M7T75B—ZC01—01
M7T75B-ZC01-01 the mainboard of the Dyon Liberty DVB-T2 HD Receiver.
Notable features:
- MStar MSD7T75 SoC, likely codenamed Kirin
- UART (115200 baud @ 3.3V) exposed and labeled on CN2
- mystery debug port CON1 (SPI flash access)
- 256 MiB RAM (128M * 16b)
- 16 MiB flash
- TP1's pads (TF1-TF8) correspond to the pins of the flash chip
- DVB-T2 antenna connector, Ethernet, USB, HDMI, analog AV, 12V in
- 6 buttons, 4 x 7 segment LED display, IR diode
- MaxLinear MxL608 tuner
- MStar MSB124x demodulator
UART boot log
decomp
done
done
[cyg_net_init] Init: mbinit(0x00000000)
[cyg_net_init] Init: cyg_net_init_devs(0x00000000)
Init device 'pcnet_eth0'
[cyg_net_init] Init: loopattach(0x00000000)
[cyg_net_init] Init: ifinit(0x00000000)
[cyg_net_init] Init: domaininit(0x00000000)
[cyg_net_init] Init: cyg_net_add_domain(0x822e53f0)
New domain internet at 0x00000000
[cyg_net_init] Init: cyg_net_add_domain(0x822e4fb8)
New domain route at 0x00000000
[cyg_net_init] Init: call_route_init(0x00000000)
[cyg_net_init] Done
[eCos][CPU INFO] : CPU Clock = 1000000000 : RTC Period = 500000
test ..............
board info E_MI_SYS_BOARD_INFO_ID_AUDIO_PATH_MAIN_SPEAKER = 0x30,
[MsOS_CPU_DisableInterrupt][3392] MsOS_CPU_DisableInterrupt is not supported
[MsOS_CPU_RestoreInterrupt][3413] MsOS_CPU_RestoreInterrupt is not supported
[MsOS_CPU_DisableInterrupt][3392] MsOS_CPU_DisableInterrupt is not supported
[MsOS_CPU_DisableInterrupt][3392] MsOS_CPU_DisableInterrupt is not supported
[MsOS_CPU_RestoreInterrupt][3413] MsOS_CPU_RestoreInterrupt is not supported
[MsOS_CPU_RestoreInterrupt][3413] MsOS_CPU_RestoreInterrupt is not supported
[35m[eCos] UtopiaInit[m
[35mFunction = SARRegisterToUtopia, Line = 1999, SAR Register finished[m
[eCos][MApi Set CPU INFO] : CPU Clock = 1000000000 : RTC Period = 500000
Wrong hash key
666600016666
Auth NG
===========================================================================
===========================================================================
===========================================================================
===========================================================================
booter_sys_init==>
ADISYSSetCfg:eRet = 0x0
ÿFlash is detected (0x0504, 0xC2, 0x20, 0x18)
booter_sys_init<====
booter_cfg_irdeto_flash==>
MDrv_SERFLASH_GetInfo()
u32AccessWidth = 1
u32TotalSize = 16777216
u32SecNum = 256
u32SecSize = 65536
=======================================================
[BOOTER]0x00000000----0x0011fc00
=======================================================
[LOADER]0xffffffff----0xffffffff
=======================================================
[-BBCB-]0x0011fc00----0x00000024
=======================================================
[--UK--]0x00120000----0x00010000
=======================================================
[Varant]0xffffffff----0xffffffff
=======================================================
[EEPROM]0x00130000----0x00010000----0x00000800
=======================================================
[LOADPT]0x00000000----0x00000400
=======================================================
[RESET-]0x00000400----0x00000100
=======================================================
[SYSSET]0x00000500----0x00000100
=======================================================
[-LOGO-]0x00180000----0x00020000
=======================================================
[--App-]0x001a0000----0x00a00000
=======================================================
[ADIBLVirEEPROMRegister 269]ii:0 index:2, flashAddr:0x120000 ok!
[booter_cfg_irdeto_flash 222]ADIIrdetoBLFlashInfoConfigV5 g_IrdflashCfg.m_stFshVariantv5.m_unStartAddress(0xffffffff) :-3
booter_cfg_irdeto_flash nRet:0<====
booter_vir_eeprom_init==>
[booter_vir_eeprom_init 88]0x130000 0x10000 0x800
booter_vir_eeprom_init nRet:0<====
booter_set_resolution==>
[ADIBLIrdetoGetSYSSettingV5 24] <0x500, 0x100, 0x1>!
[ADIBLIrdetoGetSYSSettingV5 36] crc<0x57aa16e> OK!
