Foxtel changes affecting third party receivers

**admin** · 27-11-11, 08:29 PM

Definately a lot of interest , look at the amount of views !

**couchpotato** · 27-11-11, 11:26 PM

Originally Posted by mborkp

Do not know much about it but I've read some time ago that most newer boxes have jtag chip locked. However, some guys were buing the same but unlocked jtag chips from China and replacing the one inside box. That way they could dump the firmware. Not much help but maybe a clue

Cheers

They do lock the jtag out on some cpus, I read about some st20's being locked. One arm cpu I tried also seemed locked, though I could communicate with it but not halt the cpu for dumping. All I can do is try, I may get lucky.

**beastien** · 29-11-11, 06:25 PM

I think the biggest part of the problem may be decoding the firmware.

**whiteb** · 29-11-11, 08:44 PM

Originally Posted by beastien

I think the biggest part of the problem may be decoding the firmware.

Meh, hand the decoder over to the guys that broke the security (or lack of) on the original black Xboxes

**beastien** · 29-11-11, 09:20 PM

Originally Posted by whiteb

Meh, hand the decoder over to the guys that broke the security (or lack of) on the original black Xboxes

Where are they, lets do it

**matchu** · 30-11-11, 12:14 PM

Just to chime in...
i'm waiting for some more tools for the BCM47 series, i think there's a couple of interesting things going on - if you can't trigger reset, trace the reset pin across the board and see if it's pulled to ground by a resistor or a ground short.

Also, just incase nobody figured it out yet, the BCM7401 and the BCM7402 are almost identical, and the BCM7401 is the cpu used in the DM800.

Perhaps you will get some joy out of the DM boundary scan/dump that you can use to target the IQ more effectively.

Out of interest, which header are you using on the IQ2? there's 3 that i can see.

**regulator** · 30-11-11, 07:09 PM

Just as a matter of interest, as they have killed the blue also...

Somebody I know got fox IQ HD and STD installed in a fibre estate today, the STD box had a blue inside...

**zacker** · 30-11-11, 07:29 PM

Originally Posted by regulator

Just as a matter of interest, as they have killed the blue also...

Somebody I know got fox IQ HD and STD installed in a fibre estate today, the STD box had a blue inside...

its not rare to get a blue card with new installs in std box. I have only ever ordered two standard boxes (both in last 12 months) and both have come with blues

**couchpotato** · 30-11-11, 09:05 PM

Originally Posted by matchu

Just to chime in...
i'm waiting for some more tools for the BCM47 series, i think there's a couple of interesting things going on - if you can't trigger reset, trace the reset pin across the board and see if it's pulled to ground by a resistor or a ground short.

Also, just incase nobody figured it out yet, the BCM7401 and the BCM7402 are almost identical, and the BCM7401 is the cpu used in the DM800.

Perhaps you will get some joy out of the DM boundary scan/dump that you can use to target the IQ more effectively.

Out of interest, which header are you using on the IQ2? there's 3 that i can see.

There seems to be a 14pin standard jtag header on board, there just pads no holes and are on the top right of the board. The grounds and power lines match up with 14pin jtag pinout.

I will have a go on the w/e

Thanks for the tip with the dm800.

**agarol** · 30-11-11, 10:37 PM

Why not log the firmware update from the stream, and just disassemble that?
ag

**regulator** · 01-12-11, 09:07 AM

no expert on this but have read things around the traps that the BCM series have factory modes and production modes where the jtag is permanently disabled internally, might mean the chip needs to be replaced with a virgin unit to play too much?

**couchpotato** · 01-12-11, 09:43 AM

Originally Posted by agarol

Why not log the firmware update from the stream, and just disassemble that?
ag

Easier said than done, Foxtel ota is not the same as other operators where there are tools to extract the firmware from a stream capture.

If you know different then please share.

**matchu** · 01-12-11, 01:55 PM

Originally Posted by agarol

Why not log the firmware update from the stream, and just disassemble that?
ag

Yeah it's not as easy as it sounds, i have been looking at a whole lot of openTV junk from their data feeds, but i havent had much luck with actually finding fw in a format that i can recognise.

I have found some mildly interesting stuff on the help channel transponder...
PID found: 7171 (0x1c03) [SECTION: User private] - Detailed strings which look like internal firmware info. (strings like error info and things that pop up on provider STBs - "call xxx to upgrade your subscription" and such.)
PID found: 7172 (0x1c04) [SECTION: User private] - TDS850 strings and LZMA compressed data packets.

There's a few consecutive data streams which seem to carry config data, though i havent had the time to piece together the whole loop here on 717x

PID found: 500 (0x01f4) [unknown] - Odd "merry christmas" interp_pop messages

And these non-DVB marked streams on 500 which do carry DVB data, as well as many strings regarding christmas. Once again, i havent really devoted much time to this either.

The next step for me on this front is looking into the Carousel, though i'm not sure what i'll find there - or if the FW is even being distributed via DVB or a custom signalling mechanism.

That said, a few of the private data streams are over 1mbit/s so i'll try some different apps to deconstruct the packetized data/carousel.

I know that they are there, but i just havent found them yet

Whats this about other provider firmware being captured over the air?
anyone care to PM me some links or point me the right way?

I have a feeling that it's an OpenTV mechanism being used to update - i honestly don't believe that Australia is that special that they would write their own Bootloader code to do updates.

**weirdo** · 01-12-11, 05:30 PM

Maybe have a look here >

**Pacificbanana** · 02-12-11, 01:40 PM

Ive got a Pace DS420NF that has never been plugged in to a satellite.
This is very old but came with a blue card.
Is it any useful for downloading the firmware and then updating it.
Hope this helps.
Its the one with a USB input as well.
Thanks

**vacman** · 07-12-11, 12:45 PM

Originally Posted by Pacificbanana

Ive got a Pace DS420NF that has never been plugged in to a satellite.
This is very old but came with a blue card.
Is it any useful for downloading the firmware and then updating it.
Hope this helps.
Its the one with a USB input as well.
Thanks

I offered this box a few weeks ago, check post 959..... Its a no-go-er
We need a box with an active JTAG port.

Vacman

**DUDE** · 17-12-11, 05:50 PM

There is a new version of CCcam out now version 2.3.0, i'm not saying it will help you with your problems but it's worth a try for the few minutes it will take to test it.

**beastien** · 17-12-11, 07:07 PM

New version CCcam tested and not working here.

**fudda** · 17-12-11, 07:37 PM

I think most on the forum would be waiting for a new version of Oscam, rather than CCcam.
I think we might have a long wait ahead of us.
And anyway, you wouldn't tell anyone even if you did find a working version.
Revealing anything on a public forum is certain death.
Everything goes on behind closed doors now.

**DUDE** · 17-12-11, 08:04 PM

Originally Posted by fudda

I think most on the forum would be waiting for a new version of Oscam, rather than CCcam.
I think we might have a long wait ahead of us.
And anyway, you wouldn't tell anyone even if you did find a working version.
Revealing anything on a public forum is certain death.
Everything goes on behind closed doors now.

and how do you think a closed solution would be distributed if not on a public forum ?.

and yes if i did come across a solution i would most definitely post it, there would be no discernible reason not to.