SB6190 Arris/Motorola
Moderators: justsomeguy, Koevoet
-
- Junior Member
- Posts: 6
- Joined: Sun Jul 12, 2009 7:35 am
SB6190 Arris/Motorola
Hi, I have a spare SB6190. I opened it, and discover that the circuit board is very different from the SB6141 and SB6121 modems. I'll post the SB6190 pictures to check and see if it has Jtag connection points and the ISP point. My plan is to backup its firmware and install a dual boot Forceware 1.4b_mod2/Alpha 3.0 firmware. Can you help me to identify the flash eeprom?
Thank you!!
Thank you!!
-
- Junior Member
- Posts: 7
- Joined: Mon Oct 19, 2015 8:57 am
have heard there's some development on the NAND. That's a Puma 6 right?
Axl16 wrote:Hi, I have a spare SB6190. I opened it, and discover that the circuit board is very different from the SB6141 and SB6121 modems. I'll post the SB6190 pictures to check and see if it has Jtag connection points and the ISP point. My plan is to backup its firmware and install a dual boot Forceware/Alpha 3.0 firmware. Can you help me to identify the flash epprom.
Thank you!!
-
- Junior Member
- Posts: 6
- Joined: Sun Jul 12, 2009 7:35 am
Yes, it's (Intel) PUMA 6 based...deestee wrote:have heard there's some development on the NAND. That's a Puma 6 right?
What I don't know if the flash is 8MB or 16MB...
I'll add the pictures to a zip file for everyone to check it in full resolution...
Here's:
You do not have the required permissions to view the files attached to this post.
-
- Junior Member
- Posts: 6
- Joined: Sun Jul 12, 2009 7:35 am
Update!!
I discovered that this modem is based on the MX30LF1G18AC-TI NAND flash eeprom with 1Gbit of storage memory. Again, I still don't know the firmware size (8/16MB), but I have the data file of this chip from Macronix. Here's the file:
Also, I'd like to know if USBJTAG supports this chip. There's another way to backup the firmware using Putty in SSH mode as the cable provider does updating the firmware...(But, I don't know the commands & password to do that).
Also, I'd like to know if USBJTAG supports this chip. There's another way to backup the firmware using Putty in SSH mode as the cable provider does updating the firmware...(But, I don't know the commands & password to do that).
You do not have the required permissions to view the files attached to this post.
-
- Junior Member
- Posts: 6
- Joined: Sun Jul 12, 2009 7:35 am
Tsop port connection
This PCB board has two 4-pin port connections: the ARM and ATOM. Could I connect the USBJtag to these ports?, or is better to connect it directly to the flash chip?. This chip supports only 3.3V, so the USB cable 5V trick won't work, I have to find an AC adapter to provide the 3.3V externally. Also, I need to find a TSOP test clip to connect it, due the chip's tiny pads is difficult to solder them. Any suggestion to connect those pins...
Thanks!!
There's an open source package (9.1.93D firmware) from Sourceforge: Mine is 9.1.93N (the latest ).
https://sourceforge.net/projects/sb6190.arris/files/
I'd like to know if someone has compiled this firmware on Linux.
Also, this modem has a backdoor like other Arris modems:
https://w00tsec.blogspot.com/2015/11/ar ... or-in.html
Here's a guide of NAND Flash Programming, using a Xeltek programmer . I'd like USBJtag Software to support these features concerning NAND Flash devices.
http://www.xeltek.com/resources/technical-articles/memory-device-types/nand-flash-programming/
Thanks!!
There's an open source package (9.1.93D firmware) from Sourceforge: Mine is 9.1.93N (the latest ).
https://sourceforge.net/projects/sb6190.arris/files/
I'd like to know if someone has compiled this firmware on Linux.
Also, this modem has a backdoor like other Arris modems:
https://w00tsec.blogspot.com/2015/11/ar ... or-in.html
Here's a guide of NAND Flash Programming, using a Xeltek programmer . I'd like USBJtag Software to support these features concerning NAND Flash devices.
http://www.xeltek.com/resources/technical-articles/memory-device-types/nand-flash-programming/
-
- Junior Member
- Posts: 13
- Joined: Fri Sep 30, 2011 12:16 pm
heres what was built with the toolchain, a u-boot and arm11 image http://www.mediafire.com/file/yi1k8xdax ... anilla.rar
the ATOM and ARM port, is a serial port pinout, this modem uses a multi image firmware, the atom core has its own firmware/bios, and then that will load an arm11 fw for the puma chipset, the processors speak to each other via rpc, which means its hard to do anything without crashing it completely, those images, even compiled, its hard to flash them, i have yet to find a working way, all the 6190's I have use a 1gb spansion flash (or atleast thats what the only data sheet I found says, the modems serial output, says its 128mb, I believe the phison chip in the corner is the eMMC driver, or could be actual flash as well, storing the cefsk for the intel side of the chipset? hard to tell, but this modem is a pain, no jtag that i can see, crashing bootloader at the right time gets you a shell on atom, and a recovery shell on ARM side, from which you can upgrade via ram or memory, and grab a file via tftp(ATOM SIDE ONLY) but i cant get them to boot the memory addr, since the actual bootloader is crashed and eMMC acts messed up because of drivers not working correctly from the crash. so yeah its a pain lol also, as far as I can see, the back door is not on the sb6190 unless you just have a very early stage fw, at which case send me a copy of it lol.
the ATOM and ARM port, is a serial port pinout, this modem uses a multi image firmware, the atom core has its own firmware/bios, and then that will load an arm11 fw for the puma chipset, the processors speak to each other via rpc, which means its hard to do anything without crashing it completely, those images, even compiled, its hard to flash them, i have yet to find a working way, all the 6190's I have use a 1gb spansion flash (or atleast thats what the only data sheet I found says, the modems serial output, says its 128mb, I believe the phison chip in the corner is the eMMC driver, or could be actual flash as well, storing the cefsk for the intel side of the chipset? hard to tell, but this modem is a pain, no jtag that i can see, crashing bootloader at the right time gets you a shell on atom, and a recovery shell on ARM side, from which you can upgrade via ram or memory, and grab a file via tftp(ATOM SIDE ONLY) but i cant get them to boot the memory addr, since the actual bootloader is crashed and eMMC acts messed up because of drivers not working correctly from the crash. so yeah its a pain lol also, as far as I can see, the back door is not on the sb6190 unless you just have a very early stage fw, at which case send me a copy of it lol.
-
- Junior Member
- Posts: 173
- Joined: Sat Oct 21, 2006 11:04 pm
Re: SB6190 Arris/Motorola
The only way that I have seen the 6190 firmware get up graded is using the phison mod.
-
- Junior Member
- Posts: 8981
- Joined: Mon Jul 18, 2005 9:33 pm
Re: SB6190 Arris/Motorola
I am working on emmc support. Hope we can do emmc programming soon.
-
- Junior Member
- Posts: 1
- Joined: Sat Sep 26, 2020 4:20 pm
Re: SB6190 Arris/Motorola
Thanks for adding the bitware script to 1.28, it's a big help.
-
- Junior Member
- Posts: 1
- Joined: Sat Jan 28, 2023 7:33 am
Re: SB6190 Arris/Motorola
can someone help me I need a link for bit ware 1.0.5.9 dev. thank you very much from Germany
Who is online
Users browsing this forum: No registered users and 5 guests