[booter_set_resolution 243]@SD:4 HD:21
MDrv_PNL_Init u32PnlRiuBaseAddr = bf200000
MDrv_PNL_Init u32PMRiuBaseAddr = bf000000
[_MDrv_PNL_Init_LPLL][323]pstPanelInitData->u16Width=1280, pstPanelInitData->u16Height=720
[_MDrv_PNL_Init_LPLL][325]u16HTotal=1980,u16VTotal=750,pstPanelInitData->u16HTotal=1980,pstPanelInitData->u16VTotal=750, u16DefaultVFreq=500
[_MDrv_PNL_Init_Output_Dclk][369]pstPanelInitData->u16Width=1280, pstPanelInitData->u16Height=720
[_MDrv_PNL_Init_Output_Dclk][371]u16HTotal=1980,u16VTotal=750,pstPanelInitData->u16HTotal=1980,pstPanelInitData->u16VTotal=750, u16DefaultVFreq=500
[XC,Version][0;36m 00709801
[mno need to patch
[0;31m[_XCLiteIoctl][5642] Command 203 is not existed[0m
[0;31m[_XCLiteIoctl][5643] XC Lite version is currently in use, Please register cmd 203 in XCOpenLite![0m
UTOPIA ASSERT: 0, apiXC_v2.c _XCLiteIoctl 5644
Obtain XC engine fail
[CPU INFO] cpu openCPUIoctl - MDrv_CMD_CPU_QueryClock
[utopia info] close module id: MODULE_CPU
DAC eTiming =4
DAC Panel Table Index =4
DAC eTiming =4
HDMITx eTiming =5
[0;31m[_XCLiteIoctl][5642] Command 12 is not existed[0m
[0;31m[_XCLiteIoctl][5643] XC Lite version is currently in use, Please register cmd 12 in XCOpenLite![0m
UTOPIA ASSERT: 0, apiXC_v2.c _XCLiteIoctl 5644
Obtain XC engine fail
[0;31m[_XCLiteIoctl][5642] Command 12 is not existed[0m
[0;31m[_XCLiteIoctl][5643] XC Lite version is currently in use, Please register cmd 12 in XCOpenLite![0m
UTOPIA ASSERT: 0, apiXC_v2.c _XCLiteIoctl 5644
Obtain XC engine fail
[VE info] VE open
[Hal_VE_EnableDI][1659] bEnable = 0, bIsDNR2VE = 0
Swayer s32CustomerPoolID=1985216514
[GOP INFO] gop open
Set to Mixer
Set to Mixer
booter_set_resolution<==
booter_ir_panel_key_set==>
booter_ir_panel_key_set<==
booter_panel_display==>
booter_panel_display<==
booter_ir_config==>
booter_ir_config<==
booter_osg_init==>
booter_osg_init nRet:0<==
booter_logo_display====>
[booter_logo_display 158]m_unStartAddress:0x180000
booter_logo_display nRet:0<====
booter_enter_irdeto_booter==>
===========================================================================
===========================================================================
[Irdeto BL LIB]VER:05.01---SVN:10418---TIME:2016-07-27 15:24:26
===========================================================================
===========================================================================
[LoaderCoreSPI_GetResetType 355]get:0xaa
[BSTRAP_CheckKeySequence 329](0)ReadKey unKey:0, unKEYOK:13, unKEYUP:38
[BBCB_GetBBCB 99]result:0x0
[BSTRAP_CheckAndSetDownloadType 427]LC_ReadLoaderPartition result:0
[LoaderCoreSPI_GetPSModifyFlag 464]get:0xa5
[LoaderCoreSPI_UART_Read 57]<0--------4>, tick:3523
[BSTRAP_CheckAndSetDownloadType 501]enableOtaDownload:0x0
[BSTRAP_CheckAndSetDownloadType 553]result:0x0
[BSTRAP_CheckAndSetDownloadType 571]result:0x0
[BBCB_GetBBCB 99]result:0x0
[LoaderCoreSPI_Module_GetModuleIdList 53]LoaderCoreSPI_ReadAndCheckImageHeader result:0xfffffffe==>
[BSTRAP_BootCheck 644]moduleCount:1, factoryStatus:0
Call MI_CIPHER_Open success(eCaVid = 4)
[LoaderCoreSPI_Device_GetChecksum 140]--MAC(len:18,rtn:0): 587a9d11 3dcad776 de8ccfbb 1d61e9c2 tick:3560<<<<
Call MI_CIPHER_Open success(eCaVid = 4)
[LoaderCoreSPI_Device_GetChecksum 133]--MAC(len:128,rtn:0): 94e64104 2248d5fc 7b9248d0 b98dd82f tick:12169<<<<
[LoaderCoreSPI_GetPSModifyFlag 464]get:0xa5
[LoaderCoreAPI_StartBootStrap 256] call LoaderCoreSPI_ExecuteCode>>>>>>>>>>
[LoaderCoreSPI_ExecuteCode 586]<<APP>> at:0x1a0000---0x1a00ba, tick:12189>>>>>
[readAndCheckImagePayload 81]ADIBLLzmaDecompress to:0x80000180===>tick:16508-----
[ADIBLLzmaDecompress 1231]LzmaDecode: nRet:0
[readAndCheckImagePayload 86] ADIBLLzmaDecompress: nRet:0, unOrgLen:18734944<==, tick:18278----
[readAndCheckImagePayload 112]ok
[LoaderCoreSPI_ExecuteCode 636]checkImageData result:0<<<<<
[0m[1;33mMI_HWCAPS_Init: Module has been initialized!
