How To Jtag Motorola SB6121 Modem With USBJTAGNT

SB6XXX,SBV6XXX

Moderators: justsomeguy, Koevoet

Post Reply
geant90
Junior Member
Posts: 27
Joined: Tue Dec 14, 2010 4:38 pm

How To Jtag Motorola SB6121 Modem With USBJTAGNT

Post by geant90 »

How To Jtag Motorola SB6121 Modem With USBJTAGNT

Image
Image

The SB6121 uses a 16-pin SPI chip and the method is done the exact same way as the SB6120. There is plenty of information how to solder a SB6120 online. There is one “trick” I discovered which lead me to about 5 hours total (going mad) to dump the SPI when it should have only taken 30 minutes. To help others avoid this (as I’ve found in this forum and others) since there are people running into the same issue without an answer, I am writing this tutorial. This is mostly to help all the lazy individuals who cannot search hard enough. I also thought I'd share my method of soldering as I believe that if it is truly your testing modem it should be easily flashable. The test clip is cool but it requires you to disassemble the modem (every time) and is way too expensive now. I use a 8-9" 14 pin cable which can be bought at usbjtag website for an expensive $2.00. I like buying a IDC (2 x 7) 14pin ribbon cable (anywhere around 18”) on ebay or elsewhere for a whole lot cheaper in bundles of 10 or so. Once soldered you will never have to open up the modem again and can just flash with the external IDC connector. I am going to break this down to baby steps as this modem is cute and I believe all the new “testers” will buy this since it can commonly be found for $50.

**Before you continue you should test the modem and make sure everything is working as it should as you do have to cut the serial/mac sticker to disassemble**

Image

Requirements

-Motorola SB6121 Modem
-Soldering Iron & Solder + soldering paste/flux
-T10 screwdriver + small flat head screwdriver (1.5)
-Wrench / Needle nose
-USB cable for external 5V
-USB JtagNT
-Electric tape
-Scissors and / or wire stripper
-Knife

Image

Disassembly

1) Remove T10 screw above the ethernet & hexagon nut on the coaxial F-type connector
2) Cut the sticker
3) Depress 4 clips on the 2 top and 2 bottom of the modem ( use a small flat)
4) Remove PCB and flip over as the SPI chip is located in the back.

Image

Prepare The Ribbon cable

1) cut the cable 8-9" long
2) strip and separate wires (you can cut the unused short to eliminate shorts & clutter)
**Use the RED cable for reference as it is easily identified as pin/wire number 1**
3) Wires 2 and 13 conductors should be twisted and tinned
4) use electric tape to wrap around the ribbon cable 2 inches from the IDC connector. (Used to protect cable and prevent stress on the solder joints)
5) Cut and seperate wires 14 & 13 near the IDC and
a)solder to your connector (here I used an old CD drive audio cable)
b)twist conductors to prevent fraying


Soldering

1) Tin the wire conductors using soldering paste then dip in paste and solder to corresponding pin. ( easiest way to a wire to the SPI joint is to come from on top and point downward so the wire and the pin are vertical.
2) Inspect all soldered joints
3) Place a piece of electric tape over the SPI chip.

5-Volt USB cable

1) Strip outer jacket to expose 4 wires and strip some of the commonly red and black coated wires (+ and GND)
2) twist or connect the + and - external power to modem.
** For the 5V source try to use either a PC jack or under 1 amp charger because of the low amps and not your 2 amp phone charger as I do not know how sensitive the chip is**

Confirm Soldering / SPI Access

1) Plug in USB 5V cable
2) connect DC jack on modem and let the modem boot (done waiting when the blue light is flashing "Receiving")
**Note: Sometimes the modem will boot with 2/3 dim LED's instead. Just wait 1 minute after providing power then proceed to #3**
3) while waiting go ahead and connect your USBJtagNT usb cable on both ends and start the software
4) set Category as Modem, Protocol to SPIFLASH and Target to SB6120
5) Connect USBJtagNT to ribbon cable (pay attention to pin 1 on the RED side)
6) set range to AllFlash and press ID to identify the chip
7) It should fail with FF,FF,FF
8) Unplug DC jack from modem (took me some time to find out)
9) ID the chip it should now be successful
**You can now reassemble the modem since the soldering was good**

Reassembly

Image

1) Feed the 14 pin cable through the back plate's Ethernet port cutout.
2) Replace and hand tighten the F-type hexagon nut keeping the electric tape on the ribbon cable centered in between the shield and ethernet jack.
3) Reverse the disassembly process

Complete

Image

Congrats you should now be good to go and never have to open up that modem again (unless you want serial). It was a pain figuring out that the modem needed power than it had to be removed in order for USBJtagNT to communicate with it.

