SB6190 Arris/Motorola

SB6XXX,SBV6XXX

Moderators: justsomeguy, Koevoet

Post Reply
Axl16
Junior Member
Posts: 6
Joined: Sun Jul 12, 2009 7:35 am

SB6190 Arris/Motorola

Post by Axl16 »

Hi, I have a spare SB6190. I opened it, and discover that the circuit board is very different from the SB6141 and SB6121 modems. I'll post the SB6190 pictures to check and see if it has Jtag connection points and the ISP point. My plan is to backup its firmware and install a dual boot Forceware 1.4b_mod2/Alpha 3.0 firmware. Can you help me to identify the flash eeprom?

Thank you!!

ImageImageImageImageImageImageImageImage
ImageImageImageImageImageImageImageImage
deestee
Junior Member
Posts: 7
Joined: Mon Oct 19, 2015 8:57 am

Post by deestee »

have heard there's some development on the NAND. That's a Puma 6 right?
Axl16 wrote:Hi, I have a spare SB6190. I opened it, and discover that the circuit board is very different from the SB6141 and SB6121 modems. I'll post the SB6190 pictures to check and see if it has Jtag connection points and the ISP point. My plan is to backup its firmware and install a dual boot Forceware/Alpha 3.0 firmware. Can you help me to identify the flash epprom.

Thank you!!
Axl16
Junior Member
Posts: 6
Joined: Sun Jul 12, 2009 7:35 am

Post by Axl16 »

deestee wrote:have heard there's some development on the NAND. That's a Puma 6 right?
Yes, it's (Intel) PUMA 6 based...
What I don't know if the flash is 8MB or 16MB...
I'll add the pictures to a zip file for everyone to check it in full resolution...
Here's:
You do not have the required permissions to view the files attached to this post.
Axl16
Junior Member
Posts: 6
Joined: Sun Jul 12, 2009 7:35 am

Update!!

Post by Axl16 »

I discovered that this modem is based on the MX30LF1G18AC-TI NAND flash eeprom with 1Gbit of storage memory. Again, I still don't know the firmware size (8/16MB), but I have the data file of this chip from Macronix. Here's the file:

Also, I'd like to know if USBJTAG supports this chip. There's another way to backup the firmware using Putty in SSH mode as the cable provider does updating the firmware...(But, I don't know the commands & password to do that).
You do not have the required permissions to view the files attached to this post.
Axl16
Junior Member
Posts: 6
Joined: Sun Jul 12, 2009 7:35 am

Tsop port connection

Post by Axl16 »

This PCB board has two 4-pin port connections: the ARM and ATOM. Could I connect the USBJtag to these ports?, or is better to connect it directly to the flash chip?. This chip supports only 3.3V, so the USB cable 5V trick won't work, I have to find an AC adapter to provide the 3.3V externally. Also, I need to find a TSOP test clip to connect it, due the chip's tiny pads is difficult to solder them. Any suggestion to connect those pins...

Thanks!!

ImageImageImage
Image Image

There's an open source package (9.1.93D firmware) from Sourceforge: Mine is 9.1.93N (the latest ).
https://sourceforge.net/projects/sb6190.arris/files/
I'd like to know if someone has compiled this firmware on Linux.
Also, this modem has a backdoor like other Arris modems:
https://w00tsec.blogspot.com/2015/11/ar ... or-in.html
Here's a guide of NAND Flash Programming, using a Xeltek programmer . I'd like USBJtag Software to support these features concerning NAND Flash devices.
http://www.xeltek.com/resources/technical-articles/memory-device-types/nand-flash-programming/
Lin Huan
Junior Member
Posts: 10
Joined: Fri Oct 09, 2015 1:31 pm

Post by Lin Huan »

Thumbs up man great work, wish i could help you but it's a bit out of my knowledge sorry
demonspride
Junior Member
Posts: 13
Joined: Fri Sep 30, 2011 12:16 pm

Post by demonspride »

heres what was built with the toolchain, a u-boot and arm11 image http://www.mediafire.com/file/yi1k8xdax ... anilla.rar

the ATOM and ARM port, is a serial port pinout, this modem uses a multi image firmware, the atom core has its own firmware/bios, and then that will load an arm11 fw for the puma chipset, the processors speak to each other via rpc, which means its hard to do anything without crashing it completely, those images, even compiled, its hard to flash them, i have yet to find a working way, all the 6190's I have use a 1gb spansion flash (or atleast thats what the only data sheet I found says, the modems serial output, says its 128mb, I believe the phison chip in the corner is the eMMC driver, or could be actual flash as well, storing the cefsk for the intel side of the chipset? hard to tell, but this modem is a pain, no jtag that i can see, crashing bootloader at the right time gets you a shell on atom, and a recovery shell on ARM side, from which you can upgrade via ram or memory, and grab a file via tftp(ATOM SIDE ONLY) but i cant get them to boot the memory addr, since the actual bootloader is crashed and eMMC acts messed up because of drivers not working correctly from the crash. so yeah its a pain lol also, as far as I can see, the back door is not on the sb6190 unless you just have a very early stage fw, at which case send me a copy of it lol.
universall
Junior Member
Posts: 173
Joined: Sat Oct 21, 2006 11:04 pm

Re: SB6190 Arris/Motorola

Post by universall »

The only way that I have seen the 6190 firmware get up graded is using the phison mod.
usbbdm
Junior Member
Posts: 8730
Joined: Mon Jul 18, 2005 9:33 pm

Re: SB6190 Arris/Motorola

Post by usbbdm »

usbbdm
Junior Member
Posts: 8730
Joined: Mon Jul 18, 2005 9:33 pm

Re: SB6190 Arris/Motorola

Post by usbbdm »

I am working on emmc support. Hope we can do emmc programming soon.
Post Reply

Who is online

Users browsing this forum: No registered users and 1 guest