[0mFlash is detected (0x0504, 0xC2, 0x20, 0x18)í[STBData][31]m_unSNStartAddr=0x140000,m_unHDCPStartAddr=0x140020,m_unMACStartAddr=0x140228, m_unPVRFlagAddr=0x1402e8, m_unCustomerCodeAddr=0x140308
MDrv_SERFLASH_GetInfo()
u32AccessWidth = 1
u32TotalSize = 16777216
u32SecNum = 256
u32SecSize = 65536
[ReadHDCPKey][185]unHDCPActLen=512,unHDCPLen=512
[ReadHDCPKey][195]dwHDCPCRC=0xf257c4c1,dwHDCPOrgCRC=0xf257c4c1
[ReadHDCPKey][206]en_Err=0
[AppSetHDCPKey:137]====0x93
[AppSetHDCPKey:147]====0
MDrv_IIC_Init PORT 1
MDrv_IIC_InitPort0: OK
UTOPIA ASSERT: 0, /users/singo.chang/swork/PERFORCE/THEALE/utopia_release/UTPA2-212.0.x_Keres_Series/build/../mxlib/hal/kirin/gpio/halGPIO.c HAL_Gpio_Set_High 1027
=========================================================================================
[FrontEnd_Index 0] Demod: DEMOD_MSB124X Tuner: TUNER_MXL608 I2C_Port:I2C0
=========================================================================================
MDrv_IIC_Init PORT 1
MDrv_IIC_InitPort0: OK
MDrv_IIC_Init PORT 1
MDrv_IIC_InitPort0: OK
MDrv_Dish_Init failed-1-ReadBytes fail!
MDrv_Dish_Init failed-2-WriteBytes fail!MDrv_DMD_MSB124X_Init Init DVBC DSP Table By Device Driver ...
MDrv_DMD_MSB124X_Init Init DVBT DSP Table By Device Driver ...
MDrv_DMD_MSB124X_Init Init DVBT2 DSP Table By Device Driver ...
MSPI Driver Already init
MDrv_DMD_MSB124x_Init Init MDrv_DMD_SSPI_Init Fail
@MSB124X, MIU self test successful.
[msb124x][beg]LoadDspCodeToSDRAM_dvbs2
dvbt dsp reg init ok
============[MDrv_TSP_Exit] TSP Exit Start ==============
============[MDrv_TSP_Exit] TSP Exit End ============
[utopia info] close module id: MODULE_DMX
************************ Start TSP_Init ************************
<FWTSP> : Reset TSP CPU Success.
>> FwVersion:00412300 , Date:20130725
************************* End TSP_Init *************************
[31mGo through DSCMB
[m[MWPVR] Not Initialize PVR!
[MDrv_SC_SetBuffAddr][5674] not support
[MDrv_SC_SetBuffAddr][5674] not support
[[utopia]] Start HAL_AUDIO_AllocateVars InitShmFlag=0
[[utopia]] create Audio SHM data ...
[[utopia]] Audio SHM data is created
[[utopia]] reset Audio SHM data ...
[[utopia]] End HAL_AUDIO_AllocateVars InitShmFlag=1, ClientCounter=1
[[utopia]] Audio TEE Info SHM is created...
[[utopia]] reset Audio TEE Info SHM data ...
[[utopia]] In HAL_AUDIO_SetDspBaseAddr, line(4803), u8Index(0x2), u32Bin_Base_Address(0x0), u32Mad_Base_Buffer_Adr(0xcb03000)
[[utopia]] 2 DSPBinBaseAddress = 0x0
[[utopia]] 2 DSPMadBaseBufferAdr = 0xcb03000
[[utopia]] 2 DSPMadMIUBank = 0
[[utopia]] Start HAL_AUDIO_AllocateVars InitShmFlag=1
[[utopia]] HAL_AUDIO_AllocateVars QUERY ClientCounter=1
[[utopia]] End HAL_AUDIO_AllocateVars InitShmFlag=1, ClientCounter=1
[[utopia]] MDrv_AUDIO_PCM_Init: Init PCM device
HAL_MAD2_SetMemInfo : SE_DSP_DDR_ADDR = 0x0CD03000, DEC_R2_ADDR = 0x0CB03000
======> Audio DEC_R2 Base : cb03000
MDrv_AUDIO_SeSystemLoadCode()
audio DSP_SE LoadCode success..
MDrv_AUDIO_DecoderLoadCode()
DSP1 LoadCode success..
DEC System code download finished!
[[utopia]] ===== Check Audio Decoder Protection from hash-key IP =====
[[utopia]] Hash-key Support DD.
[[utopia]] Hash-key Support DD+.
[[utopia]] Hash Key Check Dolby MS11 Fail, no Dolby MS11 license!!
[[utopia]] Hash Key Check Dolby MS12 LC profile Fail, no Dolby MS12 LC profile license!!
[[utopia]] Hash Key Check Dolby MS12 D profile Fail, no Dolby MS12 C profile license!!
[[utopia]] Hash Key Check Dolby MS12 B profile Fail, no Dolby MS12 B profile license!!
[[utopia]] Hash Key Check Dolby Pulse(MS10_DDT) Fail, no Dolby Pulse(MS10_DDT) license!!
[[utopia]] Hash-key Support Generic HE-AAC!!
[[utopia]] Hash Key Check DDCO Fail, no DDCO license!!
[[utopia]] Hash Key Check DTS Fail, no DTS license!!
[[utopia]] Hash Key Check WMA Fail, no WMA license!!
[[utopia]] Hash-key Support DRA.
[[utopia]] Hash Key Check DTSLBR Fail, no DTSLBR license!!
[[utopia]] Hash Key Check DTSE Fail, no DTSE license!!
[[utopia]] Hash Key Check DTSNeoUltra Fail, no DTSNeoUltra license!!
[[utopia]] Hash Key Check SRS_TSHD Fail, no SRS_TSHD license!!
[[utopia]] Hash Key Check SRS_THEATERSOUND Fail, no SRS_THEATERSOUND license!!
[[utopia]] Hash Key Check DTS_StudioSound3D Fail, no DTS_StudioSound3D license!!
[[utopia]] Hash Key Check COOK Fail, no COOK license!!
