SB4200 Cable modem

Motorola SB4200 surfboard
The CPU of the board uses BCM3345. The tool to debug the CPU is EJTAG (DMA).

Picture showing JTAG connector
Flash One 2MB 28F160C3T
Firmware 2MB $9FC00000-$9FDFFFFF
RAM 16MB $80000000-$81000000

 

Definition in usbjtag.def Commands (usbjtag 0.12):
Name=SB4200
Endian=Big
Memory=Ram,0,0x80000000,800000
Memory=Firm,1,0x9fC00000,110000
Memory=Cfg0,1,0x9fD10000,10000
Memory=Firm1,1,0x9fD20000,E0000
Programram=0x80400000
Endian=Big
IRLength=5
Protocol=EJTAG
DMA=Yes
ProbTrap=1
DebugMem=0
// watch dog
Init=0xfffe0224,0
Backup firmware
getram 9fc00000 200000
save 9fc00000 200000

Program whole firmware. (Should not interrupt)
detect
ldram 9fc00000
program 9fc00000 200000
cmpram 9fc00000 200000

cmpram is optional. It can be used after program only when DMA is supported.After that you should see DEBUG ON. You should see "Compair data OK"


Rescue SB4200. When box not fire up. Normal programming will not work. You can not use sprogram or erase for SB4200!!
ldram 9fc00000(Select the backed up file)
poke fffe230c 3
poke fffe2304 0
poke fffe2300 a
poke fffe2300 9
poke fffe2300 9
poke fffe2300 9
poke fffe2300 9
poke fffe2300 9
poke fffe2300 9
poke fffe2300 9
poke fffe2300 9
poke fffe2300 1c
detect
program 9fc00000 200000
cmpram 9fc00000 200000
if cmpram failed, power off and on the box again and do
delect
program 9fc00000 200000
cmpram 9fc00000 200000

Lasted Updated:December 31 2016

Vists since Jan 4,2009