FTA JTAG and REPAIR GUIDE First of all, congratulations on buying a cable from Interface Place. I pride myself on having some of the most innovative and best built JTAG cables you will find. You should always be able to find the latest revision of this guide on my website, www.interfaceplace.com. I will be doing my best to keep it updated, and I look forward to hearing from anyone who has constructive criticism or ideas for the improvement of this guide. Following is a complete set of instructions for how to repair your receiver with JTAG. I have performed the JTAG operation on my Pansat 2700A using both Skymax and jKeys and documented some of the screen shots so that you can see what things should look like. Some of the information seen in the screenshots may vary between my receiver and yours. Well, let�s get that receiver REPAIRED!!!! The first thing you need to do once you receive the cable is determine how you will connect it to your receiver. You either need to have the header already installed in the board, or you need to install the header I supplied with the cable.

If it is installed already, good. If not, here are some tips to help you install the header. I don�t mind sharing tips on how to solder better, but this is not, nor is it intended to be, a lesson in soldering. If you have no pins, but holes, you will need to take the signal (green) board out to solder in the header I include. Sometimes it is possible to take the board out just far enough to allow it to be turned over without disconnecting everything, sometimes you need to disconnect everything. If you have solder in the holes (this sometimes happens) you will need to get some solder wick/desoldering braid (Radio Shack catalog number 64-2090, $3.19) and use it with your soldering iron to remove the solder.

Remove the solder (if present) from the holes using the braid. Place the header in the holes and solder it in from the back.

Here�s a tip: Put or leave solder in 1 hole on the end of 1 row. When you are ready to solder the header in, place all of it that you can in and apply pressure from the top with your finger. It will be tilted, because of the solder in the one hole. Heat the metal and solder, and when the solder flows, the pin will come through and you can press the header flat to the board. Solder the hole on the opposite end next. Now it will stay in place while you go through and solder the rest of the pins.

Once you have the header in place you need to know how to connect your cable. Refer to the CD that I supplied with the cable for the orientation of the cable as relates to the header pins. To connect a Universal FTA cable you will need to know the pinout of the receiver you are working on. Here are some common pinouts: 20-pin headers: TRST Pin 19 TDO Pin 15 TDI Pin 13 TCK Pin 11 TMS Pin 9 GND Any even numbered pin 10-pin headers: TRST Pin 8 TDO Pin 6 TDI Pin 1 TCK Pin 3 TMS Pin 4 GND Pin 9 12-pin headers: TRST Pin 11 TDO Pin 7 TDI Pin 5 TCK Pin 3 TMS Pin 1 GND Pin 2 (any pin from the second row)

Tip: When the circuit boards are designed, the header pads or silkscreening are designed to show pin 1. In some cases, the pad for pin 1 is square, while the rest are round. In other cases, the silkscreening will show a rectangle around the header holes, and the corner with pin 1 will look cut off.

Now that your signal cables are hooked up, hook up the ground clip (various colors). Check the ground. Wiggle the alligator clip a little bit so that it bites through any coating that may be on the case or frame of the receiver. Connect the DB25 end of the cable to your computer parallel port now. Make sure that if you have the battery pack option, you have fresh batteries in the cable. If you have the USB power option, plug it into the USB port on your computer now. Using the switch on the back of the receiver, power it up. There are two different programs you could use to communicate with your processor; Skymax and jKeys. Many people prefer Skymax for ease of use, but like jKeys, it can also have it�s quirks. The basic procedure is this:

Skymax: Before running the executable file (.exe), you should check to see that the program is configured to work properly with your operating system. If using Windows XP: -Navigate to the folder that contains your Skymax executable file. -Right click on the Skymax executable file. -Select Properties -Select the tab that says Compatibility -Check the box next to �Run this program in compatibility mode for:� -From the drop down menu, select Windows 98/Me -Click Apply -Click OK

If using other versions of Windows, no modification should be necessary.

Run Skymax.

Select the size of your flash memory (1MB or 2MB).

Click START.

You should see the text scroll and it will say Init JTAG, etc.

When Skymax gives you a Init OK :), you have communicated properly with the receiver, and can begin the repair process. If Skymax returns Init Fail, you must re-check your connections and go back and make sure that the power to the STB is on, the power to the cable is good, and that you have a good ground. Assuming all is well, the next step is to erase the flash memory. Click Erase. Wait for the flash to erase.

