Difference between revisions of "DCT 5000"
(fixes) |
(More [ ] fixing) |
||
| (7 intermediate revisions by 4 users not shown) | |||
| Line 25: | Line 25: | ||
Includes US power cord, and 8" RF cable, 22 page hookup manual. | Includes US power cord, and 8" RF cable, 22 page hookup manual. | ||
| − | * nec vrc5476-83e | + | * nec vrc5476-83e North Bridge |
* nec vr5432 CPU | * nec vr5432 CPU | ||
| − | * Sony | + | * Sony [http://products.sel.sony.com/semi/PDF/CXD3204R.pdf CXD3204 IEEE 1394] |
| − | * Sony | + | * Sony [http://products.sel.sony.com/semi/PDF/CXA2094Q.pdf CXA2094] |
| − | * AMD | + | * AMD [http://www.amd.com/us-en/assets/content_type/white_papers_and_tech_docs/19436.pdf 79C970AKC Ethernet] |
| − | * 2) | + | * 2) InTel [ftp://download.intel.com/design/flcomp/datashts/29060615.pdf E28F320J5-120 flash] |
| − | * 1) | + | * 1) InTel [ftp://download.intel.com/design/flcomp/datashts/29064514.pdf TE28F320C3 flash] |
| − | * 1) AMD | + | * 1) AMD [http://www.amd.com/us-en/assets/content_type/white_papers_and_tech_docs/21534.pdf 29DL323CB flash] |
| − | * Crystal Semi | + | * Crystal Semi [http://www-test.cirrus.com/en/products/eol/detail/EOL22.html CS4620] EOL :( |
| − | * Crystal Semi | + | * Crystal Semi [http://www.alsa-project.org/alsa/ftp/manuals/cirrus/4298.pdf CS4298 Programmer's manual] EOL |
| − | * ATI | + | * ATI [http://www.ati.com/technology/hardware/ragexlxc/features.html Rage XL] |
| − | * ATI | + | * ATI [http://www.ati.com/technology/hardware/ragetheater/ Rage Theater] |
* two RF modules | * two RF modules | ||
| − | * Broadcom | + | * Broadcom [http://www.broadcom.com/pbs/BCM3120.pdf BCM3120 Set-Top Box Tranceiver] |
| − | * Broadcom | + | * Broadcom [http://www.broadcom.com/pbs/BCM3300.pdf BCM3300 Single Chip DOCSIS Cable Modem] |
| − | * Broadcom | + | * Broadcom [http://www.broadcom.com/pbs/BCM7010.pdf 7010 SetTop Box Decoder] |
| − | * 4) Mitsubishi | + | * 4) Mitsubishi[http://www.mitsubishichips.com/data/datasheets/memory/mempdf/ds/M2V64S20B.pdf M2V64S30BTP RAM] |
* 44 pin header. (ide we presume) | * 44 pin header. (ide we presume) | ||
* 144 pin SO-DIMM slot. (ram?) | * 144 pin SO-DIMM slot. (ram?) | ||
| − | * ALI | + | * ALI [http://www.ali.com.tw/eng/product/corelogic/m1543c.htm M1543 Southbridge/SuperI/O] |
| − | * EPCOS | + | * EPCOS [http://www.epcos.com/inf/40/ds/mm/M3654K.pdf M3654K - 45.75MHz IF splitter] '''''(front board F202)''''' |
| − | * Altera | + | * Altera [http://www.altera.com/literature/ds/m7000.pdf 7128S CPLD] '''''(mainboard U41)''''' |
| − | * Lattice | + | * Lattice [http://www.latticesemi.com/products/cpld/ispMACH4A/ispMACH4A3/index.cfm M4A3-32/32-10VC CPLD] ('''''mainboard U42 & U37''''') |
| − | * Macronix | + | * Macronix [http://www.macronix.com/web/P_MKROM.nsf/20d0d6aadace5e08c82566710020a501/5206329c780458c2482568eb002a5f6c/$FILE/MX23L1611-2.0.pdf MX23L1611 Mask ROM] - [http://www.macronix.com/web/P_flash.nsf/bf3add4f68988391c825667100209fa5/6a8996488065a0af482569d1000ceb2d/$FILE/MX29L1611G-0.9.1.pdf Possible Flash Equivalent] |
| − | * Winbond | + | * Winbond [http://www.winbond.com/PDF/sheet/w24257aj-8n-a2.pdf 32 x 8 SRAM] |
| − | + | [http://www.necelam.com/microprocessors/VR5432Processors.asp The processor info can be found here] | |
Or direct links: | Or direct links: | ||
| − | * | + | * [http://www.necelam.com/docs/files/U13504EJ3V0DS00.pdf Datasheet] |
| − | * | + | * [http://www.necelam.com/docs/files/1375_V1.pdf Users manual vol. 1] |
| − | * | + | * [http://www.necelam.com/docs/files/1375_V2.pdf Users manual vol. 2] |
| − | * | + | * [http://www-2.cs.cmu.edu/afs/cs.cmu.edu/academic/class/15740-f97/public/doc/mips-isa.pdf Instruction set for MIPS IV ISA] |
| − | + | Ken McGuire got his on 3/15/2003 and found the following: | |
| − | * the serial port | + | * the serial port operates at 38400 baud. |
| − | * Hold down the menu and info button, keep holding them while plugging in the box, "boot" will appear (after about 5 | + | * Hold down the menu and info button, keep holding them while plugging in the box, "boot" will appear (after about 5 seconds of holding) on the display and some stuff will come out the serial port. |
* the cursor and channel buttons will cycle through a menu: cold, hunt, disp, n dl, run. | * the cursor and channel buttons will cycle through a menu: cold, hunt, disp, n dl, run. | ||
* pressing select at each ot the menu items will do something, and produce data on the RS-232 port. | * pressing select at each ot the menu items will do something, and produce data on the RS-232 port. | ||
