Bringing my Clone OpenBox S10 PVR back from the Dead!!

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • dpettis
    Newbie
    • Aug 2012
    • 5

    #1

    Bringing my Clone OpenBox S10 PVR back from the Dead!!

    I as well as 100?s of others users I see throughout this forum and others, have one of these
    Boxes that just won?t flash. There are many great helpful suggestions to make sure you have
    the correct Null Modem Cable, Com Port settings, and the correct timing of power up. But like a lot of us?
    even when all these things are correct and in the right place?some of these machines will still not Flash.
    You have the dreaded ?On? front panel display and the EromUpgrade software always returns with message?
    Set stb memory error..
    Well being an Electronic Techie guy, I dug in and did hours of research and many experiments on this thing, taking voltage measurements,etc
    and Here is what I?ve found.

    For those that this is the case and nothing is working?I believe we have bought Clone versions.
    Any Legit firmware has Clone killer code in it to prevent these boxes from working.
    And it also seems to prevent you from flashing from the EromUpgrade software. I?ve discovered that
    any time I tried to boot normally, or use the EromUpgrade program, the Flash IC would remain in a DISABLED mode,
    So no communication with the chip was possible. I think out of hundreds of tries, this may have slipped up once for whatever reason!
    In the Flash IC PDF literature, it notes all the HEX commands used to control this Chip.
    So I ended up using Windows Hyperterm?setting up the proper settings, which are.. Com 1, {This MAY vary}, 115,200, 8Bit Data, Even Parity, 1 Stop Bit
    and Flow Control set to NONE! My goal was to try to send commands to the chip, possible erasing it, changing something?whatever it took.
    Here?s where it got interesting?When I ran Hyperterm?established a connection with the Com Port?.THEN powered up the Box?
    I noticed that the FLASH IC had then gone into an ENABLED mode. Also on the Hyperterminal screen I got a message from the Com Port.
    APP Init OK. This told me that the Processor,Com Port, my Cable, etc must be working. But after a few tries doing this?.the Box started showing signs of life.
    I got a BOOT display on the panel. It hung there?Trying it some more got me to an INIT display. Seemed letting the thing sit for a while got me a little further.
    What I believe was happening, was the BOMB instructions were designed to do something to Interfere with EromUpgradeand normal Bootup. Using Hyperterminal seemed to Bypass this allowing somewhat normal operation. Just a theory.. Haven?t tried it, but this may also work with REALTERM software if you have that.
    Anyway?at some point I got it to Boot up?and with Clone Friendly Firmware{New Red GUI} preloaded on a USB stick, I went to the Upgrade Menu as fast as I could and did manage to load the Firmware via USB. This allowed the box to Boot on it?s own everytime. Mission accomplished!!! Well Not Yet!! Lol

    This is Part 2 of my fix.
    I now had a Bootable machine, but it would only run for a short while and would freeze up?the video would go wonky, etc! Have read about a lot of people
    having similar issues on working machines. Letting it sit for a bit, booting up again, it would work for a period and crap out.
    When this happens to our Computers?it?s usually due to the processor fan breaking down and providing no cooling. So I decided to try a fan on the processor.
    I tapped into the 12v on the power supply and sat a fan on top of the processor. I had a fear of it overloading the power supply, as it?s been noted by others, that these are weak designs and are just providing enough power to run the thing. But running the fan did make it work for a while longer, but still acted up a while later.
    Hmmm? Maybe not the processor?.so moved the fan around!! Turns out Cooling the FLASH IC?or at least something near it?gave me glitch free operation. These boards must have heating issues that the designers didn?t address. Again just another guess.
    The FLASH IC is located just to the left of the Smart card bay, and sits under the cable from the smart card bay. Small 8 pin IC.
    So I installed a fan to the cover?placing the fan so that one corner caught the Flash IC, and the other corner caught a piece of the Processor heatsink, cooling it as well. I moved the Smart card cable aside, tucking it in behind a Capacitor so the the Flash IC had no cooling restrictions. The fan also has to be placed to clear the Smart card board.
    So far, this has worked fine. Also some other tests revealed that I can now flash using EromUpgrade no problem. But must be careful though?.if you install Legit Firmware again?your back to where you were. If it ain?t broke?.don?t fix it!!
    Have no idea if this will work for others, but it did bring my ?left for dead? machine back to life and in operation..
    Curious to hear if this works for anyone else.
    Will include pics and software needed. Hopefully this will help some boxes live again.
    D.P.
    Attached Files
  • slugworth
    DK Veteran
    • Nov 2011
    • 1064

    #2
    A recent tale of woe for me was the tuner actually went bad,but not 100%
    On a blindscan it would miss transponders that I knew were there and the ones it did find it found them 2x,it would find a V transponder and it would find the same freq as an H transponder.So the total channel list would be missing some channels and have duplicates of others.Luckily the tuner module is in a socket,so I tried the simple test of just removing it and reseating but that didn't work.I did have another s10 I could swap tuners and that fixed the problem for that one.I do run a 12v fan on my processor which helps a lot.It's an old 486 cpu fan from the old pc days.The receiver is going on 4 years old so it doesn't owe me any money.Both s10's were genuine receivers.One receiver I killed almost daily trying euro firmware on it and was always able to recover with loader v2.0.0c and a pc with a real serial port.Forget about usb to rs232 converters.An old pc is often cheaper and in some cases even free.

