Motorola Vip19x0 (Big brother of Vip1710)

[Martin V. (m_v)]

*** German ***

Weil mich auf die vip17x0 mpeg4 fehlt hab Ich mir ein VIP1960 auf 
Ebay.de gekauft.

Es sieht ein lott wie die VIP1710.

Telnet war nicht da, so keinen Zugriff auf diese Weise.
Mit dem Einsatz der Vip1710 Artikel fand ich den integrierten seriellen 
Port und ich konnte auf die Box zugreifen.

Hab ein generic Image gefunden. So kann mann die Box brauchen mit VDR 
als Client, wenn Sie eine gültige Kanalliste schicken uber 
infocastserver.

*** English ***

Because I use the vip17x0 and started missing the mpeg4 I bought a 
VIP1960 on Ebay.de.

It looks a lott like the VIP1710.

Telnet wasn't there so no access that way.
With the use of the Vip1710 article I found the onboard serial port and 
I could access the box.

Found a generic Image, so the box can be used with VDR as client if you 
send a valid channellist to it.

Booting...
System memory: 256 MB

Video memory: 64 MB

Using Slot 2

Unpacking Image ...Done

Commandline: console=ttyAS0,115200 bigphysarea=2048 mtdparts=Onboard_Flash:0x00070000@0x00390000(FFS),0x00390000@0x0(Raw) ramtopaddress=0xAC000000 systemmemsize=262144 videomemsize=65536 dbl=2 fw=2.26

Linux version 2.6.17.14-sh (erik@xenalinux) (gcc version 3.4.3 (STMicroelectronics Special) [build Feb 5 2007]) #1 Thu Sep 11 14:28:31 CEST 2008
STMicroelectronics STb7100 Reference board initialisation
LMI SYS setup, fixing blue dots
LMI VID setup, fixing blue dots
STb7109 version 3.x
Built 1 zonelists
Kernel command line: console=ttyAS0,115200 bigphysarea=2048 mtdparts=Onboard_Flash:0x00070000@0x00390000(FFS),0x00390000@0x0(Raw) ramtopaddress=0xAC000000 systemmemsize=262144 videomemsize=65536 dbl=2 fw=2.26
PID hash table entries: 512 (order: 9, 2048 bytes)
Using tmu for system timer
Console: colour dummy device 80x25
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 112056k/120832k available (1580k kernel code, 8612k reserved, 280k data, 76k init)
PVR=04061100 CVR=30480000 PRR=00009300
I-cache : n_ways=2 n_sets=256 way_incr=8192
I-cache : entry_mask=0x00001fe0 alias_mask=0x00001000 n_aliases=2
D-cache : n_ways=2 n_sets=512 way_incr=16384
D-cache : entry_mask=0x00003fe0 alias_mask=0x00003000 n_aliases=4
Mount-cache hash table entries: 512
CPU: STb710x
checking if image is initramfs... it is
Overmounted tmpfs
Freeing initrd memory: 906k freed
NET: Registered protocol family 16
Generic PHY: Registered new driver
DMA: Registering DMA API.
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 4096 bind 2048)
TCP reno registered
bigphysarea: Allocated 1152 pages at 0x842ed000.
JFFS2 version 2.2. (C) 2001-2003 Red Hat, Inc.
io scheduler noop registered
io scheduler anticipatory registered (default)
STPIO layer initialised
Software Watchdog Timer: 0.07 initialized. soft_noboot=0 soft_margin=60 sec (nowayout= 1)
STMicroelectronics ASC driver initialized
ttyAS0 at MMIO 0xb8031000 (irq = 122) is a asc
DMA: Registering ST40 STB710x FDMAC handler (5 channels).
STMicroelectronics - Coprocessors st231 Init
st-coprocessor-0: No RAM reserved
st231-0 Coprocessor -------------------------------------------
    not configured!
---------------------------------------------------------------
st-coprocessor-1: No RAM reserved
st231-1 Coprocessor -------------------------------------------
    not configured!
---------------------------------------------------------------
ST Cryptocore Version 1.5b
RAMDISK driver initialized: 1 RAM disks of 262144K size 1024 blocksize
LAN8700: Registered new driver
STMMAC driver:
  platform registration... <6>done!
  no valid MAC address; please, set using ifconfig or nwhwconfig!
STMMAC MII Bus: probed
Registrating STMMAC reboot notifier
Generic ST boards onboard flash device: 0x00400000 (4.0MB) at 0x00000000
Onboard_Flash: Found 1 x16 devices at 0x0 in 16-bit bank
 Intel/Sharp Extended Query Table at 0x0035
cfi_cmdset_0001: Erase suspend on write enabled
2 cmdlinepart partitions found on MTD device Onboard_Flash
Creating 2 MTD partitions on "Onboard_Flash":
0x00390000-0x00400000 : "FFS"
0x00000000-0x00390000 : "Raw"
i2c /dev entries driver
i2c_st40_pio: ST40 PIO based I2C Driver
i2c_st40_pio: allocated pin (2,0) for scl (0x841f4a24)
i2c_st40_pio: allocated pin (2,1) for sda (0x841f4a34)
i2c_st40_pio: allocated pin (4,0) for scl (0x841f4b24)
i2c_st40_pio: allocated pin (4,1) for sda (0x841f4b34)
i2c_st40_pio bus 0: SCL=PIO2[0], SDA=PIO2[1]
i2c_st40_pio bus 1: SCL=PIO4[0], SDA=PIO4[1]
fan_ctrl: Activating fan monitoring
TCP bic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
Freeing unused kernel memory: 76k freed
gpio: module license 'Proprietary' taints kernel.
-----------------------------------------------------
Init started
-----------------------------------------------------
Mounting filesystems
Verifying system integrity...
System integrity is intact
Mounting the flash file system
Reading configuration parameters
Running on Motorola VIP1960-9DB 256 with Firmware version 2.26
Using Vendor Class Id Motorola_VIP1960-9-256
Using Bootcast Id motorola-vip1960-9-256
Using SAP Id motorola.vip1960-9-256
kb driver loaded
Controller is mounted
Initialized display. Type is 1
Front_Paneldev: registered device with major 122
front_panel driver loaded
Initializing video
Open graphics device (width = 720, height = 576, bitdepth = 32).
Initialize Free Type Library
Loading font: /usr/fonts/Vera.ttf
Releasing font
Deinitialize Free Type Library
Graphics device closed.
Entering video active mode
Open graphics device (width = 720, height = 576, bitdepth = 32).
Initialize Free Type Library
Loading font: /usr/fonts/Vera.ttf
Open graphics device (width = 720, height = 576, bitdepth = 32).
Initialize Free Type Library
Loading font: /usr/fonts/Vera.ttf
Could not open /tmp/splash.bmp
Mounting flash memory
NAND device: Manufacturer ID: 0x20, Chip ID: 0x75 (ST Micro NAND 32MiB 3,3V 8-bit)
Scanning device for bad blocks
Creating 1 MTD partitions on "NAND 32MiB 3,3V 8-bit":
0x00000000-0x02000000 : "KREATEL NANDflash partition"
yaffs Sep 11 2008 14:28:35 Installing. 
yaffs: dev is 32505858 name is "mtdblock2"
yaffs: Attempting MTD mount on 31.2, "mtdblock2"
input: Kreatel IR-keyboard/remote as /class/input/input0
ir_kreatel: Enable interrupt
IR driver loaded
Setting button mask to fe

Parsed Code: 0x58, to button: 0
Parsed Codefront_panel: set_bit(88)
front_panel: set_bit(212)
front_panel: set_bit(221)
front_panel: set_bit(106)
front_panel: set_bit(108)
front_panel: set_bit(28)
front_panel: set_bit(105)
front_panel: set_bit(103)
front_panel: set_bit(0)
front_panel: set_bit(0)
input: Front Buttons as /class/input/input1
: 0xd4, to button: 1
Parsed Code: 0xdd, to button: 2
Parsed Code: 0x6a, to button: 3
Parsed Code: 0x6c, to button: 4
Parsed Code: 0x1c, to button: 5
Parsed Code: 0x69, to button: 6
Parsed Code: 0x67, to button: 7
Added Button code
No valid splash image in local storage
Bringing up the network
Reading link status...
PHY: 0:1f - Link is Up - 100/Full
-> Link is up
Using DHCP

[Martin V. (m_v)]

Heute hab Ich mich auch ein VIP1910 gekauft, nur 5 Euro mit FB aber ohne 
PS.
Es braucht 5,7 V so Ich hab die PS von VIP1710 ein gesteckt und es 
geht!!

