View Full Version: Venturer STB7766G

camerahacks >>Divergences >>Venturer STB7766G


<< Prev | Next >>

star882- 07-09-2008
Venturer STB7766G
When I opened it up, I found a connector clearly labeled "RS232". As an engineer, I couldn't resist but try connecting a MAX232 interface to see what I would get. Bootlog: øùðâ þüá ARom-bcs V1.06.00 Mar 6 2008, 08:58:08 sungwee@sungwee /cygdrive/c/boot_d/boot_1119 Config Baud Rate : 115200 bps System Clock Rate : 175 MHz U-Boot Mem offset : Text/Data [00e00000, 00e19fe7], BSS [00e19fe8, 00e3e90f] RAM Configuration: Bank #0: 00000000 32 MB manufature ID : 0x1, Device ID: 0x49 Flash: 2 MB In: serial Out: serial Err: serial Set Flash Memory Structure... Set Region for Bootrom from 00:00 0x2c000000 (131072bytes) Set Region01 for Appl from 00:05 0x2c020000 (917504bytes) cacheID : 1d0d20d2 write-back, register 7, format C cache separated D-cache 4kbytes 4-way 8 words (32bytes) I-cache 4kbytes 4-way 8 words (32bytes) Masks:: Index: c0000000, Int: 000000c0, Seg: 000003e0 Compare 00e13dd4 2c013dd4 Boot from address 2c000000 Boot from flash MMU CR : 000510f8 (00004000)-> 000550fb Processing BIZ file-from Flash: 0x2c020000 No Aux data are found [Application Code] Loading[4] Image from 2c020800 to 00010000(+1022815) -- TRY 0 ==> 2341280 bytes loaded in 0.733 sec, rc=0 -- Checking CRC32[Bin ] ==> Good, in 0.194 sec Load Image to 00010000... Start from 00010000... MMU CR : 000540fb (00004000)-> 000540fa cacheID : 1d0d20d2 write-back, register 7, format C cache separated D-cache 4kbytes 4-way 8 words (32bytes) I-cache 4kbytes 4-way 8 words (32bytes) Masks:: Index: c0000000, Int: 000000c0, Seg: 000003e0 MMU CR : 000550fa (00004000)-> 000550ff 000.020:root ] >> InitPool ]] [0x002e3000-0x01000000] 000.021:root ] SM_MAT_POOL[ 4] = 0x002e3000(0x004000) 000.022:root ] SM_MAT_POOL[ 8] = 0x002e7000(0x00c000) 000.023:root ] SM_MAT_POOL[16] = 0x002f3000(0x018000) 000.024:root ] SM_MAT_POOL[32] = 0x0030b000(0x030000) 000.025:root ] SM_MAT_POOL[64] = 0x0033b000(0x0a0000) 000.026:root ] >> InitBuddy ]] Addr=0x3db000, Size=0xc25000 000.028:root ] >> Total Free Heap Size = 0xcf1000 Stack... 336860180 002cf3a8 New Application booted, uart = 0xfe000000, baud = 115200 System Clock : 175MHz Starting V4.3.39 , Apr 1 2008, 15:19:20, from @:/cygdrive/d/Project/alco/source/TMVB_L204F_TEST/app/d2astb 000.031:root ] creating Queue uiMain ... qid is 0x002d0160 000.032:root ] creating Queue cqMain ... qid is 0x002d0194 000.033:root ] creating Queue cqChch ... qid is 0x002d01c8 000.034:root ] creating Queue CqUsrDat ... qid is 0x002d01fc 000.035:root ] creating Queue SqParse ... qid is 0x002d0230 000.036:root ] creating Queue SqDelay ... qid is 0x002d0264 000.037:root ] creating Queue SqInput ... qid is 0x002d0298 000.038:root ] creating Queue SqScreen ... qid is 0x002d02cc 000.038:root ] creating Queue SqFlash ... qid is 0x002d0300 000.039:root ] creating Queue tuner0Q ... qid is 0x002d0334 000.040:root ] creating Queue SqIR ... qid is 0x002d0368 000.041:root ] 11 Message queues are created 000.042:root ] creating Sema4 VDPVSyn ... 000.042:root ] creating Sema4 MuteSema ... 000.042:root ] creating Sema4 OSDSema ... 000.042:root ] creating Sema4 CmMainSm ... 000.043:root ] creating Sema4 DCS_Inp ... 000.043:root ] creating Sema4 DCS_Par ... 000.043:root ] creating Sema4 DCS_Scr ... 000.043:root ] creating Sema4 DCS_Fla ... 000.044:root ] creating Sema4 DCS_Inm ... 000.044:root ] creating Sema4 SectFilr ... 000.044:root ] creating Sema4 AInfo ... 000.044:root ] creating Sema4 VInfo ... 000.045:root ] creating Sema4 NvmSem ... 