[[utopia]] Hash Key Check DTS_HD Fail, no DTS_HD license!!
[[utopia]] Hash Key Check Dolby volume Fail, no Dolby volume license!!
[[utopia]] Hash Key Check SRS_PURESND Fail, no SRS_PURESND license!!
[[utopia]] ===== Check Protection IP End =====
[[utopia]]
[1;32m==========Audio R2 & DSP Version Check==================[0m[[utopia]]
[1;32m DEC-R2:0x00DF61 DSP System:0x000B52 [0m
Audio R2 codec is same(0x3), no need to reload
[1;31m<<<_MI_DISP_GetHandle[5905] Invalid Video Window hHandler !
[0m[1;31mMI_DISP_GetHandle[1934]: Error 0x7: failed to _MI_DISP_GetHandle(...)!
[0m[1;31mMI_AUDIO_Init[2732]: Open Disp handle failed!!
[0m
============== Dump Data ==============
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
============== Dump End ==============
[1;31m_MI_SPI_LoadEnv[458]: Read Env First Block Error, Read mirror block now ...
[0m
============== Dump Data ==============
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
============== Dump End ==============
[1;31m_MI_SPI_LoadEnv[464]: Read mirror block Fail !!! Check if the env is stored in serial flash!!
[0m[1;31mMI_FLASH_LoadEnv[1553]: Load env fail
[0mMDrv_PNL_Init u32PnlRiuBaseAddr = bf200000
MDrv_PNL_Init u32PMRiuBaseAddr = bf000000
[_MDrv_PNL_Init_LPLL][323]pstPanelInitData->u16Width=1280, pstPanelInitData->u16Height=720
[_MDrv_PNL_Init_LPLL][325]u16HTotal=1980,u16VTotal=750,pstPanelInitData->u16HTotal=1980,pstPanelInitData->u16VTotal=750, u16DefaultVFreq=500
[_MDrv_PNL_Init_Output_Dclk][369]pstPanelInitData->u16Width=1280, pstPanelInitData->u16Height=720
[_MDrv_PNL_Init_Output_Dclk][371]u16HTotal=1980,u16VTotal=750,pstPanelInitData->u16HTotal=1980,pstPanelInitData->u16VTotal=750, u16DefaultVFreq=500
[XC,Version][0;36m 00709801
[mno need to patch
[CPU INFO] cpu openCPUIoctl - MDrv_CMD_CPU_QueryClock
[utopia info] close module id: MODULE_CPU
DAC eTiming =4
DAC Panel Table Index =4
DAC eTiming =4
HDMITx eTiming =5
[VE info] VE open
[Hal_VE_EnableDI][1659] bEnable = 0, bIsDNR2VE = 0
[Fail][MDrv_MVOP_GetStatus,2600]
[1;35m>>>MI_TTX_Init[698]
[0m[1;32m_eTtxStatus 0
[0m[1;32mstOsdCaps.stGopCfg.u8Subtitle = 0x2
[0m[1;35m<<<MI_TTX_Init[703]
[0m[1;35m>>>MI_TTX_Open[717]
[0m[1;32m_eTtxStatus 1
[0m[1;32mapiTTX_AllocTTPktBuffer
[0m[1;32mTT_WriteCommand(TTX_CMD_INIT_TTX, 0, 0)
[0m[1;35m<<<MI_TTX_Open[726]
[0m[1;35m>>>MI_TTX_SetAttr[741]
[0m[1;32m_eTtxStatus 2
[0m[1;32mSet TT_MODE_Normal mode
[0m[1;35m<<<MI_TTX_SetAttr[762]
[0m[1;35m>>>MI_TTX_SetAttr[741]
[0m[1;32m_eTtxStatus 2
[0m[1;35m<<<MI_TTX_SetAttr[756]
[0m[1;35m>>>MI_TTX_SetAttr[741]
[0m[1;32m_eTtxStatus 2
[0m[1;35m<<<MI_TTX_SetAttr[750]
[0m
[GOP INFO] gop open
Swayer s32CustomerPoolID=1985216515
Set to Mixer
Set to Mixer
Usb init
[NCM]The allocted address is 0xa6d31cf0
Init Software Timer ok
Init USB MSC
[USB] MS USB Host Lib for KIRIN only
Init chip KIRIN, port 0
[USB] constant upll NLib usb_init start, UTMI base 0xbf207500, USBC base 0xbf200e00, UHC base 0xbf204800, USBBC base 0xbf226e00
ehci_hcd (CPE_AMBA) at 0x0xbf204800, irq 7
new USB Bus, assigned pBus number 1
pQh: 0xa6d32000, pQh->qh_dma_addr: 0x06d32000
Allocate a non-cacheable memory pool for periodic frame list array 0xa6d34000, size 1024
qh dma addr: 0x06d32000
[EHCI] Enable Park Mode: 3
EHCI 1.00, driver eCos Newhost
[root hub] device address 1
USB device manufacturer string (index 3) = MStar eCos 1.0 ehci_hcd
USB device product string (index 2) = CPE_AMBA EHCI
USB device serial number string (index 1) = cpe_ehci
usbdev 1-0 - registering interface 1-0:0
USB hub found
1 port detected
ms_ehci_hcd_cpe_ehci_drv_probe_EX -> allocate usb_hcd
Usb start EX..., pRootHub = 81121b90
Init chip KIUTask EX>> ... port 0 starting
RIN, port 1
[USB] constant upll NLib usb_init start, UTMI base 0xbf207400, USBC base 0xbf200f00, UHC base 0xbf201a00, USBBC base 0xbf226e80
ehci_hcd (CPE_AMBA) at 0x0xbf201a00, irq 94
new USB Bus, assigned pBus number 2
pQh: 0xa6d36000, pQh->qh_dma_addr: 0x06d36000
Allocate a non-cacheable memory pool for periodic frame list array 0xa6d38000, size 1024
qh dma addr: 0x06d36000
[EHCI] Enable Park Mode: 3
EHCI 1.00, driver eCos Newhost
[root hub] device address 1
USB device manufacturer string (index 3) = MStar eCos 1.0 ehci_hcd
USB device product string (index 2) = CPE_AMBA EHCI 1
USB device serial number string (index 1) = cpe_ehci_1
usbdev 2-0 - registering interface 2-0:0
USB hub found
1 port detected
ms_ehci_hcd_cpe_ehci_drv_probe_EX -> allocate usb_hcd
Usb start EX..., pRootHub = 811218d0
1UTask EX>> ... port 1 starting
881 MDrv_EMAC_Init 10:00:52 Nov 8 2016
emac addr:a146739c,a0000000,1468000,1488000
Default eth0 interface Configure......
