Need an expert...dead 508

[ocelot_ark]

I tried my usual site and no one seems to be able to help me...so I'm hoping somewhere here can. I've read some old posts that somewhat go into this problem but I never get a concrete solution. Perhaps the person whose problem was solved never posts their results... Here was my first post there... I'm following the instructions to flash my 508 for use with N2. I backed up all of my stuff...flash1/2/eeprom. So I get to the point where you overwrite the eeprom and that worked fine. Next, get to the point where I need to load up the modded TSOP bin and I get this error: "The flash codes returned are not recognized by jKeys. Mfg/Device codes returned are FFFF/FFFF (JEDEC) and FFFF/FFFF (FlashFile)." jKeys worked fine previously...I saved a screen of the boxkeys/ird info screen for safe keeping. NOW - that screen is ALL messed up. Here's a before and after shot of that screen. BEFORE! http://i28.photobucket.com/albums/c202/ocelot_ark/JTAGinfo.jpg AFTER! http://i28.photobucket.com/albums/c202/ocelot_ark/WTF.jpg As you can see, I'm using a 508. I've tried using Wall to restore my back up, but I don't quite know how to use that program. I made a virgin TSOP and tried it as well...both seem to program fine, but still can't flash in jkeys. I resoldered my JTag just to be sure. I'm not sure but I think my Ground is okay. I'm just about out of ideas. Anyone out there got an idea?

[ocelot_ark]

And a bit later (After doing a vidmod, jumping OJ1, and Pad1 Ground stuff): Also...I went into jkeys and changed all instances of 0x2250 to 0xFFFF. Doing that WILL let me get into Flash programming and actually use the options, so progress? I try to load a virgin Flash 2 and it gets to 20% before giving me this: "Error programming flash at offset 0x7fcd0000." And Then: Okay, I finally found the chipset...wasn't looking at the end of the number series. They are both GT's, so I guess it's good I did the vidmod, presuming I did it correctly.

[ocelot_ark]

And here's the latest update... http://i28.photobucket.com/albums/c202/ocelot_ark/fedup.jpg http://i28.photobucket.com/albums/c202/ocelot_ark/part2.jpg I'm getting FFFF device and MFG...It always tells me that the flash is not empty when I try to write a virgin TSOP, then it craps out on me at 20%. I've tried erasing the full flash 2 a million times but it always just flashes for a second, like it's not really doing anything. (Doing this by changing def file 0x2250 to 0xFFFF so I can at least get in there) If anyone HERE has any ideas, I'd LOVE to hear them. I'm soooooo frustrated right now. I haven't had TV since Thursday night.

[skinerd]

Did you use the 4 wire, 2 trace cut, vid mod method?? Where a trace is cut above and one below the board??
If you just used the 3 wire, 1 cut, method, you may have destroyed the flash chips, I have seen that done more times than you can imagine.

[ocelot_ark]

Yes, I used the 4 wire method with the 2 trace cuts...although, I'm not an expert so I don't know if I did the trace cut well enough (if anything, I think I might have cut the wire trace too deep).

[sukh77]

After you apply the .fs script it makes the 508/510 a 501. Redo the detect and see if everything is normal in 501.

[ocelot_ark]

What .fs script? Basically, I got to these steps:
1- using JKEYS, delete flash 1 & 2
2- overwrite eeprom
3- write VIRGIN flash 2 ---- and that's when I get the problem.

[sukh77]

Sorry so you didn't even get to write a flash. Didn't read it throughly.
I've got a box doing the same thing. I've had to put a jumper on OJ1. Then have to remove the jtag completely before doing ok on the warning screen. Had to use wall. I will post more details later tonight unless u get it figured out.

Directions for wall.

reset ejtag. (don't worry if it says incorrect BS)
Load a flash.
Set Flash base address to 1FC00000
Length(hex) = 60000.
Then erase flash (you might have to remove jtag if it hangs)
Then write flash

Then go to jkeys see if anything different happens.
Are u using 301&508 version of jkeys.

[sukh77]

The process I did was

Erase flash1 and then flash2
Then write flash2
Then eeprom if needed.

[ocelot_ark]

Okay, I'll check that out...