Aber am seriellen port gab es nur "@#$@#$@$#%@%$#$".
Gleiche board is in Vip1960 und damit gehts.

Mit infocastserver das BootImage auf die kiste and es ist nutzbar.



Die Vip 19x0 braucht 'Secure' firmware oder 'Secure, Signed and 
Encrypted' Firmware.

Mit aktuelle kreatv-kit-oss kan man nur 'Secure, Signed and Encrypted' 
Firmware machen. Aber die keys sind nur valid fur development kit 
VIP19xx.

Aber es gab ein alte 3.4.3, nur Secure!

Have fun.

[Martin V. (m_v)]

Some pictures of the box.

The solder points for the serial port.

VIP 1710 vs VIP 1910

Greetz

[Martin V. (m_v)]

But the busybox included in the bootimage is stripped of wget, dd, ls 
etc.


# busybox
BusyBox v1.2.1 (2007.06.18-17:28+0000) multi-call binary

Usage: busybox [function] [arguments]...
   or: [function] [arguments]...

        BusyBox is a multi-call binary that combines many common Unix
        utilities into a single executable.  Most people will create a
        link to busybox for each function they wish to use and BusyBox
        will act like whatever it was invoked as!

Currently defined functions:
        [, [[, ash, busybox, cat, chmod, cp, cut, date, drawblip, echo,
        find, freeramdisk, grep, gunzip, hdparm, ifconfig, init, insmod,
        kill, killall, ln, loadkmap, mdev, mkdir, mknod, mount, mv, rm,
        rmmod, route, sh, sleep, tar, test, umount, zcat


So we need to find a way to get a 'full' busybox on it some how.
Or find the right AES key and secure our own kreatv-oss firmware.

[Martin V. (m_v)]

Did try a capture with the infocast2 tools (on a KPN IPTV adsl line) but 
it didn't work.

Next try will be a wireshark capture of the traffic when the box starts.

Now waiting to access the line again, I don't have one at home.

[Martin V. (m_v)]

I played today with the 1910s, units have newer firmware then my 1960 
but in this firmware there is no option to change video out settings. 
For scart it is OK but no way to select HDMI. Don't know if every 1910 
has this, but both my 1910's don't have the options, both my 1960 have 
it.

1910 - RBL 1.9 / FW 3.11.2 -> no video output selection (in the Firmware 
Configuratie Menu)
1960 - RBL 1.7 / FW 2.26 -> video output selection

Menu can be reached if you press menu on the remote during startup 
(boot)

[Pawel (Gast)]

Hallo,

at first I want to thank you for this very interesting thread. I have 
also one question. I am facing with the problem of lack of video output 
selection in VIP 1963 STB (from KPN, currently running by my local 
operator). Similar to you. By the other hand I have older VIP 1960 with 
this menu available in firmware. Do you know any workaround for this 
issue?

Best Regards

[Martin V. (m_v)]

If telnet is possible you can create the file by hand. If not the 
settings must be send by infocastserver, at the moment I haven't studied 
on how to send it.

The setting is availible in the settings menu of the original firmware 
and can only be accessed if connected to a KPN connection.

[Martin V. (m_v)]

Have done some more working on this box. Found an other SDK image (4.3) 
which can be loaded in a KPN branded box.
This image has telnet access & wget so I can do more with it but it 
lacks the TV app so all it does is boot and wait with a white screen for 
something.

So now I try to make my own image with the SDK and see if it will boot.

And now I can get some software on the box, store the files in /flash2, 
reboot with the other firmware and try to use the stored files.

Looks like I'm missing some sleep for a couple of days.

[Ranseyer (Gast)]

Thank you for your reasearch. Great work!

[Martin V. (m_v)]

If you want to try it search for the file 
kreatv-kit-starter-kit-emea_4.3.IAP30.3_i386.tgz

Build image is working, so now to play with it some more. KPN branded 
remote is not working, so the build config must be wrong.

Program on the box, read-irdriver, shows this info:
protocol: r-step_kpn, id:  18, scan:  90 (0x5a), key:   0, mod: 0x00, 
trans_key:   0, trans_mod: 0x00 [KEY_RESERVED] -> [KEY_RESERVED]

[Martin V. (m_v)]

Fernbedienung wirkt. Mann muss bei compilieren angeben KPN 
Fernbedienung.
Demo TVportal HTML und SVG lauft.


Brauch nur noch eine tolle TVportal oder ein VDR plugin und die box ist 
fertig.

[Martin V. (m_v)]

Demo bootimage fur 19x0. Tested nur mit 1960 und 1910.

[Martin V. (m_v)]

Build an other Image during build you must make a choice SVG or HTML 
webportal. This is for HTML webportal.

I made also a quick and dirty webportal, it has the basic TV functions.
up/down & 0-9 for change channel.
Ok show OSD.
Blue restart portal.

[Mac (Gast)]

Three questions:

Can the image be used for the Motorola VIP 19x3 boxes (aka 1963)?
And how to get the image on the box?

Does anyone know where the console points are on a 1963?
I suspect at the edge, right-bottom (facing the front) but it seems to 
do nothing.

[Martin V. (m_v)]

With the newer software the console is switched off or used for debug 
messages only. So it can't be used. The image can't be used with the 
19x3 series.

This image can be used for the Vip1903, Vip1963 or Vip1853

For sending the image to the box, look in the vip1710 thread for tools.

[Martin V. (m_v)]

New version of Portal can be found here :

http://projects.vdr-developer.org/projects/vdr-vipclient

[Mac (Gast)]

Can the box be used after flashing for regular use? (Aka subscribed tv)
Or is there a way to make a bootloader with telnet enabled only and grab 
the current image from the box?

[Martin V. (m_v)]

If you connect to the network of your provider (Eg KPN ) the box detects 
an other firmware version and will update on standby or sometimes 
directly.

[Mac (Gast)]

Can you provide a quick setup?

Attach box to network.
Start infocastools and broadcast image from above

I probably have to to do something else here...

Put box in updatemode (Press menu when booting up)?
(Change parameters to suit the server providing image?)
Press update..


Correct me and add where neccesary.

[Martin V. (m_v)]

Menu, remove software will force the box to update...

[Martin V. (m_v)]

New bootimage for the 19x0 series now with AC3 downmix support.

[Mac (Gast)]

Martin, you are using a vip1960 right? with serial console (edge right 
bottom) Is there a way in the official firmware to stream the tv image 
out of the box when having serial access? I am thinking of buying a 
Vip1960 just for this purpose.

[Martin V. (m_v)]

I've got a 1910 & 1960.
Last time I got a official (KPN) image on one of the boxes, the serial 
connector only showed debug messages, no login prompt. With the Motorola 
bootimages there is also no login prompt.

