DCH70 TDI discovery

DCH 70 DCH3416
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

I can confirm the firmware and data are similar to DCT2500. It should be possible to make a dll for this device.
However, I managed to kill the box when soldering the TDI pin.
MrRogers
Junior Member
Posts: 775
Joined: Mon Jan 19, 2009 9:25 pm
Location: 127.0.0.1>localhost

Post by MrRogers »

Congratulations haha, another box lost is another lesson learned :p
I JTAGGED your mom.
I was told that there is no such thing as a free lunch, I then learned through personal experience that the best things in life ARE FREE - Me

WE ARE ANONYMOUS, EXPECT US.

All posts/topics that I post in are completely hypothetical in real life and should not be taken seriously.
cherrymachine
Junior Member
Posts: 177
Joined: Thu Jul 26, 2007 7:52 am

DCH70 takes one for the team....lol

Post by cherrymachine »

I have some of these..need one let me know
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

DCh70 now has a signature at the end. So the original firmware patch might not work unless it is signed again.
Killswitch
Junior Member
Posts: 439
Joined: Tue Mar 23, 2010 6:12 am

Post by Killswitch »

I guess that it's time for some education. In the case of the DCH70 that has a dual mode of Security (Host and M Card) do you remove the M Card if you plan to Flash the Host ? On normalized units, the M Card controls the security. But, if ya yank the Card and Flash the Host, will it work independently and on its own ? Common Sense would lead me to believe this would be the case. But, as we all know, Testing is based on trial/error and you learn as you go. Just to set up a 14 pin Header and run the TDI onto it will be a challenge. Just like somebody else said, the box itself isn't too proud but will serve the purpose of being a good Guinea Pig. I can hear the pig Oinking already.
racerx007
Junior Member
Posts: 47
Joined: Fri Oct 29, 2010 8:04 pm

was not that hard

Post by racerx007 »

i used a 6 inch piece of 30 ga. wire wrapping wire and soldered to the bottom of the pc board solder a 14 pin header with pin 3 removed before you soler it to the pc board.then solder the free end to pin you removed from the connecter now plug the pin with the wire into the jtag f/m connector pin 3 then plug the jtag connector onto the 14 pin header and read away.
put the new xml in config folder and in like nothin flat there's a fresh set of backups saved.I'll try to post a picture of the connect it's simple.

I'll try to send you some current backups to try to help.

thanks to all those involved and keep testing !
Wolfgang
Junior Member
Posts: 158
Joined: Fri May 03, 2013 6:00 pm
Location: Wild Wild West
Contact:

All JTAG points for DCH-70

Post by Wolfgang »

It's been a while since this thread has gone silent. Has any progress been made regarding the testing of this model? I don't have a DCH-70 but I came across a doc that gives away all the JTAG points for programming the flash. I apologize for the ignorance if someone has done it but I saw there were troubles identifying some JTAG points in previous posts so for those that haven't done it here they are:

TP 406 equals to TCK
TP 407 equals to TMS
TP 408 equals to TDI
TP 409 equals to TD0
TP 410 equals to VCC
TP 411 equals to Gnd

I hope this helps.
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

Wolfgang wrote:It's been a while since this thread has gone silent. Has any progress been made regarding the testing of this model? I don't have a DCH-70 but I came across a doc that gives away all the JTAG points for programming the flash. I apologize for the ignorance if someone has done it but I saw there were troubles identifying some JTAG points in previous posts so for those that haven't done it here they are:

TP 406 equals to TCK
TP 407 equals to TMS
TP 408 equals to TDI
TP 409 equals to TD0
TP 410 equals to VCC
TP 411 equals to Gnd

I hope this helps.
I did make one dll like DCT700. However there does not seem to be any voice in here.
Wolfgang
Junior Member
Posts: 158
Joined: Fri May 03, 2013 6:00 pm
Location: Wild Wild West
Contact:

JTAG on DCH-70

Post by Wolfgang »

It was reported to me that DCH-70 does not have those test points so I wanted to show a snap shot from the main board circuit diagram of the phase 1 where one can see the Test Points I was referring to.

Image

It is confirmed, these test points for a JTAG connection are present on the bottom side of the main board on DCH-70 Phase 1.
Killswitch
Junior Member
Posts: 439
Joined: Tue Mar 23, 2010 6:12 am

Skill

Post by Killswitch »

Wow! The first thing that comes to mind with this discovery is what Mr. Merkin must be thinking. There's the story of a Man who found the Needle in a Haystack (TDI) on the TOP part of the Board. Who, in their right mind, is gonna flip that Board upside down to get the job done ? Damn if that ain't remarkable ! The irony is beyond belief. Motorola must be slightly Homosexual. And, if not, maybe they go both ways. Bravo to Merkin - easily the most accomplished Tester still remaining.
merkin
Junior Member
Posts: 246
Joined: Thu Jun 28, 2007 8:49 pm

Post by merkin »

Wolfgang wrote:It was reported to me that DCH-70 does not have those test points so I wanted to show a snap shot from the main board circuit diagram of the phase 1 where one can see the Test Points I was referring to.

Image

It is confirmed, these test points for a JTAG connection are present on the bottom side of the main board on DCH-70 Phase 1.
But these are for the pld..only good for boundary scan probably. Btw the blue color is a dead giveaway that the test points are on the bottom of the board, if red they would be on top I think.

There is even another set of jtag test points for the fpga..again probably only boundary scan.

If you read back in the thread usbbdm mentions that end of flash has bad data. I think this is the encrypted verilog code which configures the fpga on every boot. The fpga controls the cable card. Fpga probably uses parallel flash loader megafunction to get this data from flash.

Nice thing about dch-70 is mine is unsubscribed, but still gets new keys..not sure why/how. That's the million dollar question.
Post Reply

Who is online

Users browsing this forum: No registered users and 4 guests