I'm using this version of jkeys (2.9.9 build 016), but I think that is the version you're talking about.

I'll let you know if using wall makes a difference.

[ducrider]

Okay, I'll check that out...

I'm using this version of jkeys (2.9.9 build 016), but I think that is the version you're talking about.

I'll let you know if using wall makes a difference.

Ocelot_ark, I am in the same boat... with a 501. My Box keys and IRD are the same as what you posted above R 0000000196 and boxkeys all FFFFFFFFFF
I have the OJ1 jumped, and pad 1 grounded, I tried modding the jkeys def, but it still would not let me into "flash programming"

I am using a universal JTAG, what are you using??..... If you hear anything or anything works please post it back. I am going to try a Buffered JTAG this weekend....

[ocelot_ark]

I'm using a simple Jtag. If I get this working I'll post what worked.

Of course, Now I can't even get into flash cause my damn Trap won't load. I keep getting DCU errors...haven't had that problem.

Ugh - I've got a headache.

[ducrider]

The story of this 501 is long, at one time i spent 2 days putting a digital lock on it from oddcurcuits, then it started giving me problems pulled the lock out.... and tried it again... another day with the d@mn hot iron....only to yank it out.....Now this crap, this 501 is taking years off my life....LOL LOL:eek:

[kssig1]

Having the same problem with a mod 510, been reading for days trying to find someone who has figured this problem out.

[ocelot_ark]

I think the using thhe altered def file is the first step...that at least allowed me into flash programming. Now I just can't get it to erase the flash. If I could erase the flash I think I could get this thing working again.

[ducrider]

Did you change it in 2 spots? Under the 501 section or the 508 section?

[ocelot_ark]

Everywhere it says 0x2250, change it to 0xFFFF. Make sure you back up your original .def file before you do this, though. When you get it working you can change it back.

[sukh77]

Yeah I think that is the same version.

Does your 508 have jtag on the bottom or did you have to solder wires. Forget the OJ1 jumper if you have jtag on bottom. Use the picture below. On 508 looking at it from the back the jumper should be placed on the furthest right pads.
Looked for this pic for 2 hours. http://www.dssftp.com/forum/attachment.php?attachmentid=6682&d=1131158741

Then try flashing.

Do detect. Unplug. Plug back in (within 2sec's press ok on warning)
Then erase flash1
Then erase flash2
Then write flash2.
Then goodluck.

[sukh77]

Also Change the ffff back to 0x2250 in the def.
The jumper on the bottom will fix your dcu errors.
You don't have to use OJ1, Take that off. Don't forget to change the def file back to normal.

[sukh77]

Having the same problem with a mod 510, been reading for days trying to find someone who has figured this problem out.
510 is a different beast compared to 501. Somewhat different from 508.

What exactly is your problem?
You can't write to flash2?
You can't get in?
You getting dcu peek errors?
Do you have vidmod installed?
Does you tsop have DT chip or GT chip?

[ocelot_ark]

Yeah I think that is the same version.

Does your 508 have jtag on the bottom or did you have to solder wires. Forget the OJ1 jumper if you have jtag on bottom. Use the picture below. On 508 looking at it from the back the jumper should be placed on the furthest right pads.
Looked for this pic for 2 hours. http://www.dssftp.com/forum/attachment.php?attachmentid=6682&d=1131158741

Then try flashing.

Do detect. Unplug. Plug back in (within 2sec's press ok on warning)
Then erase flash1
Then erase flash2
Then write flash2.
Then goodluck.

Schew! I'll try that out tomorrow...fixing to watch the Razorbacks/Huskies game.

[ocelot_ark]

I did that little mod that you posted...no difference. It's not recognizing anything in jkeys other than Device ID and Device. LOL - things are getting worse.

[sukh77]

It won't detect anything cause you deleted everything. The mod is just to get rid of dcu peak errors. Now you should be able to get back in and program your box.

[ocelot_ark]

It won't let me in...I keep getting this:
"Error reading from DCUControl register"
"Could not initiate access"

[jbooley]

I am having the same problem . it will not let me in to Flash programing. It will not let me Erase or read or program . all I see is the Device ID and Device and IRD model. I tried to erase Flash U7 and it didn't erase all the way. Now I try and get back in with Jkeys and it won't do anything



PLease Help

[Hack@d]

Here is a few questions for you. Before you erased you tsops did you get a good backup ? Did you confirm using flashedit ?

