DCH70 TDI discovery

DCH 70 DCH3416
Post Reply
merkin
Junior Member
Posts: 246
Joined: Thu Jun 28, 2007 8:49 pm

DCH70 TDI discovery

Post by merkin »

TDI from 14-pin header check out pics of top and bottom.
There is another device in the chain :(
The top via goes directly to the lattice pld.
Need to determine TDO pin of pld, than we will have TDI of bcm7115 :)
We know TDO of bcm7115 is connected to 14-pin header since we get IDCODE.
May need to cut some traces and use a jumper to bypass the pld, but maybe good idea try BYPASS mode on the pld first, which would have the same effect.

Image
Image

The traces are so damn small, but I double and triple checked my work. Maybe someone else with dch70 can confirm.
auroden
Junior Member
Posts: 9
Joined: Tue Sep 18, 2012 10:26 pm
Location: Netherlands

DCH-70 JTAG connections

Post by auroden »

I hope a schematic diagram will help you in achieving your task. Here is attached a RAR file with all the connections you are looking for on this box.
Both TDI and TDO pins are connected to other chips. I highlighted the pins of interest.
You do not have the required permissions to view the files attached to this post.
macgyver12
Junior Member
Posts: 64
Joined: Thu May 13, 2010 9:28 am

Post by macgyver12 »

Good job to both of you, and great contribution!
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

If that is the case we just need to modify the software to bypass the chip.
merkin
Junior Member
Posts: 246
Joined: Thu Jun 28, 2007 8:49 pm

Post by merkin »

auroden wrote:I hope a schematic diagram will help you in achieving your task. Here is attached a RAR file with all the connections you are looking for on this box.
Both TDI and TDO pins are connected to other chips. I highlighted the pins of interest.
Thanks. Gave up last week when I realized the chips were not in the same chain. http://www.latticesemi.com/products/cpl ... /index.cfm

Enjoy your posts, hopefully it does not get removed.
merkin
Junior Member
Posts: 246
Joined: Thu Jun 28, 2007 8:49 pm

Post by merkin »

usbbdm wrote:If that is the case we just need to modify the software to bypass the chip.
TDI is connected to a IO on the PLD. Its hard to tell from the pics, but the pld may be bridging the cpu and the flash anyway.

Another appraoch is to use BSDL from lattice and use boundary scan. But first need to find test points(if they exist) for that the chain. TDI, TDO, and TMS are on the edge of the pld so tracing will be easy, but TCK is buried.
merkin
Junior Member
Posts: 246
Joined: Thu Jun 28, 2007 8:49 pm

Found TDI

Post by merkin »

Code: Select all

Copyright (C) 2010,2011,2012
USB JTAG NT    0.57
Target: DCH70
-detect
IDCODE 2711517F
Broadcom BCM7115
IMPCODE 00800908
EJTAG V1, V2.0
DMA supoorted
Unknown flash type!
Report these values http://www.usbjtag.com/vbforum 1000,014f
-bk
-program
-FLSHDCT 90000000
Unknown flash type!
Report these values http://www.usbjtag.com/vbforum 1000,014f
-tap c
Eco :4504B125
-tap a ffffffff
Eco :0024C108
-detect
IDCODE 2711517F
Broadcom BCM7115
IMPCODE 00800908
EJTAG V1, V2.0
DMA supoorted
Unknown flash type!
Report these values http://www.usbjtag.com/vbforum 1000,014f
Image
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

Great!!
Setup teamviewer and I can take a look remotely.
merkin
Junior Member
Posts: 246
Joined: Thu Jun 28, 2007 8:49 pm

Post by merkin »

im in irc now...

its very good news, all data looks good from ram )

the bootloader is compressed with http://www.zlib.net/

still poking around. ;)
Killswitch
Junior Member
Posts: 439
Joined: Tue Mar 23, 2010 6:12 am

Determination

Post by Killswitch »

For all of us STB aficianados that are still here, it's time to put Mr. Merkin on a pedestal. He is a very determined man. I applaud you, Sir. Your skill carries a wide path.
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

I confirm that TDI is working!!.
Here is the little XML I created.
The last reserved might not be able to programmed. Try to avoid to program it.
The CPU is the same as DCT2500.The platform might be slightly different.

How many people are using DCH70 still? We might be able to do some firmware testing if there is enough interest.
You do not have the required permissions to view the files attached to this post.
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

macgyver12
Junior Member
Posts: 64
Joined: Thu May 13, 2010 9:28 am

Post by macgyver12 »

It's a garbage box, HOWEVER....

The real breakthrough here by Merkin is that its a cablecard box....

That being said, this may actually be the FIRST jtag-able cablecard box using USBJTAG


Great job Merkin!
afterhoursalex
Junior Member
Posts: 71
Joined: Sat Jan 12, 2008 7:03 pm

im interested

Post by afterhoursalex »

lets get started,great job merkin
MrRogers
Junior Member
Posts: 775
Joined: Mon Jan 19, 2009 9:25 pm
Location: 127.0.0.1>localhost

Post by MrRogers »

It would be nice to see additional progress made although it is quite irrelevant at this point. But on the other hand we cannot forget our roots and how far we have come and accomplished and in only a short amount of time.

SBH as a whole has not even come close to achieving 5% of what usbjtag and it's members have in the last 3 years. So that is something to be proud of, and good work merkin very good info indeed. Let's see what kinda damage you can do with that haha ;)
I JTAGGED your mom.
I was told that there is no such thing as a free lunch, I then learned through personal experience that the best things in life ARE FREE - Me

WE ARE ANONYMOUS, EXPECT US.

All posts/topics that I post in are completely hypothetical in real life and should not be taken seriously.
Post Reply

Who is online

Users browsing this forum: No registered users and 6 guests