recover a Dreambox dm500

[alcatel]

thanks for adding support for this one !

i didn't connect the TRST pin1 to my dm500,but i was able to read the flash,it is necessary to write ?

[usbbdm]

If you can detect falas, then not needed.
The read back entire flash might not work. I believe the memory init was not done properly. Backup and program the boot is proven to be working.

[alcatel]

I have a working DM500 and a broken.

How can i get the bootloader from the working DM500?

Only the command,the rest is already working.
Thanks!

[usbbdm]

detect
getram fffe0000 200000
save fffe0000 200000
will save a legit boot. But it might also have your mac of the other box. You might need to find how to modify the mac to make your own boot.

[alcatel]

I got the working bootloader,checked in hex if it was ok.

ldram fffe0000
ERASE fffe0000 20000
SPROGRAM fffe0000 20000
CMPRAM fffe0000 20000

This isn't succesful,it says "Compare data Failed address FFFE0000,target FF,PC memory BF"

i checked the loaded bin with hex editor and its the same as the one getting loaded,so there is a problem when writing.

[usbbdm]

can you try to use speed 2? Or I can try teamviewer with you.

[alcatel]

Hi.

i tried every speed 0,1,2 but no go.
i send you a pm for teamviewer.

[usbbdm]

Check your PM.

[moonwalker]

I have recovered 3 DM500 with the JTAG NT following the tutorial video. Everything went fine without problems.

However now I have another 2 boxes that are giving problems. The Chip is properly detected and ERASE and SPROGRAM show normal progress too. However the Compare gives error at address FFFE0000 and sometimes at address FFFE0006. Tried different speeds but got same errors.

Now the only difference on these boxes is that instead of flash JS28F640 they use TE28F640. Can this be the problem?

[CAPONE]

I have recovered 3 DM500 with the JTAG NT following the tutorial video. Everything went fine without problems.

However now I have another 2 boxes that are giving problems. The Chip is properly detected and ERASE and SPROGRAM show normal progress too. However the Compare gives error at address FFFE0000 and sometimes at address FFFE0006. Tried different speeds but got same errors.

Now the only difference on these boxes is that instead of flash JS28F640 they use TE28F640. Can this be the problem?

NO that would Not be a Problem.

[usbbdm]

I have recovered 3 DM500 with the JTAG NT following the tutorial video. Everything went fine without problems.

However now I have another 2 boxes that are giving problems. The Chip is properly detected and ERASE and SPROGRAM show normal progress too. However the Compare gives error at address FFFE0000 and sometimes at address FFFE0006. Tried different speeds but got same errors.

Now the only difference on these boxes is that instead of flash JS28F640 they use TE28F640. Can this be the problem?

When you erase it check to see if it is empty before program it.

[usbbdm]

You can use teamviewer and show me your issue. Should not be software issue since both flash are compatible. If needed we can tweak the flash.xml to bypass your issue.

[moonwalker]

Yes erase is working properly. It seems the write is not working properly.
However I will try to swap a flash with a JS one and see if the flash type is the real problem or not.
Will post back later the results.

[moonwalker]

Replaced the flash TE28F640 with a JS28F640 and now it has programmed successfully. So there must be some difference between the 2 flashes.

Also read in different forums the following statement -"if your chip is JS28F640, use jtagdm500, if TE28F640, use window version jtag".

So now I have one box with TE28F640J3C120 flash which is not programming properly. Erasing works fine so its the programming the problem.

Now this is the data I am supposed to be writing (the addr should be FFFE0000 and not 007E0000 - I got this addr after copying)

007e0000h: BF AB 00 30 FF FE 20 30 00 00 00 00 00 00 F7 E0 ; ¿«.0ÿþ ......÷à
007e0010h: FF FE 00 00 00 00 0F 80 A0 00 60 00 00 00 41 3C ;ÿþ.....€*.`...A<
007e0020h: A0 00 6F 80 00 00 00 00 00 00 00 00 00 00 00 00 ; *.o€............
007e0030h: 60 00 00 00 60 00 00 00 60 00 00 00 60 00 00 00 ; `...`...`...`...
007e0040h: 60 00 00 00 60 00 00 00 60 00 00 00 60 00 00 00 ; `...`...`...`...
007e0050h: 60 00 00 00 60 00 00 00 60 00 00 00 60 00 00 00 ; `...`...`...`...
007e0060h: 60 00 00 00 60 00 00 00 60 00 00 00 60 00 00 00 ; `...`...`...`...
007e0070h: 60 00 00 00 60 00 00 00 60 00 00 00 60 00 00 00 ; `...`...`...`...
007e0080h: 60 00 00 00 60 00 00 00 60 00 00 00 60 00 00 00 ; `...`...`...`...
007e0090h: 60 00 00 00 60 00 00 00 60 00 00 00 60 00 00 00 ; `...`...`...`...
007e00a0h: 60 00 00 00 60 00 00 00 60 00 00 00 60 00 00 00 ; `...`...`...`...
007e00b0h: 60 00 00 00 60 00 00 00 60 00 00 00 60 00 00 00 ; `...`...`...`...
007e00c0h: 60 00 00 00 60 00 00 00 60 00 00 00 60 00 00 00 ; `...`...`...`...
007e00d0h: 60 00 00 00 60 00 00 00 60 00 00 00 60 00 00 00 ; `...`...`...`...
007e00e0h: 60 00 00 00 60 00 00 00 60 00 00 00 60 00 00 00 ; `...`...`...`...
007e00f0h: 60 00 00 00 60 00 00 00 60 00 00 00 60 00 00 00 ; `...`...`...`...
007e0100h: 90 20 00 3C 90 40 00 40 38 60 01 00 48 00 9F 90 ; ￾ .<￾@.@`..H.Ÿ￾