If yes, then you know your JTAG is ok. If you have CRC issues then you JTAG is not got a good connection.

Also if you can't get into flash programming on a 5xx then you do not have a jumper on OJ1. This is required. Also I go the extra step and also ground jtag and never have had a bad read or write.

Make sure you have a modified JKEYs that has the correct memory address for the unit.

You may find this info useful.

My unit is a dispvr508-011
with the DT chips (2 TSOPS)

NO VID MOD REQUIRED.

TOP JTAG PADS FOR 501/508

REAR OF DP508/5800

OOOOOOOOOO <- 19-17-15-13-11-09-07-05-03-01
OOOOOOOOOO <- 20-18-16-14-12-10-08-06-04-02

FRONT OF DP508/5800

My buffered JTAG is from www.dishkbron.com and if you read the forums section he has a topic on creating a permanent JTAG using a PS/2 Sytle Plug. Works awsome, I have done 2 3100's and now my 5800.

Parts List

1 Dishkbron Buffered JTAG
6-12" of CAT5 Cable
1 Roll of 30 gauge wrap write
1 6 Position Chassis DIN Jack
1 6 PIN DIN Plug
1 6 Pin Plug to Go onto 6 Pins of JTAG
12 Pins (6 Extras) that slide into the Plug above.
2 Ultra Mini Toggle Switch SPST on-off

Total Cost about $55.00 US.

Make your cable and test to make sure that you have all thin pins soldered in the correct order and the connections are good.

6 Position Chassis DIN Jack

Ignore X just a spacer. O's are pins.

XOX Pin 3
OOO Pin 2 Pin 6 Pin 4
OXO Pin 1 Pin 5
XOX Grnd

Pin 1 = GRND
Pin 2 = TRST
Pin 3 = TDO
Pin 4 = TDI
PIN 5 = TCK
PIN 6 = TMS
GRND G = GRND for the Jack

Solder to pads as noted below using 30 gauge wire. If you are crappy at
soldering use a generous amount of rosin, make sure you tin the wire and
let it rip. Test your connections after with a voltmeter.

REAR OF DP508/5800

2O3456OOOZ <- 19-17-15-13-11-09-07-05-03-01
OOOOOGOZO1 <- 20-18-16-14-12-10-08-06-04-02

FRONT OF DP508/5800

Z Points are soldered to 1 Toggle Switch

OJ1

If you search the forums you will find a picture of where OJ1 is located. When you do find it solder 30 gauge wire to the pads (1 square 1 round) and then solder to the other toggle switch.

# <- Square
O <- Round

OJ1 is critical if you do not do this part you will not be able to put the unit in the proper state for JTAGGING.

Get a copy of JKEYS - 2.9.9 or Higher

You will have to make some modifications to the jkeys.def file.

Find the entry below:

IRD, 8, "501-5100", 6, 3, 1, 1, 2, 2, 0x7FFFFFC0, 0x7FFFFFC4, 0x7FFFFFA0, 0x7FFFFFA8, 0x7FFDFFF4, 0x7FFDFFF8, "10S", 3, 4
IRDFlash, 8, "Flash 1(U6-29DL323)", 0x2250, 0x7F800000, 0x400000, 2, 2, 0
IRDFlash, 8, "Flash 2(U7-29DL323)", 0x2250, 0x7FC00000, 0x400000, 2, 2, 0

Change 0x7FFFFFA0 to 0x7FFFBFE0.

Save the file.

Hook up your JTAG and cable you made and plug into PS/2 Jack.
Flip to to toggle switch on.
Turn on IRD. If green and red light on the front don't come on then you haven't flipped the toggle switch or your connections are wrong.

Start up JKEYS.

In my case my LPT port pumps out a little too much juice so I have to unplug the power supply to the JTAG.

All the info should show up...Boxkeys etc.

Save flash 1, Flash2 and EEPROM.

If you aren't getting tranfer rate of at least 12500+ bytes per sec then your solder point are no good and odds are the dumps will not be good. Should take about 5min 30sec to save each Flash and 3 sec to save EEPROM.