****
Notes:
- You cannot use pin1 of USBJtag on pin 2 of SPI flash for Voltage, just not enough power.
- I know about the 5V on the NT, but I'd rather keep the insulator around the board, I'm sure many other new testers would.
- I will post the ISP point once I try it myself but soldering on the large SPI flash is easy and can save new solderers trouble.
- With this method I'm 110% sure this way would always work and would not have varying results.
CAPONE
Junior Member
Posts: 5011
Joined: Sat Dec 27, 2008 3:25 pm

Post by CAPONE »

GREAT First Post Buddy. Right on the Money. Just so you know You could tap 3.3 and 5 Volts of the USBJTAG NT itself and avoid the second pair of wires soldered to pin 13 and 14 and you would have everything you need from there. I have 5 volts to pin 13 and 3.3 to pin 14 So when I solder my wires I can pick either voltage with out needing an external power source.

And also someone posted the ISP pin for that model so external power is not needed if you Use the ISP point to put the modem in sleep mode as I call it.

Once again, GREAT POST Buddy. FINALLY another Real TESTER shows Up in this GREAT SITE. ;)
"If you give a man a fish you feed him for a day. If you teach a man to fish you feed him for a lifetime."
geant90
Junior Member
Posts: 27
Joined: Tue Dec 14, 2010 4:38 pm

Post by geant90 »

Thanks

I know about the 5V on the NT, but I'd rather keep the insulator around the board as I am sure many other new testers would as well.

Every one has a USB cable to spare (or I think so) and another USB jack on their PC or charger.

I did try / volt meter several of the ISP points listed and eventually got tired. I believed another USB cable (since I already cut and stripped one) is the easiest since you just solder on the SPI chip and nowhere else. It was written for the lazy XP. I was also 110% sure this way would always work and would not have varying results.

Also I did not try but would pin 1 (3.3v) have worked for powering the SPI?
It does output 3.3v and would be easier to solder just soldering on the SPI flash and no need for usb cable
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

Very good post and I made the thread stick.
digitalx
Junior Member
Posts: 31
Joined: Sun Oct 14, 2012 8:42 pm

Post by digitalx »

where the isp point on that model and do I just tap first wire on the jtag like the 6120 to do it ????
geant90
Junior Member
Posts: 27
Joined: Tue Dec 14, 2010 4:38 pm

Post by geant90 »

I doubt it would be any different. Once I try it myself or someone trust worthy tells me where the ISP point is I will list in the 1st post. I gave a shot on a few of the claimed ISP points with no luck.
CAPONE
Junior Member
Posts: 5011
Joined: Sat Dec 27, 2008 3:25 pm

Post by CAPONE »

geant90 wrote:Thanks

I know about the 5V on the NT, but I'd rather keep the insulator on the board as I am sure many other new testers would as well.

Every one has a USB cable to spare (or I think so) and another USB jack on their PC or charger.

I did try / volt meter several of the ISP points listed and eventually got tired. I believed another USB cable (since I already cut and stripped one) is the easiest since you just solder on the SPI chip and nowhere else. It was written for the lazy XP. I was also 110% sure this way would always work and would not have varying results.

