password protected box (reflash help please)

[spudorange]

skybox s11

tried every password known to man.


Need a way of flashing from serial as can not get into any menu on stb with pass

Using "EromUpgrade.exe" I get the "skybox sycronizing stb's please reset target error"

anyone know of a way I can force it to accept new firmware login via ftp to factory reset please

thanks

[mahrkpat]

This is error means a communication problem:
1.Are you using the right comport? (check in device manager)
2.Have you ticked the include boot loader option?
3.Sometimes how fast or slow you switch on your box has an effect after you press next.

[slugworth]

that is also a using the wrong type cable error.
Use a pc with a real com port and turn the receiver on slowly after hitting next on loader.

[sb18180]

skybox s11

tried every password known to man.


Need a way of flashing from serial as can not get into any menu on stb with pass

Using "EromUpgrade.exe" I get the "skybox sycronizing stb's please reset target error"

anyone know of a way I can force it to accept new firmware login via ftp to factory reset please

thanks

they do it to protect the gift info. you will have to flash via null modem cable thats the only way.there are 2 types of loaders out i had more joy with the m3 loader from the official website under skybox try it you never know it may work on s11. it with either connect or not connect

[slugworth]

The "gift" is in the last 64k of flash.
I assume the password for the receiver is stored there also.
I would get the rs232 working then do a full dump via rs232.

[slugworth]

actually the password is encrypted right after the userdata in flash.
I saved the full firmware via rs232 and then changed the password on the receiver to 1111 and saved again.
Compared just the last 1.9meg of flash and found dramatic differences but no password in the clear.
I did find sections around address 310000 that start with the hex 78 56 34 12 and ascii that look like favourites and have no business being there.I FF'd out 2 sections that looked like that and saved and wrote the full firmware back to receiver.
The password was gone and was the factory 0000, which was nice,because I didn't have to mess around with the last 64k and gift area.