StarChoice, 4DTV and Digicipher II

BDM (NT) on Star Choice
Locked
Alonso
Junior Member
Posts: 67
Joined: Sun May 03, 2009 8:46 pm
Location: Merida , Yucatan Mexico

Post by Alonso »

yes i was and still completly able to get a dc light and the channel counter also increased still have that receiver turned on awaiting for a miracle but nothing yet
it gets the dc light in the channels wich are working checked with a subsc unit some channels do not get a dc signal because they were moved to eutelsat 5
Alonso
Junior Member
Posts: 67
Joined: Sun May 03, 2009 8:46 pm
Location: Merida , Yucatan Mexico

Post by Alonso »

About the clock date you call nps or sky and tell them to sincronize your clock you cant even touch it and even if you do it must be sync with the channels subs and some security bytes are associated with it. As i said before the trick is inside the xc chip and if i had a lab with microscope and microscopic probes and a several channel logic analizer the first thing to do is to look the registry where the UID is located solder some pins to the outside world and use a microprocesor to manipulate it at will so we can load and unload uids at will until we find a buddy with a very expensive channel subsc and then stay there until our rich buddy quits its subsc.
The idea is to first load backup the contents of the virgin new xc chip volatile ram
Edit the id and wait to midnight until we get the autorization hits and then we watch expensive tv.Having done all of this then we back up ram and nvram
So instead of using xc against us we can use it to make life easy playing by the rules of the ic chip.
if i sometime ever won the lotto ill redesign xc chip to be "editable" on the UID part
I still have the hability Of designin a procesor from discrete parts and still remember the day i get my Electronics engineer title by doing a 8 bit processor from discrete parts and when it worked i got my title i can remember it as if it happened yesterday.
Ill keep in touch and trying.
merkin
Junior Member
Posts: 246
Joined: Thu Jun 28, 2007 8:49 pm

Post by merkin »

Ok, Alonso I have another question and comments please. Thankyou again, I havent seen you post in a while, so I wasnt sure if you would respond.

We are talking about two different things XC chip AND/OR Satellite Maps. It is my fault I was confusing. Please make sure we distinguish them.

The Maps:
That is nice that you get DC lock and even channel count rises as well. Are you able to follow the first step of skyvision's instructions and get DC lock on Eutelsat 5 as well with the NEW EMM for HITS2HOME? It would be VERY interesting if SRL can activate the new UID. SRL PROBABLY WILL TRY IF YOU ASK. They have nothing to lose
Are you able to backup and restore the addon maps that get stored in the SRAM. When your battery went dead you lost UID and extra maps. The only maps left were those in the NVRAM which GI/Motorola shipped the units with.

**Are you able to READ the registers of the SRAM via BDM of your GOOD DSR and WRITE them to your BAD DSR that lost the maps?** Or after a Master reset?

The XC:
I understand your comments about XC.
I found this site http://www.tinytransistors.net/
Sure would be nice to have his scope. He looked at your pictures of the XC chip and believes it is possible to reverse engineer the circuits with an optical scope. Not an expensive electron scope. Also guessed the size between 1.0 - 0.5 microns.

Also look here http://www.programming-center.net/sams_online.htm
They let us send our own subscriptions by internet, no need to call.
It would be nice to get USBBDM's SPI logger going with DSR since we can activate/deactivate our subscriptions.
Alonso
Junior Member
Posts: 67
Joined: Sun May 03, 2009 8:46 pm
Location: Merida , Yucatan Mexico

Post by Alonso »

before using sams i dont know if they can deny service because i have the equipment in mexico.
Second part is yes i managed to change my uid and receiver number
But they are this:
UID: 5B-8408-1D54-16
RECEIVER NUMBER:091-22151-24308-022
They clearly say the number must start with 3 zeros but im failing miserably in that part.
Perhaps i should try to order some music channels for 7 usd and see if their system let me enter something wich doesnt starts with 3 zeros.
About the ic circuit i didnt tell this part because i cant prove it with photos due to lack of resolution but there are inner layers what you see on the video and photos is just the surface. I zoomed even more and i could see small tracks like an iron structure from a building but undressed no walls so this points to inner layers .
I didnt worry about ram because its just a mirror of the xc chip ram wich will be displaced when rehit is done.
when i installed the chip i could see my channel count like when you do a master reset and then going hi to 4854 channels just turn it on now but i found no dc light on g1-3
Alonso
Junior Member
Posts: 67
Joined: Sun May 03, 2009 8:46 pm
Location: Merida , Yucatan Mexico

Post by Alonso »

ok after too much time sitting my equipment i found w5 and park it there my channel map increased to 5030 i have a dc light in everychannel from 100 to 806 please note that from the ram was lost when battery died then i replaced the xc chip find satellites my channels increased on g1-3 when i did this now nomore g1-3 no dc signal lock found. now went to w5 and channel increased to 5030 guess ill have to try with hits2home if they can accept on screen my first digits not starting with 3 000's
Guess ill have to ask that question to somebody who is subscribed to see what happens if they try to enter other numbers like mine.
merkin
Junior Member
Posts: 246
Joined: Thu Jun 28, 2007 8:49 pm

Post by merkin »

@Alonso
Read through here http://www.themusicworkshopchicago.com/4dtv/index.html

Like I said, if you call SRL the worst that can happen is SRL will say "No". Tell them you used to get your service from NPS.

