Philips DIT9719
Hi/Tag.
In the UK we have a similar box to the x300t, but made by phillips - it is MIPS based but the pinouts for JTAG
connection are not as apparent, I will take photos this evening and post them, however just as a thought, on
the hdd there is an xml file which allows you to connect to the content server via VODStore and download a
developer ROM, I have tried several things to get this file to run, but have gotten nowhere so far, As the Microsoft
IPTV platform is the same across all of the range, it maybe the same on your side of things too. I Will search it out
this evening and upload it for you.
Thanks/Danke.
BTVHack
Hey,
nice to see you here! The first non german speaking guy here :)
Yeah, interessting thing! We wait for your info and pictures. Maybe you can put you infomation directly into the wiki (http://www.t-hack.com/wiki).
That would be great!
Greets
Asgard
Welcome BTVHack.
I have already found the BT-Vision update server at
http://ref-bootstrap.nevis.btopenworld.com/upgrade/upgrade-files/005/PKG.DIR
and two debug ones at
http://bootstrap.nevis.btopenworld.com/upgrade/upgrade-files/005/PKG.DIR
http://sg01clgv.nevis.btopenworld.com/upgrade/upgrade-files/005/PKG.DIR
the debug ones seem to be carry an older version, but they contain some interesting debug and test files.
The main one I was taking about is the buildselector.xml file, I'm not sure if it's on the t-mobile hdd, it is as follows.
-------------------------------------------------------------------------------------
Buildselector.xml
-------------------------------------------------------------------------------------
<?xml version="1.0" encoding="utf-8" ?>
<uidescription>
<BuildSelectorPage class="Page.Animated" initialFocus="_upgradeButton">
<Panel id="_waitPanel" visible="false" left="35" top="70" >
<Text class="Text.VodStorePleaseWait" id="_waitMessage"></Text>
<ProgressBar id="_waitProgress" top="200" left="35" width="500" height="20" borderwidth="2" background="@Darkbackground" foreground="@Secondary" />
</Panel>
<Panel id="_uiPanel">
<Panel class="Panel.MenuBackground" clipchildren="true" top="20" width="640">
<Menu class="Menu.Start" left="33" id="_branchMenu" />
</Panel>
<VerticalFlowPanel left="35" top="70" width="570">
<HorizontalFlowPanel>
<VerticalFlowPanel>
<HorizontalFlowPanel>
<Text width="100">Client HW:</Text>
<Text width="170" id="_clientHW"/>
</HorizontalFlowPanel>
<Panel height="8" />
<VerticalFlowPanel>
<Text width="120">Target:</Text>
<Text width="270" id="_validTargetName"/>
</VerticalFlowPanel>
</VerticalFlowPanel>
<Panel width="80" />
<VerticalFlowPanel>
<Button class="Button.Vertical" onClick="OnClick_Upgrade" id="_upgradeButton">Upgrade</Button>
<Button class="Button.Vertical" href="page:ServiceSelector.xml">Service Selector</Button>
<Panel height="8" />
<RadioButtonGroup id="_flavorGruop">
<RadioButton class="RadioButton" onclick="OnClick_FlavorRadioButton">nondebug</RadioButton>
<RadioButton class="RadioButton" onclick="OnClick_FlavorRadioButton">debug</RadioButton>
<RadioButton class="RadioButton" onclick="OnClick_FlavorRadioButton">release</RadioButton>
</RadioButtonGroup>
</VerticalFlowPanel>
</HorizontalFlowPanel>
<Panel height="8" />
<HorizontalFlowPanel >
<Panel width="210"/>
<VerticalFlowPanel id="_listWaitPanel">
<Panel height="70" />
<Text class="Text.VodStorePleaseWait">Populating build cache...</Text>
</VerticalFlowPanel>
<VerticalFlowPanel visible="false" id="_listUiPanel">
<Text class="Text" width="200" height="20">Select a build number:</Text>
<Panel height="4" />
<List class="List" numvisibleitems="5" id="_list" />
</VerticalFlowPanel>
</HorizontalFlowPanel>
</VerticalFlowPanel>
</Panel>
</BuildSelectorPage>
</uidescription>
--------------------------------------------------------------------
Serviceselector.xml
--------------------------------------------------------------------
<?xml version="1.0" encoding="utf-8"?>
<uidescription>