Click Erase. Wait for the flash to erase. Click Erase. Wait for the flash to erase. That wasn�t a mistake, and you read that correctly. Erase it three times. That way you can be sure that it is clean, and I don�t have to go into anything like what to do if you get an error saying that your flash is not erased.

When prompted, click OK. You are now ready to write a factory .bin to your STB. Click Write. Navigate to the factory .bin file and select it. Click OK.

Once Skymax is done writing,

power off the STB, remove power from the JTAG cable, remove the cable from the STB, and power up the STB. You should have lights on the front, either a On or a 0000. jKeys: jKeys is a little more involved, but can be a very nice utility if understood. One of the first things to understand about jKeys is about the .def, or definition file. This file causes many headaches because people don�t take the time to read the documentation that is supposed to come with each copy of jKeys. The jkeys.def file contains the flash and processor information cross-referenced to each STB. What happens sometimes is that people modify this file to include only the STB info they need, and then when someone gets that copy they are screwed.

If you are interested in using jkeys to repair your receiver, check the flash memory of your particular model. I mean actually check it. Open the cover of your STB and look at the memory. Write down what it says on the chip. If you don�t have a heatsink in the way, write down the processor information, as well. Look in the jkeys directory on your computer and open the jkeys.def file with Notepad. Read what it says, and read the other file that should be in the same directory, FLASH and IRD definitions.txt. After reading and understanding this, make sure that your STB information is in the jkeys.def file and it is correct. Open jKeys.exe.

Your processor, flash info, and STB model should be displayed in the appropriate fields. If your IRD Model does not appear in the proper field, use the drop down selection box to choose it. Example: the Pansat 2700A is listed in this �jkeys.def� file as �STi55xx_2M�, but I could have easily changed the name to My Pansat 2700A, or anything I wanted, by editing the info in the .def file. Click File|Preferences and select Parallel Port.

Click OK. Click Flash Programming. You will see a window pop up that gives you two ways to enter the flash programming mode. You will actually not use either of these methods for the majority of receivers.

Instead, when this window comes up, just click OK. Once in the Flash Programming window, look in the upper right corner at the box called Chip/Sector Programming. Make sure it reads Full; if not, use the drop down menu to select Full.

Click Erase. Click Yes.

Wait for the flash to erase.

Click Erase. Click Yes.

Wait for the flash to erase.

Click Erase. Click Yes.

Wait for the flash to erase.

. That wasn�t a mistake, and you read that correctly. Erase it three times. That way you can be sure that it is clean, and I don�t have to go into anything like what to do if you get an error saying that your flash is not erased. You are now ready to write a factory .bin to your STB. Click Program. Navigate to the factory .bin file and select it. Click OK.

Once jKeys is done writing,

power off the STB, remove power from the JTAG cable, remove the cable from the STB, and power up the STB. You should have lights on the front, either a On or a 0000.

Following are some exceptions to the above procedure. These are things that I have accumulated over some time, and not all have I tested. If you can not get something to work following the above steps, look below for some ideas. Ogre

Ariza/Fortec Lifetime and Ultra: Ogre: If having problems getting into Flash Programming mode with jKeys, try turning the power off and back on, then clicking OK within 3 seconds. This is one of the options listed in the Flash Programming screen. The rest of this is piecemeal that people have written on forums: 0xFFFFFFFF is mean Jtag wire is not connected with IRD . 0x00000000 is mean Jtag wire had connected mainboard but not turn on IRD yet . solution: turn on switch on back Pansat2500A receiver . Error reading from IRD (DCU Peek) .is mean Jkeys sw is not recornigze CPU Sti 5518 for Dianogtic.. Reviving an Ultra The following method has revived two Ultras that were �dead,� both had �.BTC-70 chips, and the units were dated Nov 2004 and Jan 2005. Another one was revived 11/29/05 and the following steps were used. Following these steps should eliminate the DCU Fail error messages. Hopefully, I remembered what I did better this time. Since then, many Ultras revived. All the files that I used can be found in the Revive Ultra Loader and bin zip files that are attached to avoid hunting for them. Download them both to a folder and unzip them. First thing is to hook up the jtag cable ( or a printer extension cable between the Ultra and the computer). The approach below should be followed to the letter to avoid DCU Fail error messages. Turn the Ultra ON in the back. Run the SKYMAX_up1.3.exe program (see picture below). Click on START. Click on Erase. Wait till it competes. Turn the Ultra OFF in the back. Wait 10 seconds. Turn the Ultra back ON in the back. Click on START. Click on Erase. Wait till it completes. Turn the Ultra OFF in the back. Wait 10 seconds. Turn the Ultra back ON in the back.

