Debrick tool hangs at 0xac00a000

[Budisha]

Hello.
For the past few months ive been trying to flash my Cisco IPP330HD STB but with no luck. I've managed to get a working JTAG interface and tried to flash the custom bootloader
(http://www.t-hack.com/wiki/images/b/bc/Beta_rom_img.zip)
with the debrick tool i got from the wiki
(http://www.t-hack.com/wiki/index.php/Debrick_SMP863x_Device)
but with no luck. The flashing process simply hangs at 0xAC00A000.
This is the command i use for flashing:
wrt54g_o -flash:custom  /start:0xac000000 /window:0xac000000 /length:0x00200000
The flash chip is a Spanison S29GL016A.

The flashing starts like this:

Code: [Select]


====================================
WRT54G/GS EJTAG Debrick Utility v4.8
====================================

Probing bus ... Done

Instruction Length set to 5

CPU Chip ID: 00001000011000110000000000000001 (08630001)
*** Found a SigmaDesigns SMP8634 Rev A CPU chip ***

    - EJTAG IMPCODE ....... : 01000000010000010100000000000000 (40414000)
    - EJTAG Version ....... : 2.6
    - EJTAG DMA Support ... : No

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Skipped
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done

Probing Flash at (Flash Window: 0xac000000) ... Done

Flash Vendor ID: 00000000000000000000000000000001 (00000001)
Flash Device ID: 00000000000000000010001001001001 (00002249)
*** Found a AMD 29lv160DB 1Mx16 BotB   (2MB) Flash Chip ***

    - Flash Chip Window Start .... : ac000000
    - Flash Chip Window Length ... : 00200000
    - Selected Area Start ........ : ac000000
    - Selected Area Length ....... : 00200000

*** You Selected to Flash the CUSTOM.BIN ***

=========================
Flashing Routine Started
=========================
Total Blocks to Erase: 35

Erasing block: 1 (addr = ac000000)...Done
Erasing block: 2 (addr = ac004000)...Done
Erasing block: 3 (addr = ac006000)...Done
Erasing block: 4 (addr = ac008000)...Done
Erasing block: 5 (addr = ac010000)...Done
Erasing block: 6 (addr = ac020000)...Done
Erasing block: 7 (addr = ac030000)...Done
Erasing block: 8 (addr = ac040000)...Done
Erasing block: 9 (addr = ac050000)...Done
Erasing block: 10 (addr = ac060000)...Done
Erasing block: 11 (addr = ac070000)...Done
Erasing block: 12 (addr = ac080000)...Done
Erasing block: 13 (addr = ac090000)...Done
Erasing block: 14 (addr = ac0a0000)...Done
Erasing block: 15 (addr = ac0b0000)...Done
Erasing block: 16 (addr = ac0c0000)...Done
Erasing block: 17 (addr = ac0d0000)...Done
Erasing block: 18 (addr = ac0e0000)...Done
Erasing block: 19 (addr = ac0f0000)...Done
Erasing block: 20 (addr = ac100000)...Done
Erasing block: 21 (addr = ac110000)...Done
Erasing block: 22 (addr = ac120000)...Done
Erasing block: 23 (addr = ac130000)...Done
Erasing block: 24 (addr = ac140000)...Done
Erasing block: 25 (addr = ac150000)...Done
Erasing block: 26 (addr = ac160000)...Done
Erasing block: 27 (addr = ac170000)...Done
Erasing block: 28 (addr = ac180000)...Done
Erasing block: 29 (addr = ac190000)...Done
Erasing block: 30 (addr = ac1a0000)...Done
Erasing block: 31 (addr = ac1b0000)...Done
Erasing block: 32 (addr = ac1c0000)...Done
Erasing block: 33 (addr = ac1d0000)...Done
Erasing block: 34 (addr = ac1e0000)...Done
Erasing block: 35 (addr = ac1f0000)...Done


Can anyone help?

[merkin]

Two things to consider.

1.  Does the IPP330HD use sigma's SDK vendor keys?

Where on the forum or wiki is this beta_rom_img.zip discussed?

2.  Detected flash is here http://pdf1.alldatasheet.com/datasheet-pdf/view/55494/AMD/AM29LV160DB-90EC.html

and actual flash is http://pdf1.alldatasheet.com/datasheet-pdf/view/217860/SPANSION/S29GL016A.html

It seems it is wrongly detecting the flash..perhaps that could be issue.

AMD and Spansion have the same vendor ID, but different flash chips should NOT have the same device ID.

[Budisha]

Hello.
The CPU is Sigma SMP8634LF 0751 rev B

Here is the link to the image on the wiki:
http://www.t-hack.com/wiki/index.php/X300tBeta

Some guys on the Croatian bug.hr forums have been able to flash it successfully, but they have an older revision of the STB than me.

[mce2222]

perhaps the flash is not as large as you defined in the Length parameter ?