Configing IP:0.0.0.0
Configing SubNet:255.255.255.0
Configing Gateway:192.168.0.2
2224 EMAC_stop
_DrvEMAC_Task0
[1;33m
drvEMC:Can't get MAC from EMAC register!!!
drvEMC:Plz Setting MAC Address on MBOOT FIRST!!!
(setenv ethaddr XX:XX:XX:XX:XX:XX;saveenv)
[mIP = 00000000
Subnet = 00ffffff
Gateway = 000000855 EMAC_PhyAddrScan phy [0]=78c9
006
MAC = 00:30:1b:ba:02:db
Routing tables
Destination Gateway Mask Flags Interface Genmask
0.0.0.0 0.0.0.0 255.255.255.0 U eth0
0.0.0.0 192.168.0.2 0.0.0.0 UG eth0
127.0.0.0 127.0.0.1 255.0.0.0 UG lo0
127.0.0.1 127.0.0.1 U lo0
Interface statistics
eth0 IP: 0.0.0.0, Broadcast: 0.0.0.255, Netmask: 255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU: 1500, Metric: 0
Rx - Packets: 0, Bytes: 0, Tx - Packets: 0, Bytes: 0
lo0 IP: 127.0.0.1, Broadcast: 127.0.0.1, Netmask: 255.0.0.0
UP LOOPBACK RUNNING MULTICAST MTU: 16384, Metric: 0
Rx - Packets: 0, Bytes: 0, Tx - Packets: 0, Bytes: 0
Default MI_NET interface Done......
0879 EMAC_CableConnection Link change 78c9
[LzmaDecompress 1226]LzmaDecode: nRet:0
[LzmaDecompress 1226]LzmaDecode: nRet:0
APAssert: "nFlashBlockCount < 3", in file /home/liaoyuansong/MAS1110/DTV/Component/ServicesDataBasePlayer/DataBase/Archive/FlashFSRW/InitFlashBlockList.cpp, at line 63
ThisUVE.initedEMAC = 1
EMAC: init done
APAssert: "nFlashBlockCount < 3", in file /home/liaoyuansong/MAS1110/DTV/Component/ServicesDataBasePlayer/DataBase/Archive/FlashFSRW/InitFlashBlockList.cpp, at line 63
APAssert: "nFlashBlockCount < 3", in file /home/liaoyuansong/MAS1110/DTV/Component/ServicesDataBasePlayer/DataBase/Archive/FlashFSRW/InitFlashBlockList.cpp, at line 63
APAssert: "nFlashBlockCount < 3", in file /home/liaoyuansong/MAS1110/DTV/Component/ServicesDataBasePlayer/DataBase/Archive/FlashFSRW/InitFlashBlockList.cpp, at line 63
APAssert: "nFlashBlockCount < 3", in file /home/liaoyuansong/MAS1110/DTV/Component/ServicesDataBasePlayer/DataBase/Archive/FlashFSRW/InitFlashBlockList.cpp, at line 63
APAssert: "nFlashBlockCount < 3", in file /home/liaoyuansong/MAS1110/DTV/Component/ServicesDataBasePlayer/DataBase/Archive/FlashFSRW/InitFlashBlockList.cpp, at line 63
APAssert: "nFlashBlockCount < 3", in file /home/liaoyuansong/MAS1110/DTV/Component/ServicesDataBasePlayer/DataBase/Archive/FlashFSRW/InitFlashBlockList.cpp, at line 63
APAssert: "nFlashBlockCount < 3", in file /home/liaoyuansong/MAS1110/DTV/Component/ServicesDataBasePlayer/DataBase/Archive/FlashFSRW/InitFlashBlockList.cpp, at line 63
APAssert: "unRe == 1", in file /home/liaoyuansong/MAS1110/DTV/Component/ServicesDataBasePlayer/DataBase/DataBase.cpp, at line 3761
APAssert: "pEventStrategyNotify != NULL", in file /home/liaoyuansong/MAS1110/DTV/Services/CombinationServices/UpdateLiveEventInfo/EventStrategy/EventStrategy.cpp, at line 14