| − | * there is a reset button inside that does the same as powering on. | + | * there is a reset button inside that does the same as powering on. labelled SW900. |
* holding just the menu button during reset gets the "boot" display without any serial port activity. | * holding just the menu button during reset gets the "boot" display without any serial port activity. | ||
* the "pcmcia slot" connects to the motherboard via a 24 pin connector J402, so it's probably not true, or complete PCMCIA. | * the "pcmcia slot" connects to the motherboard via a 24 pin connector J402, so it's probably not true, or complete PCMCIA. | ||
* there is no video out of any of the outputs, VGA, S-VID, video out. | * there is no video out of any of the outputs, VGA, S-VID, video out. | ||
* JTAG comes out to J7, a 10 pin header with half the pins grounded. | * JTAG comes out to J7, a 10 pin header with half the pins grounded. | ||
| − | * | + | * pin-out at: [http://www.paonia.com/~kenm/Pix/images/DCT5000/J7.jpg JTAG pin-out] |
| − | * J7 with connector (it's a .050" spacing): | + | * J7 with connector (it's a .050" spacing): [http://www.paonia.com/~kenm/Pix/images/DCT5000/J7conn.jpg J7conn picture] |
Here is what comes out the serial port at boot time: | Here is what comes out the serial port at boot time: | ||
| Line 85: | Line 85: | ||
* 00 00 00 00 03 01 CF CA | * 00 00 00 00 03 01 CF CA | ||
| − | + | T0mW found that while holding the INFO button down while powering up, or RESET, it will give a verbose debug of the frequencies it is "hunting" on. | |
| − | or RESET, it will give a verbose debug of the | ||
| − | + | MonMotha got his DCT5000 on 3/19/2003. I haven't done much with it other than take the top off, but I'll update this page as I go. So far I'm just attempting to find some of the missing doc links. | |
| − | sorphin got both of his DCT-5000's on 3/18/2003, and is doing some digging, also found this link http://24.125.76.224:8000/www.cableboxen.prjct to a page where a guy is working on mapping out how the DCT-2000 and 5000 work. | + | sorphin got both of his DCT-5000's on 3/18/2003, and is doing some digging, also found this link [http://24.125.76.224:8000/www.cableboxen.prjct] to a page where a guy is working on mapping out how the DCT-2000 and 5000 work. |
Here's a list of test points, add to them as they are discovered: | Here's a list of test points, add to them as they are discovered: | ||
| − | * TP9 (next to the CPU, towards the back): Pin 76 of CPU - | + | * TP9 (next to the CPU, towards the back): Pin 76 of CPU - Sys Clock |
* TP11 (Next to U33): SDRAM Clock | * TP11 (Next to U33): SDRAM Clock | ||
* TP510: Ground | * TP510: Ground | ||
| − | Notes [[ | + | Notes [[User:TimRiker|TimRiker]] "found": |
| − | Connect a straight-through serial cable from the COM1 port on the host computer | + | Connect a straight-through serial cable from the COM1 port on the host computer to the RS-232 port on the target system. Make sure that the RS-232 connector is attached to internal connector labelled J800. 9600-8-n-1 |
| − | to the RS-232 port on the target system. Make sure that the RS-232 connector is | ||
| − | attached to internal connector | ||
Power ON the target board. When it boots, a # prompt appears. | Power ON the target board. When it boots, a # prompt appears. | ||
| Line 117: | Line 114: | ||
</pre> | </pre> | ||
| − | [[ | + | [[User:TimRiker|TimRiker]] is not sure if this is after installing a different ROM or something... Still looking. |
| − | + | Ken McGuire searches through the binary images of Tim's ROM and [http://www.eLinux.org/datafiles/DTC5000.rom.bz2 the original ROM] and doesn't find any of the above strings. Nothing comes out his DCT5000's J800 on power-up either. | |
Here's the DOCSIS configuration file of the box: | Here's the DOCSIS configuration file of the box: | ||
| Line 138: | Line 135: | ||
MaxCPE = 4 | MaxCPE = 4 | ||
</pre> | </pre> | ||
| + | |||
| + | [[Category:Hardware Hacking]] | ||
Latest revision as of 15:49, 13 July 2012
- http://www.gi.com/noflash/digicable_dct5000.html
- http://gicout60.gic.gi.com/customer_docs/
- http://www.linuxdevices.com/news/NS3134551333.html
note these are _not_ the 5200. no HD/PVR functionality in the base model
- cable in
- RF out
- conv in
- conv out
- 2 ieee-1394
- r-l-v in and out
- 1 rs-232
- vga out
- parallel
- ethernet PCNet
- 2 usb.