Looks like Motorola removed the login part from the serial port.

/ # cat proc/tty/driver/stasc
serinfo:1.0 driver revision:
0: uart:stasc mmio:0x18031000 irq:122 tx:1190 rx:0 RTS|CTS|DTR|DSR|CD
1: uart:stasc mmio:0x18032000 irq:121 tx:0 rx:0 CTS|DSR|CD
/ #

[Mac (Gast)]

Idea:

find old bootloader with console access. Put it on the box.
Block updates from KPN to bootloader (but let it download for future 
references)
Let the box update the other parts (kernel, middleware userland)
You think that would work?

[Martin V. (m_v)]

Don't think it will. Box has Firmware, which can be updated from the 
provider I think, and a bootimage. The bootimage is a secure and signed 
file you get from the provider. The bootimage a complete package and 
includes all you need to get TV.

But what do you what to do with the access?

[Mac (Gast)]

Stream a tv channel across my network. I am subscribed.

[Martin V. (m_v)]

I see. It isn't possible to get the stream and send it out over the 
serial port.

Maybe you can get hold of the adres of the streaming server and access 
the streams by PC (VLC/ Mplayer etc)

Try sniffing the traffic VIP <--> ExperiaBox or logclient on the 
original KPN firmware to see if you can get the server adres.

[Mac (Gast)]

Oroginal streams are verimatrix encrypted, I sniffed the traffic between 
VIP and server but there's no firmware. just config list, channel list 
and boot options list. I could try to spoof the boot options list since 
telnet is an option. (I read the manual) Will see whether that works.

The reason for the telnet/serial access was to put some streaming client 
on the device without the need for decryption keys since the box does a 
good job on those :-)

[Martin V. (m_v)]

The verimatrix encrypted streams aren't a problem. All you need is the 
rootcert.pem from the box and the ip of the verimatrix server.

If you use the settings from your own box & contract it isn't illegal I 
think. If KPN still use the same way, all allowing is done based on DSL/ 
Fiber connection location.

[Mac (Gast)]

thanks for that. How to get the certificate without some kind of access 
access to the box?
I am missing a step I think. There's something listening on port 9001 
but telnet does not show any banners.

[Mac (Gast)]

Or perhaps you mean just put "your" software on the box and it will 
still work since it's based on mac and decryption is still done inside 
box because of rootcert is still in the box?

[Martin V. (m_v)]

Try telnet to port 19999, if that is possible you get the log output of 
the box.

How to get the rootcert.pem I don't know but maybe all needed is the IP 
of the server.

KPN settings are in the KPN bootimage so if I don't have them I can't 
include them. And you need the verimatrix to say if you are allowed to 
watch stream x.

[Mac (Gast)]

Oh Well, for those who are interested:

First, the box downloads an index file (RTSP encoded plaintext file)
<ip-of-server>/index/mac-adress-of-box)
Content:
---
vqec-network-cfg <md5 sum of settings file to be downloaded>
vqe-channels <md5 sum of channellist file to be downloaded>
---

Then another RTSP encoded plaintext file called vqec-network-cfg
<ip-of-server>/vqec-network-cfg/mac-adress-of-box)
- This one holds the settings for the box (If different as stored in 
flash)
Then final RTSP encoded plaintext file called vqe-channels
<ip-of-server>/vqe-channels/mac-adress-of-box)
- This one holds the channels and their IP and ports etc etc.

If you can the box into thinking that it loads a valid (but modified) 
vqec-network-cfg with telnet enabled then you can get access to the box.

I can try if I can do that with tcpreplay or another pcap injection 
software.

(Command to inject to cfg file is: libcli_telnet_port = 1; )

[Martin V. (m_v)]

Telnet must be in the bootimage, only enableing isn't enough.

Motorola says in the telnet module docs "NOTE: This should NEVER be 
enabled in a live environment. It is strictly for debugging purposes 
only."

So I don't think KPN put it in the bootimages.

Search google for "kreatv sdk 4shared" to find the SDK and make your own 
images.

[Mac (Gast)]

Martin,

do you know (or can you check) how to insert ab-c-d-e etc. characters 
with the remote? When the device boots and you press menu...and 
afterwards 2357 (Ip settings) and 7532(advanced menu) You can change 
boot order, netconsole ip, tftp ip, http ip, boot filename, splash 
filename...etc.etc. But I need to insert characters. Any Idea?

[Martin V. (m_v)]

Sorry I don't know, maybe a USB keyboard works. But do you need it? With 
Infocast Server you can send most of the settings.

Greetz

[Mac (Gast)]

By the way:

splash protocol 313 meand 3 (Bootcast, Local Image, Bootcast)

Change with: arrow back/? button (delete)

1. Local image
2 TFTP
3 Bootcast
4 HTTP

(I guess, 2 is definately Bootcast and 2 definately tftp)

scroll down (channel down) to see other options like enable adavaced 
menu? (No default) Uhmm how to change it to Yes is what is the problem. 
(not that it cannot be done but you have to change it to "Yes" and only 
available option is 123456789

[Mac (Gast)]

I am a fool

313 (3 Bootcast, 1 Local image, 3 bootcast)

Anyway, you get the idea.

[Martin V. (m_v)]

From the motorola SDK

"A string with the splash protocol-order to use when downloading the 
splash image.
1 = BootCast

2 = TFTP

3 = Local Storage (if available)

4 = SAP (Session Announcement Protocol)

5 = DVD/CD (if available)

6 = HTTP (available from version 3.03)

For instance, "1,2" means that Bootcast is the first protocol to use but 
if it fails, TFTP shall be tried. It is not necessary to use comma 
separation. 16 Protocols are supported.
"

[Martin V. (m_v)]

Thanx for the Advanced menu tip, it isn't listed in the SDK. But I found 
no needed settings in it.

At the moment I'm fighting a 1853, basicly a lowbudget 19x3 but new 
firmware.
That one doesn't have the menu, grrrr

[Mac (Gast)]

Right, i downloaded the firmware onto the box with tftp.
Everyting went ok. I got a white screen but that's because I have to put 
in the portal used. (Have to find out about that) telnet and ssh worked.
No I want to download the original software somehow by using your image.
Any idea what command to use to do that? I know the server, SAP adress 
port etc. etc.

[Mac (Gast)]

Martin,

/proc/kboxbch
/proc/kboxparam
/proc/kboxuserparam

are holding those menu settings..you can change them by hand if you or 
me can find a way to make it writable (it's Readonly at the moment)

[Martin V. (m_v)]

With the infocast2 tools you can get the files.
http://sourceforge.net/projects/infocast2tools/

If you google for the infocastd server tools from Motorola you can send 
all those settings. It is also possible to change some with 'toish'

'toish is getobject all' shows all the settings. Some settings are 
stored in /flash/settings2.xml

And in flash.config_s1


Greetz from Holland,

Martin

[Martin V. (m_v)]

Do you've got a KPN-brand line? If so, can you list the multicast 
address and ports for the servers?

My 1853 looks for 224.0.250.64, but I don't know which port.

Better would be a wireshark capture from a booting 1853.

[Mac (Gast)]

I have an Xs4all line, basically an KPN line. It has another server for 
downloading the fw. But when you look in the debug you can find the 
server it tries to connect with. (if you have the original fw on the 
box)

Since infocast tools are freaking out my computer (maybe use a linux one 
for this) I tried streaming media monitor which detects something but 
nothing usefull. Anyway, fo a 1963 the server is

Listening on SAP channel 224.3.2.6:9875
Searching for splash session splash.motorola.vip1963...
Searching for kernel session bootstrap.motorola.vip1963...
SAP: Image download attempt 1 of 1
Loading splash image from address 224.0.250.82:64082...
Retrieving network splash version from SAP...
<snap>
SAP: Image download attempt 1 of 3
Loading kernel image from address 224.0.250.118:64118...