[LockingNotify][229]---0/0/0
m_ucStandby = 0
m_ucMute = 0
m_ucMainVolume = 22
m_ucEnableAD = 0
m_ucADVolume = 21
m_ucPreferenceAudioFormat = 0
m_ucPreferenceAudioType = 128
m_ucDigitalOutput = 0
m_ucAudioChannel = 0
m_ucSDResolution = 4
m_ucHDResolution = 19
m_ucHDMICECEnable = 1
m_ucAspectRatio = 2
m_ucMatchMode = 0
m_ucAutoTimeZoneEnable = 1
m_ucSummerTime = 0
m_ucManualTimeZone = 27
m_acContryCode = DEU
m_ucRegionId = 0
m_acFirstAudioLanguageCode = deu
m_acSecondAudioLanguageCode = eng
m_ucSubtitleEnable = 0
m_acFirstSubtitleLanguageCode = ger
m_acFirstSubtitleLanguageCode = gng
m_ucPGLevel = 15, m_ucPGControlOff = 0
m_ucGroupIndex = 0
m_usServiceIndex = 0
m_sLongtitude = 0
m_sLatitude = 0
m_ucOSDTransparency = 100
m_ucScreenBrightness = 50
m_ucScreenContrast = 50
m_ucScreenSaturation = 50
m_ucIndividualVolumeOnOff = 0
m_ucIndividualAudioChannelOnOff = 0
m_ucIndividualAudioLanguageOnOff = 0
m_ucIndividualSubtitleLanguageOnOff = 0
m_usLastTVServiceIndex = 0
m_usLastRadioServiceIndex = 0
m_ucVBITeletextOutput = 0
m_ucVBICCOutput = 0
[_MDrv_PNL_Init_LPLL][323]pstPanelInitData->u16Width=1920, pstPanelInitData->u16Height=1080
[_MDrv_PNL_Init_LPLL][325]u16HTotal=2640,u16VTotal=1125,pstPanelInitData->u16HTotal=2640,pstPanelInitData->u16VTotal=1125, u16DefaultVFreq=500
[_MDrv_PNL_Init_Output_Dclk][369]pstPanelInitData->u16Width=1920, pstPanelInitData->u16Height=1080
[_MDrv_PNL_Init_Output_Dclk][371]u16HTotal=2640,u16VTotal=1125,pstPanelInitData->u16HTotal=2640,pstPanelInitData->u16VTotal=1125, u16DefaultVFreq=500
DAC eTiming =6
DAC Panel Table Index =6
DAC eTiming =6
[LockingNotify][229]---0/0/0
HDMITx eTiming =7
[Hal_VE_EnableDI][1659] bEnable = 0, bIsDNR2VE = 0
[LockingNotify][229]---0/0/0
[_MDrv_PNL_Init_LPLL][323]pstPanelInitData->u16Width=1280, pstPanelInitData->u16Height=720
[_MDrv_PNL_Init_LPLL][325]u16HTotal=1980,u16VTotal=750,pstPanelInitData->u16HTotal=1980,pstPanelInitData->u16VTotal=750, u16DefaultVFreq=500
[_MDrv_PNL_Init_Output_Dclk][369]pstPanelInitData->u16Width=1280, pstPanelInitData->u16Height=720
[_MDrv_PNL_Init_Output_Dclk][371]u16HTotal=1980,u16VTotal=750,pstPanelInitData->u16HTotal=1980,pstPanelInitData->u16VTotal=750, u16DefaultVFreq=500
DAC eTiming =4
DAC Panel Table Index =4
DAC eTiming =4
[LockingNotify][229]---0/0/0
HDMITx eTiming =5
[Hal_VE_EnableDI][1659] bEnable = 0, bIsDNR2VE = 0
[1;31m<<<_MI_DISP_CalHDWin[3346] MDrv_MVOP_GetOutputTiming failed!!
[0m[1;31m<<<MI_DISP_ApplySetting[3867] fatal error, return
[0m[1;31m<<<ADIVIDEOSetMatchMethod[721] MI_DISP_ApplySetting error
[0m[LockingNotify][229]---0/0/0
[1;35m>>>MI_PM_GetAttr[1603]
[0m[1;35m<<<MI_PM_GetAttr[1629]
[0m[ADIBLVirEEPROMRegister 269]ii:0 index:2, flashAddr:0x120000 ok!