<ServiceSelector class="Page" initialFocus="_selectButton" limoline="350" >
<Panel class="Panel.Masthead" height="70"/>
<Panel class="Panel.VideoOverlay"/>
<Panel class="Panel.MenuBackground" clipchildren="true" top="25" width="640">
<Menu class="Menu.Start" left="33" id="_serviceListMenu" />
</Panel>
<!-- panel with settings on the right and service description on the left -->
<HorizontalFlowPanel top="80" left="50" width="550">
<!-- left side panel with description of service -->
<VerticalFlowPanel width="370">
<Text id="_bootstrap" class="Text.ServiceSelect" width="370"/>
<!-- spacer -->
<Panel height="10" />
<!-- miscellaneous info -->
<HorizontalFlowPanel>
<Text class="Text.ServiceSelect" width="140">Status:</Text>
<Text id="_status" class="Text.ServiceSelect" width="230"/>
</HorizontalFlowPanel>
<HorizontalFlowPanel>
<Text class="Text.ServiceSelect" width="140">Backend SMS:</Text>
<Text id="_backendsms" class="Text.ServiceSelect" width="230"/>
</HorizontalFlowPanel>
<HorizontalFlowPanel>
<Text class="Text.ServiceSelect" width="140">Build:</Text>
<Text id="_build" class="Text.ServiceSelect" width="230"/>
</HorizontalFlowPanel>
<HorizontalFlowPanel>
<Text class="Text.ServiceSelect" width="140">Compatible Clients:</Text>
<Text id="_compatibleClients" class="Text.ServiceSelect" width="230"/>
</HorizontalFlowPanel>
<!-- spacer -->
<Panel height="10" />
<TextBox class="TextBox.ProgramInfo" id="_notes" width="320" height="230" maxlines="50" allText="" fontStyle="Reg16"/>
<!-- spacer -->
<Panel height="3" />
<Text class="EditText" padding="rect(5,0,5,0)" layout="center" height="20" width="530" id="_clientId" justification="center"/>
<!--<Text id="_notes" class="Text.ServiceSelect" width="310" height="200" /> -->
</VerticalFlowPanel>
<!-- right side panel with buttons and settings -->
<VerticalFlowPanel id="_topPanel" width="180">
<!-- first panel has select/skip on left and client's info on the right -->
<VerticalFlowPanel>
<Button class="Button.Menu" width="180" id="_selectButton" onClick="OnClick_Select" href="page:Welcome.xml">Connect</Button>
<Button class="Button.Menu" width="180" id="_skipButton" onClick="OnClick_Skip" href="page:Welcome.xml">Skip</Button>
<Button class="Button.Menu" width="180" id="_buildButton" href="page:BuildSelector.xml">Choose Build</Button>
<Button class="Button.Menu" width="180" id="_quitButton" onClick="OnClick_Quit" visible="false">Quit Client</Button>
</VerticalFlowPanel>
<!-- spacer -->
<Panel height="8" />
<!-- radios to pick server off the network or from local file -->
<RadioButtonGroup id="_configSource" width="6">
<RadioButton class="RadioButton" width="180" id="_radioButtonWSConfig" onclick="OnClick_UpdateFromWS">Web Service</RadioButton>
<RadioButton class="RadioButton" width="180" id="_radioButtonLocalConfig" onclick="OnClick_UpdateFromLocal">tv2config.xml</RadioButton>
</RadioButtonGroup>
<Panel height="8" />
<!-- checkboxes for settings -->
<VerticalFlowPanel>
<Checkbox class="Checkbox" width="180" id="_autoProvisionCheckbox" selected="false">Auto Provision</Checkbox>
<Checkbox class="Checkbox" width="180" id="_forceUpgradeCheckbox">Force Upgrade</Checkbox>
</VerticalFlowPanel>
<Panel height="8" />
<!-- client information -->
<Text class="Text.ServiceSelect" width="180" height="100" id="_extraInfo" />
</VerticalFlowPanel>
<!-- end of right side panel -->
</HorizontalFlowPanel>
</ServiceSelector>
</uidescription>
My Apologies,
I just d/l'ed the content of the HDD for the x301t box and I see those files are included, I will try the BooterCE patch this evening and see if i can run it from my box. My main reason for looking at this box is that media sharing is disabled by default, and I am looking to turn it on.
Regards
BTVHack
It is unlikely that the BooterCE patch will work without patching the Bootloader first. I expect that the Bootloader should be very similar to that of the x300t so it will check the signature of the NK.BIN.
So without JTAG I don't see a way of doing that.