Open Flashedit and confirm the files are OK.
Select Model 501/508/5100 (moved bootsrap)

Make a few backups just to be safe.

Get a copy of Dudeman316's Provider conversion Guide and goto the
501(508)/5100(5800) Conversion do 4th option. Erase Section SA13
of Flash 2(U7).

Turn off the IRD and uplug everything and switch the toggle switches off.

Put into the stream and in about 15-20min it will update with the firmware.

Unplug and make some more backups of your TSOPS and EEPROM.

I am using a Universal ATMEGA PLL and programmed it using Beavis v.04.
Plugged the IRD back in and put in the card (love the 508 because the card is completely hidden). It had some problems with the card and took about 3 inserts before it took and then away it went. No problems after that....

Went to look for some porn but could find it. Turns out virgin units are truly 'virgin' and have a password set on them. Not a problem.

Press menu-6-3-browse-themes-tv/video (do it fast) and should give you a memory dump screen scoll down to 320 and this is what I saw.

320 00000000 31393934 01001700 000000007

in the second column read between the 3's so my password was 1994.

I have not installed my lock yet but it is high on my priority and will update this post with my experiences.

[ocelot_ark]

Using a different version of Jkeys I can get into flash programming...of course THAT version is giving me the FFFFFFFF/FFFFFFFF error. I thought to myself, "No big deal, edit the .def file," So i did and it didn't make a difference.

I'll mess with it some more tomorrow I guess.

[sukh77]

$55 for jtag way too much. You'll be better off buying from mili.

[Hack@d]

$55 for jtag way too much. You'll be better off buying from mili.

You can if you want, but that JTAG is kick ass and works with any receiver.
BTW that was the total parts list.

[Hack@d]

I had a similar situation and it was because I tried loading a TSOP not compatible with my unit. My unit has the moved bootstrap and until I found a compatible tsop dump had nothing but problems. Also had to zero the drive because got errors saying drive not recognized. Once that problem was fixed I have never had an issue with that unit.

[ocelot_ark]

Well I have a backup of my original TSOP...I just can't get it to flash.

[ararat]

Did you use the 4 wire, 2 trace cut, vid mod method?? Where a trace is cut above and one below the board??
If you just used the 3 wire, 1 cut, method, you may have destroyed the flash chips, I have seen that done more times than you can imagine.

can you please post instruction 4 wire vid mod. Thanks.

[Hack@d]

Well I have a backup of my original TSOP...I just can't get it to flash.

The key is to keep erasing until you get a good write.

[skinerd]

If, after jumping OJ1, you still have DCU errors, put your finger on the CPU chip, the Biggest chip, see if it is really HOT, if it is......CTS....if not get back and I'll get you in....

Get 301-508 jkeys from the files section........

[kssig1]

I am having almost exactly the same situation as Ocelot_ark and have tried all the same things with the same result. I do have a vid mod installed and a switch to jumper oj1. It has GT chips. I can read both flashes but cant write to them. I tried wall like you said but that didnt seem to help. I have tried every combination of getting into this thing I can think of. I tried erasing one sector at a time and alll of them will erase except SA70, is this normal? Rechecked all of my connections on the Jtag and all are good. It worked fine before I erased both flashes, I guess I wont do that again. I am also wondering if wall is only good for 301s due to the address of flash one being different than the 5XX series

[skinerd]

If they erase one at a time how do you know they are really erased??

SA70 is locked, that's the purpose of the vid mod, unlock that sector......

You NEVER need wall except for a 301-010, then only once in a great while....
I have resurrected dozens or receivers, and jkeys is all I use, except he occasional use of wall2 with a stubborn 301-010.

Get 301-508 jkeys from the files section.......I can tell from the first post of this thread, the poster is NOT using that version.

[kssig1]

Not sure if they erase of not but at least I dont get an error when I do it hat way, makes me wonder if my vid mod is not working somehow. I do have the correct voltages at the switch and the wiring is good. I have all the versions of jkeys including 301-508 and the newest version 2.9.11 or whatever it is called. I may have to just wait until I am not so mad at this thing to try again. Thanks for the help, if Ocelot gets his figured out hopefully it will be the same fix for mine. I have jtaged this thing several times without problems this only occured when I was trying to write the rom10x to rom 10 mod to it.