and this is what I read after programming

007e0000h: BF AB 00 30 FF FF 20 30 00 00 00 00 FF FF F7 E0 ; ¿«.0ÿÿ ....ÿÿ÷à
007e0010h: FF FE 00 00 00 00 0F 80 FF FF 60 00 00 00 41 3C ;ÿþ.....€ÿÿ`...A<
007e0020h: FF FF 6F 80 00 00 00 00 00 00 00 00 00 00 00 00 ; ÿÿo€............
007e0030h: 60 00 00 00 60 00 00 00 60 00 00 00 60 00 00 00 ; `...`...`...`...
007e0040h: 60 00 00 00 60 00 00 00 60 00 00 00 60 00 00 00 ; `...`...`...`...
007e0050h: 60 00 00 00 60 00 00 00 60 00 00 00 60 00 00 00 ; `...`...`...`...
007e0060h: 60 00 00 00 60 00 00 00 60 00 00 00 60 00 00 00 ; `...`...`...`...
007e0070h: 60 00 00 00 60 00 00 00 60 00 00 00 60 00 00 00 ; `...`...`...`...
007e0080h: 60 00 00 00 60 00 00 00 60 00 00 00 60 00 00 00 ; `...`...`...`...
007e0090h: 60 00 00 00 60 00 00 00 60 00 00 00 60 00 00 00 ; `...`...`...`...
007e00a0h: 60 00 00 00 60 00 00 00 60 00 00 00 60 00 00 00 ; `...`...`...`...
007e00b0h: 60 00 00 00 60 00 00 00 60 00 00 00 60 00 00 00 ; `...`...`...`...
007e00c0h: 60 00 00 00 60 00 00 00 60 00 00 00 60 00 00 00 ; `...`...`...`...
007e00d0h: 60 00 00 00 60 00 00 00 60 00 00 00 60 00 00 00 ; `...`...`...`...
007e00e0h: 60 00 00 00 60 00 00 00 60 00 00 00 60 00 00 00 ; `...`...`...`...
007e00f0h: 60 00 00 00 60 00 00 00 60 00 00 00 60 00 00 00 ; `...`...`...`...
007e0100h: 90 20 00 3C 90 40 00 40 FF FF 01 00 48 00 FF FF ;￾ .<￾@.@ÿÿ..H.ÿÿ

So it looks like there are some addresses which are not being programmed.
And this is using the low speed since with the high speed I get more errors.

Hope this helps to fix this issue.

[moonwalker]

Some more data. This time I filled the flash with AA 55 AA 55......

007e0000h: AA 55 AA 55 FF FF AA 55 FF FF AA 55 FF FF AA 55; ªUªUÿÿªUÿÿªUÿÿªU
007e0010h: FF FF AA 55 FF FF AA 55 FF FF AA 55 FF FF AA 55 ; ÿÿªUÿÿªUÿÿªUÿÿªU
007e0020h: AA 55 AA 55 FF FF AA 55 FF FF AA 55 FF FF AA 55 ; ªUªUÿÿªUÿÿªUÿÿªU
007e0030h: FF FF AA 55 FF FF AA 55 FF FF AA 55 FF FF AA 55 ; ÿÿªUÿÿªUÿÿªUÿÿªU
007e0040h: FF FF AA 55 FF FF AA 55 FF FF AA 55 FF FF AA 55 ; ÿÿªUÿÿªUÿÿªUÿÿªU
007e0050h: FF FF AA 55 FF FF AA 55 FF FF AA 55 FF FF AA 55 ; ÿÿªUÿÿªUÿÿªUÿÿªU
007e0060h: FF FF AA 55 FF FF AA 55 FF FF AA 55 AA 55 AA 55 ; ÿÿªUÿÿªUÿÿªUªUªU
007e0070h: FF FF AA 55 FF FF AA 55 FF FF AA 55 FF FF AA 55 ; ÿÿªUÿÿªUÿÿªUÿÿªU
007e0080h: AA 55 AA 55 FF FF AA 55 FF FF AA 55 FF FF AA 55 ; ªUªUÿÿªUÿÿªUÿÿªU
007e0090h: FF FF AA 55 FF FF AA 55 FF FF AA 55 FF FF AA 55 ; ÿÿªUÿÿªUÿÿªUÿÿªU
007e00a0h: AA 55 AA 55 FF FF AA 55 FF FF AA 55 AA 55 AA 55 ; ªUªUÿÿªUÿÿªUªUªU
007e00b0h: AA 55 AA 55 FF FF AA 55 FF FF AA 55 FF FF AA 55 ; ªUªUÿÿªUÿÿªUÿÿªU
007e00c0h: FF FF AA 55 FF FF AA 55 AA 55 AA 55 FF FF AA 55 ; ÿÿªUÿÿªUªUªUÿÿªU
007e00d0h: FF FF AA 55 FF FF AA 55 FF FF AA 55 FF FF AA 55 ; ÿÿªUÿÿªUÿÿªUÿÿªU
007e00e0h: AA 55 AA 55 FF FF AA 55 FF FF AA 55 FF FF AA 55 ; ªUªUÿÿªUÿÿªUÿÿªU
007e00f0h: FF FF AA 55 FF FF AA 55 FF FF AA 55 FF FF AA 55 ; ÿÿªUÿÿªUÿÿªUÿÿªU
007e0100h: FF FF AA 55 FF FF AA 55 FF FF AA 55 FF FF AA 55 ; ÿÿªUÿÿªUÿÿªUÿÿªU