XENV]] block in the external flash memory.

The [[XENV]] contains a pointer where the flash-boot-partition is located. The boot partition is encrypted and signed in case of the x300t. Therefore the [[XPU]] decrypts the flash-boot-partition and stores the decrypted code in RAM.

The signature of the boot partition is verified, and if it is ok, then the [[XPU]] triggers the CPU to start the code from RAM.

This code is the IPTV Bootloader. It does some hardware inits and downloads the "bootstrap" file via TFTP from discovery.iptv.t-online.de

The content of this file is not important for the boot itself.

Next step is the Desaster-Recovery check. On the 1st partition on the harddrive there is the file "BOOT.PRF". This file contains a boot counter that is increased on each boot attempt by the IPTV Bootloader. If the BOOT.PRF file is not found or if the boot counter is at least 4, then a Desaster-Recovery is triggered.

=== Disaster-Recovery ===
For Disaster-Recovery the Bootloader downloads the files "sync" and "dra" from discovery.iptv.t-online.de also via TFTP. (On the BT-Vision version the file sync contains the dns name of the server to download dra from, and a some Certificate information).

dra contains a WinCE kernel (NK.BIN) and a signed hash for the kernel. If the signature is correct, then the kernel is started.

The NK.BIN is a stripped down WinCE 5.0 kernel, with some SMP863x drivers, DotNet Compact 2.0 and a Boot application (TV2DRACE.exe)

The WinCE initializes the hardware and starts the TV2DRACE.exe (a C# application)

The TV2DRACE.exe will download the IPTV application with all its data files from the t-online server, same way as the regular [[IPTV application update]] takes place.

After all the files are extracted to harddisk, the box will reboot because there is also a new NK.BIN included in the application files.

The Bootloader will detect that there is a NK.BIN on the harddrive and it will check the signature that is in the boot.sig file.

If the signatur is ok, and the hash and size of the NK.BIN matches as well, then it will start the new NK.BIN.

The new NK.BIN is similar to the one that is in the "dra" but it has much more files, and instead of a TV2DRACE.exe it contains a BooterCE.exe

=== BooterCE ===
The BooterCE.exe autostarts and will check if there is an update available on the bootstrap server of t-online. If this is true the [[IPTV application update]] is started.

Next the BooterCE.exe searches the harddrive for *.sig files and processes them. Any file that is not listed in a .sig file will be deleted. If an incorrect hash is found, then the system will be rebooted... which will finally result in a desaster recovery.

The file check takes quite some time as it is recursively checking all files on the first partition. If no problems were found then the TV2Client.exe (C#) is started. The TV2Client.exe is now embedded in the NK.BIN (in earlier version it was stored on the harddrive)

The TV2Client.exe is the application that handles all the communication with the IPTV server and it also creates the GUI that is seen on TV.

DIT9719 PCB

2008-02-29T21:32:53Z

Mikeprotts:

DIT9719 PCB

2008-02-29T21:31:53Z

Mikeprotts: Starter page for DTI9719 PCD investigation

See picture [[Image:100_1155.JPG]]

There are some interesting solder blobs in square C3, left and down from the SMP8634LF chip. Could these be UART (numbered 1300) and Jtag (14 blobs, number looks like 1301)? Could 1304 be the jtag enable jumper?

EJTAG

2008-02-29T21:28:04Z

Mikeprotts: /* JTAG on the SMP863x */

== JTAG on the SMP863x ==

eJTAG is a debug interface specified bei MIPS. it is an extension of the standard JTAG specification.

Since the SMP863x CPU has a MIPS core, it also has a JTAG port :) But it is deactivated by default :(

In case of the X300T there is a eJTAG connector and also a jumper to activate the eJTAG, as shown in the image below. The jumper can be permanently shorted. For DIT9719 PCB follow [[DIT9719 PCB]].

Only the pins TDI, TDO, TMS, TCK and GND are needed to make the interface work.

eJTAG Pinout of the X300T
[[image:Pinout.jpg|300px|eJTAG Pinout of the X300T]]

== How to get an Interface ==

The easiest solution to use the eJTAG interface is to build an unbuffered DLC5 JTAG interface found below.

If you decide to buy a JTAG interface you should be aware the the 14pin header of most JTAG interfaces use a different pinout then the eJTAG.
So you might have to fix the cable to correct the pinout.

