Mutant HD51

Discussion in 'Other satellite receivers.' started by EnoSat, Dec 29, 2019.

  1. EnoSat

    EnoSat New Member

    Messages:
    5
    Likes Received:
    0
    Trophy Points:
    1
    Gender:
    Male
    Location:
    Slovakia
    hi,
    maybe help with recovery my HD51 ?
    dark display and led after start, only RS232 write:
    Code:
    CPU 01
    BCM74390012
    PRID07251112
    v1.7
    RR:00000003
    BFW
    SEC
    seclib-1.5
    BBL v1.0.1
    AVS init...
    spare0/rmon_hz=017e7878
    spare1/rmon_vt=017e7878
    AVS init OK
    AVS load:select_image: addr_offset: 00051000 part_offset: 00000000 bootStatus: 2a002b00
    AVS load_code offset =00051000
    AVS: OTP Decrypt 0x00000000, OTP Verify AVS 0x00000000
    LOADED
    
    single board
    select_image: addr_offset: 00055000 part_offset: 00000000 bootStatus: 3d2b2500
    MemsysFW: OTP Decrypt 0x00000000, OTP Secure Boot 0x00000000
    SHMOO 01020000 BLD:9695 HW:hpf0_b1p6 V:1.2.0.0
    MCB: FIX
    AVS start:status=000000ff
    STB: Current voltage=000003cd(973)
     temperature=0000b2c4(45764)
     PV=0000037a(890)
     MV=000003ce(974)
    AVS FW rev=30333078 [0.3.0.x]
    OK
    DDR0: *@ ffe0ba98 <= ffe0ba98 MEMSYS-0 @ f1100000 OK
    DDR1: -
    Sdram Scramble OTP = 0x00000001
    Sdram Scramble OK
    select_image: addr_offset: 00020000 part_offset: 00000000 bootStatus: 1b25252b
    BFW load mode OTP = 0x0000000f
    bfw_hash_locked = 0x00000000
    BFW key3 OK, CPU 01
    BCM74390012
    PRID07251112
    v1.7
    RR:00000403
    BSP Debug Info:
    0x4204010f
    0x00000122
    0x00000000
    0x0000002a
    0x00000030
    0x00000000
    0x00000100
    0x00000000
    0x00000000
    0x00000000
    0x00000000
    0x00000000
    0x00000000
    0x00000000
    0x00000000
    0x00000000
    0x00000000
    BFW
    SEC
    seclib-1.5
    BBL v1.0.1
    AVS init...
    spare0/rmon_hz=017e7878
    spare1/rmon_vt=017e7878
    AVS init OK
    AVS load:*** BCHP_BSP_GLB_CONTROL_GLB_DWNLD_ERR is set.
    select_image: addr_offset: 00051000 part_offset: 00000000 bootStatus: aa252b2b
    AVS load_code offset =00051000
    AVS: OTP Decrypt 0x00000000, OTP Verify AVS 0x00000000
    LOADED
    
    single board
    *** BCHP_BSP_GLB_CONTROL_GLB_DWNLD_ERR is set.
    select_image: addr_offset: 00055000 part_offset: 00000000 bootStatus: bd2b252b
    MemsysFW: OTP Decrypt 0x00000000, OTP Secure Boot 0x00000000
    SHMOO 01020000 BLD:9695 HW:hpf0_b1p6 V:1.2.0.0
    MCB: FIX
    AVS start:status=000000ff
    STB: Current voltage=000003d2(978)
     temperature=0000b2c4(45764)
     PV=0000037d(893)
     MV=000003d2(978)
    AVS FW rev=30333078 [0.3.0.x]
    OK
    DDR0: *@ ffe0ba98 <= ffe0ba98 MEMSYS-0 @ f1100000 OK
    DDR1: -
    Sdram Scramble OTP = 0x00000001
    Sdram Scramble OK
    *** BCHP_BSP_GLB_CONTROL_GLB_DWNLD_ERR is set.
    BFW:0000002f
    FATAL ERROR: Boot 2nd image failed
    on net talk for recovery need
    BBS tool (google on cy7c68013a)
    Broadband Studio for 7439
    BOLT bootloader HD51
    Probably only Windows XP or windows 7 for broadcom driver
     
  2. Johnny B.

    Johnny B. Technical Support Staff Member Moderator

    Messages:
    2,459
    Likes Received:
    1,235
    Trophy Points:
    113
    Gender:
    Male
    Location:
    Netherlands
    Home Page:
    As far as I see it (but I do not have experiences with this receiver) it looks (based on the end error:
    FATAL ERROR: Boot 2nd image failed)
    as if your boot loader is not compatible with the image file.

