ATS-E6501S Unlock

[meister_sd]

I have an ATS-E6501S that was on Sunrocket. I already posted the passwords a long time ago over at DSLReports:

http://www.dslreports.com/forum/remark,18715088

but now I want to JTAG it so it won't phone home and so I can unlock it. I've just ordered the USB JTAG from USBBDM and he said to start this thread.

Here is the device breakdown from my notes:

ATS - E6501S
KH29LV320CBTC-70G
CPU: Infineon - ADM5120P
RAM: W9864G2GH-6

+---------------------

Serial:

115200 8-N-1 None
Programming Points - under base unit on left

1 2
3 4
5 6

1) SDA - Not Used
2) SCL - Not Used
3) (unmarked) - GND
4) PCM_D1 - TX
5) PCM_D0 - RX
6) VDD3v3 - POS

+---------------------

JTAG Notes:

http://www.linux-mips.org/wiki/Adm5120 (This is a 5120P)

JTAG
ADM5120 PQFP JTAG pinout:

134 nTRSTN
135 TDI - J_TDI
136 TDO - J_TDO
137 TMS - J_TMS
139 TCK - J_TCK

Pin out board layout:

1 2 3 4
5 6
7 8

1) VccPLL (?)
2) 1V8
3) 3V3
4) TDO - ORA
5) TCK - WHT
6) TMS - GRN
7) ?
TDI - RED

GND can be used from serial connection.

+-----------------------

This device only uses pads, but they are marked. Not much is found about JTAGing these. Also, there is a resister tying down nTRSTN to ground, but I don't have the equipment to see if this value is being used to tie down the JTAG to activate it or stop it.

I also have a flash ROM dump, if anyone is interested.

I just previewed the post and all the spacing for pinouts is gone. If needed, I can do it as a JPG....

[usbbdm]

It looks like MIPS core to me but I am not sure. Nobody can help you to unlock it. I am interested in help you once you get it. Use teamviewer might be only thing needed if it is a simple one. If not I might need to put my hand on it (either generate a script or write dll for it).

[usbbdm]

meister_sd Just finished 0.1 of CYT.dll. I will work on ATS-E6501S tomorrow. Thanks for your donated device and I hope we can get it working quickly.

[meister_sd]

Well, I should say; "Thank You!" for all your work here!

As time permits, I'll submit more VoIP devices that I have stacked in the closet along with anything I find that has a JTAG port.

[usbbdm]

I have JTAGed this device. Whole 4M flash is read. The firmware is zipped. I am compiling the xml and see if I can get the information you had in that post.
http://www.dslreports.com/forum/r187150 ... ATS-E6501S

[usbbdm]

Phone home address is at 0x9fc10310 and 0x9fc1034b. Should be easily erased.
[update] Erase flash works ok.