[Mac (Gast)]

Martin,,

do you know how to mount the <stored image> in the flash? (Or do you 
know the mountpoint/start address?) I can load your image via tftp in 
memory but I want to mount the original rootfs which is on the box.

Infocast is not going to work since it's using sap btw. (If you can 
program in C you can get the full desciption out of the 
bootloader-toolchain)

[Mac (Gast)]

Found it, it's called .bootimage on the /flash
So that should be the stored image. Now find a way to extract the rootfs 
out of it. After that it can simply be mounted. (I think)

[Martin V. (m_v)]

BootImage and Picture are in flash also the settings.
Problem with extracting is the encoding used by KPN. You need the keys 
to decrypt the file. See the 1710 thread and also the info on 
http://duff.dk/zaptor/

Too bad it is SAP only. Hopefully the newer versions of Infocast can 
speak SAP.

[Mac (Gast)]

Thanx for the duff site. It's probably only for 17xx boxes. Search for 
the key will continue since my box isn't secured, althought the software 
(hex) says SEC. And you can have secured without encrypted and signed. 
(they say)

Btw. If you use a DHCP server with the right options you can override 
parameters. It happens when I connect to the DSL line and use their DHCP 
server.. You can find DHCP options in 
kreatv-doc-sdk-user-manual_4.3.IAP30.3.tgz and examples, maybe this 
helps.

I will try to send the spanish guy some (c file) info on the sap 
structure, I gained it from the bootloader, Motorola licensed it under 
GPL.

I 've written them a small message to release the OSS bootloader for the
19x0/19x3 family of stb's. Let's see what they have to say.

[Mac (Gast)]

Did you sig or encrypted your version of the software Martin?

[Martin V. (m_v)]

The Duff site is for "VIP1920-9DCB Zaptor box from Stofa"

With the OSS keys it won't boot, you need special keys. But I don't know 
what the SDK makes for image, only know the Motorola likes it ;)

Booting with DHCP parameters I already tried but the 1853 didn't change 
the way its boots. Still wants a SAP server.

Greetz

[Jan (Gast)]

Beste Martin,

Om hier even offtopic iets te vragen.

Is het mogelijk om een overgekochte vip1853 werkend te krijgen. Dit als 
2e ontvanger bij telfort. De ontvanger download z n software komt 
uiteindelijk met de melding: Geblokkeer​d Uw account is geblokkeer​d. 
Dus het lijkt erop dat de gegevens van de vorige gebruiker er nog op 
staan.

How to fix this?

Gr Jan

[Martin V. (m_v)]

Check manual or 
http://www.xs4all.nl/klant/helpdesk/televisie/ontvanger/reset/

[Jan (Gast)]

Beste Martin,

Dit werkt niet. Er komt geen vraag voor abonnementsnummer en code.

Is het eventueel mogelijk om deze ontvanger een ander mac adres te 
geven?

Mvg Jan

[Martin V. (m_v)]

All I can say is factory default & remove software. Box should be as 
new. But maybe your provider only supports 1 box.

Remember English is hard for most readers, Dutch is impossible to read.

[Jan (Gast)]

When i reset en factory default the box. I turn one Receiver off. Then i 
connect the other one. It comes up downloads it's software. Then the 
message apears: Blocked, Account is locked out, contact HD.

So it looks like the receiver is blocked in the Netwerk of the Service 
Provider. If it is still in the profile of the other user (on the site 
of the Service Provider) Will it come up also with this message?

Is it possible to change mac and serial number anyway?

Greetz

[Martin V. (m_v)]

Without special tools from Motorola it isn't possible right now to 
change MAC/Serial.

Maybe you can call the HD and ask them to release the box from the 
previous owners account or ask if you are allowed to have 2 boxes.

This problem can better be asked at an other forum like tweakers.net.

Most readers (me included) don't have an dutch IPTV provider so I don't 
think anyone here can help you.

I just play with the hardware and try to unlock all its power. Right now 
the 1960/1910/1903 are running great with the custom software and VDR. 
For about 10 - 15 euro you've a great HD capable player.

[Mac (Gast)]

Reset the box to factory settings won't do the job. Serial number or Mac 
or some key identifier will identify it subscriber as valid/invalid on 
Telforts/KPN/other-provider server. You have to call them to release the 
box.

[Jan (Gast)]

Thanks Martin,

I had figured it out. But the HD of Telfort or KPN won't release the 
box. So thats not going to help.

Thanks Anyway

[Mac (Gast)]

"Without special tools from Motorola it isn't possible right now to 
change MAC/Serial"

I left a message on the Motorola Forum that they are violating the GPL 
by not releasing the oos bootloader code. If we have that one we can 
figure soemthing out.

I found a strange key sequence in the Kreatel 1710 bootloader.

static enum remote_key fb_console_code[] =
  { KEY_5, KEY_5, KEY_7, KEY_7, KEY_7, KEY_3, KEY_3,
    KEY_2, KEY_8, KEY_3, KEY_3, KEY_5, KEY_5, KEY_5, KEY_0,
    KEY_3, KEY_3, KEY_3, KEY_2, KEY_2, KEY_8, KEY_8, KEY_4 };

fb...framebuffer? Console? Any clue?

[Mac (Gast)]

Btw, KPN is not using a "portal". The complete userinterface with 
screens is written in Java (and with espial webkit/browser). (And not 
secured) I can make it crash (by using a normal keyboard) but then the 
UI restarts. If you want to play with it, i can post the archive if 
anyone wants that.

[Marian (Gast)]

Hello,

I have one VIP1960 that cannot be used for now. I power the box and it 
waits the connection to server. How can i get some custom software on 
it? I want to use it to receive some streams from my streaming server.

How can i do this ?
Thanks!

[Mac (Gast)]

Boot the VIP1960 (Powered off..unplug it)

Keep  pressing the "menu" button while booting. You 'll see a blue 
screen with some info. Press 2357 for IP Settings and Press 7532 for 
changing bootsequence and tftpserver. (For tftpserver boot change 
bootsequence to 23
2 is tftp...3 is boot from flash

[Mac (Gast)]

Sourcecode for 19x3 and 190x and 185x is released by Motorola btw.

http://sourceforge.net/projects/vip19x0.motorola-home/files/

[pete K. (hihnala)]

Does that newly released bootloader help to make this devices more 
useful?

[Martin V. (m_v)]

Got a Comhem 1903C box, first tested it. It worked OK for the free Ziggo 
channels. After that I cleared the box and tried to push the firmware on 
it no luck. So this box won't work with the Motorola developer keys.

[pete K. (hihnala)]

Just tried kreatv-bi-vdr.config_4.3.IAP30.3_st40_vip19x3.bin image on 
1903 and remote control does not work, also tv blinks a lot with HDCP 
error in logclient.

[Martin V. (m_v)]

This is the version I use for my 1903.

Greetz

[pete K. (hihnala)]

Not booting on my box... you didnt use keys from sdk 4shared package?
and remote does not work with kreatv-option-rcmaps:kpn option enabled.
My box is from small nordic ISP.

[Martin V. (m_v)]

I've got a Comhem 1903C box, but that one doesn't like the images I make 
with the developer keys.

Too bad not all boxes like the developer keys.

[pete K. (hihnala)]

By developer keys you mean keys that come with packages from
http://sourceforge.net/projects/vip19x0.motorola-home/files/ ??

