Swisscom Bluewin-TV KMM3010-SC-B - how to make it alive?

[maros]

Hello!

From about two weeks I'm owner of Swisscom Bluewin-TV KMM3010-SC-B Set-up box, and I want to make something with it.
In this moment, this box is not very useful, because when I switch power on, only what I get on the screen is a grey gear wheel and something like a progress bar at the bottom, and nothing else.
On the front display while switching on, for a less than second blinks "Starting" message and then only unset clock sign: --:--

I've had an original 160GB HDD from it, but I've gave it to somebody. I've copied all files from it (the file is attached to this post). Now I found 20GB HDD. And my question is: should I make any partitions or the box will make it all?

After few minutes nevermind if it's connected to the internet or not, the screen is showing red x sign, and on VFD display is showing "Connect Fail" message with blinking REC sign. After that in serial console I received "HALTING" message.
Full output from console is:

Code: [Select]


xosPc0 serial#97d634be075d6ca73075760a104d533b subid 0xc4
xenv cs2 ok
Power supply: OK
DRAM0 OK (8)
DRAM1 OK (9)
zboot ok
SIGNED BL

Microsoft IPTV Bootloader, Build (1051)
Built by BM-DELL-167, Sep 11 2006 16:54:12


I've build a JTAG, but I'm receiving this:

Code: [Select]

USAGE: x300tdump
            /start:XXXXXXXX .... custom start location (in HEX)
            /length:XXXXXXXX ... custom length (in HEX)
            /wiggler ........... use wiggler cable

            -----------------------------------------------
Probing bus ... Done

Instruction Length set to 5

CPU Chip ID: 00000000000000000000000000000000 (00000000)
*** Unknown or NO CPU Chip ID Detected ***

Issuing Processor / Peripheral Reset ... Done
Halting Processor ... <Processor did NOT enter Debug Mode!> ... Done
Clearing Watchdog ...

The JTAG is checked many times, all seems to be good. I don't know why it's not working.

When it's connected to ethernet card, all what tcpdump sniffed is saved in a file in the attachment.

Is there any posibility to make something useful with the box? It have a potential, but I don't have now any ideas how to run it.

[is0-mick]

Hi,
Doesnt seem to be much on the hard drive from the files you posted...

RE: Jtag it could be anything. It looks like the jtag is not responding at all. Maybe you will have to wire an enable pin to the smp directly?

Mick

[maros]

For the disk content, it's all that I found on it.

I have shorted the JTAG_enable jumper, but with no results, the same communicate.
What decides that I must wire an enable pin direcly to the SMP, it is possible to solder to that small circuit?

Does anybody have an idea to make something with the box?

[is0-mick]

what i did first with the BT box is to verify the JTAG enable pin.
I did this by metering from the fine wire point on the surface of the smp chip, to the pad which I thought would be the JTAG enable on the actual PCB.

I would check the same on your box to make sure the JTAG enable pin is connected first.

http://www.t-hack.com/wiki/index.php/EJTAG_on_SMP
(connections on the SMP chip are here)

You could also do the same with the other pins, incase a resistor or other components have been omitted from your PCB.

One other thing, on a later revision of the BT box, they removed some of the pullup resistors that are wired to the JTAG TDI, TDO pins etc.. I would check around that area too for unpopulated component pads.

Not sure about the lack of files on the hard drive.. It could be that the box has not downloaded its full O/S yet? and is running in disaster recovery mode?

Mick

[maros]

Thanks for interesting in this topic is0-mick!

I've done the same things before you posted, and finally I get JTAG working! In my case the JTAG_enable pins are connected together with a resitor, and on both pins is 3.3V, and there is no connection with the path on SMP chip. So I connected the path with 3.3V source, and it works.
The whole bootloader is readead:

Code: [Select]

CPU Chip ID: 00001000011000110000000000000001 (08630001)
*** Found a SigmaDesigns SMP8634 Rev A CPU chip ***

Issuing Processor / Peripheral Reset ... Done
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done
=========================
Backup Routine Started
=========================

Saving BOOTLOADER_20090410_180901 to Disk...
[ 99% Backed Up]  0x936fff00  (359 bytes/s)
Done  (BOOTLOADER_20090410_180901 saved to Disk OK)

bytes written: 1048576
=========================
Backup Routine Complete
=========================
elapsed time: 2921 seconds


*** REQUESTED OPERATION IS COMPLETE ***

JTAGEMUL: Processor exited debug mode.

I've attached the images extracted from the bootloader, there are included the images with gear wheel and red x sign that I wrote in my first post.

Besides, from some interesting things in the bootloader I found url to the certificate: http://www.scientificatlanta.com/security/pki/crl/msiptve/CA00024_000.crl.htm

It is very plausible that the OS didn't have been fully downloaded yet in the box, I don't know the past of this box.
What are the symptoms of being in disaster recovery mode? If think it is in this mode, because I can run bootloader dumper in every moment after power on.

What are the next steps that I must made to get it working? It is possible in my situation to get it working?

[maros]

Does everybody don't know how to help me? I'm waiting for any clues from couple of days, and there's no answer. I don't have any idea what should I do now.

Is there any chance to do something with this box, or I should put it into trash?

[Hoernchen]

Is it a known bootloader, can the jtag patcher patch it ? If not, someone would have to take a look at your bootloader dump to find the right patch offsets. If you are not interested in playing with the box and developing stuff there is not a lot (read: hardly anything) you can do with it...

[is0-mick]

Does everybody don't know how to help me? I'm waiting for any clues from couple of days, and there's no answer. I don't have any idea what should I do now.

Is there any chance to do something with this box, or I should put it into trash?

Been away for a couple of days.. just got back.
You probably need to see if there is any other files on a working boxes hard drive...(not sure how your particular box works).


Mick

[diogoc]

hi
I have this box too.
Is there any posibility to make something useful with the box already?

thanks