Samsung 3262

JTAG (NT) on Cable Boxes

Moderator: justsomeguy

Post Reply
reflexus
Junior Member
Posts: 14
Joined: Fri Nov 06, 2009 1:56 pm

Samsung 3262

Post by reflexus »

Can someone help me please. Does anyone know how to jtag this samsung 3262, 3272 and other samsung tv cable box unit, or how to edit diag mode, or if can be copied?
Any input is appreciated, thanks in advance.
http://imageshack.us/photo/my-images/15 ... 00023.jpg/
http://imageshack.us/photo/my-images/57 ... 00021.jpg/
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

reflexus wrote:Can someone help me please. Does anyone know how to jtag this samsung 3262, 3272 and other samsung tv cable box unit, or how to edit diag mode, or if can be hacked?
Any input is appreciated, thanks in advance.
http://imageshack.us/photo/my-images/15 ... 00023.jpg/
http://imageshack.us/photo/my-images/57 ... 00021.jpg/
Very little information here. What kind of CPU? It looks like there is a possible JTAG port. Nothing has been done in here.
reflexus
Junior Member
Posts: 14
Joined: Fri Nov 06, 2009 1:56 pm

Post by reflexus »

Mainboard

Samsung manufactured the board and holding up to their normal standards the board is very high quality. The mainboard uses all sold state capacitors. On the left side next to the cable card slot you'll see the dual digital tuner. Right above that is a Broadcom BCM3248KPBG, this is a QAMLink Set-Top box single-chip front end. Essentially this is the cable modem part of the box that allows it to be managed and to retrieve data as well.

In the middle of the board is a chip with a heat-sink on it. I didn't pop the heatsink off to identify the chip because I was going to have to disassemble the entire unit to get to the back of the board. I'm pretty sure this is the process that handles the video encoding/decoding which is CPU intensive and would necessitate a passive cooling device. Scattered throughout the board some some Samsung RAM chips and a couple of flash chips. There is a solder pad on the lower left next to the cable card that is labeled “MOCA” which stands for Multimedia over Coax, apparently this model does not have that feature.

There are a couple of 14-pin solder pads which could be JTAG ports, Broadcom doesn't usually release spec sheets for their parts unless your a customer so trying to track down JTAG ports usually requires a oscilloscope and patience.
Source Code
This DVR is running STB Linux and since its GPL software Samsung has posted the source code on their website. This could be helpful in gaining shell access to the device.
The source package includes the following files
• busybox.bz2 (Unix utilities optimized for embedded devices)
• dhcpcd.bz2 (DHCP client)
• fdisk.bz2 (Disk partitioning utility)
• stblinux.bz2 (Core operating system)
• tftpd.bz2 (TFTP server)
• uClibc.bz2 (C library optimized for embedded systems)
• xfsprogs.bz2 (Utilities for managing the XFS filesystem)


All companies release these new boxes, can u do something please?
reflexus
Junior Member
Posts: 14
Joined: Fri Nov 06, 2009 1:56 pm

Post by reflexus »

. The Ethernet port is enabled
The box pulled an IP address from my DHCP server after it finished booting
CAPONE
Junior Member
Posts: 5011
Joined: Sat Dec 27, 2008 3:25 pm

Post by CAPONE »

usbbdm wrote:Very little information here. What kind of CPU? It looks like there is a possible JTAG port. Nothing has been done in here.
That port If you happen to be correct does not follow normal EJTAG protocol.

Happy goose chasing. Unless you can target the M-Card your wasting your time. No If I am Mistaken about that, WHY is it you cant JTag the Motorola Boxes with M-Card?????????????????? AH
"If you give a man a fish you feed him for a day. If you teach a man to fish you feed him for a lifetime."
reflexus
Junior Member
Posts: 14
Joined: Fri Nov 06, 2009 1:56 pm

Post by reflexus »

what card u r talking about? there is a card, powerkey inside, multistream by cisco...i dont know if it used or not
CAPONE
Junior Member
Posts: 5011
Joined: Sat Dec 27, 2008 3:25 pm