You cannot get a DC lock at g1-3 maybe because motorola shut down the EMM. (You can read all about it at the link above)

Can you go to GB satellite and try http://www.lyngsat.com/galaxy17.html
4115 H 19510 3/4 And tune to Northwest Cable News. Can you receive this?

Can you go to T4 satellite and try http://www.lyngsat.com/galaxy28.html
3780 H 29270 7/8 And tune to Net 1 or 2 or 3. Can you receive this?

You may have to load a generic satellite table to tune the right frequency and polarity. http://gofastmotorsports.com/4dtvgeneri ... etable.htm

I want to know if you can get FP keys programming still. When you lock a DC2 transponder you can go to subscription status and see FP, ZK, U etc. You should still be able to watch anything ZK. You should also be able to watch ZK and FP with your DSR that starts with UID 000-*****.

MOST IMPORTANTLY DO NOT DO A MASTER RESET after you download from g1-3

This is the problem EVERYONE is having. That 4play app was able to backup/restore maps via BDM. I believe that the SRAM has XC data like you said, but MAY also the "extra maps" from g1-3. We need to back these up since motorola stopped transmitting them. Then we can do MASTER RESETS again and load the maps ourselves via BDM.

I saw another thread where you used the DSR405.xml and started to manually poke around and you found data?
If I run the SRAM command line executable from the 4play souce It can dissassemble the SRAM dumps that are in there also.

I do not own a 4dtv so I cannot test. But I do have a DSR-4800, which dont need maps and gets ALL FP and ZK programs ;-)

Did you ever bet a digital receiver? I will trade you http://www.tbsdtv.com/english/product/QBox.html

If you send me one of the blank XC chips you bought.

You can connect this to your PC if it is fast and watch High Definition FTA digital signals.
Alonso
Junior Member
Posts: 67
Joined: Sun May 03, 2009 8:46 pm
Location: Merida , Yucatan Mexico

Post by Alonso »

I HAD the experience 3 times at least when battery dies i cant get anything after uid goes to 000s not even the clear channels to receive all again also when i performed a master reset i needed a rehit first not like yours wich still gets the clear signals.
The channels you talk about i cant get them because they are DC and i feel my rotor arm will not reach them my map i remember i updated the last time i parked on g1-3 and now that i park it all night at w-5 perhaps as you say i must back it up
How did you used 4play with usbbdm? or did you buyed another cable to do that?
So perhaps i should susbscribe to music channels and try a online rehit to see if their system takes my uid numbers NOT STARTING WITH 000'S
Alonso
Junior Member
Posts: 67
Joined: Sun May 03, 2009 8:46 pm
Location: Merida , Yucatan Mexico

Post by Alonso »

my status at w5 is ZK in every channel guess i need a rehit.
Alonso
Junior Member
Posts: 67
Joined: Sun May 03, 2009 8:46 pm
Location: Merida , Yucatan Mexico

Post by Alonso »

Here is the answer from srl i sent them a mail requesting my webSAMS

If that is no mistake as what your seeing for a receiver number, that receivers is NO good
Alonso
Junior Member
Posts: 67
Joined: Sun May 03, 2009 8:46 pm
Location: Merida , Yucatan Mexico

Post by Alonso »

Yesterday by thinking on reverse engineering about XC78066-9 and also thinking about doing it from discrete parts an idea came to me.
Did a call minutes ago to my ic supplier to ask if XC78066-9 it is avaiable as another brand and bingo its also avaiable as XILINX besides Motorola.Same function but with the logo of XILINX and motorola.
I was forgetting about PLDS instead of doing a des procesor from discrete parts we can create it as a PLD teoretically i said it like this because i havent programed in my life a PLD
and guess what XILINX does PLDS and this is a cheap way to make a processor .
NOW we have to start thinking how to read the program of the xc chip via ITS BDM pins to try to read their program
Please read here how this document relates to this

http://www.xilinx.com/support/documenta ... /wp115.pdf

Do you remember the set of photos i posted? do you remember the part of the program memory arrange lower left corner i mean. all of the upper part looks like the discrete parts array.
merkin
Junior Member
Posts: 246
Joined: Thu Jun 28, 2007 8:49 pm

Post by merkin »

Well there is still a way.

http://www.ats-electronics.com/ <<< they can fix it if you are willing to pay.
It also proves everything we want to do, can be done if we knew how.

I wonder why SRL will not even try to rehit your new ID even though its not three leading zeros. It seems they have nothing to lose, but they must have tried it before and it didnt work. Also they make no mention that you can subscribe from them because you are in Mexico. That probably means they will send hits to you with a good UID 000-****** and you can subscribe from Mexico.

That is also strange the DSR with the new UID says ZK for every channel channel on W5. That is definately NOT the case, although it would be nice.