- data hs
- ir connector
- SPDIF
- S-Video
- smart card
- pcmcia slot. The card located under the mainboard has a legend on it: "DCT5000 PCMCIA Conn".
Includes US power cord, and 8" RF cable, 22 page hookup manual.
- nec vrc5476-83e North Bridge
- nec vr5432 CPU
- Sony CXD3204 IEEE 1394
- Sony CXA2094
- AMD 79C970AKC Ethernet
- 2) InTel E28F320J5-120 flash
- 1) InTel TE28F320C3 flash
- 1) AMD 29DL323CB flash
- Crystal Semi CS4620 EOL :(
- Crystal Semi CS4298 Programmer's manual EOL
- ATI Rage XL
- ATI Rage Theater
- two RF modules
- Broadcom BCM3120 Set-Top Box Tranceiver
- Broadcom BCM3300 Single Chip DOCSIS Cable Modem
- Broadcom 7010 SetTop Box Decoder
- 4) MitsubishiM2V64S30BTP RAM
- 44 pin header. (ide we presume)
- 144 pin SO-DIMM slot. (ram?)
- ALI M1543 Southbridge/SuperI/O
- EPCOS M3654K - 45.75MHz IF splitter (front board F202)
- Altera 7128S CPLD (mainboard U41)
- Lattice M4A3-32/32-10VC CPLD (mainboard U42 & U37)
- Macronix MX23L1611 Mask ROM - Possible Flash Equivalent
- Winbond 32 x 8 SRAM
The processor info can be found here
Or direct links:
Ken McGuire got his on 3/15/2003 and found the following:
- the serial port operates at 38400 baud.
- Hold down the menu and info button, keep holding them while plugging in the box, "boot" will appear (after about 5 seconds of holding) on the display and some stuff will come out the serial port.
- the cursor and channel buttons will cycle through a menu: cold, hunt, disp, n dl, run.
- pressing select at each ot the menu items will do something, and produce data on the RS-232 port.
- there is a reset button inside that does the same as powering on. labelled SW900.
- holding just the menu button during reset gets the "boot" display without any serial port activity.
- the "pcmcia slot" connects to the motherboard via a 24 pin connector J402, so it's probably not true, or complete PCMCIA.
- there is no video out of any of the outputs, VGA, S-VID, video out.
- JTAG comes out to J7, a 10 pin header with half the pins grounded.
- pin-out at: JTAG pin-out
- J7 with connector (it's a .050" spacing): J7conn picture
Here is what comes out the serial port at boot time:
- DCT5000 Boot ROM v1.17
- Copyright (c) 1999 by General Instrument Corp.
- SUDB 0xBF000004
- 58 00 00 00 53 55 44 42 00 00 11 01 07 00 00 00
- E9 E2 EB E2 01 BC 20 02 74 7B 0B 00 03 10 20 20
- 20 20 20 20 20 20 30 30 30 2E 00 30 00 00 00 00
- 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 BF
- 00 00 00 00 00 00 00 00 00 00 00 00 00 06 00 BF
- 00 00 00 00 03 01 CF CA
T0mW found that while holding the INFO button down while powering up, or RESET, it will give a verbose debug of the frequencies it is "hunting" on.
MonMotha got his DCT5000 on 3/19/2003. I haven't done much with it other than take the top off, but I'll update this page as I go. So far I'm just attempting to find some of the missing doc links.
sorphin got both of his DCT-5000's on 3/18/2003, and is doing some digging, also found this link [1] to a page where a guy is working on mapping out how the DCT-2000 and 5000 work.
Here's a list of test points, add to them as they are discovered:
- TP9 (next to the CPU, towards the back): Pin 76 of CPU - Sys Clock
- TP11 (Next to U33): SDRAM Clock
- TP510: Ground
Notes TimRiker "found":
Connect a straight-through serial cable from the COM1 port on the host computer to the RS-232 port on the target system. Make sure that the RS-232 connector is attached to internal connector labelled J800. 9600-8-n-1
Power ON the target board. When it boots, a # prompt appears.
Enter the following commands at the # prompt:
export BOOTFILE=vmlinus export BOOTHOST= export NETADDR= export NETMASK= export BROADCAST= export ETHERHWADDR=
TimRiker is not sure if this is after installing a different ROM or something... Still looking.
Ken McGuire searches through the binary images of Tim's ROM and the original ROM and doesn't find any of the above strings. Nothing comes out his DCT5000's J800 on power-up either.
Here's the DOCSIS configuration file of the box:
NetworkAccess = Yes Start ClassOfService ClassID = 1 MaxRateDown = 1500000 MaxRateUp = 128000 PriorityUp = 1 GuaranteedUp = 1280 MaxBurstUp = 0 PrivacyEnable = Yes EndOf ClassOfService MaxCPE = 4