[LockingNotify][229]---0/0/0
[BBCB_GetBBCB 99]result:0x0
[LoaderCoreAPI_InitApplicationModule 19]LC_ReadLoaderPartition result:0
[ReadMAC][270]unMACActLen=12,unMACLen=64
[ReadMAC][280]dwMACCRC=0x3a186ffd,dwMACOrgCRC=0x3a186ffd
[ReadMAC][290]MAC=8C6D5055DF4B\n[ReadMAC][293]en_Err=0
2224 EMAC_stop
8c 6d 50 55 df 4b Mac addr 8c:6d:50:55:df:4b
IP = 00000000
Subnet = 00ffffff
Gateway = 00000006
MAC = 8c:6d:50:55:df:4b
Routing tables
Destination Gateway Mask Flags Interface Genmask
0.0.0.0 0.0.0.0 255.255.255.0 U eth0
127.0.0.0 127.0.0.1 255.0.0.0 UG lo0
127.0.0.1 127.0.0.1 U lo0
Interface statistics
eth0 IP: 0.0.0.0, Broadcast: 0.0.0.255, Netmask: 255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU: 1500, Metric: 0
Rx - Packets: 0, Bytes: 0, Tx - Packets: 0, Bytes: 0
lo0 IP: 127.0.0.1, Broadcast: 127.0.0.1, Netmask: 255.0.0.0
UP LOOPBACK RUNNING MULTICAST MTU: 16384, Metric: 0
Rx - Packets: 0, Bytes: 0, Tx - Packets: 0, Bytes: 0
[ReadPEF][340]en_Err=0
[CAInit:203]============eEN_STB_DATA = 0,unPEFActLen = 60
[LockingNotify][229]---0/0/0
[LockingNotify][229]---0/0/0
[LockingNotify][229]---0/0/0
[LockingNotify][229]---0/0/0
[LockingNotify][229]---0/0/0
[BBCB_GetBBCB 99]result:0x0
[BBCB_GetBBCB 99]result:0x0
[BBCB_GetBBCB 99]result:0x0
Call MI_CIPHER_Open success(eCaVid = 4)
[LoaderCoreSPI_Device_GetChecksum 140]--MAC(len:18,rtn:0): 298c1afd 98194e12 75cd7a28 fbf6dc9c tick:11976<<<<
[LC_VerifyMACSignature 562]---OK---
Call MI_CIPHER_Open success(eCaVid = 4)
[LoaderCoreSPI_Device_GetChecksum 140]--MAC(len:132,rtn:0): 74a1e3a3 2364083a ea233c7d b6ced0a6 tick:12043<<<<
[LC_VerifyMACSignature 562]---OK---
[BBCB_GetBBCB 99]result:0x0
[BBCB_GetBBCB 99]result:0x0
[ADI_CA_Initialize 231] UniversalClient_StartCaClient: nRet 0
SET gusDeviceSubCustomer: 0xa3
[BBCB_GetBBCB 99]result:0x0
[BBCB_GetBBCB 99]result:0x0
[BBCB_GetBBCB 99]result:0x0
[IRDETOOTAInitialise 98] init nResult:0
[LockingNotify][229]---0/0/0
[LockingNotify][229]---0/0/0
[LockingNotify][229]---0/0/0
[LockingNotify][229]---0/0/0
[LockingNotify][229]---0/0/0
[LockingNotify][229]---0/0/0
[CloakMsgNortify 59]sCoreStatus.m_aucCoreList: (I01) D500-0 M05 m00 N00 C01 S00 V09 T00
[CloakMsgNortify 61]sCoreStatus.m_aucCoreUpdateStutus:
[CloakMsgNortify 73] UC_GLOBAL_NOTIFY_FLEXIFLASH_MESSAGE (I01) D500-0 M05 m00 N00 C01 S00 V09 T00 5.0.0-1.0
5.0.0-1.0 (I01) D500-0 M05 m00 N00 C01 S00 V09 T00
[Warning] Bad mac_config_data.macrovisionConfig.length: 17
[LockingNotify][229]---0/0/0
[LockingNotify][229]---0/0/0
[LockingNotify][229]---0/0/0
[LockingNotify][229]---0/0/0
===ChangeInitLogoToDyon, 697, unCRC = 0x1e5ea41e ====
[CurlInit:210]========================m_unIsCreateCURL = 1
[RSSNetwork:23]=============unRet = 0
[LockingNotify][229]---0/0/0
APAssert: "unRet != 1", in file /home/chenyuxing/trunk_new/NetworkApplication/RSS/RSSInfo/RSSNetwork.cpp, at line 488
[CurlInit:210]========================m_unIsCreateCURL = 1
[LockingNotify][229]---0/0/0
[LockingNotify][229]---0/0/0
[LockingNotify][229]---0/0/0
[LockingNotify][229]---0/0/0
[LockingNotify][229]---0/0/0
IP = 00000000
Subnet = 00ffffff
Gateway = 00000006
MAC = 8c:6d:50:55:df:4b
Routing tables
Destination Gateway Mask Flags Interface Genmask
0.0.0.0 0.0.0.0 255.255.255.0 U eth0
127.0.0.0 127.0.0.1 255.0.0.0 UG lo0
127.0.0.1 127.0.0.1 U lo0
Interface statistics
eth0 IP: 0.0.0.0, Broadcast: 0.0.0.255, Netmask: 255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU: 1500, Metric: 0
Rx - Packets: 0, Bytes: 0, Tx - Packets: 0, Bytes: 0
lo0 IP: 127.0.0.1, Broadcast: 127.0.0.1, Netmask: 255.0.0.0
UP LOOPBACK RUNNING MULTICAST MTU: 16384, Metric: 0
Rx - Packets: 0, Bytes: 0, Tx - Packets: 0, Bytes: 0
[LockingNotify][229]---0/0/0
[LockingNotify][229]---0/0/0
[LockingNotify][229]---0/0/0
[LockingNotify][229]---0/0/0
[LockingNotify][229]---0/0/0
[LockingNotify][229]---0/0/0
[LockingNotify][229]---0/0/0
[LockingNotify][229]---0/0/0
[LockingNotify][229]---0/0/0
[LockingNotify][229]---0/0/0
[ADIPanelClear---150]:eName == 31
[1;35m>>>MI_PM_Init[1308]
[0m[1;32mSram Size=0x4800
[0m[1;35m>>>_MI_PM_MbxInit[329]
[0m[1;32mE_MBX_CLASS_PM_WAIT - MBX register msg success
[0m[1;32mPM will run on Sram!
[0m[1;32mMove PM from Dram to Sram by BDMA!
