Hello.
For the past few months ive been trying to flash my Cisco IPP330HD STB but with no luck. I've managed to get a working JTAG interface and tried to flash the custom bootloader
(http://www.t-hack.com/wiki/images/b/bc/Beta_rom_img.zip)
with the debrick tool i got from the wiki
(http://www.t-hack.com/wiki/index.php/Debrick_SMP863x_Device)
but with no luck. The flashing process simply hangs at 0xAC00A000.
This is the command i use for flashing:
wrt54g_o -flash:custom /start:0xac000000 /window:0xac000000 /length:0x00200000
The flash chip is a Spanison S29GL016A.
The flashing starts like this:
====================================
WRT54G/GS EJTAG Debrick Utility v4.8
====================================
Probing bus ... Done
Instruction Length set to 5
CPU Chip ID: 00001000011000110000000000000001 (08630001)
*** Found a SigmaDesigns SMP8634 Rev A CPU chip ***
- EJTAG IMPCODE ....... : 01000000010000010100000000000000 (40414000)
- EJTAG Version ....... : 2.6
- EJTAG DMA Support ... : No
Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Skipped
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done
Probing Flash at (Flash Window: 0xac000000) ... Done
Flash Vendor ID: 00000000000000000000000000000001 (00000001)
Flash Device ID: 00000000000000000010001001001001 (00002249)
*** Found a AMD 29lv160DB 1Mx16 BotB (2MB) Flash Chip ***
- Flash Chip Window Start .... : ac000000
- Flash Chip Window Length ... : 00200000
- Selected Area Start ........ : ac000000
- Selected Area Length ....... : 00200000
*** You Selected to Flash the CUSTOM.BIN ***
=========================
Flashing Routine Started
=========================
Total Blocks to Erase: 35
Erasing block: 1 (addr = ac000000)...Done
Erasing block: 2 (addr = ac004000)...Done
Erasing block: 3 (addr = ac006000)...Done
Erasing block: 4 (addr = ac008000)...Done
Erasing block: 5 (addr = ac010000)...Done
Erasing block: 6 (addr = ac020000)...Done
Erasing block: 7 (addr = ac030000)...Done
Erasing block: 8 (addr = ac040000)...Done
Erasing block: 9 (addr = ac050000)...Done
Erasing block: 10 (addr = ac060000)...Done
Erasing block: 11 (addr = ac070000)...Done
Erasing block: 12 (addr = ac080000)...Done
Erasing block: 13 (addr = ac090000)...Done
Erasing block: 14 (addr = ac0a0000)...Done
Erasing block: 15 (addr = ac0b0000)...Done
Erasing block: 16 (addr = ac0c0000)...Done
Erasing block: 17 (addr = ac0d0000)...Done
Erasing block: 18 (addr = ac0e0000)...Done
Erasing block: 19 (addr = ac0f0000)...Done
Erasing block: 20 (addr = ac100000)...Done
Erasing block: 21 (addr = ac110000)...Done
Erasing block: 22 (addr = ac120000)...Done
Erasing block: 23 (addr = ac130000)...Done
Erasing block: 24 (addr = ac140000)...Done
Erasing block: 25 (addr = ac150000)...Done
Erasing block: 26 (addr = ac160000)...Done
Erasing block: 27 (addr = ac170000)...Done
Erasing block: 28 (addr = ac180000)...Done
Erasing block: 29 (addr = ac190000)...Done
Erasing block: 30 (addr = ac1a0000)...Done
Erasing block: 31 (addr = ac1b0000)...Done
Erasing block: 32 (addr = ac1c0000)...Done
Erasing block: 33 (addr = ac1d0000)...Done
Erasing block: 34 (addr = ac1e0000)...Done
Erasing block: 35 (addr = ac1f0000)...Done
Can anyone help?
Two things to consider.
1. Does the IPP330HD use sigma's SDK vendor keys?
Where on the forum or wiki is this beta_rom_img.zip discussed?
2. Detected flash is here http://pdf1.alldatasheet.com/datasheet-pdf/view/55494/AMD/AM29LV160DB-90EC.html
and actual flash is http://pdf1.alldatasheet.com/datasheet-pdf/view/217860/SPANSION/S29GL016A.html
It seems it is wrongly detecting the flash..perhaps that could be issue.
AMD and Spansion have the same vendor ID, but different flash chips should NOT have the same device ID.
Hello.
The CPU is Sigma SMP8634LF 0751 rev B
Here is the link to the image on the wiki:
http://www.t-hack.com/wiki/index.php/X300tBeta
Some guys on the Croatian bug.hr forums have been able to flash it successfully, but they have an older revision of the STB than me.
perhaps the flash is not as large as you defined in the Length parameter ?