Debrick an RCA modem. (Not recommend)

This is JTAG to debrick any JTAG device. Modem, cable boxes, dish boxes routers.
Post Reply
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Debrick an RCA modem. (Not recommend)

Post by usbbdm »

Today I debricked an RCA DCM 315 modem. This is programmed with bad boot. The detect always get stuck. When set debrick on, the detect gives you 0000,0000.
Here is how to debrick it.

First solder a wire on 3.3V on the flash.
Image
The step to do.
1.Start the JTAG 0.22
2. Carefully use the wire touch the CE pin. Start the power.
3. set debrick on by command "debrick"
4. power on the modem. Please note, because the CE pin is connected to the 3.3V. The modem will not function properly.
5. use command "bk". At this time you should see "DEBUG ON"
6. Remove the pin from CE
7. Use "flshset" command to set the flash. In this example command, "flshset boot 1 2249
8. type command "erase boot"
You have erased the boot.
Now you can use the method 1 or method 2 of http://www.usbjtag.com/jtagdevices/sb5100.php to recover the modem.

I am searching new method to debrick device with software only. Please use this method with caution.
santino
Junior Member
Posts: 197
Joined: Wed Jul 19, 2006 4:50 pm

Post by santino »

tried that and did get to erase boot but still detect 0000. did the poke and would stay stuck on the program.
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

santino wrote:tried that and did get to erase boot but still detect 0000. did the poke and would stay stuck on the program.
I normally check the register view when configure.
After bk command you should see the PC as BFC0XXXX. If not normally the bk does not really gives you the trick.
You also need to give proper flash type and if erase properly, the modem will be able to use rescue method.
santino
Junior Member
Posts: 197
Joined: Wed Jul 19, 2006 4:50 pm

Post by santino »

Ok finally got 2 rca back up and running. But have problems with the others they wont take the sprogram boot, just stays stuck. Why?
Juansel10
Junior Member
Posts: 404
Joined: Tue Jan 01, 2008 2:01 pm

Post by Juansel10 »

usbbdm wrote:I normally check the register view when configure.
After bk command you should see the PC as BFC0XXXX. If not normally the bk does not really gives you the trick.
You also need to give proper flash type and if erase properly, the modem will be able to use rescue method.
Hi usbbdm, i have done that method, is great, no more 000 on detect, but now when i places debrick i got just ffff. what can i do. My flash is Intel 28F160CEB of an SB5100 modem.

thanks
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

You have not done the full procedure of what is stated here.

When you type bk
you are breaking the CPU to debug mode. Then remove the CE while power is on. And your CPU is still in debug mode.

DO NOT use flshdct. Use flshset.
blowhard7
Junior Member
Posts: 43
Joined: Sat Aug 12, 2006 9:01 am

Post by blowhard7 »

Could someone tell me the proper "flshset" command for the Intel TE28F160C3BD70.

Trying to debrick SB5100. Detect will not detect the flash.

Thanks.
Juansel10
Junior Member
Posts: 404
Joined: Tue Jan 01, 2008 2:01 pm

Post by Juansel10 »

blowhard7 wrote:Could someone tell me the proper "flshset" command for the Intel TE28F160C3BD70.

Trying to debrick SB5100. Detect will not detect the flash.

Thanks.
That's good, could you please tell me if you can debrick it, i also having some problems with my SB5100. The comand is:

"flshset boot 89 88C3" for that Flash. I would be pleased if you can inform me if you debrick your modem.

Bye
blowhard7
Junior Member
Posts: 43
Joined: Sat Aug 12, 2006 9:01 am

Post by blowhard7 »

Successfully debricked the modem. USBjtag hung at "erasing" every time.

I finally gave up and used the Blackcat to rewrite the boot block. USBjtag now successfully restored the modem. I then used the USBjtag to install the Sigma firmware.

Apparently there is a problem erasing the boot block after it is damaged. I honestly tried everything.
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

blowhard7 wrote:Successfully debricked the modem. USBjtag hung at "erasing" every time.

I finally gave up and used the Blackcat to rewrite the boot block. USBjtag now successfully restored the modem. I then used the USBjtag to install the Sigma firmware.

Apparently there is a problem erasing the boot block after it is damaged. I honestly tried everything.
Have you tried to use debrick mode? If in debrick on mode you can detect the flash, you can
1. use erase to erase the flash.
2. Use poke command to erase flash.

The USB JTAG erase command use the debug port and sometime when CPU is in bad mode it can not enter debug mode properly. Thus it hangs. Same thing happened on detect the flash. Use the short pin (be careful about this, might be a better idea to use a 100ohm resistor is to force the CPU enter the known state and can safely enter the debug mode.
MaXt
Junior Member
Posts: 13
Joined: Mon Nov 26, 2007 8:00 am

Post by MaXt »

usbbdm wrote:a better idea to use a 100ohm resistor is to force the CPU enter the known state and can safely enter the debug mode.
What exact way is this?
Juansel10
Junior Member
Posts: 404
Joined: Tue Jan 01, 2008 2:01 pm

Post by Juansel10 »

blowhard7 wrote:Successfully debricked the modem. USBjtag hung at "erasing" every time.

I finally gave up and used the Blackcat to rewrite the boot block. USBjtag now successfully restored the modem. I then used the USBjtag to install the Sigma firmware.

Apparently there is a problem erasing the boot block after it is damaged. I honestly tried everything.
Do you debrick an sb5100, what were the symptoms, please tell how you debrick it.

Thanks
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

Someone had told me program SB5101 firmware to sb5100 will brick it heavily, I will try sometime latter.
Juansel10
Junior Member
Posts: 404
Joined: Tue Jan 01, 2008 2:01 pm

Post by Juansel10 »

usbbdm wrote:Someone had told me program SB5101 firmware to sb5100 will brick it heavily, I will try sometime latter.
You would try to brick it and then debrick it with this method?? Tell us the results please.
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

I have programmed the SB5101 original to SB5100 with ST flash chip. (M28W160CB)
The modem is NOT bricked. I can easily debrick it.

I have one flash chip Intel TE28F160C3B. It is bricked. I can get the flash type. But erase hangs. The flash must have been written some command and the chip is bad now. After I replace the flash, the modem works just fine.

For those who have bricked modem, knowing how to replace the flash chip is a must when all the JTAG options have been used.

To replace the flash you need a good heat gun and a fine solder iron and a magnifier and a steady hand. Sometime you have to do it.

You do not have to find a new flash chip, those flash chips can be found on older modems.
Post Reply

Who is online

Users browsing this forum: No registered users and 8 guests