[Martin V. (m_v)]

No not that keys but the keys from the SDK package from 4shared.

[pete K. (hihnala)]

Ok, my 1903 boots fine when i build image with SDK from 4shared.
But why didnt our image work on my box if you used "4shared" to build 
it?

[Martin V. (m_v)]

Strange, can you post your image maybe my Comhem box works with that.

[pete K. (hihnala)]

My box boots with this one

[Martin V. (m_v)]

Too bad same error, my Comhem box doesn't like it.
But it might have something to do with the onboard DVB-C.

[Martin V. (m_v)]

For the problems with the remote.
Telnet into the box and start 'read-irdriver' it tells you what driver 
to use.

/ # read-irdriver
Run 'read-irdriver -h' for help, press Ctrl+C to quit
protocol: kreatvir, id:  37, scan:  15 (0x0f), key:   0, mod: 0x00, 
trans_key:   0, trans_mod: 0x00 [KEY_RESERVED] -> [KEY_RESERVED]
protocol: kreatvir, id:  37, scan:  15 (0x0f), key:   0, mod: 0x00, 
trans_key:   0, trans_mod: 0x00 [KEY_RESERVED] -> [KEY_RESERVED]
protocol: r-step_kpn, id:  18, scan:  30 (0x1e), key: 217, mod: 0x00, 
trans_key:  87, trans_mod: 0x00 [KEY_OK] -> [KEY_F11]
protocol: r-step_kpn, id:  18, scan:  30 (0x1e), key: 217, mod: 0x00, 
trans_key:  87, trans_mod: 0x00 [KEY_OK] -> [KEY_F11]
Received a total of 4 key presses

First is the COMHEM remote, second the KPN.

[Marian (Gast)]

Hi guys,

Anything new?
How can get into this box and get the command line on my screen ?
I still have the box on hold...
I set a static IP to the box but i cannot ping it...
Maybe a short tutorial for breaking into this and connect it to my 
network to play some streams from my pc ?

I appreciate your work and i wish to help you as much as I can.

Marian

[Martin V. (m_v)]

1) Download the Infocastserverd software and one of the motorola 
software listed here.

2) Start the Infocastserverd, the motorola should now connect to it and 
get the software.

3) Enjoy the unleased power of the 1960.

[pete K. (hihnala)]

You can also use http to get image on your box.

Just go to http://search.4shared.com/q/CCAD/1/kreatv
and download starter kit, sdk and docs.
They include everything you need to know.

[pete K. (hihnala)]

Martin can you share those packages?

kreatv-font-vdrsymbols
kreatv-option-nfs-drivers

[Martin V. (m_v)]

I only changed the content, not the copyrights, opensource notes etc

If I find the time I'll make a NFS/Samba server package, so the 
1960/1963 hdd can be shared.

Greetz

[Martin V. (m_v)]

Digilive has a SDK for free on the webshop.

http://shop.idigilive.com/en/middleware/sdk-license.htm

I ordered one, you get a question about your project and after that a 
link in  mail.

It is not the full SDK but the OSS with some evaluation images, a 
current Infocastserver and (stripped down) 3.7.3 starter kit.

But the included docs are nice to have.

[Wiebe (Gast)]

Need some help finding Infocast server software

[Martin V. (m_v)]

See above posting, order the free SDK, it include the infocastserver and 
demo files.

[gogi (Gast)]

hi all i have a problem with my motorola i use image download over HTTP 
all services work fine my problem is the time on stb is 1.1.1970 and the 
clock is 0:00 any can halp me hov to resolve this problem i dont like to 
use infocast server

[Martin V. (m_v)]

If your image support it, you can use NTP to set time.

[gogi (Gast)]

how can i see this i haw configure the NTP server bat dont have corect 
time is it a way to configure it manual or how can i create a image i 
use BeeSmart platform with ekioch browser and i use the image from 
infocast server

for conection with server i use this script on my HTTP Server



 <?xml version="1.0"?>
<!DOCTYPE StbConfig SYSTEM "stbconfig.dtd">
<StbConfig>
<BootParams>
<KernelUrl>http://ServerIP:85/image/kreatv-bi-beesmart_1xx3.bin</KernelUrl>;
<KernelVersion>3.0</KernelVersion>
<SplashUrl>http://ServerIP:85/image/motorola-splash-pal_1900.spl</SplashUrl>;
<SplashVersion>3.0</SplashVersion>
</BootParams>
<StbConfig>

the portal url i inser manual over Telnet
using this comand

toish is SetObject config.ekioh.homepageurl http://my 
ServerIP:85/omniplay/client/index.svg permanent

[Martin V. (m_v)]

toish is getobject all

In my image it said

'const.time.available_sources: ntp'

Because I've put 'kreatv-option-ntp' in my image.

So you need to know what options are included in the image, often images 
comes with a text file which indicate what is included.

Or search for the KreaTV SDK on the web and build your own image.

[gogi (Gast)]

BusyBox v1.13.3 (2010-02-12 17:22:36 CET) built-in shell (ash)
Enter 'help' for a list of built-in commands.

/ # toish is getobject all
[Volatile]
_dhcp.serverid: 192.168.1.1
_dhcp.sroutes:
stat.infocast.0.time.total: 2952
stat.infocast.0.totalbytes: 0
stat.infocast.0.totalpackets: 0
stat.infocast.0.url: opch://224.2.2.2:22222
var.io.state: normal
var.ip._dhcp.240:
var.ip._dhcp.241:
var.ip._dhcp.242:
var.ip._dhcp.243:
var.ip.dns1: 192.168.1.1
var.ip.dns2: 192.168.1.1
var.ip.eth0.addr: 192.168.1.3
var.ip.eth0.link: true
var.ip.eth0.mask: 255.255.255.0
var.ip.gateway: 192.168.1.1
var.standby.mode: false
var.system.mode: false

[FlashUser]
[Production]
_fw.cfg.ip.eth0.mode: DHCP
cfg.locale.vendorid: Motorola_VIP1003
cfg.media.tv.colorsystem: PAL
cfg.media.tv.output: RGB
config.architecture.bootcastid: motorola-vip1003
config.architecture.bootimagecompatibility: 29
config.architecture.dblcompatibility: 29
config.productdisplayname: Motorola VIP1003
config.productname: VIP1003
const.capabilities.decoder.avc: false
const.capabilities.dtt: false
const.capabilities.hdmi: true
const.capabilities.macrovision: false
const.capabilities.rf: false
const.fw.region: emea
const.hw._dsp:
const.hw._dvbnim:
const.hw._hdmi: Yes
const.hw._mainprocessor:
const.hw._rfmodulator:
const.hw.manufacturer: Motorola
const.hw.productname: vip1003
const.hw.serialnumber: M91245EGF152
const.hw.version: 583711-001-00

