Bicephale
join:2005-09-24 | reply to Cidi Rome
Re: Thomson SpeedTouch 5x6 & 585 EJTAG "De-Brick" Access
I count in dollars and i don't hide the computer cost. |
|
Bicephale
join:2005-09-24
 ·TekSavvy Solutions..
| reply to fenster16
Hi,
We're not arguing about wether it works or not, my
position is that i yet have to see JTAG interfaces
posted in our forum which garantee that a reader's
HardWare won't be exposed to any avoidable risk...
The normal thing to do once such an issue has been
identified should be to search for a solution, not
to deny that the problem is real. The few circuit
samples you've seen were meant to help, i prefered
a transistor level-shifter approach to specialized
chips but this didn't close the door to unexplored
solutions (as opto-couplers) just yet. Of course,
if i'm alone on this you can bet it will take more
time than if i could count on external assistance. |
|
Cidi Rome
join:2007-12-12 | reply to Bicephale
"not to deny that the problem is real."
Once again I say:
"Every one that is going to try this kind of things already know that it has risks" |
|
Bicephale
join:2005-09-24 | Once again, risks that can be avoided but which are not being addressed at the moment. |
|
Angelo_
The Network Guy
Premium
join:2002-06-18 | i'll make this guide when i have less on my plate :/ |
|
Bicephale
join:2005-09-24 | You too?
I guess we all have our plates full then. |
|
fenster16
join:2008-01-04
| reply to Bicephale
hello
a friend of mine has an open ST585v6
he would lend me the modem to backup
but it should not be damaged
he would KILL me !!!
i do not have a secure BUFFERED JTAG ADAPTOR
if anyone can post a easy tutoral to built
an secure BUFFERED JTAG ADAPTOR
i will try it
the BUFFERED JTAG ADAPTOR should work with the
software from Cidi Rome
OR
it would be faster if anyone which has an
working BUFFERED JTAG ADAPTOR to send it me
by postal service
i live in Austria
you can get my postal address by mail:
pinguinlinux@topmail-files.de
best regards
fenster |
|
Bicephale
join:2005-09-24 | I was already on it a couple days ago, what's your dead line? |
|
revs per min
join:2005-07-29
Australia
1 edit | reply to Bicephale
I followed cidi rome's instructions to the letter. Using an unbuffered cable I got the flash copied from a 585 and 536. Both totally in working condition after the extraction. PC perfectly fine.
If you have 5v on one side of a resistor and 3.3v on the other, that is a difference of 1.7v. Across 100ohm I make that 17ma. If you are worried just make it with 330ohm resistors. But it worked fine. |
|
Bicephale
join:2005-09-24
·TekSavvy Solutions..
| 
Active JTAG Adaptor - Current Limiting Resistors |
Oh! An unexpected visit from the WhirlPool Forums
people! I had hopes that this humble thread might
gain some reach some day, Google works for us now!
As i pointed out two days ago, for me the question
is to eliminate avoidable risks, not to prove that
we can gamble and walk away with it. You are free
to take chances with your HardWare, i feel obliged
to offer our past, present and future readers some
safer alternatives. It is suitable to account for
multiple failure scenarios including possibilities
which have been mentioned previously. Suppose the
TDI, TCk and TMS lines carry 5 Volts CMOS signals,
for example... This is what i had in mind with my
first two drawings (shown above) where i deal with
Totem-Pole 5 V CMOS outputs. At left you have the
300 Ω solution, in the middle i replaced it with a
pair of 680 Ω resistors to include noise rejection
via a small value capacitor (100 pF). What we see
on the right is equivalent to the filtered circuit
but where the parallel port outputs are Open-Drain
5 V CMOS stages with 2.2 KΩ Pull-Up resistors. It
is reasonable to expect other variations which use
3.3 V CMOS chips that range from discrete gates to
high integration ones. In my opinion, the average
reader just can't be expected to know what kind of
HardWare he's got and much less how to ensure that
no component is submitted to stress while facing a
set of unpredictable technology mixes. Is it TTL,
Low-Voltage CMOS or an exotic variation?... Open-
Drain or Totem-Pole on the PC side? Was the ST5xx
device ever designed to interface via some passive
JTAG adaptor? What's the right Power-Up/Power-Off
sequence, isn't it an important consideration when
two independant power-supplies are being involved?
Is it worth it not to address the avoidable risks?
Maybe the adaptor shouldn't draw much current from
the parallel port at all unless speed is a factor.
I see no reason why i should gamble on ESD diodes;
one more IC here, a transistor there, it's a minor
issue once the design is ready but that's just me.