[skinerd]

Not sure if they erase of not but at least I dont get an error when I do it hat way, makes me wonder if my vid mod is not working somehow. I do have the correct voltages at the switch and the wiring is good. I have all the versions of jkeys including 301-508 and the newest version 2.9.11 or whatever it is called. I may have to just wait until I am not so mad at this thing to try again. Thanks for the help, if Ocelot gets his figured out hopefully it will be the same fix for mine. I have jtaged this thing several times without problems this only occured when I was trying to write the rom10x to rom 10 mod to it.

maybe the rom10x mod flash is corrupted...........where did you get it?? or did you make it yourself??
if you made it yourself, how did you go about it?

above all calm down, these are not easy to deal with but CAN be make to work....

I use ONLY jkeys 301-508, and it always gets it done.......

[kssig1]

Used this file in flash edit to modify the original flash with the new box keys and ird # I assumed it would not mess up my 510 even it didnt work. that is what I get for thinking and I am not all that mad just tired. I usually only use 301-508 jkeys on this thing and it has always worked well.

[RSAnew508-304Ponly]
prepare_reverse_crc(0x262b30)
set(0x25c180, 0x6EF7E8A138BAB5CD7DC7FD6966CFC56D)
set(0x25c190, 0x59F11DB1B45C0B61D5D123230B5C8531)
set(0x25c1a0, 0xAE06993AB4D00AE9A667AC89BB99E3BC)
set(0x25c1b0, 0xF8490FE9478B959F8A0355AB42C9335A)
commit_reverse_crc()

[skinerd]

Better use this .fs........I know it says 501 but it DOES work with 508/510 also.

[RSAnew501P3.03,3.04only]
prepare_reverse_crc(0x25CFA0)

set(0x25C180, 0x6EF7E8A138BAB5CD7DC7FD6966CFC56D)
set(0x25C190, 0x59F11DB1B45C0B61D5D123230B5C8531)
set(0x25C1A0, 0xAE06993AB4D00AE9A667AC89BB99E3BC)
set(0x25C1B0, 0xF8490FE9478B959F8A0355AB42C9335A)

set(0x3fff40, 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF)
set(0x3fff50, 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF)
set(0x3fff60, 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF)
set(0x3fff70, 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF)
set(0x3fff80, 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF)
set(0x3fff90, 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF)

set(0x3fffa0, 0x32324142)
set(0x3fffa4, 0x88257847)
set(0x3fffc0, 0x0162B382)
set(0x3fffc4, 0x87382EC5ACC1047E)
set(0x3fffcc, 0xFAC6)

commit_reverse_crc()

[skinerd]

afcter applyin gth above .fs, it will no longer appear as a 508 or 510 in flashedit or jkeys, but don't sweat the small stuff, it works.

[kssig1]

Ok thanks, I will try it tommorow and let you know how it goes, if I get ths thing going again I will owe you a case of beer. I would happy just to see the green light on the front again....

[grandpa]

Ok thanks, I will try it tommorow and let you know how it goes, if I get ths thing going again I will owe you a case of beer. I would happy just to see the green light on the front again....

This may or may not help you.

One of my 501 doesn't go to the "sleep mode" for writing easily. So while I am erasing flash 2 I pull the card in and out until I get the green and red lights to stay on. After that reading and writing goes smoothly.

Grandpa

[kssig1]

Just an update, cant get into the flash programing with jkeys 301-508, no trap. I will recheck all my connections for the tenth time, it does show the chip number in jkeys, and the cpu is only slightly warm, but no lights on the front, when i go to flash programing I get the dreaded ffffffff/ffffffff not recognized message

[skinerd]

Just an update, cant get into the flash programing with jkeys 301-508, no trap. I will recheck all my connections for the tenth time, it does show the chip number in jkeys, and the cpu is only slightly warm, but no lights on the front, when i go to flash programing I get the dreaded ffffffff/ffffffff not recognized message

OJ1 jumped??
Getting a device ID shows the jtag is correctly installed...
Also you might try an earlier jkeys version.

[wdiddy]

To make sure you cut traces thoroughly, use an ohm meter and check it.