[FlashFs]
cfg.media.audio.formatpriority: MPEG,AC3,HE_AAC_STEREO,HE_AAC_SURROUND
cfg.migration.v3_x_done: TRUE
cfg.tvoutput.audioconfig: <?xml version="1.0" ?>
<AudioOutputSettings version="1">
        <connection type="AUDIO_CONNECTION_TYPE_ANALOG" index="0" 
volume="100" l
atency="0">
                <mapping from="AUDIO_FORMAT_MPEG_1" 
to="AUDIO_FORMAT_PCM_2CH" mi
x="0"/>
                <mapping from="AUDIO_FORMAT_MPEG_2" 
to="AUDIO_FORMAT_PCM_2CH" mi
x="0"/>
                <mapping from="AUDIO_FORMAT_AC3" 
to="AUDIO_FORMAT_PCM_2CH" mix="
0"/>
                <mapping from="AUDIO_FORMAT_AC3_PLUS" 
to="AUDIO_FORMAT_PCM_2CH"
mix="0"/>
                <mapping from="AUDIO_FORMAT_AAC_HE" 
to="AUDIO_FORMAT_PCM_2CH" mi
x="0"/>
                <mapping from="AUDIO_FORMAT_AAC_LC" 
to="AUDIO_FORMAT_PCM_2CH" mi
x="0"/>
                <mapping from="AUDIO_FORMAT_PCM_2CH" 
to="AUDIO_FORMAT_PCM_2CH" m
ix="0"/>
        </connection>
        <connection type="AUDIO_CONNECTION_TYPE_SPDIF" index="0" 
volume="0" late
ncy="0">
                <mapping from="AUDIO_FORMAT_MPEG_1" 
to="AUDIO_FORMAT_PCM_2CH" mi
x="0"/>
                <mapping from="AUDIO_FORMAT_MPEG_2" 
to="AUDIO_FORMAT_PCM_2CH" mi
x="0"/>
                <mapping from="AUDIO_FORMAT_AC3" 
to="AUDIO_FORMAT_PCM_2CH" mix="
0"/>
                <mapping from="AUDIO_FORMAT_AC3_PLUS" 
to="AUDIO_FORMAT_PCM_2CH"
mix="0"/>
                <mapping from="AUDIO_FORMAT_AAC_HE" 
to="AUDIO_FORMAT_PCM_2CH" mi
x="0"/>
                <mapping from="AUDIO_FORMAT_AAC_LC" 
to="AUDIO_FORMAT_PCM_2CH" mi
x="0"/>
                <mapping from="AUDIO_FORMAT_PCM_2CH" 
to="AUDIO_FORMAT_PCM_2CH" m
ix="0"/>
        </connection>
        <connection type="AUDIO_CONNECTION_TYPE_HDMI" index="0" 
volume="0" laten
cy="0">
                <mapping from="AUDIO_FORMAT_MPEG_1" 
to="AUDIO_FORMAT_PCM_2CH" mi
x="0"/>
                <mapping from="AUDIO_FORMAT_MPEG_2" 
to="AUDIO_FORMAT_PCM_2CH" mi
x="0"/>
                <mapping from="AUDIO_FORMAT_AC3" 
to="AUDIO_FORMAT_PCM_2CH" mix="
0"/>
                <mapping from="AUDIO_FORMAT_AC3_PLUS" 
to="AUDIO_FORMAT_PCM_2CH"
mix="0"/>
                <mapping from="AUDIO_FORMAT_AAC_HE" 
to="AUDIO_FORMAT_PCM_2CH" mi
x="0"/>
                <mapping from="AUDIO_FORMAT_AAC_LC" 
to="AUDIO_FORMAT_PCM_2CH" mi
x="0"/>
                <mapping from="AUDIO_FORMAT_PCM_2CH" 
to="AUDIO_FORMAT_PCM_2CH" m
ix="0"/>
        </connection>
        <connection type="AUDIO_CONNECTION_TYPE_DECODER" index="0" 
volume="100"
latency="0">
        </connection>
</AudioOutputSettings>

cfg.video.color_system: PAL-B
cfg.video.component_mode: OFF
cfg.video.hdmi_color_space: sRGB
cfg.video.hdmi_mode: EDTV
cfg.video.tv_scart_mode: CVBS
config.ekioh.homepageurl: http://MyServerIP:85/omniplay/client/index.svg
config.tvoutput.videooutputconfiguration: <?xml version="1.0"?>
<VideoOutputConfiguration version="1">
  <ColorSystem>COLOR_SYSTEM_PAL_B</ColorSystem>
  <ScartLoopThrough>NO_VALUE_MODE</ScartLoopThrough>
  <Outputs>
    <Output>
      <Id>0</Id>
      <ConnectionType>VIDEO_CONNECTION_TYPE_HDMI</ConnectionType>
      <Mode>VIDEO_MODE_576P50</Mode>
      <ColorSpace>DIGITAL_COLOR_SPACE_SRGB</ColorSpace>
    </Output>
    <Output>
      <Id>2</Id>
      <ConnectionType>VIDEO_CONNECTION_TYPE_SCART</ConnectionType>
      <ScartMode>SCART_MODE_CVBS</ScartMode>
    </Output>
  </Outputs>
</VideoOutputConfiguration>

info.ffs.periodtimestamp: 946684822
info.ffs.periodwritecount: 1
info.ffs.totalwritecount: 3

[Infocast]
var.ip.metachannel: 224.2.2.2:22222

[Os]
config.architecture.target: vip1903
config.portalarea.height: 576
config.portalarea.width: 720
config.safearea.height: 490
config.safearea.width: 612
config.screenarea.height: 576
config.screenarea.width: 720
config.visiblearea.height: 490
config.visiblearea.width: 612
config.visiblearea.x: 54
config.visiblearea.y: 43
const._fw.version: 3.17.2
const.capabilities.fp.display:
const.capabilities.fp.leds: 20
const.ip.eth0.mac: 00:02:9b:98:a5:da
var.memfree:
var.utctime:

[Default]
cfg.locale.keyboard: en-US+toggle_off
cfg.locale.timezone: UTC
cfg.locale.ui: en-US
cfg.media.sub.hoh: FALSE
cfg.media.tv.aspectratio: 4:3
cfg.media.tv.colorsystem: PAL
cfg.media.tv.output: Video
cfg.media.useprogramcache: TRUE
cfg.media.video.16_9method: None
cfg.media.video.4_3method: LetterBox
cfg.standby.allowupdate: TRUE
cfg.standby.kreatv_mode: 1
cfg.uilangs: en-US
cfg.video.hdmi_auto_activate: FALSE
cfg.video.hdmi_ignore_edid: TRUE
config.1staudiolanguage: eng
config.1stsublanguage: eng
config.2ndaudiolanguage: swe
config.2ndsublanguage: swe
config.audiocontrol: TRUE
config.channeltable:
config.defaultfontsize: 16
config.initialvolume: 80
config.minfontsize: 16
config.onscreenkeyboard: FALSE
config.onscreenkeyboarddelay: 1500
config.onscreenkeyboardmode: EXTENDED
config.onscreenkeyboardtoggle: FALSE
config.portalshowwebcontent: FALSE
config.scartarsignal: FALSE
config.soundmode: Analog
config.standbyled: TRUE
config.subtitling: TRUE
config.support.multicast: TRUE
config.uilanguage: eng
config.useragent:
const.capabilities.macrovision: FALSE
const.sw.branch:
const.sw.company: Motorola, Inc.
const.sw.configuration: beesmart
const.sw.date: 20110316
const.sw.host: rehel-sussa-test3
const.sw.time: 101246
const.sw.user: root
const.sw.version: 3.8.3.13

[RCU Event]
var.rcu.low_battery: false


/ #

Ich weis nicht wie man ein image kreiert ist es möglich das sie für mich 
eins machen were super ich habe nicht sehr fiel ahnung davon danke in 
foraus

[gogi (Gast)]

Martin V. schrieb:
> toish is getobject all
>
> In my image it said
>
> 'const.time.available_sources: ntp'
>
> Because I've put 'kreatv-option-ntp' in my image.
>
> So you need to know what options are included in the image, often images
> comes with a text file which indicate what is included.
>
> Or search for the KreaTV SDK on the web and build your own image.

is it posible to giv me your image or can you create one for me
thenks

[Martin V. (m_v)]

According to Motorola the 1003 can use the 19x3 image.
So you can download on of the above 19x3 images.

