Hi to all the forumers.
I'm a new italian user and i have any questions. ...sorry for my english.
I have a the decoder iptv/dvbt MOTOROLA VIP1616T distribuited by a local provider, the hardware are similar at the Bluewin....kiss kmm ecc.
This is the specification pdf:
http://www.motorola.com/staticfiles/Video-Solutions/Products/TV%20Video%20Distribution/Set-tops/IP%20Set-tops/VIP1616T/_Documents/Static%20Files/1616T-001%20a_5728.pdf (http://www.motorola.com/staticfiles/Video-Solutions/Products/TV%20Video%20Distribution/Set-tops/IP%20Set-tops/VIP1616T/_Documents/Static%20Files/1616T-001%20a_5728.pdf)
it mounts a SIGMA SMP8634LF processor and now WinCE upgradable only online with the lan by the provider.
it have the uart connector...
now any pics of the motherboard
http://img177.imageshack.us/img177/2311/sdc12257.jpg (http://img177.imageshack.us/img177/2311/sdc12257.jpg)
http://img684.imageshack.us/img684/5049/43724442.jpg (http://img684.imageshack.us/img684/5049/43724442.jpg)
http://img263.imageshack.us/img263/2263/sdc12267t.jpg (http://img263.imageshack.us/img263/2263/sdc12267t.jpg)
http://img177.imageshack.us/img177/2416/sdc12260.jpg (http://img177.imageshack.us/img177/2416/sdc12260.jpg)
At the end... it' hackable?! If yes can post the procedure?
tnx so much at all
Danilo
hackable... yes sure. how much effort it is depends on the connector port next to the sticker with the barcode.
the 14 pin connector is definately the JTAG port and the 2 pins next to it will be the "jtag enable" pins.
however it looks like some needed components are missing on the board, so the port might not work without them.
Ok, thanks.
sorry....but to proceed for hack i have to follow the BT Vision Modification guide for this box? ... is compatible and still valid?
thanks for any replys
Danilo
the process is the same for all SMP 863x based MS-IPTV devices... however there are usually different versions of the bootloader in the flash, so it is required to dump the decrypted bootloader with the dump-tool from the wiki.
if you post the dump, someone could check if it is a known version, and if it isn't then the patch has to be updated.
I confirm that the 14 pin connector it's a JTAG port, but R199 and R230 must be bridged for it to work; JTAG pin 1 (TRST_N) must be connected to 3.3V.
For some reason, the port is incompatible with my xilinx interface, and even using a 74HC244 buffer doesn't help. So i built a "USB->serial->JTAG" interface using an arduino, and I'm currently dumping the bootloader at 0x93600000 (length 0x100000) :) - I'll post the file later.
I've got also a backup of XENV if necessary...
Dumps at http://repofulm.dyndns.org/index.php?dir=jackthevendicator/vip1616t/
Variables defined in xenv.bin:
francesco@Spartan:~/Sviluppo/Sigma/vip1616t$ ../xenv
org. sha1: ee 07 8e 07 eb cb 74 89 5d 55 d5 1a e7 85 45 d4 69 63 19 93
calc sha1: ee 07 8e 07 eb cb 74 89 5d 55 d5 1a e7 85 45 d4 69 63 19 93
idx: offset type key value
-----------------------------------------------------
0: 0x00000006 xos.boot 0x00008000
1: 0x00000011 xos.ds 0x00010040
2: 0x00000020 xos.d0.cfg 0xe34111ba
3: 0x0000002f xos.d1.cfg 0xe34111ba
4: 0x0000003a xos.dt 0x00000001
5: 0x00000046 xos.csf 0x00000002
6: 0x00000054 xos.l2rzc 0x0000000c
7: 0x00000061 xos.l2xz 0x00000015
Is there someone that can calculate the addresses for the patch? :)
I think MOTOROLA is good company..