In Need Of 301.013 Write Protected Sector Help!!!!

[Crazy1_79]

I have this 301.013, I originally did the vid mod, saved the tsop and eeprom and rewrote D500 at 7FFFFFAC to 0000, no problem, went smooth, I then added a Auto reset lock, AR105C to be exact, no problem, works and went smooth. I left the vid mod on the receiver, and just tacked the reset wire to the wire I had coming from Sb35 to the vid mod switch I installed in the back.

This is where I get greedy, I had a old 301.013 that I have the yellow card for that still has its original subbed programming so it is my brilliant idea to clone my 301 using flashedit to the old 301's boxkey and ird number so if and when nagra 1 goes down and nagra 2 isn't hacked I can use a MC with blocker mode and still get some free tv. So I successfully make the file using flashedit, (couldn't use the old 301 tsop image because of two different build configs) The file is good, Good crc and what not. I unlock the autoreset lock and I erase the flash on my current 301 and try to load the cloned image, it works great untill I get to 99 percent and then I get to address 7FFFFF40, then we have a error. After much research on the forums, I now know this is the beginning of the write protected tsop so I get out the volt meters and check my voltage at the sb35 test spot. I have 3.3V with the vidmod turned on or off. I find this very strange but then remember the reset wire going to it. I unsolder the reset wire from the sb 35 test point and now I have 12.3 volts at the sb 35 test point with vidmod on, and only 3.2 with the vidmod off.


I think I am now good to go, so I try again and once again, I get error programming at address 7FFFFF40. I have tried taking the jumper off of the lock, uhooking the positive feed to the lock, I have tried wall 2.0. I have tried several variations of combinations but have one DEAD DEAD DEAD 301 on my hands. I have checked connections on the vid mod, look good to me, I need some help here guys, I cannot believe this unit is dead.

One more thing, I could swear that last night at one point I actually brought up address 7FFFFFAC and I got all FFFF so I put in 0000 and hit the program button for one address programming, I swear that it programmed to that address but it was late and I was tired so I may be mistaken. After it did that, I erased the flash 3 times and tried programming, it got to 7FFFFF40 and errored out. I have R79 grounded to the case just so you know.

Do you think the lock could be causing this even though it is in the unlock position? I have checked the connections of all points on the lock and they look good to me. Any suggestions would be greately appreciated.

[Crazy1_79]

Just to edit up on this post, I still get the error that of programming at 7FFFFF40 but I can manually program just that address by putting in another combination of letters and hitting program, this tells me that my vid mod is working correctly. I can also program 7FFFFFAC from FFFF to 0000 but yet it will not program the whole flash. Still need help.

[skinerd]

First off, you CAN write you subbed 301 receiver image to another 301 of the same type, ie. -013 single if both are single, or both are dual tsop. Build config is not a concern for 301's of the same type.........trust me on that, I have done quite a few. Write the subbed flash and eeprom to the other 301 you'll be good to go, if they are the same type as discussed above.

Secondly, read 7FFFFF40 and see if it is FFFF, if not then it is not erased, and therefore will not program.
As far as blank or erased sectors, blank is considered to be FFFF, not 0000.

[Crazy1_79]

it is FFFF and thanks for the quick post skinerd, I appreciate it. 7FFFFFAC is also FFFF. Any other suggestions? I am going to try the original image of the receiver that has the subbed card.

Would the write protected area of the tsop read and be saved to memory of the flash if I did it with the vidmod switch in the off position? Maybe this is what I did, but I find it hard to beleive.

[HILLBILLY]

I have this 301.013, I originally did the vid mod, saved the tsop and eeprom and rewrote D500 at 7FFFFFAC to 0000, no problem, went smooth, I then added a Auto reset lock, AR105C to be exact, no problem, works and went smooth. I left the vid mod on the receiver, and just tacked the reset wire to the wire I had coming from Sb35 to the vid mod switch I installed in the back.

This is where I get greedy, I had a old 301.013 that I have the yellow card for that still has its original subbed programming so it is my brilliant idea to clone my 301 using flashedit to the old 301's boxkey and ird number so if and when nagra 1 goes down and nagra 2 isn't hacked I can use a MC with blocker mode and still get some free tv. So I successfully make the file using flashedit, (couldn't use the old 301 tsop image because of two different build configs) The file is good, Good crc and what not. I unlock the autoreset lock and I erase the flash on my current 301 and try to load the cloned image, it works great untill I get to 99 percent and then I get to address 7FFFFF40, then we have a error. After much research on the forums, I now know this is the beginning of the write protected tsop so I get out the volt meters and check my voltage at the sb35 test spot. I have 3.3V with the vidmod turned on or off. I find this very strange but then remember the reset wire going to it. I unsolder the reset wire from the sb 35 test point and now I have 12.3 volts at the sb 35 test point with vidmod on, and only 3.2 with the vidmod off.


I think I am now good to go, so I try again and once again, I get error programming at address 7FFFFF40. I have tried taking the jumper off of the lock, uhooking the positive feed to the lock, I have tried wall 2.0. I have tried several variations of combinations but have one DEAD DEAD DEAD 301 on my hands. I have checked connections on the vid mod, look good to me, I need some help here guys, I cannot believe this unit is dead.

