......

Hi 9u4rk,

Any progress in this Front? Did you have success dumping the flash?

Best regards

Hi guys.

Unfortunately, nothing at all...

Best regards.

Hello.. people, i like to thanks to evreybody on this forum for this wonderfull thread wich helping me to see many thinks...
About my first jtaging experience, i try to dumping a STi5107, 10 pinout, and after many research i am preety sure the connection is the same like STi5517, but the definiton file for 5107 is missing me!
Hop i'll fiind the needed help here...

Great Day

Tired of continuous searching? Here's what you are looking for - Rar Repair Tool 4.0

It seems that they continue to work on the DCU3 cpu's on that site http://forum.tele-sat.ru/showthread.php?t=3570
But you need at least 5 posts to be able to download the utilities.
Rgds.

I could never even register there,so forget that one.

I have seen examples of sti5518 based firmware that had anti-jtag code
to disable the jtag port.So it may be possible that other processor
firmware has the same thing.That would also explain the serious lack
of dcu3 jtag programs.

Hi guys.

It's been quite a while since I last tried anything on the 5517. Sort of given up because, as far as I could understand it and in my particular case, looks like after the initial data exchange, the processor waits for a code to be inputted to proceed any further. Maybe brute-force would be the next step but, unfortunately, I have no time to carry on testing it...

Best regards.

The sti5517 toolset has a flashburner program to compile,so if people can't do that
and burn the flash there must be something in the firmware preventing it.

I assume you have to prevent the receiver from booting into the firmware,
similar to the BFR on a sti5518 processor.If the receiver boots all the
way the jtag port is probably then disabled.The sti5517 was supposed to
have enhanced security to prevent pirating.

The enhanced security is basically a a command and client PIN number. Unless you know the correct PIN then you cannot initialise the DCU unit beyond very basic jtag functions.

Unfortunately, there's also a lockout on the PIN. Get it wrong 5 times and the chip effectively locks out further attempts permanently. There is probably a manufacturer reset code but this is unknown

Strange,since the sti5517 toolset never mentions it.

Code:

## SMI=8MB ############################################################################# ## Copyright (c) STMicroelectronics ## ## 5517FTACI UNIFIED MEMORY Board configuration for STBURNER ## ##=========================================================================== ## 8K of internal SRAM starting at 0x80000000 : ## 0x140 is committed for System use ## 0x1EC0 is uncommitted (can be used for on-chip data, stack or ## time critical code) ## ## 08MB of SMI SDRAM starting at 0xC0000000 ## 08MB of FLASH starting at 0x7FE00000 ## ############################################################################# ## very important !! This file is provided with the Toolset it includes chip command etc... include "alliref_clk.cfg" include "asus_clk.cfg" ##Useful Variables K=1024 M=(1024 * 1024) ## Shared Memory address & size SMI_BASE = 0xC0000000 SMI_SIZE = (7*M) AVMEM_SMI_SIZE = (1*M) AVMEM_SMI_BASE = (SMI_BASE) SMI_CACHED_BASE = (AVMEM_SMI_BASE + AVMEM_SMI_SIZE) SMI_CACHED_SIZE = (SMI_SIZE - AVMEM_SMI_SIZE) ## External Memory address & size ##EXTMEM_BASE = 0x40000000 ##EXTMEM_SIZE = (16 * M) ## original is 32 ## Address & size of Debug Traphandler area (place at end of External Memory) TH_SIZE = 0x400 TH_BASE = (SMI_BASE + SMI_SIZE - TH_SIZE) TRACE_BUFFER_SIZE = (64 * K) TRACE_BUFFER_BASE = (SMI_BASE + SMI_SIZE - TH_SIZE - TRACE_BUFFER_SIZE) ## Addresses & sizes of cached & non-cached areas of External Memory. ## The area defined by NCACHE_BASE and NCACHE_SIZE will contain the ## 'Non-cached' memory partition. The size of this area may be reduced if ## required (NB subject to hardware limitations!) ## IMPORTANT: These definitions reflect the constants of the same ## name in mb361.h. If one of these files is modified then the ## other must be manually updated accordingly. */ ##NCACHE_SIZE = (2*M) ## Louie: CBR1300 NCACHE_SIZE = (512 * K) NCACHE_BASE = SMI_CACHED_BASE CACHED_BASE = (NCACHE_BASE + NCACHE_SIZE) CACHED_SIZE = (SMI_SIZE - NCACHE_SIZE - TH_SIZE - TRACE_BUFFER_SIZE) proc Mem5516Space progSMI BootFromFlash useAsusClk{ if ($# != 0) { progSMI = $1 } if ($# == 2) { BootFromFlash = $2 ; useAsusClk = 0} if ($# >= 3) { BootFromFlash = $2 ; useAsusClk = $3} ## This procedure calls proc STi5516MB361_noexternal in dcu_mb361.cfg ## which does the "chip STi5516" command (supports DCU3) STi5516MB361_noexternal (1) (progSMI) ## Call clocks configuration procedure (in clks_5516.cfg) if(useAsusClk == 1) { asus_clock_gen } else { clock_gen } ## define memory areas memory NONCACHED (NCACHE_BASE) (NCACHE_SIZE) RAM memory iEXTERNAL (CACHED_BASE) (CACHED_SIZE) RAM memory mytracebuffer (TRACE_BUFFER_BASE) (TRACE_BUFFER_SIZE) RAM memory TRAPHANDLER (TH_BASE) (TH_SIZE) DEBUG ## memory STEM0 0x50000000 (32*M) DEVICE ## memory STEM1 0x60000000 (32*M) DEVICE ## memory AT_DVB 0x70000000 (240*M) DEVICE ## FLASH1 is currently undefined as this causes problems ## when booting from FLASH. By default sections are placed ## in the first rom segment when building a ROM image. ## If the code is placed in FLASH1 then it cannot run ## because the bank sizes need to be setup before this ## section can be accessed. memory FLASH0 0x7FE00000 (2*M) ROM memory SDRAM 0xC0000000 (8*M) RAM ##set up code placement sections if (BootFromFlash == 1) { place <startup_section> iEXTERNAL place <shutdown_section> iEXTERNAL place def_code iEXTERNAL ## To copy def_code to SDRAM and execute from there ##FLASH0## place def_data iEXTERNAL place def_bss iEXTERNAL place def_const iEXTERNAL place os20_th_code iEXTERNAL place os20_task_queue INTERNAL place os20_th_data INTERNAL place os20_root_tdesc INTERNAL place os20_int_complex_text iEXTERNAL place os20_int_moderate_text iEXTERNAL place os20_int_simple_text iEXTERNAL } else { place <startup_section> iEXTERNAL place <shutdown_section> iEXTERNAL place def_code iEXTERNAL place def_data iEXTERNAL place def_bss iEXTERNAL place def_const iEXTERNAL place os20_th_code iEXTERNAL place os20_task_queue INTERNAL place os20_th_data INTERNAL place os20_root_tdesc INTERNAL place os20_int_complex_text iEXTERNAL place os20_int_moderate_text iEXTERNAL place os20_int_simple_text iEXTERNAL } ## Section for partitions in internal (on-chip) memory. ###place internal_section INTERNAL ###place internal_section_noinit INTERNAL -noinit ## Section for partitions in general external (off-chip) memory. ###place system_section EXTERNAL ###place system_section_noinit EXTERNAL -noinit ## Section for non-cached partitions. ###place ncache_section NONCACHED -noinit PlaceDebugTrapHandler iEXTERNAL ## divide the stack and heap stack iEXTERNAL (128*K) heap iEXTERNAL (1*M) define NcachePartitionBase "NCACHE_BASE" define NcachePartitionSize "NCACHE_SIZE" define InternalPartitionBase "(addressof INTERNAL) + (sizeused INTERNAL)" define InternalPartitionSize "(sizeof INTERNAL) - (sizeused INTERNAL)" define SystemPartitionBase "(addressof iEXTERNAL) + (sizeused iEXTERNAL)" define SystemPartitionSize "(sizeof iEXTERNAL) - (sizeused iEXTERNAL)" define CacheBaseAddress "CACHED_BASE" define CacheSize "CACHED_SIZE" define AVMEM_BASE_ADDRESS "AVMEM_SMI_BASE" ##define AVMEM_SMI_BASE "AVMEM_SMI_BASE" define AVMEM_SMI_SIZE "AVMEM_SMI_SIZE" ## bootdata location changes if FLASH hex image if (BootFromFlash == 1) { bootdata FLASH0 } else { bootdata iEXTERNAL } } ############################################################################## ## procedure called during link time proc board_init { write Setup5516 reset Mem5516Space (1) (0) ST20C2MemoryInit ## procedure written by MCDT, replaces c2MemoryInit, reserves area 0x80000000 to 0x80000040 } proc board_init_hex { write Setup5516 reset Mem5516Space (1) (1) ST20C2MemoryInit ## procedure written by MCDT, replaces c2MemoryInit, reserves area 0x80000000 to 0x80000040 } ############################################################################## ## procedure called during run time proc board_runtime_init { board_init EMIpokes5516 ## from mb361_emi.cfg sti5516ConfigureSDRAM ## from sti5516sd.cfg for SMI } proc asus_runtime_init { write Setup AsusBoard reset Mem5516Space (0) (0) (1) ST20C2MemoryInit ## procedure written by MCDT, replaces c2MemoryInit, reserves area 0x80000000 to 0x80000040 EMIpokes5516 ## from mb361_emi.cfg sti5516ConfigureSDRAM ## from sti5516sd.cfg for SMI } proc board_runtime_init_nor { write Setup5516 reset STi5516MB361_noexternal (1) (0) memory NONCACHED (NCACHE_BASE) (NCACHE_SIZE) RAM memory EXTERNAL (CACHED_BASE) (CACHED_SIZE) RAM memory mytracebuffer (TRACE_BUFFER_BASE) (TRACE_BUFFER_SIZE) RAM memory TRAPHANDLER (TH_BASE) (TH_SIZE) DEBUG memory FLASH0 0x7FC00000 (4*M) ROM memory SDRAM 0xC0000000 (8*M) RAM ST20C2MemoryInit EMIpokes5516 ## from mb361_emi.cfg informs -enable program -new flash.dbg } ############################################################################## ## END of FILE ## ##############################################################################