P.S.:
Current and Voltage aren't at their maximum values
simultaneously in these simulations, of course!... |
|
Bicephale
join:2005-09-24
·TekSavvy Solutions..
| reply to Bicephale
 .JPG/thumb.jpg "64966 bytes")
MSP430 JTAG Adaptor (ICQ 99826732) |
Here we have a creative design where the 3.6 volts
power supply seems to receive energy both from the
parallel and JTAG ports. Notice the 74AHC244 CMOS
level-shifting chip, just as suggested in previous
references... Pay attention to how little current
from the parallel port is allowed to reach it, not
to mention its "Tri-State" outputs seem to be shot
down in absence of power from any of the sides, if
i'm not mistaking!!! No attempt is made to filter
out any eventual "ringings", nor is level-shifting
bidirectional (the "TDO" signal is no full 5 Volts
logic level as expected on a parallel port input);
yet, this refined piece of work is too nicely done
to ignore! Pin layouts must be revised but i like
how it looks so i'd bet on this one as the winner!
Ref.:
MSPFET MSP430 JTAG Project |
|
HyperDrive
join:2008-01-22
| Hi, everyone! I also have an ISP-locked ST585 with custom AL firmware (same ISP as Chaveiro, we're both portuguese, it seems), which I've been trying to learn how to unlock for the past year. It was quite a surprise to come across this (long) thread.
Trying to summarize what I've learned (correct me if I'm wrong), the possibility is to find a standard ST585 with AA firmware, dump it and use it to re-flash the locked router, all through the JTAG pads (my ST585 doesn't have pins, unlike my ST580, I guess it's commonplace), correct?
Thanks in advance! |
|
Cidi Rome
join:2007-12-12
2 edits | reply to Bicephale
Hi Hyperdrive.
That info is not quite right.
You are correct about being able to unlock one locked through one that is unlocked, but the question is not the Software variant AL/AA or others, it is the bootloader itself.
After changing the bootloader you will be able to upgrade the firmware to a general one (AA).
In the meanwhile do not try to use my application with the ST585v6 because I haven't tested it yet on ST585v6 and I already have feedback that it will not flash correctly. I'm waiting to receive one to make further tests. At this time I can only approve it with ST516v6 since that's the one I've made more tests with.
Best Regards. |
|
HyperDrive
join:2008-01-22 | Thanks for the reply, Cidi Rome! Yes, makes sense implementing the protection inside the bootloader. I'll be eagerly watching this thread for further developments.  |
|
chaveiro
join:2007-12-06
| reply to fenster16
As i did get a JTAG BUFFERED tool were.
They send worldwide and accept paypal:
»shop.gtronica.com/product_info.p···ts_id=53
Risk? None.
Why? Se my documentated posts above. |
|
chaveiro
join:2007-12-06 | reply to HyperDrive
Hi,
Mine is a st585v6, i used the original software package without modifications. |
|
master
@novis.pt
| said by chaveiro  :Hi, Mine is a st585v6, i used the original software package without modifications. So... you already "unlocked" your 585?
Im Portuguese, with an 585 from vodafone |
|
Bicephale
join:2005-09-24
·TekSavvy Solutions..
3 edits | reply to chaveiro
Adaptor for Altera MAX3xxx 5 Volts tolerant FPGA |
»Re: Thomson SpeedTouch 5x6 & 585 EJTAG "De-Brick" Access
Ref.:
FPGAs DEMISTIFIED - LETS TALK KLINGON, Fig. 3
-=*=-
Notice the similarities, the GTronica circuit just
got the Power-Sensing and TriState Muting features
removed... This technology has been transposed to
another context without even knowing if BroadCom's
chip is 5 Volts tolerant at all, see for yourself:
GTronica's "simplified" version
Such modifications allow the injection of currents
into the MoDem even when it's turned off, resistor
values are not adapted and i must also insist once
again the Lithium cell generates 3 Volts, not 3.3,
which is even worst when interfacing to 5 V logic.
And lets not forget to mention the risk of current
injection into the computer's parallel port too...
Can it work? Obviously it does. Is it safe? No! |
|
Laidback
join:2001-09-30
Woodstock, ON | reply to Bicephale
bicephale, I know this thread is on the 500 series, but I have a 780WL. I wonder if you might know how hot these run at?
Regards
Mike |
|
Bicephale
join:2005-09-24
·TekSavvy Solutions..
| Hi LaidBack,
I repeated my requests asking for cooperation over
collecting electrical signatures, in hope it might
open the door to more MIPS-32 based devices... My
attempt was useless and there's no garantee you'll
get help on a short notice unless the audience has
some direct interrest about your topic. My advice
is to share images of main areas such as the Flash
chip, etc., as it may ease future identifications. |
|