Also I did not try but would pin 1 (3.3v) have worked for powering the SPI?
It does output 3.3v and would be easier to solder just soldering on the SPI flash and no need for usb cable
You would believe so But, NO the 3.3 v of wire one won't do the trick. But like you said, WHO does not have an extra USB wire or two laying around.
I like to save them for cases like this where they come in handy.
I agree with you on keeping the heat shrink intact and not void warranty on the tool, But I just like pushing the limits. LOL and aside from that being the way I rigged it up, I can solder the wires straight t from the 14 Pin connector wire and by simply plugging in my USBJTAG NT I will be ready to read and write to the flash. One less wire hanging out of the modem.
Congrats on your Sticky Post. ;)
"If you give a man a fish you feed him for a day. If you teach a man to fish you feed him for a lifetime."
geant90
Junior Member
Posts: 27
Joined: Tue Dec 14, 2010 4:38 pm

Post by geant90 »

Yeah I just tried wire 1 myself. I guess it is just not enough power as it did detect something shortly after unplugging the modem but not successfully. Afterwards it could not detect at all.
CAPONE
Junior Member
Posts: 5011
Joined: Sat Dec 27, 2008 3:25 pm

Post by CAPONE »

geant90 wrote:I doubt it would be any different. Once I try it myself or someone trust worthy tells me where the ISP point is I will list in the 1st post. I gave a shot on a few of the claimed ISP points with no luck.
The thing to keep in mind is that Not knowing the ISP Point WILL NOT keep you from Reading and Writing the Flash. And no matter How Hard I try to drive that into peoples BRAINS, they don't seam to get it. :rolleyes:

As far as finding out the ISP point, its a matter of patience and Risk. I have been able to find the ISP pint on 3 different Models Modems that are Not listed on software or Tested by USBBDM, As he says. But I am willing to risk losing a USBJTAG or Modem to Find it, Not everyone is willing to take that kind of Risk.
"If you give a man a fish you feed him for a day. If you teach a man to fish you feed him for a lifetime."
CAPONE
Junior Member
Posts: 5011
Joined: Sat Dec 27, 2008 3:25 pm

Post by CAPONE »

geant90 wrote:Yeah I just tried wire 1 myself. I guess it is just not enough power as it did detect something shortly after unplugging the modem but not successfully. Afterwards it could not detect at all.
Yep, Been there done that. And my guess is same as yours, Not enough Power to do the job....
"If you give a man a fish you feed him for a day. If you teach a man to fish you feed him for a lifetime."
Pir8pete
Junior Member
Posts: 105
Joined: Thu Nov 02, 2006 5:56 pm
Location: C A N A D A

Post by Pir8pete »

good job bro, but there's an easier way -> http://usbjtag.com/phpbb3/viewtopic.php?t=8351
geant90
Junior Member
Posts: 27
Joined: Tue Dec 14, 2010 4:38 pm

Post by geant90 »

Yes it will work. You know I primarily wrote this tutorial for you. lol Between your terrible English and the fact that you never gave up I had to do it. IDK if it is a new security feature on the board because I wanted to de-solder the entire SPI itself just to test if it would flash. While I did not bother reverse engineering it seems like there is possibly a circuit / lack of circuit that prevents from interacting with the SPI flash at all. I tried every method possible, just 5v + Jtag,power then Jtag etc. You do not need to boot with the 5V connected but I wanted an order every one can follow. The modem must power on and boot, and the 5V must remain on the SPI as i guess it is now "unlocked" then it will detect, read,write and even do a back flip. I guess this because the SB6121 was just a updated physical security version of the SB6120. They also included all solid capacitors (more or less same tuner).

I even went crazy and thought it was my soldering, however; I know even with a 15 dollar iron I could get the job done. I doubted my soldering and re-soldered a few points and then realized it could not be that afterwards.
Killswitch
Junior Member
Posts: 439
Joined: Tue Mar 23, 2010 6:12 am

Post by Killswitch »

Bravo! This Man's a Solid! Even gave ya a look at his Bench. All the Tools in their proper place. A breath of fresh air to see a Tester be on time and punctual. God, I was getting slightly depressed before this went down. Without a doubt, an excellent teacher. The Man laid down a substantial track of wisdom. For a letter grade, I give him an A . Nothing more to say.
digitalx
Junior Member
Posts: 31
Joined: Sun Oct 14, 2012 8:42 pm

Post by digitalx »

so my question is it the same pinout as 6120 ?????
geant90
Junior Member
Posts: 27
Joined: Tue Dec 14, 2010 4:38 pm

Post by geant90 »

Yes given that you provide the external power of 5V.
Post Reply

Who is online

Users browsing this forum: No registered users and 9 guests