SBG900 Cable modem

Motorola SBG9000 surfboard
The CPU of the board uses BCM3348. The tool to debug the CPU is EJTAG (DMA).

Picture showing JTAG is connected
Flash One 8MB 28F640J3
Firmware 4MB $9FC00000-$9FFFFFFF
RAM 16MB $80000000-$80FFFFFF
Definition in usbjtag.def Commands (usbjtag 0.11):
Test:
Name=SBG900
DLL=SBG900.dll
Memory=Ram,0,0x80000000,0x1000000
// Boot loader Memory=boot,1,0x9fc00000,0x20000
Memory=App,1,0x9fc20000,0x3c0000
Memory=cfg,1,0x9fFe0000,0x20000
Programram=0x80400000
// watch dog Init=0xfffe0224,0
Endian=Big
IRLength=5
Protocol=EJTAG
DMA=Yes
ProbTrap=1
Backup firmware
getram 9Fc00000 400000
save 9fc00000 400000

Program whole firmware.
ldram 9fc00000
program 9fc00000 400000
Rescue SBG900. When box not fire up. Normal programming will not work. First need to program boot.
detect
ldram boot (Select proper boot file)
erase boot
sprogram boot (Slow programming)

Power off on modem

detect
ldram app(Any tabes you have backed up)
program app(Any tabs you want at normal speed)

Lasted Updated:December 31 2016

Vists since Jan 4,2009