SB4101 bricked

This is JTAG to debrick any JTAG device. Modem, cable boxes, dish boxes routers.
Post Reply
otraver
Junior Member
Posts: 26
Joined: Thu Jan 04, 2007 7:00 am

SB4101 bricked

Post by otraver »

Hi all

I have read all posts in this section but nothing works for me.
I changed the firmware of a SB4101 but I programed one from SB4200.
I used the 0.24 version of the usbjtag
Now the power, receive, send and standby leds are always on.
I tried to debrick without results.
In others SB4xxx bricks I solved this with the Slow program mode (sprogram) with a old version of the usbjtag soft, but in this occassion the sprogram don't work.

Now I do this in order to try.

Code: Select all

- detect
- debrick
- ldram 9fc00000 (full flash backup of a 4101)
- program 9fc00000 200000
and this is the result.
- detect
IDCODE 0335017F
Broadcom BCM3350
IMPCODE 8009E8
DMA (Acceso Directo De Memoria) Compartible
Tipo De Flash Desconocido!
Reportar Estos Dos Valor Tambien [email protected] ffff,ffff

- debrick
detect
IDCODE 0335017F
Broadcom BCM3350
IMPCODE 8009E8
DMA (Acceso Directo De Memoria) Compartible
Dirección Encontrada= 9fc00000 Intel 28F160C3T
No Se Pudo Borrar
- ldram 9fc00000
- program 9fc00000 200000
El Borrado A Comenzado...
Tiempo De Borrado 00:00:09 .012
Velocidad De Programa------- ¡¡¡¡¡ 10330.80 KB/s !!!!!
Tiempo De Programacion 00:00:00 .015
El Programa Pasó, Si Programación Adicional No Necesaria, Energía Apagada/Encendida De Aparatato
Please note de program speed... 10330.80KB/s

Any help????
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

otraver wrote:Hi all

I have read all posts in this section but nothing works for me.
I changed the firmware of a SB4101 but I programed one from SB4200.
I used the 0.24 version of the usbjtag
Now the power, receive, send and standby leds are always on.
I tried to debrick without results.
In others SB4xxx bricks I solved this with the Slow program mode (sprogram) with a old version of the usbjtag soft, but in this occassion the sprogram don't work.

Now I do this in order to try.

Code: Select all

- detect
- debrick
- ldram 9fc00000 (full flash backup of a 4101)
- program 9fc00000 200000
and this is the result.



Please note de program speed... 10330.80KB/s

Any help????
I noticed the debrick gives your flash ID. That is a good sign.
You CAN NOT use program yet. You need to use
http://www.usbjtag.com/jtagdevices/sb4200.php

"Rescue SB4200. When box not fire up. Normal programming will not work. You can not use sprogram or erase for SB4200!!"

If you just type program it will not work.

Please make sure after you see the sectors erased, power off/ on the modem. Then execute pokes and you will be OK.
otraver
Junior Member
Posts: 26
Joined: Thu Jan 04, 2007 7:00 am

Post by otraver »

But the problem is when I program the full flash.
Note the high speed programing, the programing time is only .031 seconds.
I think that nothing is programed.
Obviously, when I compare the data I obtain comparaision errors.

If I try to program with the "sprogram" command of the old usbjtag versions then the program proccess don't start. Also If I use the 4200 rescue metod whit the older version of the usbjtag, the proccess start to erase the flash and at 10% - 15% stops to erase it and I need to power off the modem, unplug the usb and restart the soft.

Why don't exist the "sprogram" command in the newest versions of the software?

thanks in advance for your attention.

Octavio
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

otraver wrote:But the problem is when I program the full flash.
Note the high speed programing, the programing time is only .031 seconds.
I think that nothing is programed.
Obviously, when I compare the data I obtain comparaision errors.

If I try to program with the "sprogram" command of the old usbjtag versions then the program proccess don't start. Also If I use the 4200 rescue metod whit the older version of the usbjtag, the proccess start to erase the flash and at 10% - 15% stops to erase it and I need to power off the modem, unplug the usb and restart the soft.

Why don't exist the "sprogram" command in the newest versions of the software?

thanks in advance for your attention.

Octavio
"You can not use sprogram or erase for SB4200!!" SB4200 is different as far as the JTAG. The JTAG mode is different and you cannot use sprogram to program SB4200.