000.045:root ] creating Sema4 IR ... 000.045:root ] creating Sema4 TIME ... 000.045:root ] 15 Semaphores are created 000.046:root ] 0 Partitions are created 000.046:root ] Configuring D2A_MODE manufature ID : 0x1, Device ID: 0x49 000.140:root ] Flash size: 2MB 000.180:root ] >> InitPool ]] [0x01000000-0x01084000] 000.181:root ] >> InitBuddy ]] Addr=0x1000000, Size=0x084000 000.182:root ] >> Total Free Heap Size = 0xd6e368 000.635:root ] NVRAM] found at 0:0xa2 : PageSize 64 000.657:root ] CN NVM ] Size of Source List = 12 000.657:root ] CN NVM ] Source List from allocation 000.657:root ] CN NVM ] Size of Mapping Buf = 12 000.658:root ] CN NVM ] Mapping Buffer from allocation 000.658:root ] CN NVM ] Size of NVRAM = 27904 000.659:root ] CN NVM ] NVRAM Buffer from allocation : 27904 bytes 000.660:root ] CN NVM ] number of Windows = 1 000.660:root ] CN NVM ] number of Sources = 1 000.660:root ] CN NVM ] SRC00 = ANT0 TV(VSB ANT) 000.661:root ] SOURCE 00 : 69 channels (0x003e1024) 000.662:root ] NVRAM divided 2 parts : 312:27592 bytes 000.663:root ] NVRAM for VCH : 27592 bytes, (each 250 bits (32 bytes), total 862 vchs) 000.664:root ] vch_stat : 003e520c 000.664:root ] NUM_OF_SOURCE : 1 000.664:root ] NUM_OF_TV_INPUT : 1 000.665:root ] NUM_OF_TV_SOURCE : 1 000.665:root ] CM_NUM_WINDOWS : 1 000.666:root ] NUM_VCH_ENTRY : 862 Num Of Sources : 1 Index 0 : InputID 0, Type : DTV00 (0x00000001,0x00000001) Src2OrderTable, 0 Order2SrcTable, 0 Src2OrderTable2, 0 Order2SrcTable2, 0 000.668:root ] CN NVM ] Sizeof(CNVM_CM_Data.header) = 24 000.668:root ] CN NVM ] Num VCH Entries = 862 000.669:root ] CN NVM ] Size of VCH Entry = 250 000.669:root ] CN NVM ] Initial Flag = 179 000.842:root ] cm_ReadMap 1343 000.842:root ] cm_ReadMap 1378 000.843:root ] cm_ReadMap 1402 000.843:root ] CM NVM ] Reading 12 Virtual Channel Informations 000.844:root ] [VCH] Remove 0.7.7.2 000.844:root ] [VCH] Remove 0.7.7.3 000.845:root ] [VCH] Remove 0.7.7.4 000.845:root ] [VCH] Remove 0.33.24.1 000.846:root ] [VCH] Remove 0.33.24.2 000.847:root ] [VCH] Remove 0.43.42.1 000.847:root ] [VCH] Remove 0.43.42.2 000.848:root ] [VCH] Remove 0.49.54.1 000.848:root ] [VCH] Remove 0.56.7.1 000.849:root ] [VCH] Insert 00, 0.7.12.1 000.850:root ] [VCH] Insert 00, 0.7.12.2 000.850:root ] [VCH] Insert 00, 0.7.12.3 000.851:root ] [VCH] 3 Virtual Channel has been added 000.865:root ] Initializing MPX Resources 000.886:root ] Initializing AtvCC Resources 000.887:root ] Initializing TmrRsc Resources 000.888:root ] creating Task Tuner0 , Prio= 35, Stk= 8192 fp 000cf6f4... 000.889:root ] creating Task UImain , Prio= 48, Stk= 16384 fp 00054c94... 000.890:root ] creating Task CMtune , Prio= 41, Stk= 8192 fp 00033f50... 000.891:root ] creating Task CMStat , Prio= 40, Stk= 8192 fp 0004a8f0... 000.893:root ] creating Task CCParser, Prio= 29, Stk= 16384 fp 00072128... 000.894:root ] creating Task CCPeriod, Prio= 27, Stk= 8192 fp 00072048... 000.895:root ] creating Task CCFlash , Prio= 26, Stk= 8192 fp 00070a4c... 000.896:root ] creating Task DccScren, Prio= 31, Stk= 8192 fp 0007975c... 000.898:root ] creating Task DccParse, Prio= 33, Stk= 8192 fp 00077de0... 000.899:root ] creating Task DccInput, Prio= 34, Stk= 8192 fp 000779dc... 000.900:root ] creating Task DccDelay, Prio= 30, Stk= 8192 fp 00076398... 000.902:root ] creating Task DccFlash, Prio= 32, Stk= 8192 fp 000795e8... 000.903:root ] creating Task IRtask , Prio= 37, Stk= 8192 fp 000cbf40... 000.904:root ] creating Task KeyBoard, Prio= 24, Stk= 8192 fp 00012904... 000.905:root ] creating Task SysTimer, Prio= 53, Stk= 8192 fp 000ac8a0... 