recover a Dreambox dm500

alcatel · Post by **alcatel** » Thu Jul 28, 2011 1:37 pm

i have a dm500(dreambox) and my bootloader is corrupted.

i want to restore it and i hooked up usbjtag.
when i press detect i get the following.

-detect
IDCODE 12955049
Manufacturer not found 024

The flash chip is.

E28F640J3

Post by **usbbdm** » Fri Jul 29, 2011 7:55 am

alcatel wrote:i have a dm500(dreambox) and my bootloader is corrupted.

i want to restore it and i hooked up usbjtag.
when i press detect i get the following.

-detect
IDCODE 12955049
Manufacturer not found 024

The flash chip is.

E28F640J3

Please do not do anything yet. I will add DM500 supprt soon. Hope on 0.52. However, like the conexant support your hardware ID has to be 4000 and higher. Once DM500 is supported I will upload the youtube like recently I did for Sonicview, Nano 2, Viewsat and XV3300.
DM500 uses Power PC and new development needs to be done. Keep watching the news forum.

alcatel · Post by **alcatel** » Fri Jul 29, 2011 3:12 pm

thanks,i keep watching the forum,since i can't watch TV

slugworth · Post by **slugworth** » Fri Jul 29, 2011 3:45 pm

As I recall there was old parallel port firmware for jtagging years ago.
Clone kill recovery I think.

alcatel · Post by **alcatel** » Mon Aug 22, 2011 12:40 pm

I have just tested the new version 0.52 but it seems i cannot read from the device.

-detect
IDCODE 12955049
IBM STB02500
-getram Flash

It gets detected,but when i press read data from target,nothing happens.

Post by **usbbdm** » Mon Aug 22, 2011 1:35 pm

Sorry. The DM500 was delayed due to 0.52 support. I will go back to this project. Hope next release will have DM500 support (PPC).

Post by **usbbdm** » Tue Aug 23, 2011 8:02 am

Actually peek command is impllemented. So if you do command
peek ff800000
peek ff800004
You will see the data read out. It is time to implement the other functions.

alcatel · Post by **alcatel** » Thu Aug 25, 2011 11:19 am

i got a backup off a working image,so if i could flash that my problem would be solved
Thanks for the update

Post by **usbbdm** » Thu Aug 25, 2011 10:14 pm

DM500 slow read is done. The slow read speed is about ~53KB/s. I do not know if the fast read exist. But for now it is good enough to get started. Will try to detect flash now.

Post by **usbbdm** » Tue Aug 30, 2011 8:53 am

I can read and program DM500 and soon will release 0.53. There are some questions.

1. Where is the boot? The current flash map is from 0xff800000 and size 0x800000. I do not see the 0xff800000 is the start of the boot.
2. Other program's backup seems to have the byte swapped. Which means when you load the backup from other program you need to swap the byte (hilo). I only see 132KB of the boot. Should I add the hilo byte swap in the software?

Only slow programming is implemented, the read speed is about 53KB/s. The programming speed is about 24-25KB/s (Intel J28F640). Program entire 8M needs about 5-6 minutes. I could add another programming method which can at least double the programming speed. But I think this is going to be good enough to start.

alcatel · Post by **alcatel** » Tue Aug 30, 2011 10:23 am

Hi.

I don't have this info,i did find this.

root@dreambox:~> cat /proc/mtd
dev: size erasesize name
mtd0: 00500000 00020000 "DreamBOX cramfs+squashfs"
mtd1: 002c0000 00020000 "DreamBOX jffs2"
mtd2: 00040000 00020000 "DreamBOX OpenBIOS"
mtd3: 007c0000 00020000 "DreamBOX (w/o bootloader)"
mtd4: 00800000 00020000 "DreamBOX (w/ bootloader)"
mtd5: 003e0000 00020000 "DreamBOX SquashedFS"
mtd6: 00120000 00020000 "DreamBOX Cramfs"

I don't know if this is what you need.

I also found these files,this is the way you can recover using a lpt-jtag method.
it also included files like a bootloader and a working image.
maybe usefull to compare.

http://www.mediafire.com/?i7b0vcm2mjde48o

Post by **usbbdm** » Tue Aug 30, 2011 5:17 pm

OK. I got the point I can kill the box (erase entire flash) then program the boot ( a few seconds) then revive it with DreamUp (That is quite long about 8 minutes).
The box then is up and running.
I will release 0.53 latter. Also fix the side by side issue.

CAPONE · Post by **CAPONE** » Tue Aug 30, 2011 5:24 pm

usbbdm wrote:OK. I got the point I can kill the box (erase entire flash) then program the boot ( a few seconds) then revive it with DreamUp (That is quite long about 8 minutes).
The box then is up and running.
I will release 0.53 latter. Also fix the side by side issue.

Awsome Boss. Great News Like Always.....

Post by **usbbdm** » Tue Aug 30, 2011 10:11 pm

If you want to test before I post the pages and video.
Here is some tips.
1. Connect reset pin on NT (pin 11) to Halt pin (pin 11) on the pad. This is important to halt the CPU.
2. The boot is from fffe0000. Size 20000. Just load the right boot
ldram fffe0000

erase fffe0000 20000
sprogram fffe0000 20000

After about 4 seconds. You are ready to use the serial app to revive the DM500. I will most likely upload pages and video tomorrow.

Post by **usbbdm** » Wed Aug 31, 2011 10:23 pm

As promised. I will upload the web page tomorrow.

USB JTAG

recover a Dreambox dm500

recover a Dreambox dm500

lpt

DM500 almost ready.

Who is online