Hi guys.

You're right @slugworth, there's no such mention on that document and that might be the reason why we can find some 5517's configurations where JTag access is possible and others, is not (if I remember well...). Also, I remember reading a not recent European Patent Application having ST as the applicant, that dealt precisely with this issue. This security feature introduced a "password" verification before any BFL (boot from link) could be obtained. The number of possible attempts before the device locks permanently any further access was not specified, but one has to admit that it wouldn't be difficult to implement as well.
Good to see this topic still "moving"...

Best regards.

The sti5517 toolset wasn't one that was freely (publicly) available.
You had to sign an agreement with stmicro to get it.
There were 2 versions,one with dvb/dss support and one with only dvb
support.So I find it strange that it never mentions any security features.
Although it covers a few processors-5514,5516,5517 so it may not go into
detail on the 5517.The previous code I posted actually only mentions the 5516
and the mb361.
I regret not having a sti5517 based receiver with a jtag port.

Hi guys.

Didn't know there were 2 versions...

Best regards.

this is from the relnotes.pdf that comes with the toolset.

Code:

Distribution The 5517ref Production is available in the following formats: • WinZip archive, for PC users. 5517ref-1.0.0.zip DVB & DIRECTV WinZip file 5517ref-1.0.0-DVB.zip DVB-only WinZip file • Compressed TAR Archive for Unix users. 5517ref-1.0.0.tar.Z DVB & DIRECTV Unix archive 5517ref-1.0.0-DVB.tar.Z DVB-only Unix archive

I dare you to find them tho

Hi guys.

C'mon @slugworth, I never wanted to disbelief you. It was never my intention...
Let it be clear that I believed you when you said that there were 2 versions for the STi5517 toolset, one public and another one less so.
When I said that looked to me that the 5517 was waiting for a password, was what I find best to explain its behaviour but, of course, I might be wrong. So far and as far as I'm aware, none of us knows what's happening when we try the BFL...

Another thing: - I haven't even been able to find the public one so how can I find the less public one...?

Best regards.

I didn't mean to insult,I was just implying that you or anyone will have
a hard time finding it.

Hi guys.

No worries @slugworth, no insult taken.

Best regards.