Your process should be.
1. debrick make sure boot erased.
2. Power off/on modem
3. Use rescue method.
otraver
Junior Member
Posts: 26
Joined: Thu Jan 04, 2007 7:00 am

Post by otraver »

I have tried all but I can't debrick the modem
I used this

Code: Select all

detect 
 IDCODE 0335017F
 Broadcom BCM3350
 IMPCODE 8009E8
 DMA (Acceso Directo De Memoria) Compartible
 Tipo De Flash Desconocido!
 Reportar Estos Dos Valor Tambien [email protected] ffff,ffff
-poke fffe230c 3 
-poke fffe2304 0 
-poke fffe2300 a 
-poke fffe2300 9 
-poke fffe2300 9 
-poke fffe2300 9 
-poke fffe2300 9 
-poke fffe2300 9 
-poke fffe2300 9 
-poke fffe2300 9 
-poke fffe2300 9 
-poke fffe2300 1c 
-detect 
 
 IDCODE 0335017F
 Broadcom BCM3350
 IMPCODE 8009E8
 DMA (Acceso Directo De Memoria) Compartible
 Dirección Encontrada= 9fc00000 Intel 28F160C3T	
-ldram 9fc00000  
-program 9fc00000 200000
 El Borrado A Comenzado...
But the erase proccess stops and I have to power off the modem and unplug USBJTAG to close ustbjtag software and restart the proccess.
Image

I have tried with
-program 9fc00000 200
-program 9fc00000 2000
-program 9fc00000 20000
And all works perfectly, but when I try -program 9fc00000 200000 the erase stops.
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

otraver wrote:Hi all

I have read all posts in this section but nothing works for me.
I changed the firmware of a SB4101 but I programed one from SB4200.
I used the 0.24 version of the usbjtag
Now the power, receive, send and standby leds are always on.
I tried to debrick without results.
In others SB4xxx bricks I solved this with the Slow program mode (sprogram) with a old version of the usbjtag soft, but in this occassion the sprogram don't work.

Now I do this in order to try.

Code: Select all

- detect
- debrick
- ldram 9fc00000 (full flash backup of a 4101)
- program 9fc00000 200000
and this is the result.



Please note de program speed... 10330.80KB/s

Any help????
Can you tell me which version you can use sprogram to program sb4200?
otraver
Junior Member
Posts: 26
Joined: Thu Jan 04, 2007 7:00 am

Post by otraver »

The version is the 1.0.0.1

I always brick all the SB4x00 modems if I only change the firmware.
What's the problem?
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

otraver wrote:The version is the 1.0.0.1

I always brick all the SB4x00 modems if I only change the firmware.
What's the problem?
I mean the software version that you said have sprogram on sb41xx?

If you program the wrong boot to the mode, you have 100% chance to brick the modem.
otraver
Junior Member
Posts: 26
Joined: Thu Jan 04, 2007 7:00 am

Post by otraver »

Sorry, the version is the 0.141

But...
I allways use the newest usbjtag version to program the modems. If I only program the firmware I brick the modem and I need to use the old version to debrick.
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

otraver wrote:Sorry, the version is the 0.141

But...
I allways use the newest usbjtag version to program the modems. If I only program the firmware I brick the modem and I need to use the old version to debrick.
I will review it to see if sprogram needs to be added back. As the poke command should do the work to rescue the modem. sprogram should normally not needed.

http://www.usbjtag.com/jtagdevices/sb4200.php

said you cannot use erase and sprogram for sb4200 (same as SB4100).

Rescue SB4200. When box not fire up. Normal programming will not work. You can not use sprogram or erase for SB4200!!
ldram 9fc00000(Select the backed up file)
poke fffe230c 3
poke fffe2304 0
poke fffe2300 a
poke fffe2300 9
poke fffe2300 9
poke fffe2300 9
poke fffe2300 9
poke fffe2300 9
poke fffe2300 9
poke fffe2300 9
poke fffe2300 9
poke fffe2300 1c
detect
program 9fc00000 200000
cmpram 9fc00000 200000
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

erase stop in middle led me believe your flash might be bad at one sector. Try to only program half the flash and see if the boot block is up. You should then be able to detect without those poke commands.
otraver
Junior Member
Posts: 26
Joined: Thu Jan 04, 2007 7:00 am

Post by otraver »

Hi
Finally I debricked the modem programing the first 80000 bytes.
I tested from 9fc00000 200000 to 9fc00000 80000 in 10K decrements, and 80K is the first that don't stop to erase.
Now..
What's the most secure metod to program a hackware firm to the 4x00??

Thank's
otraver
Junior Member
Posts: 26
Joined: Thu Jan 04, 2007 7:00 am

Post by otraver »

I have tried to program many firmware versions and always the modem is bricked.
otraver
Junior Member
Posts: 26
Joined: Thu Jan 04, 2007 7:00 am

Post by otraver »

Hi all
It's impossible.

I can recover the modem with a copy of a original 4101 flahs backup but when I try to program any hacked firmware the modem is bricked.
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

otraver wrote:Hi all
It's impossible.

I can recover the modem with a copy of a original 4101 flahs backup but when I try to program any hacked firmware the modem is bricked.
So the hacked firmware is not for your modem. It is incompatible.
Post Reply

Who is online

Users browsing this forum: No registered users and 11 guests