PDA

View Full Version : Some responses from the D2


LeeGibling
02-22-2006, 08:15 AM
During the fall of 2005 a new DTV card surfaced, commonly referred to as
D2, P6 or "rethink tv". Here a few responses from this new card:
The ATR of the D2 (0017 ...) is like that of a P4 or a D1

Trying to reset card...
Reset Successful
ATR: 3F 78 13 25 03 40 B0 20 FF FF 4A 50 00
Convention: INVERSE
Protocol: T=0
TA1 = 13
TB1 = 25
TC1 = 03
Historical Bytes: 40 B0 20 FF FF 4A 50 00
@ ° ÿ ÿ J P
Programming Voltage = 5.0 volts
Programming Current = 50ma
Maximum Clock Frequency = 5.0MHz
Assuming a 3.5790MHz clock:
Work ETU = 0.0000259849 seconds
Guard Time = 0.0003897737 seconds
Baud Rate After Reset = 38484
The INS 02, which gets us the ID and the ROM version

48 02 00 00 08
R01
R08
R02

returns the following:

Trying to reset card...
Reset Successful
RX ATR : 3F 78 13 25 03 40 B0 20 FF FF 4A 50 00
TX Data : 48 02 00 00 08
RX Data : 02
RX Data : 48 55 58 56 04 00 44 31
H U X V D 1
RX Data : 90 00

An attempt to read 8 bytes from the beginning of the EEPROM

48 12 00 00 08
R01
R08
R02

has this result:

RX ATR : 3F 78 13 25 03 40 B0 20 FF FF 4A 50 00
TX Data : 48 12 00 00 08
RX Data : 12
RX Data : 78 FF 25 17 EF 19 05 15
RX Data : 90 00

As it still has the "Before Returning from ATR Hole", we can get the ATR_DM:
33 99 FF BF E1 00 5B 17 08 67 5F 57 71 CF
inverted, according to ISO-7816 it looks like this:
33 66 00 02 78 FF 25 17 EF 19 05 15 71 0C
Bottom Line:
Except for the result of INS 02, it looks pretty much like a D1, whose return value is

44 31 44 56 - 30 31 30 37
D 1 D V - 0 1 0 7

vmod32
02-22-2006, 08:23 AM
good to know you are still at it. ;) Good Luck

hackkil
02-22-2006, 08:30 AM
any new progress with the p4 lee?

compaqsat
03-11-2006, 05:34 PM
good to know you are still at it. ;) Good Luck
what Vmod32 said

LeeGibling
03-11-2006, 06:45 PM
any new progress with the p4 lee?
Not much headway from my side, except the finding that the execution
of the UL4S command
Cn FF ... FF in the "Post ATR_DM Phase" takes exactly

0x14 + ((n + 1) * 0x2518)

external clock cycles to execute, which can serve as a benchmark helping us to find the
point where the much feared "random wait states" originate.