    Comment

    • dpettis
      Newbie
      • Aug 2012
      • 5

      #3
      Yeah I haven't dug in too deep yet, but I have found that a quick Blind Scan doesn't seem to pick up everything I know is there. However...I'm scanning with the Disq and SW21 rigging all hooked up, so I'm sure that's why. Always found it best to hook up each LNB individually and do the scans, and once everything is done, then wire it all up to the switches. At least I'm getting some HD stuff that I could never get on my trusty ole Coolsat!!

      Comment

      • slugworth
        DK Veteran
        • Nov 2011
        • 1064

        #4
        I killed a genuine openbox s10 with the anonymousx firmware from aug 2012 and actually had more fun with it loading euro firmware like the globo hd x100 after I disable the prot ic.The rec icon disappears after hitting rec and it records in 4gig chunks instead of the usual 1gig.

        Comment

        • dpettis
          Newbie
          • Aug 2012
          • 5

          #5
          Ahhh Nice. ...Well I must have a Clone for sure then..cause it's still working fine with that Firmware. I still wanna mess with the Flash Chip and see if I can get a response back from it. But will just use it for a while first as it's sat on a shelf for almost a year...And with the PVR function...I can eliminate the dedicated computer with a Video Capture Card.

          Comment

          • slugworth
            DK Veteran
            • Nov 2011
            • 1064

            #6
            the m3602 processor is wonderful.
            even if the flash is completely blank the rs232 port still receives the firmware.
            With the flash corrupt or blank you get no response on the rs232 port but the receiver still takes the firmware.

            Comment

            • plasterer
              V.I.P. Member
              • Jun 2008
              • 1631

              #7
              perseverance is the key word with these boxes IMO
              juat stick with it ,Run the loader
              And keep swopping firmware till it works
              Some good stuff in the downloads Here
              Fix for openbox S9 clone - Downloads - Digital Kaos

              Just like the old dbox and ifa always booted in the end stick with it ...............Paul
              If your Happy with the Help push the Thanx button
              PAUL

              Comment

              • slugworth
                DK Veteran
                • Nov 2011
                • 1064

                #8
                I think the clones had a 24c16 eeprom instead of the protection ic,which was good enough in the beginning til about summer 2011 when they added the clone detection to the firmware.You may want to try june 2011 firmware and prior.
                I think they recommended doing that when you check the chip id on the sys info screen,to have old firmware loaded.

                Comment

                • dpettis
                  Newbie
                  • Aug 2012
                  • 5

                  #9
                  The Flash Chip I have...a W25Q32BV.... has multiple protection schemes. Both for accidental erasure/corruption and also for Security purposes, as is the case with Clone Units.
                  Anyone messing with Firmware Disassembly should Google Search that number and get the PDF manual on it. Lots of valuable info in there, much of which I've yet to get into, but will be tinkering around with for sure in the near future!!

                  Comment

                  • slugworth
                    DK Veteran
                    • Nov 2011
                    • 1064

                    #10
                    but the firmware would have to support that chip,mine uses the standard mx25L3206 for u39

                    Comment

                    • dpettis
                      Newbie
                      • Aug 2012
                      • 5

                      #11
                      I'd like to figure out if any of those protection features are actually being used as a Clone Killer or it's just simply the power up protection part of flash chip that keeps these boxes from Flashing. If you've never had that issue...maybe it's due to your particular Flash Chip not having any of those extra features. Must check that chip out and compare specs.
                      I almost want to pick up another S10 just to brick it on purpose and start over. hehe!! Hesitant to mess with this one too much as I have it nicely integrated now with my system. The HD, 8QPSK, and other modes...sure opens up a lot of other channels! But I'm sure I'll dig in soon and do some more experimenting!! Be nice to punch in a few simple Hex commands and shut off or change the Security Parameters at will.

                      Comment

                      • slugworth
                        DK Veteran
                        • Nov 2011
                        • 1064

                        #12
                        autopsy of a clone kill showed the bootloader section was overwritten with garbage,as well as the 1st 64k of app area of flash.
                        If I had a 2k dump of a clone eeprom I could replace the prot ic with a 24c16 and be able to use old pre clone detect firmware in a defective receiver I have.
                        When you want a clone you can never find one.

                        Comment

                        Working...