== DLC5 JTAG ==
[[image:JTAGunbuffered.png]] [[image:DLC5-Sample.JPG|right|thumb|300px|my cable]]

or

[[Image:Wrt jtag-kabel schaltung.gif]]

;Advantage
* easy to build
* very cheap
* no power supply needed

;Disadvantage
* interface cable has to be rather short to avoid transmission errors. 10-20cm is probably the maximum length. shorter == better

== Wiggler Clone JTAG ==
An alternative is to use a Wiggler-Clone .. (the original Wiggler interface cost 150$)

[[image:Wiggler.png]]

;Advantage
* interface cable can be a bit longer .. probably 30-50cm, but also in this case, shorter == better
* Macraigor software can be used
* the target systems CPU is protected by the buffer

;Disadvantage
* more complicated to build
* more expensive but still cheap

Hardware Images

2008-02-29T20:44:16Z

Mikeprotts: Add BT vision picture link

Sample output

2008-02-29T20:13:01Z

Mikeprotts:

'''Sample obtained using BT-Vision download
'''

<pre>
viewbin.exe NK.BIN

ViewBin... NK.BIN
Image Start = 0x91E00000, length = 0x00FB6070
Start address = 0x91E00004
Checking record #78 for potential TOC (ROMOFFSET = 0x00000000)
Found pTOC = 0x92db4c6c
ROMOFFSET = 0x00000000
Done.

cvrtbin.exe -r -a 0x91E00000 -w 32 -l 0x00FB6070 NK.BIN

ViewBin... NK.BIN
Image Start = 0x91E00000, length = 0x00FB6070
Start address = 0x91E00004
Checking record #78 for potential TOC (ROMOFFSET = 0x00000000)
Found pTOC = 0x92db4c6c
ROMOFFSET = 0x00000000
start 91e00000 length 00000014
start 91e00040 length 00000008
start 91e00048 length 00000004

... lots more similar

start 92db4c6c length 00000054
start 92db4cc0 length 000013b0
Progress...
0%Done.

dumprom.exe -d foundfiles NK.nb0

img 00000000 : hdr=92db4c6c base=91e00000 commandlineoffset=91e00000
ERROR: could not find pointer for ofs 00000000
NOTE: section at 00fb7000 iso 00051000 for nk.exe
NOTE: section at 0007b000 iso 00051000 for nk.exe
NOTE: section at 00fe4000 iso 00080000 for nk.exe
NOTE: section at 00fe6000 iso 00082000 for nk.exe
NOTE: section at 00f91000 iso 0000b000 for osaxst0.dll

... lots more similar

NOTE: section at ff077000 iso 0008c000 for iptvplatform.dll
NOTE: section at ff085000 iso 00008000 for fasld.dll
NOTE: section at ff093000 iso 00004000 for scart_drvr.dll

91e00000 - 91e00000 L00000000 rom_00 start
91e00000 - 91e00004 L00000004 NUL
91e00004 - 91e00010 L0000000c unknown e0 b1 1a 3c bc 5f 5a 37 08 00 40 03
91e00010 - 91e00040 L00000030 NUL
91e00040 - 91e00048 L00000008 'ECEC' -> 92db4c6c
91e00048 - 91e0004c L00000004 unknown 6c 4c fb 00
91e0004c - 91e01000 L00000fb4 NUL
91e01000 - 91e50bd4 L0004fbd4 o32 region_0 rva=00001000 vsize=0004fbd4 real=91e01000 psize=0004fc00 f=60000020 for nk.exe

... lots more similar

92dabfe0 - 92db1815 L00005835 filedata TDASCR.dll
92db1818 - 92db4c6c L00003454 filedata XTLApp_1.2_XosE0.bin
92db4c6c - 92db4cc0 L00000054 rom_00 header: dlls=01b201d5-02000000 phys=91e00000-92db6070, 112 modules, 52 files, 6 copyentries ext=91e01020 ram=92db7000-93a00000 cputype=00000166
92db4cc0 - 92db4ce0 L00000020 modent 0 00000007 01c80a784b7e5f26 416768 91e00000 nk.exe
92db4ce0 - 92db4d00 L00000020 modent 1 00000807 01c80a778678ebd8 48640 91e8c000 osaxst0.dll

... lots more similar

92db6038 - 92db6054 L0000001c filent 50 00000001 01c772a4f46edde1 13396 13396 92db1818 XTLApp_1.2_XosE0.bin
92db6054 - 92db6070 L0000001c filent 51 00000001 01c772a4f4786749 1060 1060 91fe8ad8 XTUApp_1.2_XosE0.bin
92db6070 - 92db6070 L00000000 rom_00 end
</pre>