Post by CAPONE »

reflexus wrote:what card u r talking about? there is a card, powerkey inside, multistream by cisco...i dont know if it used or not
EASY to determine, Take card Out and see if box works. If like motorolo cable boxes, the box will turn on but not reflect any UID. Or in other words, the UID, Authorized Channels and else is In the card and If we can access it we CAN'T TEST IT. That SIMPLE.
"If you give a man a fish you feed him for a day. If you teach a man to fish you feed him for a lifetime."
reflexus
Junior Member
Posts: 14
Joined: Fri Nov 06, 2009 1:56 pm

Post by reflexus »

every time i take the card out, snmp is not accessable, trying to jtag this sucker, using 14 pins, but i dont know what config to use it? what should i try?
CAPONE
Junior Member
Posts: 5011
Joined: Sat Dec 27, 2008 3:25 pm

Post by CAPONE »

reflexus wrote:every time i take the card out, snmp is not accessable, trying to jtag this sucker, using 14 pins, but i dont know what config to use it? what should i try?
Like I said before, What appears to be a JTag Port, IF in fact a Jtag Prot, does not follow standard EJTag Protocol.
"If you give a man a fish you feed him for a day. If you teach a man to fish you feed him for a lifetime."
reflexus
Junior Member
Posts: 14
Joined: Fri Nov 06, 2009 1:56 pm

Post by reflexus »

What does jtag port means? would you please explain it
CAPONE
Junior Member
Posts: 5011
Joined: Sat Dec 27, 2008 3:25 pm

Post by CAPONE »

reflexus wrote:What does jtag port means? would you please explain it
GOOGLE is your FRIEND

"Like ISP (In System Programming) is a method/interface to program AVR microcontrollers, similarly JTAG also is an interface for Programming,"
"If you give a man a fish you feed him for a day. If you teach a man to fish you feed him for a lifetime."
reflexus
Junior Member
Posts: 14
Joined: Fri Nov 06, 2009 1:56 pm

Post by reflexus »

What programmer is capable to program it?
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

reflexus wrote:Mainboard

Samsung manufactured the board and holding up to their normal standards the board is very high quality. The mainboard uses all sold state capacitors. On the left side next to the cable card slot you'll see the dual digital tuner. Right above that is a Broadcom BCM3248KPBG, this is a QAMLink Set-Top box single-chip front end. Essentially this is the cable modem part of the box that allows it to be managed and to retrieve data as well.

In the middle of the board is a chip with a heat-sink on it. I didn't pop the heatsink off to identify the chip because I was going to have to disassemble the entire unit to get to the back of the board. I'm pretty sure this is the process that handles the video encoding/decoding which is CPU intensive and would necessitate a passive cooling device. Scattered throughout the board some some Samsung RAM chips and a couple of flash chips. There is a solder pad on the lower left next to the cable card that is labeled “MOCA” which stands for Multimedia over Coax, apparently this model does not have that feature.

There are a couple of 14-pin solder pads which could be JTAG ports, Broadcom doesn't usually release spec sheets for their parts unless your a customer so trying to track down JTAG ports usually requires a oscilloscope and patience.
Source Code
This DVR is running STB Linux and since its GPL software Samsung has posted the source code on their website. This could be helpful in gaining shell access to the device.
The source package includes the following files
• busybox.bz2 (Unix utilities optimized for embedded devices)
• dhcpcd.bz2 (DHCP client)
• fdisk.bz2 (Disk partitioning utility)
• stblinux.bz2 (Core operating system)
• tftpd.bz2 (TFTP server)
• uClibc.bz2 (C library optimized for embedded systems)
• xfsprogs.bz2 (Utilities for managing the XFS filesystem)


All companies release these new boxes, can u do something please?
Where can we download the source? From it I can see what core it uses. MIPS or ARM.
If it is MIPS core, then you can see if JTAG pin 2,4,6,8,10 are grounded.
reflexus
Junior Member
Posts: 14
Joined: Fri Nov 06, 2009 1:56 pm

Post by reflexus »

reflexus
Junior Member
Posts: 14
Joined: Fri Nov 06, 2009 1:56 pm

Post by reflexus »

So, what do you think?
Post Reply

Who is online

Users browsing this forum: No registered users and 7 guests