About the clock sychronization: There are reports of people who subscribed to hits2home and when the rotor to a different satellite there clocks begin to lose time. Everything is restored however once they go back to W5. Any thoughts on that?
http://www.satelliteguys.us/4dtv-discussion/

Also Alonso the maps, you are looking for no longer exist on any satellite at all. Motorola shut them down. We are all holding out on doing a master reset until we have confirmed a way to backup and restore the "Full maps", because after a master reset the only maps left are those stored in the NVRAM. But we NEED to save "extra" the maps that I think maybe are stored inside SRAM.

4play cannot be used with USBBDM it is meant for a parrallel lpt to BDM cable (referred to as a wiggler) There are two public versions
1. PD BDM http://www.btinternet.com/~j_holland/de ... AN1230.pdf
(circuit is on page 3)

2. Gal16v8 based
http://cmp.felk.cvut.cz/~pisa/m683xx/bdm_driver.html

Have you ever programmed a GAL before with OPAL file?
Considering you background, this stuff should be a walk in the park. Please download the 4play source code and look through the directories. You will find data sheets and command line apps, and ALSO SRAM memory register sizes and locations.

I am confused, what is your Eastern most satellite past W5 105.0w that you can recieve? GB is at 91.0w and T4 is at 89.0w degrees. You should easily be able to receive satellites between 61.0w-139.0w. How many inches is your actuator?

If your rotor cannot get past W5, then you are missing a lot of channels...you should fix it. http://www.gofastmotorsports.com/channellist.html
http://www.lyngsat.com/america.html

Good Luck.
Lets figure out the location of the "extra maps" so we can back them up and reload.
Too bad you didnt replace your batteries http://www.pacificsites.com/~alanjudd/920.htm
before they died.
merkin
Junior Member
Posts: 246
Joined: Thu Jun 28, 2007 8:49 pm

Post by merkin »

Alonso wrote:Yesterday by thinking on reverse engineering about XC78066-9 and also thinking about doing it from discrete parts an idea came to me.
Did a call minutes ago to my ic supplier to ask if XC78066-9 it is avaiable as another brand and bingo its also avaiable as XILINX besides Motorola.Same function but with the logo of XILINX and motorola.
I was forgetting about PLDS instead of doing a des procesor from discrete parts we can create it as a PLD teoretically i said it like this because i havent programed in my life a PLD
and guess what XILINX does PLDS and this is a cheap way to make a processor .
NOW we have to start thinking how to read the program of the xc chip via ITS BDM pins to try to read their program
Please read here how this document relates to this

http://www.xilinx.com/support/documenta ... /wp115.pdf

Do you remember the set of photos i posted? do you remember the part of the program memory arrange lower left corner i mean. all of the upper part looks like the discrete parts array.
Now this is interesting because my DSR-4800 has about 5 Xlinix chips in it, with jtag/bdm headers, also look at the picture of my DSR-4800. It has a GI ACE control module for XC.
http://cgi.ebay.com/ws/eBayISAPI.dll?Vi ... K:MEWAX:IT
Everytime I see one of these on Ebay I copy the picture and take note of the UID.
The only differece in UID is the part I erased. It should be easy to bruteforce active UID's if tht is the case.

WE NEED TO FIND OUT HOW TO LOAD UID ONTO XC, that simple.

Please note
dte-7100/7150 and dsr-4800/4810 are all interchangeable units.
You do not have the required permissions to view the files attached to this post.
RIP_Felipeferras
Junior Member
Posts: 489
Joined: Thu Dec 31, 2009 6:33 pm

Post by RIP_Felipeferras »

guys you should go to the chat i mean you been in this post all day long
٩(●̮̮̃•)۶=ε/̵͇̿̿/'̿'̿ ̿ ᴼ•ₒ ○ ˚ͦ ◦•ᵒ ºᴼ•ₒ no andaba muerto andaba de parranda ₒ•ᴼ۝
Alonso
Junior Member
Posts: 67
Joined: Sun May 03, 2009 8:46 pm
Location: Merida , Yucatan Mexico

Post by Alonso »

Even if it is a PLD we still have one trouble if security bit is active we cant read nothing and to date i dont know any device that bypasses security in this devices .
wolffie454
Junior Member
Posts: 34
Joined: Mon Jul 05, 2010 12:49 pm
Location: Somewhere in space and time

Post by wolffie454 »

merkin wrote:
About the clock sychronization: There are reports of people who subscribed to hits2home and when the rotor to a different satellite there clocks begin to lose time. Everything is restored however once they go back to W5. Any thoughts on that?
I too have been wondering about the clock, when I go to for example to Morelos satellite clock changes by over 2 hours, and some sats such as c4 or W7 lose a few minutes. So, clock can/is settable via DCII streams. I do not recall this happening prior to G1-3 being shut down. This is interesting because if system clock time can be changed that easily, I assume date could be as well which may prove to be beneficial.

I have backed up memory from dsr922, but have not noticed the extra (generic) maps in the file. I do notice the stock tiles however. Has anyone found the generic location yet?
Locked

Who is online

Users browsing this forum: No registered users and 7 guests