000.906:root ] 15 Tasks are created 000.906:root ] Set Flash Memory Structure... 000.908:root ] Set Region for Bootrom from 00:00 0x2c000000 (131072bytes) 000.909:root ] Set Region01 for Appl from 00:05 0x2c020000 (917504bytes) 000.912:root ] creating Task psipMt, Prio= 12, Stk= 16384 fp 0003223c... 000.913:root ] creating Task SecRecv, Prio= 19, Stk= 16384 fp 0001fca4... 000.915:root ] creating Task psipPt, Prio= 11, Stk= 16384 fp 0002e160... 000.916:root ] creating Task psiPt, Prio= 10, Stk= 16384 fp 00029684... 000.917:root ] creating Task psipTm, Prio= 13, Stk= 16384 fp 0002137c... 000.919:root ] creating Task psipCl, Prio= 9, Stk= 16384 fp 0002cd84... 000.919:CMtune ] CM Task] Start CM_Tuner1 Does anyone know what OS that appears to be? The root reference suggests a variant of UNIX. If I hold down Ctrl-C to get a prompt and type help: [D2A-BRD #] help ? - alias for 'help' autoboot- set auto boot b - boot from server base - print or set address offset bdinfo - print Board Info structure boot - boot from server bootm - boot application image from memory bootp - boot image via network using BootP/TFTP protocol cache - cache operation cmp - memory compare cp - memory copy crc32 - checksum calculation dbgs - server network address delay - delay the whole system diag - Go to diag routine at start of flash(default) or ram(index = 1) echo - echo args to console erase - erase FLASH memory ether - set ethernet address flinfo - print FLASH memory information gateway - set gateway IP go - start application at address 'addr' help - print online help ifconfig- set/retrieve ipaddr iminfo - print header information for application image load - load from server loop - infinite loop on address range ls - Show boot history mcd - Change Memory Clock Parameters md - memory display mm - memory modify (auto-incrementing) mmu - MMU operation model - change Model Configuration m-*test*-('") - simple RAM -*test*-('") mw - memory write (fill) netmask - set netmask nm - memory modify (constant address) power_on- get IR input for start up printenv- print environment variables protect - enable or disable FLASH write protection rarpboot- boot image via network using RARP/TFTP protocol rem - delete boot command entry reset - Perform RESET of the CPU saveenv - save environment variables to persistent storage sclock - Change System Clock Rate setenv - set environment variables sto - store image from server tftpboot- boot image via network using TFTP protocol tick - read timer tick uart - change uart enable / disable status version - print monitor version vqt - Do vsb/qam performance -*test*-('") Looks like the firmware was originally set up for Ethernet! If only I could figure out how to connect an Ethernet PHY...

BillW- 07-09-2008

You're getting access to the U-boot bootloader. http://www.denx.de/wiki/view/DULG/UBootCmdGroupInfo AFAIK U-boot currently supports Linux, NetBSD, VxWorks, QNX, and U-Boot standalone applications. Using a standalone application as a second stage bootloader is possible, but probability favors one of the built-ins. The cygdrive parts shows that the dev environment was based around cygwin.

star882- 07-10-2008

I just started dumping the entire memory after booting it up, jumpering the reset circuit while holding Ctrl-C to get the prompt, and the command "md 0 0x2000000" after enabling logging in minicom. Looks like I'll have to let it run overnight to finish... Much like the days of dialup...

Forumer™ is Voted #1 Free Forum Hosting provider
Build your own community today with the largest message board hosting company.