[Martin V. (m_v)]

At request a version with 192.168.178.76 as homepage, other have 
192.168.3.15.

[Esben Taersker (Gast)]

Hi everybody.

From work I've got my hands on 2 vip1903 boxes. I might get more. It 
seems they are obsolete in our area, and are apparently just scrapped.

I've goggled and found this thread where it seems you guys know a lot 
about these boxes.

Personally I live outside my company's area, and have no cable-tv at 
all.
So my question is - do I have any use of these boxes at all. I figure I 
would like to use them for displaying videos from my own dlna-server or 
the USB port, or just YouTube... I guess Netflix is not an option...

Am I way off and ought to quit right here, or should I ask for a dummy's 
guide to install such a "stand-alone-image". (Yes, I tried to follow 
several of the instructions given above unsuccessfully...)

Yours
Esben



PS: There is also a few vip1510 boxes, but they have no HDMI so I'm 
unable to connect them to any of my spare monitors...

[Martin V. (m_v)]

Hi,

over here I have satellite TV, I use VDR to convert that into IPTV which 
I stream through my house to the 1903 boxes.

At the moment I'm not able to reflash a comhem cable box. I've got one 
but it doesn't like the software.
So if you have a  Comhem box you are out of luck for now.

[Fred L. (flangeslag)]

Hi Martin,

Just found my old vip1960 box and your information.
I'd like to give a try in reconfiguring the box as you describe.
Starting reading your articles I'm stuck at the serial interface of the 
box, on a picture soldering points are shown but what point is tx, rx, 
gnd. What cable should I use? Will the TTL-232R-3v3 do?
Thanx in advance for your response...

[Martin V. (m_v)]

With the latest images you don't need any cables. Telnet/ SSH is in the 
images.

Just send the images to the box and it should work. If your box has the 
new firmware the box can download the image from a web server, if not 
you need the infocastserver from Kreatel.

[Mac (Gast)]

Hi Martin,

do you  know how to compile java into your image? Since the gui from KPN 
is a jar archive ..I want to use it for testing.

[Martin V. (m_v)]

If the above image won't work with java you need to find a java module/ 
package for the developer kit. Or make your own java package, the box is 
running stlinux. http://www.stlinux.com/

Greetz

[Mac (Gast)]

Hi Martin,

can you try whether this 
(https://dl.dropboxusercontent.com/u/27375099/ui.jar) works on your 
firmware?
It's a java (jar) archive. Holds the complete UI for  VIP 19x3.

I can't test your software since the key is wrong. It refuses to load on 
mine.

[Martin V. (m_v)]

The key should work because it is a developers key, so far all the Dutch 
boxes I've got worked with it. Tested a dozen of 1910/1960/1903/1963
The 1853 doesn't work with infocastserver so I can't put an image on 
that one.

Looked into the jar-file, there are references to Mozilla. This is 
removed from Kreatv by Motorola. So I don't think it will work.

[Mac (Gast)]

Well,for what reason unknown to man the config signed with the 
starters-kit keys is working. Anyway, how did you find out what the 
IIP's need for parameters? I want to compile firmwaremanager in it but 
it keeps saying
"build_time install script failed for with paramter. I untarred the IIP 
and looked in the info.xml for the parameters. But maybe i have to put 
some ; or : or , somehwere.

[Martin V. (m_v)]

Please post the exact error message.

[Mac (Gast)]

Error: buildtime install script failed for IIP 
'kreatv-option-upgrade-firmware' with parameters 'reboot'

[Martin V. (m_v)]

Read the docs?

kreatv-option-upgrade-firmware

This updates the firmware on STB bootup if the firmware has newer CRC 
and is not of the same version. It is also possible to downgrade the 
firmware. Extra note for the VIP1900 series: It is also possible to 
update the configuration parameters (flash.config_sX).

Parameters

Name  Repeat  Description  Example
config  Once  Full path to the new configuration parameters file.
Note:ONLY possible for the VIP1900 series.  config=<file>
dbl  Once  Full path to the DBL (firmware) file.  dbl=<file>
force  Once  If this parameter is added, it will be possible to update 
only the configuration parameters.
Note:This option is considered INSECURE and should ONLY be used if you 
REALLY> know what you're doing!  force
reboot  Once  If this parameter is added, the STB will reboot after 
successful firmware upgrade.
Note: This parameter will only take effect if the DBL-option is 
specified.  reboot

[roma (Gast)]

is there a way to get the telnet password for an existing image ?

[Martin V. (m_v)]

A production image doesn't have telnet access.

Motorola docs say :
"kreatv-tool-telnet

With this IIP, you can telnet to the STB and get a root shell.

NOTE: This should NEVER be enabled in a live environment. It is strictly 
for debugging purposes only."

[roma (Gast)]

Hi Martin i saw that
but i think the company that provided the image didnt take care of that 
warning

if i telnet to my VIP1003 box ( usual TCP 23 port ) i get

ENTER PASSWORD :......

and it only allows 1 try then it closes the connection

i am sure that the password is on the image but cant find a way to find 
it

the image itself is encrypted/secure and it starts with SEC


here is a screenshot of the fingerprint of the image and the telnet 
window

http://i.imgur.com/exAKEpm.png

[roma (Gast)]

the whole idea is to modify the portal URL on that image because its 
hardcoded on the inside files

i tried with infocast server sending new portal URL-s but the image 
still connects to the other portal ( their portal )

till now the only option was to create a DNS server that responds when 
the STB asks for resolving the domains giving a IP of my webserver 
instead of the real IP of the portal

-----------------------------------------

Another option is to have the STB boot from a self made firmware but i 
tried some of the firmwares on this page but all came with incorrect 
verification and the STB didnt installed them on itself

[roma (Gast)]

Never mind , i was able to flash building images using the SDK-s and 
also i got the portal ( attached on this topic ) to work


now does anyone knows if there are limitations for the development 
version of the images  ?

do they i.e "expire" , have any non working parts ?

regards

[Martin V. (m_v)]

Nice to hear, so working with the SDK are : Nangu (Czech), KPN (Dutch), 
a Nordic ISP.

Only problems are finding the iip's. There are some on the web but I 
like to find/have the dlna iip and some youtube stuff.

[roma (Gast)]

what about building/cross compiling programs ?

suppose we need a webserver installed on the STB .

i already did cross compiling for other STB-s ( mag 250 , some routers 
etc ) but i`m having probs finding the root filesystem on the motorola 
toolchain

P.S : i think the image i have is related to Nangu/ITONIS ... at least 
so its named

[roma (Gast)]

as i see the IIP are gzip-ed files containing the executables(if any) 
and the startup/install/uninstall script

so ... seems we need :
1) to find i.e a DLNA server
2) cross compile it for sh4-linux using the 
/usr/local/motorola/toolchain/st40/2.3.0/bin/sh4-motorola-linux-XYZ
3) prepare the startup/install/uninstall files
4) make an IIP with all executable/startups

am i right ?

[Martin V. (m_v)]

Partly right, compiling and making the IIP isn't the problem. I've made 
some IIP's myself.

The problem is how to use it in the portal. If you install the official 
IIP you get some new commands to use in the portal.