    Maybe if you, Press and hold power button while you power up the box, can re-flash this box, or else it may indeed possible to fix it with a jtag(i2c) method.
    But don't ask me how, I do not own this receiver, thus I have no experiences with this box.
     
    raza05 likes this.
  3. EnoSat

    EnoSat New Member

    Messages:
    5
    Likes Received:
    0
    Trophy Points:
    1
    Gender:
    Male
    Location:
    Slovakia
    hi, thank to answer
    yes, bootloader bad
    now waiting on cy7c68013a board for connect SDA/SCL
     
  4. cobramostar

    cobramostar New Member

    Messages:
    3
    Likes Received:
    0
    Trophy Points:
    1

    can you use this cy7c68013a i have some problem ? ? ?

    thanks
     
  5. Aliraza63

    Aliraza63 Active Member

    Messages:
    105
    Likes Received:
    185
    Trophy Points:
    43
    Gender:
    Male
    I dont think so u need it .
    as per your log i see its flash map error . it clearly shows partition from which the system was started no longer starts. this partition must be flashed again.
    But if there is no any "emergency switchover" to another partition. Than definatly only the loader could do that, becaz if the map is destroyed accidently . it doesn't know or miss the flash script for multiboot.
    Did you try this

    Code:
    How is this bootloader flashed?
    For safety's sake, first save settings so that you can restore them later. (at all Start_Ups, if you want to keep this)
    Turn off the box
    Unzip the attached file
    Copy HD51 directory to a USB stick
    Insert the USB stick into the front USB and press and hold the power button while the box is switched on.
    The display shows then "bolt", after 2-4 seconds is then "complete" and the box restarts.
    In the image then via menu> Information> Check whether the new bootloader version is in there.
    
     

    Attached Files:

    Johnny B. likes this.
  6. cobramostar

    cobramostar New Member

    Messages:
    3
    Likes Received:
    0
    Trophy Points:
    1
    can someone picures do from flash and nand ? ? ?

    thanks
     
  7. Johnny B.

    Johnny B. Technical Support Staff Member Moderator

    Messages:
    2,459
    Likes Received:
    1,235
    Trophy Points:
    113
    Gender:
    Male
    Location:
    Netherlands
    Home Page:
    To give a answer to...
    Q: can you use this cy7c68013a i have some problem ? ? ?
    A: It depends, you must have the BBS software for the BCM7362 as also the xml script for the type nand flash chip it has, and probably some boot loader for these receiver.
    Without it, it is useless to try the cy7c68013 i2c/jtag board.

    Unfortunately I have not any experiences with this receiver and thus I can only give you some thought of what I think.
    But regarding this jtag / i2c option, I have my doubts, because using google search for Mutant HD51 jtag gives me the impression that no one did it, or at least failed.
     
    Aliraza63 likes this.
  8. cobramostar

    cobramostar New Member

    Messages:
    3
    Likes Received:
    0
    Trophy Points:
    1
    yes i have here like some reciver vantage 4000 UHD of board is print DSH5030
    use SPI w25q32fvrevh091613 and NAND TC58NVG1S3HBA14
    if 51 use some flash i would put this bootloader direkt with spi programer of flash
    for this i need dump from flash 51

    thanks
     
  9. Johnny B.

    Johnny B. Technical Support Staff Member Moderator

    Messages:
    2,459
    Likes Received:
    1,235
    Trophy Points:
    113
    Gender:
    Male
    Location:
    Netherlands
    Home Page:
    The W25q32 is a 8p programmable chip, which may be used as a sort of protection chip, decoding chip, same as dreambox still does with before a sim card, later a chip.
    These can not be cloned, only upgraded with probably a tool written to use for these receivers and probably by usb.
    But again, I do know nothing of these receivers, as also the way to program these.

    As for the nand chip and trough i2c/jtag way.
    This I already answered, however since it's a chip with legs, a tsop48, than another way could be to remove the nand chip from a working box, to clone it with a nand flash chip programmer as the TL86 plus programmer because it has the best cloning option, and to reprogram the nand chip from the not working receiver.
    Needless to say that you need to remove, and resolder the nand chip which is not entirely without risk.
     
    raza05 and Aliraza63 like this.