The channel mask in NVRAM.

Backup of earlier posts.
Post Reply
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

The channel mask in NVRAM.

Post by usbbdm »

Just found a channel mask in the NVRAM.
Disable the channel can be done by setting the channel bit to 0. When you flip the channel will jump
Enable the bit does not gurantee the channel can be enabled. It depends on if this channel is available in your area.
Here is how you search for it.Backup your NVRAM first.

Code: Select all

Search the NVRAM range from 00 01 02 00 between $20b000 - $20b1d6
Here is what I have 
00 01 02 00 81 9F 00 10 FF FF at address 
Use 5th and 6th byte is 0x819f. Sub 0x8000 got 0x19f.
Use 0x19f * 0x20 = 0x33e0
Add 0x200418, 0x200418 + 0x33e0 = 0x2037f8
Go to address 0x2037f8
Offset 37F8 size 200
7F FF FF FF FF FF FF FF FF BB FF 7F FF FF FF BE 
FF D6 03 FF FF FF FF FF 01 60 00 87 FE 00 00 7E 
C0 00 00 00 00 07 F0 00 00 00 00 00 00 00 00 00 

Each bit in here is a channel enable/disable. So try to disbale one channel just reset that bit.

Change the first 7F FF FF to 7F 00 00 to see what happened.
twistedps
Junior Member
Posts: 62
Joined: Fri Jul 22, 2005 10:24 am
Location: boston

Post by twistedps »

hmmm interesting stuff!!!
kai
Junior Member
Posts: 34
Joined: Thu Jul 28, 2005 12:54 pm

Post by kai »

How about that, now I don't have channels 8-23 as expected. Great work!

I was trying to find out how to add channels on the 2244, because I'm receiving channels on my ATSC/QAM256 pci card that are in the clear, but definitely are not on any assigned channels on the 2244.
kai
Junior Member
Posts: 34
Joined: Thu Jul 28, 2005 12:54 pm

Post by kai »

I tried to add the bits for channels 101-104 but the 2244 keeps overwriting my changes. Maybe there are other tables that have to be adjusted also when you add channels??
patsfan
Junior Member
Posts: 673
Joined: Thu Jul 21, 2005 4:02 pm

Post by patsfan »

very intersesting. will give it a try later. excellent find.
twistedps
Junior Member
Posts: 62
Joined: Fri Jul 22, 2005 10:24 am
Location: boston

Post by twistedps »

anyone else try this out? i'm gonna reset the nvram and see what channels i dont have and try it out to see if it will enable.
Phredog
Junior Member
Posts: 39
Joined: Tue Jul 26, 2005 3:46 pm

Post by Phredog »

So Kai, is it still overwriting your changes?
kai
Junior Member
Posts: 34
Joined: Thu Jul 28, 2005 12:54 pm

Post by kai »

Phredog wrote:So Kai, is it still overwriting your changes?
Yes, but it may just be the channels I'm trying to add are protected. I know that channels 101-104 are good REAL channels numbers on my cable system, as in channels 1-125, but this channel map only refers to mapped channel numbers which can be all over the place.

It also could be that there is a link between this map and another one, so when you remove a channel it's gone, but adding one may need some adjusting somewhere else. So many questions!!!

By the way, I tried putting FF's all the up to channel 999, but that all got overwritten too.
twistedps
Junior Member
Posts: 62
Joined: Fri Jul 22, 2005 10:24 am
Location: boston

Post by twistedps »

i dont see how your getting to Go to address 0x237f8 ? like in the program? do you issue a 'd 237f8' ? because it brings up the dipcode tab if i do that.
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

twistedps wrote:i dont see how your getting to Go to address 0x237f8 ? like in the program? do you issue a 'd 237f8' ? because it brings up the dipcode tab if i do that.
Sorry I made a mistake and fixed that. The start address is 0x200418.
Phredog
Junior Member
Posts: 39
Joined: Tue Jul 26, 2005 3:46 pm

Post by Phredog »

kai....

Any more luck? Is the box firmware still overwriting the channels?

Perhaps there are two tables. Each my have an LRC, or CRC. The firmware may periodically check both tables. If one is fails the check, it gets overwritten by the other.

I can't remember where, but I had seen this done before. I was using a software based debugger on an embedded system, and was trying to change some memory addresses. The clock ISR, kept accessing the same memory. Somtimes my changes would post, and sometimes not.
kai
Junior Member
Posts: 34
Joined: Thu Jul 28, 2005 12:54 pm

Post by kai »

Phredog wrote:kai....

Any more luck? Is the box firmware still overwriting the channels?

Perhaps there are two tables. Each my have an LRC, or CRC. The firmware may periodically check both tables. If one is fails the check, it gets overwritten by the other.

I can't remember where, but I had seen this done before. I was using a software based debugger on an embedded system, and was trying to change some memory addresses. The clock ISR, kept accessing the same memory. Somtimes my changes would post, and sometimes not.
I was hoping that usbbdm would comment on why the channels get overwritten.
tester5
Junior Member
Posts: 21
Joined: Wed Jul 27, 2005 9:16 pm
Location: NewYork&Chicago
Contact:

Post by tester5 »

its a broadcast i have problems too right now i wana fix. i belive is somehting in the nvram.........with a a diferent nvram fromdiferent area your channels will not disapear......with the nvram from your area it does.... the box actualy connects .....ok dosent send back signals but its related to head end and those MCA numbers what the box uses to connect get tvguide data like names etc.........

since the 2000 are going out they broadcast new channel lineup..


please coment on that i also found a way to make the box stop from autoupdating broadcast firmware( 230000-234000 erase that or write bad data i am not sure a precise location but is in that 4000 range) so i am almost 100% sure this is simmilar to this and is somewere in the first 10000

====*****updated its the nvram i updated it with the newest nvram and is working now dosent skip.
Post Reply

Who is online

Users browsing this forum: No registered users and 11 guests