Firmware checkum for DVI3000.

[usbbdm]

I believe this should apply to DVI3020 too. It is very simple.
Here is the code to calculate it.

Code: Select all

        DWORD nCheckSum = 0;

        unsigned int nCodeLength = (pIn[0x10] << 24) + (pIn[0x11] << 16) + (pIn[0x12] << 8) + (pIn[0x13]);

        for (unsigned int i = 0; i < nCodeLength - 4; i ++)
        {
            nCheckSum += pIn[i + 0x14];
        }

Example
firmware 16.21.
code length is 0x3a413c
checksum is 0x0fd1ef76 at address offset 0x3a414C

Please verify this. I will latter find the place to fake unit address.

[haute]

hi, this checksum it was already commented in this post.
http://www.usbjtag.com/bdmjtagbb/viewto ... c&start=30

i think it is a simple checksum for check the uploaded firmware.
I think there are another one, and it can be possible to relationated with nvram.

but I will test but to verify this

thx

[usbbdm]

hi, this checksum it was already commented in this post.
http://www.usbjtag.com/bdmjtagbb/viewto ... c&start=30

i think it is a simple checksum for check the uploaded firmware.
I think there are another one, and it can be possible to relationated with nvram.

but I will test but to verify this

thx

Oh yes I did not read the Spanish one.

[haute]

That there is about the table of motorola present in firmware?

[usbbdm]

Nvram at both offset 0x70 and 0xe0 should be the checksum. Checking the firmware now to find out how to calculate checksum.

[haute]

hi, Days ago I reduced the information of the NVRAM to the smaller possible number of bytes so that it worked with firmware. The single NVRAM occupied about 60 bytes approximately. Offset 60 and E0 leave them in bytes 0000, and I do not believe that they are checksum. If you want I send that nvram so that you throw a look. It is for 16.25 firmware version. The actual version in use. With only 60 bytes off info it much easy search any checksum.
If you make swap16 to a nvram you can see the firmware version 16.25.

thk for your work

[usbbdm]

Caculate checksum for DVIs are getting close. DVI actually has much more strong checksums than DCT2000/DCT2500. I am about to build small MIPS emulator to emulate the last bulk of check caculation. The first part of checksum caculation is the same as DCT2500.

[usbbdm]

haute
I have the simulator working now. can you go online so we can continue work on the checksum issue?

[haute]

hi , i am working out my house, night work. i can go online beteen 4:00 - 6:30 Pm everiday.

You can send the tests to dagra82 to test in in dvi3000.

we can speak abaut ALTERA. I think the counter watchdog is programmed in altera chip. two pines of chip inverter (watchdog) are connect to ALTERA chip.

[usbbdm]

hi , i am working out my house, night work. i can go online beteen 4:00 - 6:30 Pm everiday.

You can send the tests to dagra82 to test in in dvi3000.

we can speak abaut ALTERA. I think the counter watchdog is programmed in altera chip. two pines of chip inverter (watchdog) are connect to ALTERA chip.

haut I am stuck at the checksum, maybe we can first program the altera chip and then I put a break point then we can find the algorithm to compute the checksum.

[haute]

Hi usbbdm, as the works of the checksum go?

[usbbdm]

Hi usbbdm, as the works of the checksum go?

Not these days. I think we can live with first modify the boot to bypass the checksum. I am working on HD6412 to provide EJTAG64 support in next release.

[husus1]

please usb,your you are the unical person that can help, tries to remove to the checksum from dvi. thanks us for the obtained thing until, but now can finishing to this project and the next following with others since without you we will not obtain it

[usbbdm]

please usb,your you are the unical person that can help, tries to remove to the checksum from dvi. thanks us for the obtained thing until, but now can finishing to this project and the next following with others since without you we will not obtain it

I worked on it for a while and I found it too difficult. There are two pass of checksum and I have one passed. I will investigate when I have time again. The current work is focus on HDbox (EJTAG64). Sorry for keep you very long on this issue.

[usbbdm]

Just got the NVRAM from HD6412 and I found that the NVRAM from HD6412 is EXACT the same as DVI3000. I should be able to solve them both at the same time. The first thing I am going to do is to make the box connected. If I do this any box from ebay can be localized.