MOTOROLA VIP1616T

[venomq3a]

Hi to all the forumers.
I'm a new italian user and i have any questions. ...sorry for my english.
I have a the decoder iptv/dvbt MOTOROLA VIP1616T distribuited by a local provider, the hardware are similar at the Bluewin....kiss kmm ecc.
This is the specification pdf:
http://www.motorola.com/staticfiles/Video-Solutions/Products/TV%20Video%20Distribution/Set-tops/IP%20Set-tops/VIP1616T/_Documents/Static%20Files/1616T-001%20a_5728.pdf
it mounts a SIGMA SMP8634LF processor and now WinCE upgradable only online with the lan by the provider.
it have the uart connector...
now any pics of the motherboard
http://img177.imageshack.us/img177/2311/sdc12257.jpg
http://img684.imageshack.us/img684/5049/43724442.jpg
http://img263.imageshack.us/img263/2263/sdc12267t.jpg
http://img177.imageshack.us/img177/2416/sdc12260.jpg
At the end... it' hackable?! If yes can post the procedure?
tnx so much at all

Danilo

[mce2222]

hackable... yes sure. how much effort it is depends on the connector port next to the sticker with the barcode.

the 14 pin connector is definately the JTAG port and the 2 pins next to it will be the "jtag enable" pins.
however it looks like some needed components are missing on the board, so the port might not work without them.

[venomq3a]

Ok, thanks.
sorry....but to proceed for hack i have to follow the BT Vision Modification guide for this box? ... is compatible and still valid?
thanks for any replys

Danilo

[mce2222]

the process is the same for all SMP 863x based MS-IPTV devices... however there are usually different versions of the bootloader in the flash, so it is required to dump the decrypted bootloader with the dump-tool from the wiki.
if you post the dump, someone could check if it is a known version, and if it isn't then the patch has to be updated.

[JackTheVendicator]

I confirm that the 14 pin connector it's a JTAG port, but R199 and R230 must be bridged for it to work; JTAG pin 1 (TRST_N) must be connected to 3.3V.
For some reason, the port is incompatible with my xilinx interface, and even using a 74HC244 buffer doesn't help. So i built a "USB->serial->JTAG" interface using an arduino, and I'm currently dumping the bootloader at 0x93600000 (length 0x100000) - I'll post the file later.

I've got also a backup of XENV if necessary...

[JackTheVendicator]

Dumps at http://repofulm.dyndns.org/index.php?dir=jackthevendicator/vip1616t/

Variables defined in xenv.bin:

Code: [Select]

francesco@Spartan:~/Sviluppo/Sigma/vip1616t$ ../xenv
org. sha1: ee 07 8e 07 eb cb 74 89 5d 55 d5 1a e7 85 45 d4 69 63 19 93
calc sha1: ee 07 8e 07 eb cb 74 89 5d 55 d5 1a e7 85 45 d4 69 63 19 93

idx: offset      type key                  value
-----------------------------------------------------
  0: 0x00000006   xos.boot                 0x00008000
  1: 0x00000011   xos.ds                   0x00010040
  2: 0x00000020   xos.d0.cfg               0xe34111ba
  3: 0x0000002f   xos.d1.cfg               0xe34111ba
  4: 0x0000003a   xos.dt                   0x00000001
  5: 0x00000046   xos.csf                  0x00000002
  6: 0x00000054   xos.l2rzc                0x0000000c
  7: 0x00000061   xos.l2xz                 0x00000015

Is there someone that can calculate the addresses for the patch?

[blakenick]

I think MOTOROLA is good company..