dreambox için jtag

This is a Manual for repairing a dead Dreambox 500 (clone or not) and all other models with faulty bootloader.

You can find 2 methods to do this. The first one is with a Cas Interface 3 (thanks to Duolabs) and second one is with a selfmade jtag (thanks to Satr3x).

METHOD 1

The Cas Interface 3

http://www.duolabs.com

The Kit supplied with Cas Interface 3 comprises:
• 1 Cas Interface 3 device
• 1 20-pin female cable, length 30 cm
• 1 J-Card
• 1 Dummy Card
• 1 Case for the Cam Module






With the Cas Studio Application (http://www.duolabs.com)

Click the button that corresponds to the DreamBox and perform the
following operations:
• If you are using Cas Interface 2 with the Add-on, connect the flat
cable to the Add-O and to the DreamBox as shown in the figure:






• If you are using Cas Interface 3, insert one end of the flat cable
into the external connector and the other end into the DreamBox
as shown in the figure (the figures refer to two models of

DreamBox: refer to the photo of the model you are using






Click “Connect” when the receiver is on.

If the application is able to correctly detect the device, additional
buttons are displayed (“Open File” and “Write”).


Click “Open File” and select the desired file.
Note: the file to use must be a 128k boot file, which can be
downloaded from Web sites dedicated to Dreambox (Duolabs shall
not be liable for damages originating from the files used).


Click “Write”.

METHOD 2

Selfmade jtag

You can see below a memmap of the dreambox flash:

0x00000000-0x00600000 : "DreamBOX cramfs+squashfs"
0x00600000-0x007c0000 : "DreamBOX jffs2"
0x007c0000-0x00800000 : "DreamBOX OpenBIOS"
0x00000000-0x007c0000 : "DreamBOX (w/o bootloader)"
0x00000000-0x00800000 : "DreamBOX (w/ bootloader)"
0x00120000-0x00600000 : "DreamBOX SquashedFS"
0x00000000-0x00120000 : "DreamBOX Cramfs"

What dream multimedia did in their release of gemini 4.3.1 is that it detects on the basis of your fake mac adress that it has to destory your box and a timer is activated. This will destroy the first part of your memory... Which contains the "Open bios" and the bootloader to give your dreambox the basic inputs/outputs working (like the serial port).

To repair this damage done by dream multimedia we need a jtagger. Jtag devices/cables are used by hardware developpers and testers but are quite easy to build. (and cheap!).

To build jtag for dreambox.

Requirements:

- 74LS245 IC (74LS245 is an Octal Bus Transmitter/Receiver designed for 8-line asynchronous 2-way data communication between data buses.)
- LPT (25pins D-sub connector)
- A bit of copper cable or Flat ribon cable (like ide cable is ideal)
- Solder iron
- Pin header
Optionally: 5 x 100ohm resistors (use max 10cm cable otherwise u will have voltage problems)

The build.

The build is quite easy if you look at this schematic (thanks to tododream team)



As you can see you have the JPx and the LPTx all you have to do is solder the correct wires as shown below



When are done with this. your cable is ready. You can have on one end a connector thats fits on your pin header. This way you can just put the pin header onto the dreambox jtag connector and flash away without soldering on the mainboard of the dreambox.

You can use a pinheader which looks like this:



When you are done with the build its all a matter of connecting your jtag cable to your pc and to your dreambox. Then you just need to see which type of tuner you have. Alps or Philips.... This is important to have the right bootimg in your dreambox.

There is a flashtool for Windows:

http://dreambox.site50.net/appz/jtagwin5xxx.zip

(windows tool is quite straight forward. Just load the correct blimg)

And a flashing tool for PC linux (this is a binary compile tested on fedora, mandrake, redhat )

http://dreambox.site50.net/appz/JTAG_Linux.zip

For linux you need:

A Pc with Linux like Madrake or Redhat or an other distribution.
A parallel port (LPT)
A parallel cable to your JTag Interface
A point on the pcb of Dreambox for the +3.3V to Chip LS245 Vcc
All GND are the same
Login with root to your Linux system.
All files must be in the same folder!
to flash the bootloader:
a) connect the JTag
b) power on Dreambox
c) Linux console with user "root"
command: ./ flash write
when the flash is write protected: ./flash unprotect

The part that is destoryed on your dreambox is about 128Kb so we need to put the correct image on it. There might be many images on the net but these are tested & working. The file is usually called Blimg or Bootimg please make sure u select the write image for your box:

For philips / alps (orignal blimges ? ):

http://dreambox.site50.net/appz/dm500-alps_philips-boot.zip

Other Dm 500 clones with diffrent tuners

http://dreambox.site50.net/appz/bootloader_500.tar.gz

After you downloaded the correct files its all a matter of flashing your box.


To do this make sure the timing between pressing connect and powerup of the dreambox is simultanious.

The connect and powerup timing is slightly diffrent. U must make sure u press connect before it powers up. But also the box may not powerup 1 second after the connect.

This is the only tricky part as soon as flash is done correctly you can use your serial cable and use dreamup to flash your favorite image again.

Thanks to FME_fta for this guide.

So that the program Dreamflash v0.1 DanMark works (tested personally) with jtag, the jtag can only have resistences and they can’t have more than 10cm.

The connections are:

LPT————–> Dreambox/Clone

2 –> 100 ohms –> 11 ( Halt)

3 –> 100 ohms –> 9 ( Tms )

4 –> 100 ohms –> 7 ( Tck )

5 –> 100 ohms –> 3 ( Tdi )

11 –> 100 ohms –> 1 ( Tdo )

25 —————— 16 ( Ground)

Th pins 18, 19, 20, 21, 22, 23, 24 e 25 of the port LPT must be shunted between themselves, like commercial jtags has.





Now, The science of the thing (thanks to Matrix10 tip) is doing the connect and turn on the box at the same time.

With the tests done I’ve understood better how it works great:

The secret is in 1º do connect to the program and then turn on the clone, but with a certain delay. This delay depends on the speed of your CPU, the faster CPU’s, minor the time/delay (between 0 e 1 seconds).

Change the priority of the program jtag_windows.exe on the task manager for the real time which must turn more real the delay itself, once the program will give maximum priority of the use of the CPU.

About the timming, if it shows you only “ERROR:register test failded” then the jtag is ok, but you have turned on the box sooner then expected, if it shows you the 4 times “ERROR: communication with LPT/JTAG”, then you must turn on the box sooner, or the jtag isn’t ok.

Remmember that you must connect the box always after making connect on the program.

After you must warp/straight the pins on the adaptor switch of the box, so it fits faster on the electric switch.

By end, you must use an electric switch easy to fit, I have used one triple (from the bad ones), but I had to dismount it and press their electric pins to don’t make bad contact.

When doing “write” the program sends immediately the boot, that is the file “blimg”.

The file present in this attachment is the boot of a DM500 and tunner ALPS of CRC-32 9055B110, once again thanks Matrix10, because I’ve tested a boot that were supposed to be for the DM500 and ALPS and it didn’t worked, and this one in the attachment is guaranteed it works.

After sending the boot of 128KB by Jtag, you can turn on the box with dreamup and by rs232 send an image (with exception of Gemini 4.3.1 because some people say it kills clones… )

DreamBox Dm500 FLash Dump


Evet ArkadaşLar Buda Sık Çöken MakineLerden Biri.ELinizde 56 Pin Adaptör Varsa YükLeyebiLirsiniz!Herkese İyi ÇaLışmaLar!..





http://s2.dosya.tc/DreamBox-Dm500.rar.html