Sample output

2008-02-29T20:09:10Z

Mikeprotts: Sample output from some of the tools

<pre>
viewbin.exe NK.BIN

ViewBin... NK.BIN
Image Start = 0x91E00000, length = 0x00FB6070
Start address = 0x91E00004
Checking record #78 for potential TOC (ROMOFFSET = 0x00000000)
Found pTOC = 0x92db4c6c
ROMOFFSET = 0x00000000
Done.

cvrtbin.exe -r -a 0x91E00000 -w 32 -l 0x00FB6070 NK.BIN

ViewBin... NK.BIN
Image Start = 0x91E00000, length = 0x00FB6070
Start address = 0x91E00004
Checking record #78 for potential TOC (ROMOFFSET = 0x00000000)
Found pTOC = 0x92db4c6c
ROMOFFSET = 0x00000000
start 91e00000 length 00000014
start 91e00040 length 00000008
start 91e00048 length 00000004

... lots more similar

start 92db4c6c length 00000054
start 92db4cc0 length 000013b0
Progress...
0%Done.

dumprom.exe -d foundfiles NK.nb0

img 00000000 : hdr=92db4c6c base=91e00000 commandlineoffset=91e00000
ERROR: could not find pointer for ofs 00000000
NOTE: section at 00fb7000 iso 00051000 for nk.exe
NOTE: section at 0007b000 iso 00051000 for nk.exe
NOTE: section at 00fe4000 iso 00080000 for nk.exe
NOTE: section at 00fe6000 iso 00082000 for nk.exe
NOTE: section at 00f91000 iso 0000b000 for osaxst0.dll

... lots more similar

NOTE: section at ff077000 iso 0008c000 for iptvplatform.dll
NOTE: section at ff085000 iso 00008000 for fasld.dll
NOTE: section at ff093000 iso 00004000 for scart_drvr.dll

91e00000 - 91e00000 L00000000 rom_00 start
91e00000 - 91e00004 L00000004 NUL
91e00004 - 91e00010 L0000000c unknown e0 b1 1a 3c bc 5f 5a 37 08 00 40 03
91e00010 - 91e00040 L00000030 NUL
91e00040 - 91e00048 L00000008 'ECEC' -> 92db4c6c
91e00048 - 91e0004c L00000004 unknown 6c 4c fb 00
91e0004c - 91e01000 L00000fb4 NUL
91e01000 - 91e50bd4 L0004fbd4 o32 region_0 rva=00001000 vsize=0004fbd4 real=91e01000 psize=0004fc00 f=60000020 for nk.exe

... lots more similar

92dabfe0 - 92db1815 L00005835 filedata TDASCR.dll
92db1818 - 92db4c6c L00003454 filedata XTLApp_1.2_XosE0.bin
92db4c6c - 92db4cc0 L00000054 rom_00 header: dlls=01b201d5-02000000 phys=91e00000-92db6070, 112 modules, 52 files, 6 copyentries ext=91e01020 ram=92db7000-93a00000 cputype=00000166
92db4cc0 - 92db4ce0 L00000020 modent 0 00000007 01c80a784b7e5f26 416768 91e00000 nk.exe
92db4ce0 - 92db4d00 L00000020 modent 1 00000807 01c80a778678ebd8 48640 91e8c000 osaxst0.dll

... lots more similar

92db6038 - 92db6054 L0000001c filent 50 00000001 01c772a4f46edde1 13396 13396 92db1818 XTLApp_1.2_XosE0.bin
92db6054 - 92db6070 L0000001c filent 51 00000001 01c772a4f4786749 1060 1060 91fe8ad8 XTUApp_1.2_XosE0.bin
92db6070 - 92db6070 L00000000 rom_00 end
</pre>

NK.BIN toolset

2008-02-29T19:50:09Z

Mikeprotts:

Content of this toolset:

viewbin.exe - shows the contents of the NK.BIN

cvrtbin.exe - converts the NK.BIN to and from other formats

binmod.exe - is able to replace files inside the NK.BIN however it has several limitations

dumprom.exe - this tool extracts all files and modules from the kernel. It does not use NK.BIN files as input but NK.nb0 files, which can be created with the cvrtbin.exe

[[Media:Nkbintools.zip|Download the toolset]]

Output from a sample session using BT Vision files
[[sample output]]

NK.BIN toolset

2008-02-29T19:47:16Z

Mikeprotts: Added sample output link