510 password problem

[irjr]

I recently got a presubbed 510 going on it's original 102 card without having to jtag it, but there are a few recorded movies on it that I cannot remove because they are "protected", and I don't know what password the previous owner used, nor can I find out. I tried using the remote method used for earlier boxes, but it does not work on the 510. Is there a "default" password that I can try, or maybe some other method you know of that I didn't run across during my searches ? Any ideas at all ? ........ JR

[Crazy1_79]

you could jtag it and write a virgin eeprom to it, or you can take the harddrive out, save sectors 0-3 and sector 131071, format it using the seagate utility or maxblast depending on the hard drive model (do not format it using windows) and then rewrite those sectors back to it, they contain the ird info on the harddrive, you will need a program called diskprobe to do the latter of my suggestions. I don't know if a hard reset of the box will do it

[irjr]

Thanks Crazy1, it looks like nobody else has any further suggestions, so I'll just wait awhile for the old shaky hands to calm down a bit, and get out the soldering iron once more. Probably better to jtag it anyway while I can still remember how........ JR

[Bandit5906]

There is a file I d/l prolly in the dish misc utilities that will show the p/w without doing anything more than reading the TSOP and saving. that way you don't risk anything and can use the original p/w to access and then eliminate the p/w alltogether.

I don't remember the file name, but the use is in the description I posted. I'm in China and cannot access my system at present.

[irjr]

Bandit, I have looked through the entire download section and could not find any files even close to what you describe.
This would be the way to go for sure, as I have two 510's, and I believe both might have been subbed by the same person. I do have the original Tsop & Eeprom backups for receiver #1, which has been jtagged, so I am guessing that they might have used the same password for both receivers. If that is so, then all I need is to know how to extract the password from the file.

[Alabamaone]

here you can try these methods


unlock systms
Quote:
Originally Posted by kiutie
Hi there!
I did the eeprom dump on the screen, but getting to the third group at NVM 01C0 , i get it exctly like this:FFFF0000.
What's the password?
Thank's.

just press menu/locks
press right arrow 4 times
hilite ok
press select
now click on unlock system

Password is stored in Eeprom.
This sequence works for all current model irds (2700, 3100, 4700, 5100, 5800, 6000, etc. etc.).
Press the following keys on your remote:
(Menu)
(6)
(3)
Within 4 seconds, press the following sequence:
(info)
(Browse/Right Arrow >>> )
(Theme/ Left Arrow <<< )
When the Device Status & Memory Dump screen appears press (tv/video) (if that doesn't work, then press the (info) button).
A "non-volatile memory corrupt" message should appear, if it does not, start over you need that message.
Once you get the proper message, unplug your reciever for about 15 seconds then plug it back in. Everything should be reset at this point.

IRD 2700 - You can use the memory dump page to display a lost password.
Scroll to line NVM 01C0.
Example: NVM 0001C0: 0000000 00000000 34120000 00000000
The third set of numbers contains your password, the numbers are in reversed pairs.
Eg. If your password is 1234 they would read 3412.
Alternate method (worked on my 508):
With your remote (ird powered on ) push menu, 6, 3, then rapidly push info, right, left, TV/Video. A memory dump screen will appear........unplug the IRD at this time for a couple of minutes, plug it back in. Password gone.

[irjr]

I probably should have mentioned that I tried that routine first before asking for help. It may work on other receivers, but it absolutely does not work for the 510.

{edit} kept doing it, got memory dump, checking it out now.

[irjr]

Got to the memory dump by doing the following. menu, 6, 3, then left and right rapidly, no tv/video involved. Unplugged the receiver for about 10 minutes, powered up, password still there........ On line 0001c0, there are two digits in the first column, but nothing but zeroes in in all the following columns. Might be the password is at a different address on this receiver, just need to find out where. Thanks for your help, I wouldn't have tried the memory dump scheme again, but because you said it worked on your 508, I had to keep trying. At least I know that this option is available with the 510 now. Now to do some more searching.............

[irjr]

Well, I got to the point where it said "non-volatile memory corrupt" and shut down the receiver. Powering up and going back to the memory dump page showed a lot more zeros than it had before, but the password is still in effect. Line 01C0 now shows all zeros in all columns...... I'm stumped for now.