Click on START. Click on Erase. Wait till it completes. Turn the Ultra OFF in the back. Wait 10 seconds. Turn the Ultra back ON in the back. Click on START. Click on Write this time. You will be asked for a bin. Use the fta.bin file that is in the Revive Ultra bin.zip file. Presumably, you unzipped the Revive Ultra Loaders and bin.zip files to a new folder you created. You should see the 00000000 window changing. I think the all zero window counts up to 7FFFF000 when it is finished. Wait several minutes till this completes, and turn the unit OFF and disconnect the jtag cable. If an error message occurs, Exit, turn OFF the unit, and repeat the sequence till no error message occurs. Upon turning power back ON, you ought to see the clock/channel lights. At this point you are ready to load a functioning bin. Attach the serial cable now, and load the file pusser122105.bin which was made with new keys from 282t3 using Blacklist STB UPDATER 1.3.exe, all of which are included in the Revive Ultra Loaders and bin zip files attached, and then scan the satellite of interest. If you use FortecLoader, select Flash, then pull down the menu to get LifeTime Ultra, browse to enter the bin and Download. Should the FortecLoader not work, I�ve also substituted Blacklist STB UPDATER 1.3.exe. Hope this saves someone some time, and the DCU Fail error does not cause a problem. Here are the ultra chipsets that are good with Pansat bins: GOOD COMBOs good ==cpu>sti5518bvc chipset>39vf800a 70 4c ek good ==cpu>sti5518bvc chipset>29lv800 btc 90 bad(meaning do not flash with pansat bins) BAD COMBOs bad == cpu>sti5518bqc chipset>39vf800a 70 4c ek bad ==cpu>sti5518bvc chipset>29lv800 bbtc 70 Bad (meaning not to flash with Pansat bins) As previuosly posted: - bad == cpu>sti5518bqc chipset>39vf88a 70 4c ek bad == cpu>sti5518bvc chipset>29lv800 bbtc 70 ADD ---------------------- bad == cpu>sti5518bvc chipset>29lv800BE - 70 PFTN Fortec Ultra This was posted by 4q2 at al7bar and it surely applies here too: Warning...warning...warning

-------------------------------------------------------------------------------- It seems that there are many members that cannot understand what a WARNING means. They choose to ignore warnings and then whine about their failures to heed warnings. Current official releases for Pansat receivers will contain code designed to prevent the file from being used on clone boxes. They have done this to protect their business from clone boxes that use their technology by copying it. Coolsat does the same thing. There are no Viewsat clones at this time but when there are, I'm sure they will follow suit. There are huge shipments of cloned Fortecs enroute to the market right now. Pansat files damaged a few genuine Pansat boxes recently. They took it on the chin and repaired those FREE and even paid the return shipping to the owner. They made a mistake and worked hard to fix that mistake. I have no reason to believe that other brands would not do the same. Viewsat has been very good to stand behind their products. If you choose to save a couple of dollars by purchasing a clone, be advised that the coding teams are going to do everything they can to prevent you from being able to use it. Currently their files are modified to remove their protective code and then reposted as "clone tested" or some other version. They will be working to make that more and more difficult with the intent to make it impossible. There are some boxes on the market that have no real support. There are others that are well supported. Naturally, those that are supported have the largest market share. They intend to keep it. That's business. If you own a clone and screw it up with a file, you're on your own. Current files have not damaged genuine boxes. Were it to happen, I hope that the manufacturers would respond as they did a few weeks ago with Pansats. There are also a lot of fear mongers that are trying to spread hate and discontent through malicious posts about malicious code. They are jealous or have other agendas. This thread will not become a vehicle for their rants. Nor will it become an altar for buttkissing. These are facts. Deal with them. You've been warned (again and again and again)!!! It doesnt matter, original or clone! I never ask people to download Pansat firmware for Ultras. Just tell me, DO WE HAVE PROBLEMS WITH PANSATS!? NO! Regards Blacklist

Ultrasat

bin found in downloads, coolsat files, jtag a coolsat using coolsat resucitator kit. I used jkeys set to 4900 recvier. not cooltec recvier. good luck JTAG a Coolsat using Coolsat Resucitator Kit