But there should be another way in your case :)
The debug build of the BT-Vision Client has a content.sig file that doesnt have any effect since it has "BOOTABLE" flags for all files and those files are skipped during file validation phase.
That means you can modify any file without problems.
The only question is: does the debug build work on your client or does it need special developer boxes.
By the way... I checked out the media sharing. It is working on my box, but since you cannot share video files, it is not that useful :(
the client needs to be modified to also accept video files.... that should be doable.
Welcome BTVHack.
I have already found the BT-Vision update server at
http://ref-bootstrap.nevis.btopenworld.com/upgrade/upgrade-files/005/PKG.DIR
and two debug ones at
http://bootstrap.nevis.btopenworld.com/upgrade/upgrade-files/005/PKG.DIR
http://sg01clgv.nevis.btopenworld.com/upgrade/upgrade-files/005/PKG.DIR
the debug ones seem to be carry an older version, but they contain some interesting debug and test files.
Debug ones seem to be unavailable now. Main one working OK.
yeah, it is gone now... but you are in luck, because I have a backup of the files ;)
the most important one is attached. the signed content.sig file ... you should check if that works in combination with a current application version.
if the signature is accepted, then you can modify any file that is mentioned in the content.sig
for example the tv2config.xml
yeah, it is gone now... but you are in luck, because I have a backup of the files ;)
the most important one is attached. the signed content.sig file ... you should check if that works in combination with a current application version.
if the signature is accepted, then you can modify any file that is mentioned in the content.sig
for example the tv2config.xml
So if I can male the box think my local web server is the one it is contacting, then I may be able to get it to update with these, or do I replace them directly on the hard disk from another machine?
Cheers
Mike
you have to replace the file directly on the harddrive... at least that is easier to do ;)
you have to replace the file directly on the harddrive... at least that is easier to do ;)
I hope so. If I unlock the drive properly then it will probably be automatically reformatted & locked when I put it back in. Maybe a hotswap is the way. I assume the idea of using the IDE password protection is to make it hard to get the data off the disk. Of course it's possible that the disk is just faulty, but I would expect some error indication (either from the original box or Linux in a USB caddy) in that case.
Cheers
Mike
[ Of course it's possible that the disk is just faulty, but I would expect some error indication (either from the original box or Linux in a USB caddy) in that case.
Strange, but it seems that disk is fine & not locked but the disk was not properly recognised by my usb caddy or motherboard onboard IDE! A different USB caddy is fine. Now I can play with different files and see if the box will accept some changes.
Cheers
Mike
I finally got my "spare" btv box yesterday and connected the HDD upto my laptop with a IDE/USB cable. At first is was recognised, but the system couldn't use it. I removed the cable select jumper and it was recognised and popped up as USB mass storage. Fully accessible.
I finally got my "spare" btv box yesterday and connected the HDD upto my laptop with a IDE/USB cable. At first is was recognised, but the system couldn't use it. I removed the cable select jumper and it was recognised and popped up as USB mass storage. Fully accessible.
Is it normal for the HD to be wiped as part of the DRA? I'm glad this is my spare box :-)
Is it normal for the HD to be wiped as part of the DRA? I'm glad this is my spare box :-)
I think the main data part is untouched. The disk has three partitions, 125 MB,, 148 GB and 2.47 MB (yes that's right!). The 125MB FAT partition contains the TV2CLIENTCE directory and NK.BIN etc. The 148GB FAT32 partition has TV2ClientCrashLogs directory - I assume the video would be here if it had been used. The 2.47 MB FAT partition is empty.
Maybe I'll copy some files on to see what happens.
Cheers
Mike
Mine appears to be a single unpartitioned 149.5Gb at the moment, after a few runs of DRA routine last night. Only just got around to hooking a monitor up and see that after the dra file is sent, the screen displays "An error has occured" "BE01", can't find it in the strings, might be able to find what it means in the unpacked dra file though... I suspect it is a disk problem, so I may try to manually partition and copy back the origininal files...
Couldn't get DRA to complete, constantly get BE01 so manually created 125Mb FAT partition and copied the original contents, incl BOOT.PRF so it was able to do a Normal start, which only gets as far as posting bootstrap.asmx (auth ticket request)
Couldn't get DRA to complete, constantly get BE01 so manually created 125Mb FAT partition and copied the original contents, incl BOOT.PRF so it was able to do a Normal start, which only gets as far as posting bootstrap.asmx (auth ticket request)
I can't get mine to go past dra, although the files are on the disk, so maybe there's something not quite right with how we think this works. I'll have another look at the process. In fact the files on the disk are probably out of date. Still need to investigate further.
