Jtag pinout mips-BCM7538(STB Kaon)

JTAG on Dish Receivers.
merkin
Junior Member
Posts: 246
Joined: Thu Jun 28, 2007 8:49 pm

Post by merkin »

pin3 of j7 is not connected to ground plane in the picture
offlinemodus
Junior Member
Posts: 10
Joined: Wed Jan 15, 2014 12:31 am

Post by offlinemodus »

@no1oneknow

have you the bcm97358.msi?

@merkin:

you mean the J7 pinout from the picture of my pcb?

###
i tried with an usb to uart controler(like in the picture) but no succes, nothing in the terminal.

i am not an expert but i measured the j7 pinout with a multimeter(i have a cheep one)

the first pin(the above one) on the first picture(on the second picture is the right one) is 0V

other three pins have 3.3v and the third pin is 0v on booting and after 3-4seconds goes to 3.3v

my cheap multimeter cant do a continuity test, i measured resistance for all 4 pins on the j7 pinout
first pin (the above one) has resistance, other three pins shows 1 in the multimeter display(overflow) with all resistance measuring ranges.

do i need a mm with a continuity test or my resistance measure shows the pin 1 is the only one grounded?

thank you in advance
n01kn0ws
Junior Member
Posts: 13
Joined: Thu Jan 23, 2014 4:49 pm

7358 kaon

Post by n01kn0ws »

Hi

i have a different receiver Brand from another tv provider

which uses the same 7358 cpu

and this is my pinout diagram

JTAG seems to be bricked by challenge key mechanism anyone know how this works ?

Anyone knows a different command to try to enter in CFE mode from log terminal console??
You do not have the required permissions to view the files attached to this post.
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

n01kn0ws wrote:Hi

i have a different receiver Brand from another tv provider

which uses the same 7358 cpu

and this is my pinout diagram

JTAG seems to be bricked by challenge key mechanism anyone know how this works ?

Anyone knows a different command to try to enter in CFE mode from log terminal console??
Looks like standard EJTAG pinout.
n01kn0ws
Junior Member
Posts: 13
Joined: Thu Jan 23, 2014 4:49 pm

Post by n01kn0ws »

usbbdm wrote:Looks like standard EJTAG pinout.

Hi looks like its not..

i found something on the internet i will test later, but this looks like pinout for this models


seems like only pins

3,5,7,9,12,14 are used

Pin 3 = TDi
Pin 5 = TDO
Pin 7 = TMS
Pin 9 = TCK
Pin 12 = NC (For EJTAG 2.6 standard)
Pin 14 = Vcc/Vref

as pin 14 being vcc 3.3v or 5v so which pin shall i use on USBJTAGNT for this option ?
You do not have the required permissions to view the files attached to this post.
merkin
Junior Member
Posts: 246
Joined: Thu Jun 28, 2007 8:49 pm

Post by merkin »

offlinemodus wrote: @merkin:

you mean the J7 pinout from the picture of my pcb?
Yes, but it was in response to the other post about UART pinout...its pretty clear that those two resistors are pullups for I2C/BBS bus, not for UART.

You may have done damage hooking up UART.

What makes anyone think these targets are running CFE? The bcm7xxx based boxes I have from motorola/arris do not use CFE. Many vendors write their own bootloader.
n01kn0ws wrote:Hi looks like its not..
Looks like it is!
Both pictures show standard ejtag, but dont forget about gnd signal.
offlinemodus
Junior Member
Posts: 10
Joined: Wed Jan 15, 2014 12:31 am

Post by offlinemodus »

@merkin:

thank you for sharing your knowledge.

I will wait for my i2c ez-usb adapter and try a bbs/i2c connection with the broadcom studio.

@anyone:

someone managed to get or find the bcm97358.msi file needed for the broadcom studio?( in my case of course)

i think without this file i dont have chance to get a connection between my stb and broadcom studio, right?

to make a xml file for the spansion flash should not be the problem(how2 is described in the broadcom tool)

cheers
n01kn0ws
Junior Member
Posts: 13
Joined: Thu Jan 23, 2014 4:49 pm

Post by n01kn0ws »

merkin wrote:
Looks like it is!
Both pictures show standard ejtag, but dont forget about gnd signal.
Hi merkin

i have made testing with GND also from pin2 to pin 14 and neither of them it managed to the the DEVICE ID

anyways who knows in the upcomming weeks we might have some new information...
numind
Junior Member
Posts: 9
Joined: Sat Mar 23, 2013 4:08 am

Post by numind »

you can't access to BCM SoC, is state-of-the-art security....need more than a simply jtag access, althought is good you are trying.
chotky
Junior Member
Posts: 13
Joined: Wed Apr 09, 2014 4:04 am

Post by chotky »

hello any news for ejtag on braodcom bcm7358 cpu ?? !!
Post Reply

Who is online

Users browsing this forum: No registered users and 6 guests