[0m[1;32mpu8PMLite Addr= 0xa6d20cc0
[0m[1;32mRun Pm on Sram success
[0m[LockingNotify][229]---0/0/0
Wait for PM51 ó��à��àüàà�àà�àü�àà�ü�ààüàüàü�àààààààà�àü�àà�à�àüà�ààüààààü�à��àü�àü�àü��à��üüüüàà�üüüü��ÿ
The firmware contains a small bootloader at the start of the flash, and a bigger, LZMA-compressed part with copies at 0x20100 and 0x720100.
The main part of the firmware (the OS) is probably based on eCos.
binwalk output
$ binwalk dump1.bin
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
24976 0x6190 SHA256 hash constants, little endian
131328 0x20100 LZMA compressed data, properties: 0x5D, dictionary size: 1048576 bytes, uncompressed size: 3040544 bytes
1345276 0x1486FC Sega MegaDrive/Genesis raw ROM dump, Name: "/SEGSIZE>", "SEGSIZE>0x56400<",
1345443 0x1487A3 Sega MegaDrive/Genesis raw ROM dump, Name: "/SEGSIZE>", "SEGSIZE>0x56400<",
1345610 0x14884A Sega MegaDrive/Genesis raw ROM dump, Name: "/SEGSIZE>", "SEGSIZE>0x56400<",
1345777 0x1488F1 Sega MegaDrive/Genesis raw ROM dump, Name: "/SEGSIZE>", "SEGSIZE>0x56400<",
1345944 0x148998 Sega MegaDrive/Genesis raw ROM dump, Name: "/SEGSIZE>", "SEGSIZE>0x56400<",
1346111 0x148A3F Sega MegaDrive/Genesis raw ROM dump, Name: "/SEGSIZE>", "SEGSIZE>0x56400<",
1346278 0x148AE6 Sega MegaDrive/Genesis raw ROM dump, Name: "/SEGSIZE>", "SEGSIZE>0x56400<",
1346445 0x148B8D Sega MegaDrive/Genesis raw ROM dump, Name: "/SEGSIZE>", "SEGSIZE>0x44400<",
1346537 0x148BE9 Sega MegaDrive/Genesis raw ROM dump, Name: "/SEGSIZE>", "SEGSIZE>0x12000<",
1346704 0x148C90 Sega MegaDrive/Genesis raw ROM dump, Name: "/SEGSIZE>", "SEGSIZE>0x56400<",
1346871 0x148D37 Sega MegaDrive/Genesis raw ROM dump, Name: "/SEGSIZE>", "SEGSIZE>0x26c00<",
1346963 0x148D93 Sega MegaDrive/Genesis raw ROM dump, Name: "/SEGSIZE>", "SEGSIZE>0x2f800<",
1347129 0x148E39 Sega MegaDrive/Genesis raw ROM dump, Name: "EGSIZE>", "SEGSIZE>0xc00</S",
1572944 0x180050 JPEG image data, JFIF standard 1.02
7365008 0x706190 SHA256 hash constants, little endian
7471360 0x720100 LZMA compressed data, properties: 0x5D, dictionary size: 1048576 bytes, uncompressed size: 3040544 bytes
8519760 0x820050 JPEG image data, JFIF standard 1.02
12058755 0xB80083 Zlib compressed data, best compression
12452443 0xBE025B Certificate in DER format (x509 v3), header length: 4, sequence length: 467
12452624 0xBE0310 Certificate in DER format (x509 v3), header length: 4, sequence length: 286
There are lots of strings in the main part of the firmware (the OS). Here are a few:
/ecos-y/DDI_Kirin/THEALE/Uranus/Kirin/DDI_Package/ddi_pkg_ecos/ecos/LIB_eCosNet_fileio_posix_fat_ntfs_v3_net_cpuload_c++_kirin_74kf_install/include/cyg/kernel/smp.hxx
/home/liyanjun/trunk/Artpal/Porting/Mstar/msd7t75-ecos/src/msddrv4bl/DDI/ecos/V1.0/Kirin/DDI_Package/ddi_pkg_ecos/cus_mstar/project/mstar_loader/../../../cus_mstar/castpal/adi_tuner.c
Artpal_ADI_BL_svn7281() (svn://192.168.100.2/artpal/trunk/Artpal/Porting/Mstar/msd7t75-ecos) (mode:ManualCompile) Mar 21 2016 15:30:45
/home/adminuser/stb/SZ_Keres_Series/UTPA2-212.0.x_Keres_Series/build/../mxlib/hal/kirin/gpio/halGPIO.c
| stage | flash offset | load address | description |
|---|---|---|---|
| boot1 | 0x000000 | 0x94000000 | probably memory-mapped SPI flash |
| LDR0 | 0x004000 | 0x80800000 | loaded into RAM; performs decompression |
| boot2 | 0x020100 | 0x82000180 | LZMA-compressed eCos OS |
| app | 0x1a0000 | 0x80000180 | encrypted DVB-T2 app ("Irdeto") |
The 8-pin connector (CON1) can be used to access the flash (U1), if the 0402 resistors next to it are populated.
| CON1 pin | unpop resistor | function |
|---|---|---|
| 1 | -- | power? |
| 2 | R155 (2) | TF6 / SCK |
| 3 | R184 (1) | TF1 / CS# |
| 4 | R185 (3) | TF5 / MOSI |
| 5 | -- | -- |
| 6 | R186 (5) | TF2 / MISO |
| 7 | -- | GND |
| 8 | R188 (4) | -- |
