The ejflash.ini has to be edited to include the flash chip you are playing with.
I think the cable pinout is the ejtag wiring,not the standard simple jtag.
The jtag cable wiring must match the program,so you can't use wigglers or other
wiring designed for other jtag programs.

Tanks

I may not be a simple jtag,it looks like something you would have to buy.
From the tele-sat forum.

Schema Russian amending the LPT pin 8/11 so that anything

Structurally, combined with the JTAG programmer (SPI Saketa SPI).
Working in EPP mode, this version of JTAG adapter provides speeds of 2-4 more than the usual scheme of NS244.

Environment:

Connecting to the JTAG port, run the program CPLD_EJTAG_TT, connect the power from USB JTAG. After connecting the power supply is usually the LPT port is in the SSP and the standby LED green card "Act" is off. Press the "Connect", "act" should be lit. If you click "Connect" indicator "lights ACT 'and then leave after a few seconds (do not change the port mode EPP), you must:
1. Try changing the mode of LPT port in BIOS to EPP 1.9
2. Dopayat ohm resistor between 68-100 feet 13 LPT connector and the general conclusion of feeding (18-25 contacts LPT), as shown below

Programer SPI

Manual Ejtagg_TT

It's interesting to note that EJTAG developers have decided to upload the DCU3 trap routine into internal memory (0x80000400) so that they don't have to setup the external RAM.

The sti5105 jtag was for a 4meg flash.
It was 1000 blocks of 4k each.
It would be tedious making an ejflash.ini for that.

It won't work with a simple jtag,the program crashes.
Probably looking for the missing atmel interface.
Strike 2 is the fact it will only do up to 2meg flashes,
my sti5105 receivers have 4meg flashes.

If you look at the ejset.ini you will see the program was linked to a
particular pc.Sounds like you have to pay$$$ to get a working version.

Code:

<?xml version="1.0"?> <CONFIG svIptr="80000400" svPort="888" svLevel="0" svEppMode="False" svUserCpuId="1027764289" svForceDetect="False"/>

My EJTAG_TT is program of module type.
Flash module possible to flashing up to 16mb flash (tested on 8mb Intel 28F640, more 8mb i not have for test).
In ST20 core DCU2/3 flashing/reading speed 20-25kbyte/sec.

Sergius very sorry for the upload EJTAG CPLD software in rapidshare.com
I have ban in tele-sat.ru for upload EJTAG CPLD software in rapidshare.com.
Many people are interested in handling processors DCU3.
Sergiuss whether it could add support to the program DCU3 procesors EJTAG Tiny Tools?
Very many people would be happy if they would be able to read and write flash in processor DCU3 (STI5517. ..)

The biggest gains in sat hacking have been made right after programs were
released free to the public.By the time a free dcu3 core1/2 program has been
made public those processors will be obsolete.
The sti5516/17 has been around since the 1990's and is already an antique.
I have no urge to buy a jtag device/program if I am only going to use it once.

aha !

It seems the ST DCU3 unit is lockable on most of the 5514/16/17 devices (and probably others as well). From what I've been told the unit can either be locked permanently or put into a mode where it requires an unlock key (which seems to be customer definable).

When locked, the DCU unit will ignore virtually everything except the unlock command. The TDO pin will tend to stay in its 3-state hi impedance state whenever the DCU should be outputting data. This behaviour is pretty much what i've been see'ing on my test board

DCU lock doesn't interfere with the jtag ID command.

Looks like the only way to jtag these boards might be to replace the processor with an unlocked chip. Probably not really very practical for the majority of people.

I was always able to get full flash dumps from my sti5516 based receivers
using jkeys.The pvr2flash files were for fixing the pace3100 receiver,which
was sti5514 based.If those old processors were locked,it must have just been
a fad that didn't catch on.Later more modern processors just don't have jtag
spots to thwart pirates.

Seems there is an extra set of commands to the DCU.

1. Permanent DCU external connection disable
2. DCU lock <key>
3. DCU unlock <key>

Looks like nothing particularly fancy but once the DCU has been locked with a key then it can only be opened with that same key. The ST specs say that all processors with DCU3 or later debug units have this capability.

Must admit it is strange that some boxes seem to implement this system whilst some dont, even from the same manufacturer. I've even seen a Pace pvr 3100 that appears locked whilst another one reads no problem (with exactly the same jtag hardware). It seems quite random !

Hi guys.

Do you know what type of key can be used, @Boxy?
I also think that TDO doesn't always stay hi-Z after cpuID. It actually burps out something...

Best regards.

9u4rk wrote:

QUOTE:
Hi guys.

Do you know what type of key can be used, @Boxy?
I also think that TDO doesn't always stay hi-Z after cpuID. It actually burps out something...

Best regards.

I think its an 8 byte key. I'd guess it will just be 8 bytes that get stuck in a set of non-volatile registers when you program the lock key. When you try to unlock, the key will be compared to the lock key previously entered.

I have no idea what the actual DCU commands are for setting these various modes. ST generic equipment neither mentions or uses such things. I think this is something that was requested of ST by various customers. If you know the command I would be a little careful as there may well be a 5-try lockout on the code.

The TDO output seems to be selectively open circuit. Various things like Jtag Id still work perfectly well and even certain DCU commands may work ok

Hi guys.

Unfortunately, I don't know the DCU command...
Well, we're being shut out!

Best regards.