Hello to everyone. Today I got a new Coolsat4000Pro and I soldered a 20-pin header to the JTAG connector on the main board. The connection diagram is the same as Pansat 2500a so, any JTAG built for Pansat 2500a can be used with Coolsat. After that, I reset the box to its Factory Settings using the option given in the Menu. Then, I connect my buffered JTAG to it, and using skymax did a read of the flash memory saving this file as Coolsat4000Pro Factory Flash. This file and all that is needed to bring a Coolsat4000Pro receiver back to life, including a how to document, is contained in the Coolsat4000Pro Resucitator Kit.rar.Good Luck and Happy testing !

PanTec Ogre: The first thing to do here is figure out if you have a PanTec MX or MS. This task alone can be difficult, as there seem to be many different variations of the PanTec. There are many knowledgeable people on the forums that can give you lots of good information and help you determine your model. MX: This receiver does not have a JTAG header, nor does it have a place to install one. Because of the technical nature of the JTAG install, I will not be including instructions on installing a JTAG to this box; at least not in the first version of this how to. MS: This receiver usually has a 10 pin JTAG header installed. If not, you will have to install it yourself. I provide a header with the FTA cables I sell. Once the header is installed, if you purchased the cable from me, you can refer to the picture below to connect your cable. After that, it is simply a matter of following the instructions for the software program you are using (jKeys or Skymax).

Digiwave

7000 In the Pansat 2700a download section Downloaded the Pansat 2700a J-Tag Repair Kit Download Skymax 2.1 Now i used Skymax 2.1 first hook your J-Tagg cabl;e up and click on start on Skymax and it'll find your incode and all that stuff now click on erase and erase 3 times Exit out of skymax and use the unlocker program found in the Pansat j-tag repair kit Now when you open up the unlockler program click on detect and should detect ird # and box keys Now it will open up unlock and at the very top you'll see full click on unlock and it'll unlock all sectors Now click on Flash programming and use the j-tag dump bin file found in the Digiwave download section under J-Tag Digiwave by YONO After all that unhook j-tag cable, turn power off from switch on the back of the receiver and your ready to flash!!!

6800 Flash Digiwave

Quote:

Originally Posted by i am stuck in boot mode (6800), i tryed the tricks to download firmware as read but no luck. so i am trying to jtag the ird, i build the simple resistor version it detects fine but when i try to erase the chip i get Flash time out (DQ5 set) .click ok and get error detected erasing sector i always used a buffered jtag before this is the 1st time i am useing the simple version, would i be better off useing the buffered vesion?

HI it is such as this ..... ground Resistor R005 (is pin115 of Sti5518 for DCU peek poke not for Cpu boot from Rom )...still not solutions ..must put pin 7 epprom to H level ..or Pulse 12vpp by osciloscope ...for disable protect mode for erase it ...total 34 Sector ...made It s stuck on "boot" ..Then.Flash by firmwaver any ver Digi ...that' ok just to make sure on my part pin 7 of the small eeprom and not the 2Mb flash, correct? If you know designator of the chip would be excellent, ie. Uxx. can you point me to the orignal threat of . thanks in advance. I tried to searh and nothing came up. yes It is here ....but Jtag for Digiwave when erase is not OK ...seem hard fix it ..hope your endeavor is affect success. I importance first ..must ground Resistor R005 at side CPU Sti5518 ...when you power on IRD 3 sec ....for after not error massege

Poor Mans Jtag fix.

You may also use wall v2 to hold the cpu low and use jkeys 211 with correct def file for digiwave ,D ground pin 7 of the JTAG header with a toggle switch . You can use old computer MB push on connector on the end of you jtag for no solder quick fit. Wall V2 is picky so timing is key first turn on recvr then click reset uP in wall v2(ignore errors) then open jkeys and you will get no errors selct D7000 for your recvr type enter flash programming flip toggle switch to gnd pin 7 of header then you may click read to save orig then erase 2 times(when correctly erasing it will pulse rythmicly to count 34) then load up the known good bin of your choice. sometimes the erase will dump halfway through just keep telling it to erase untill is 100 percent successful. then loadup. This is best done with buffered Jtag with external batt pwr source. 5v EOF.

I am not done yet! There are people out there with more information, that they think should go into this guide! If you are one of them, send me an email at interfaceplace@verizon.net or from my website, www.interfaceplace.com.