One more thing, I could swear that last night at one point I actually brought up address 7FFFFFAC and I got all FFFF so I put in 0000 and hit the program button for one address programming, I swear that it programmed to that address but it was late and I was tired so I may be mistaken. After it did that, I erased the flash 3 times and tried programming, it got to 7FFFFF40 and errored out. I have R79 grounded to the case just so you know.

Do you think the lock could be causing this even though it is in the unlock position? I have checked the connections of all points on the lock and they look good to me. Any suggestions would be greately appreciated.
rewrote D500 at 7FFFFFAC to 0000 - what does this do?
sorry, if there is somewhere i can read up on this stuff, please point me in the right direction.
thanks
hillbilly

[Crazy1_79]

allows the 013 to accept older blue rom cards.

[HILLBILLY]

allows the 013 to accept older blue rom cards.
oh, this is done in conjunction with a vid mod then on a single tsop. kool.
i was just wondering cause i have a .013 dual and thought i was missing something. thanks for the info.

[skinerd]

it is FFFF and thanks for the quick post skinerd, I appreciate it. 7FFFFFAC is also FFFF. Any other suggestions? I am going to try the original image of the receiver that has the subbed card.

Would the write protected area of the tsop read and be saved to memory of the flash if I did it with the vidmod switch in the off position? Maybe this is what I did, but I find it hard to beleive.


The flash should save without the vid mod, but I always turn it on and ground R79 before I do anything, then I have the best chance of getting everything right w/o DCU peek or other errors.
The protected sectors are only write protected, not read protected.

[Crazy1_79]

I can write to each individual adrress but it will not write the complete flash. I just went through and manually entered the last lines in jkeys after opening up the tsop image in hex workshop, I got all the way to the next to last line and mixed up a number, It actually read in jkeys and I got software and box keys after adding that much but the box keys were inverted every two bytes. I must have to flip the bytes around when I put them in. It doesn't make any sense why I can put them in one at a time but the whole image won't flash.

[skinerd]

You can enter the receiver number and boxkeys manually, but you have to know what you are doing, it is not straight forward the procedure. Please don't ask me to explain. I will however give a brief description of how jkeys stores and reads individual addresses. First jkeys does not display individual addresses, 7FFFFFAC when read is not 7FFFFFAC, only it is also 7FFFFFAD.....try enter and to read 7FFFFFAD... you can't........
D500, when read entering 7FFFFFAC, is D5 in 7FFFFFAD, and 00 in 7FFFFFAC. Now you see why I won't try to explain how the receiver number and boxkeys are stored and entered manually? Understand what Dword is?

If you can enter addresses and program them, I'd look at the jtag as a possible problem, you using a good buffered jtag?

[Crazy1_79]

THE 301 IS ALIVE!!!! hahahaha, ok guys, I couldn't get it to write the write protect but I could put it in 2 bytes at a time and change the address and then write two more bytes, so I opened the tsop bin in hex workshop and copied the write protected area onto the chip, and guess what, it works!! One thing of note though. if you take address 7FFFFF40 and address 7FFFFF41 you must invert the two, byte 41 goes into jkeys before byte 40. I hope like hell no one ever has to know that because my eyes are about to bleed from this damn thing. but it is working and thanks skinerd for all of the advice.

[acvb]

I am trying to follow this. I have hexworkshop, but my boxkeys start at the end of line 003FFF34 and continue at line 003FFF48. How do you get 7FFFFF40 ? or 7FFFFF40?

[skinerd]

I am trying to follow this. I have hexworkshop, but my boxkeys start at the end of line 003FFF34 and continue at line 003FFF48. How do you get 7FFFFF40 ? or 7FFFFF40?

The flash address starts at 0x7FC00000. The hex editor starts at 0x0. So you have to add, in hexidecimal, the 2 together, 7FC00000 + 003FFF34=7FFFFF34, which is the address of the first address in that line.

[skinerd]

THE 301 IS ALIVE!!!! hahahaha, ok guys, I couldn't get it to write the write protect but I could put it in 2 bytes at a time and change the address and then write two more bytes, so I opened the tsop bin in hex workshop and copied the write protected area onto the chip, and guess what, it works!! One thing of note though. if you take address 7FFFFF40 and address 7FFFFF41 you must invert the two, byte 41 goes into jkeys before byte 40. I hope like hell no one ever has to know that because my eyes are about to bleed from this damn thing. but it is working and thanks skinerd for all of the advice.


Glad you figured a way to get it going, but still would like to know why jkeys would not let you write the whole flash. It is possible that there is one single bad address that does not totally erase or program, so jkeys stops when it hits that address. And if that address contains non vital data, it will still allow the receiver to function. I don't know if that's the case, just an idea.

[Crazy1_79]

Glad you figured a way to get it going, but still would like to know why jkeys would not let you write the whole flash. It is possible that there is one single bad address that does not totally erase or program, so jkeys stops when it hits that address. And if that address contains non vital data, it will still allow the receiver to function. I don't know if that's the case, just an idea.
Actually skinderd there was one address that did not erase I don't remember which one it was a couple of line down I believe, I went to erase it and it said you have to erase the sector before you can write to it but it already had the info I wanted to put there so that may have been my problem, I erased the flash 5 times before I programmed and when it checked it, it came back blank. so that may have been my problem