Cheers
Mike
But there should be another way in your case :)
The debug build of the BT-Vision Client has a content.sig file that doesnt have any effect since it has "BOOTABLE" flags for all files and those files are skipped during file validation phase.
That means you can modify any file without problems.
The only question is: does the debug build work on your client or does it need special developer boxes.
I can't get the debug version to work...
I've tried both full debug version which went straight to DRA mode, even with a boot.prf (does the boot.prf contain something specific to the build?), and the box's original image with content.ctc, content.sig and content folder from the debug image. This combo version looks good initially, (ie doesn't got straight to dra mode), shows "BTVision Starting" on the screen, then restarts (screen goes blank). This happens 4 or 5 times until eventually it goes to dra mode... During these initial startup attempts there is not apparent net activity apart from the dhcp each time the startup loops around.
Obviously, the box has no serial port so I have no console, or way of establishing how far it gets...
Does the pattern of events look familiar to any X300t owners? Are all the sigs, etc checked first, or is it when the files are used are accessed? Is there a way to enable logging to a file on the 3rd partition like the crash log?
I think jtag is going to be the only way in... unfortunatley I have no idea what to look for... anybody else found any hopes?
Cheers
Red...
From the wiki it looks as though jtag is needed. There seem to be candidate solder points - I plan to hook up some wires to check. Then I'll have to look at making a jtag cable, the instructions seem to be around, but the wiggler seems to be the better option if I can find a suitable chip.
Cheers
Mike
make sure to use an extremely low voltage soldering iron, I made the mistake of GOING FOR IT with a few glasses of
vino on board and made a balls of it....
Made a start (notes in wiki) - tried to solder up the jumper pins where they seemed to fit (1302, 1304) - seems to have not broken anything, so I'll go for the harded blobs later.
I have an old serial and an old parallel header cable handy, so I may use these for connecting (I've also got the gender benders) as these should be reliable. The serial connection would be straighforward, so I'll probably solder direct, but the parallel (jtag) would be likely to be trickier so I will probably pull the connectors of an old IDE board and solder (short) wires from the board to these, so I can swap them round if I need to. The old parallel header will fit well on these.
Cheers
Mike
Made a start (notes in wiki) - tried to solder up the jumper pins where they seemed to fit (1302, 1304) - seems to have not broken anything, so I'll go for the harded blobs later.
I have an old serial and an old parallel header cable handy, so I may use these for connecting (I've also got the gender benders) as these should be reliable. The serial connection would be straighforward, so I'll probably solder direct, but the parallel (jtag) would be likely to be trickier so I will probably pull the connectors of an old IDE board and solder (short) wires from the board to these, so I can swap them round if I need to. The old parallel header will fit well on these.
Cheers
Mike
I'm interested to know how you get on. I've done a bit of soldering in my time but never on such a small scale.
Talking of scale, could you upload a bigger version of your circuit board image? I'ts quite difficult to make out what's what.
Cheers
Red
I'd pinched another image (not mine) - I'll take a picture or two and upload these in the next couple of days.
I'm not used to very small scale soldering, apart from reattaching an LED display to an old calculator, and adding USB cable to an xbox memory card (xbox now runs Linus). I have a variable voltage iron that helps. I have soldered a number of small cables to circuit boards in the past - simple single core (stiff) wires are easiest, and if well tinned seem to attach ok first or second go. I had a lot of trouble getting the jumper pins to attach, the solder blocking the holes seems to need a high tempature, and with a small component (maybe a resistor) near by I didn't want to overheat. As the box was free to me, I'm probably less cautious than I might be, but I decided the fine soldering will have to wait until I have plenty of time. I'll also probably experiement a bit with some single core wires (from a cat 5 cable) and multi strand (from the serial header) before I decide which to use on the board.
Cheers
Mike
before soldering anything that looks like jtag ... I would recommend to measure against the known JTAG traces on the CPU itself, just to confirm that you actually found the
jtag pins (if they even exist on the Philips box)
mce2222 could you post more of the unsigned debug files please?
cheers
what exactly do you need ?
the boot.sig file only works on development boxes, so it wont help you much.
Ahh okay, started to play arround with files on my box to see what they did, thought you might have the magic solution.