[roma (Gast)]

seems my fault ... didnt read the full documentation of motorola

there seems that the DLNA support/service interface is there the prob is 
how to use it on the portal :)


by the way can you attach some IIP or share the links of those you found 
on the internet ?


thanks

[roma (Gast)]

Also working with SDK is also Beesmart/Beenius http://forum.beenius.tv/

[roma (Gast)]

for the youtube part you might have a look at the stalker middleware ( 
open source ) .... it has the youtube plugin for the MAG250 and what it 
does its that it parses the youtube API and gives back the URL of the 
video with other functionality also ( like search etc )

so since the VIP can play direct HTTP and also rtp/rtsp we can use the 
MAG 250 parsing script to get the URL of the video and then pass it to 
the TOI player instance

[roma (Gast)]

here is the link
http://wiki.infomir.eu/doku.php?id=en:stalker:start

[Martin V. (m_v)]

The VDR plugin from Thorsten which I use for my portal can also do some 
Youtube. But I still have to program the user input part. I was hoping 
to find the Motorola client for it. So in the portal you can switch to 
that program and let it do all the work.

The IIP I found are all on 4shared.
The SDK & start-kit include some and also there is 
"kreatv-extra-iip-package-ericsson_mu_4.3.IAP30.3.tgz" which include MP4 
and ca-verimatrix

[Mac (Gast)]

Hi Martin,

if you factory reset a VIP (and delete the local image) then it runs 
some kind of very small firmware. (Splash image is black and only shows 
yellow dots.) Do you know where that filesytem can be found? Maybe we 
can mount it.

2d question: If the box starts from a local image..will it copy it's 
rootfs to nand (permanent) or does it unpacks the encrypted image and 
stores it in memory 'till a reboot?

I wonder how the GUI writes back the settings on a local image.

[Martin V. (m_v)]

Info about the small image you talk about can be found : 
http://sourceforge.net/projects/vip19x0.arris/

The second question, there are small parts (/flash & /flash2) which can 
be written. That space is also used in the Vip1710 exploit.

[Killinr (Gast)]

Is it also possible to get XBMC installed on any of the motorola Vip 
boxes?

Thanks KR.

[Martin V. (m_v)]

It might be possible if you can find the right output module.
The same problem as for VDR there is no output module written (yet).

[Killinr (Gast)]

what do you mean with output module?

[Martin V. (m_v)]

The part that shows info on tv. Like vdr-sxfe / vdr-fbfe, softhddevice 
etc.

[alcomys (Gast)]

please can someone help.
i want to download the new firmware to the box via tftp.
but i got error on the box 36.
what do i wrong ?
and the howto in this tread is very low in information.
thanks

[user56 (Gast)]

What about duckbox running in this box?

http://en.wikipedia.org/wiki/Wikipedia_talk:Articles_for_creation/Duckbox

[Martin V. (m_v)]

@alcomys what box and what firmware are you trying?

@user56 try it. If it works post it!
The problem as far as I know is the output but maybe they have it build 
in already.
VDR is running on the VIP but the lack of output makes it useless.
If you can write C, it should be possible to create a output driver for 
VDR, X, XBMC etc.

[Thorrnado (Gast)]

@Martin V
I have the new STB from KPN, the Arcadyan HMB2260, and i happen to have 
1 left over, can this one also be overwritten with your custom fw ?
Or do you think KPN made a whole new system for the arcadyans ?
They are not letting out any info to me. ... (and i work for them as a 
field-engineer :P)

[Martin V. (m_v)]

Short answer : NO
Longer answer : It is a complete other unit, different CPU/ SOC. You 
need the developer kit from Arcadyan to make software for it.

[Thorrnado (Gast)]

@Martin V
Okay, in that case, i also have a few VIP1853 units in the car, they 
will work right? or will i really have to look for a 1903 or 1963 ?

BTW ... offtopic, did you ever work at Online/Bosch ??

[Martin V. (m_v)]

[offtopic]Yup, 'Tosti' I did[/offtopic]

Software should work on the 1853 because it is a stripped down 19x3 but 
the problem is getting it on the box. The Infocastserver can't be used 
that part is stripped out of the bootloader.
The 1853 looks for a SAP server. Because I don't have KPN I can't make a 
wireshark capture of the startup of a 1853. With a capture you can find 
what info the 1853 wants to have. After that it is easy to setup your 
own sap server and send software.

[Thorrnado (Gast)]

Okay, so i'll start capturing then ...
I do have KPN, so i can make that happen.
I presume you will be interested to get a copy of the capture files?
If so, do you need anything special ? (or perhaps a capture from another 
model ?) name it, and i'll see what i can do.

[Martin V. (m_v)]

First you need a HUB not a switch to capture the traffic.
What is needed? All the requests and answers the 1853 gets until 
receiving the firmware/software.
As far as I could find the 1853 search for a SAP server, that server 
answers with a (text)file that has the firmware/software server info.
Just like the infocast server does.

[Alcomys (Gast)]

@Martin-v
i have the full sheet of the sti7109 can u use it for more deleopment 
maybe ?

regards

[Martin V. (m_v)]

Some real coder might. Too bad I'm not a coder.

[Alcomys (Gast)]

Shame :(
because i also have the full document from the sti7105.
where you can see the jtagging connections ect.
maybe other coders are on this board ?

Regards

[Alcomys (Gast)]

Today i found the Jtag interface on the Motorola(VIP1853) STI7105.
in the image you can see the connections.

Regards

[Johny M. (mamonick)]

Hello Martin,
I would like to run video on demand with vlc server and VIP1003, but I 
always get open error when I try to play RTSP stream. HTTP stream works 
fine but I want use pause and fastfoward function. Have you any 
experience with that or could you recomend me some another server. I 
tried vdr but I didnt figere out how to run in without DVB card.

[Martin V. (m_v)]

Sorry, work only with VDR at the moment.
Is rtsp enabled in the image you use?

[Johny M. (mamonick)]

yes I have image with:
kreatv-option-streamclients:rtsp,basic,http,bitband

Here is error from log:
810 02:22:59.124 halserver(404) Note: Video: Enable component output
1811 02:22:59.125 halserver(404) Note: Client id 67 opened resource 
MediaDecoder/VIDEO
1812 02:22:59.125 mediamanager(490) Note: Active streamers:
1813 02:22:59.126 mediamanager(490) Note:        491   2, 
rtsp://10.1.1.112:8554/test PLAYING
1815 02:22:59.133 streamer(491) Note: PositionOffsetStates.cpp: Entering 
awaiting flow state
1816 02:22:59.133 streamer(491) Note: TPositionManager.cpp::Halt
1817 02:22:59.133 streamer(491) Note: OPEN command issued to source 
element
1818 02:22:59.133 streamer(491) Note: [Rtsp Source] Open
1819 02:22:59.134 streamer(491) Note: [Rtsp Source] Establishing 
connection to server 10.1.1.112:8554.
1820 02:22:59.142 streamer(491) Note: [Rtsp Source] OnOpen
1821 02:22:59.142 streamer(491) Note: [Rtsp Source] Connection 
established
1826 02:22:59.154 mediamanager(490) Note: Notifying observers 
OnCapabilitiesChanged(1f)
1827 02:22:59.161 webkit_portal.sh(735) Note: Nastaven full screen.
1838 02:22:59.252 streamer(491) Note: [Rtsp Source] [RET-config]: 
Profile was set to AVP
1839 02:22:59.252 streamer(491) Note: [Rtsp Source] Found transport type 
RTP in describe response
1841 02:22:59.252 streamer(491) Warning: [Rtsp Source] Could not parse 
range:  npt=0-1750.563
1843 02:22:59.252 streamer(491) Note: [Rtsp Source] OpenPayloadChannel
1846 02:22:59.253 streamer(491) Note: [Rtsp Source] BindRandomPorts RTSP 
payload port used: 48708
1854 02:22:59.280 streamer(491) Note: [Rtsp Source] OnClose
1855 02:22:59.280 streamer(491) Note: [Rtsp Source] Connection closed
1857 02:22:59.280 streamer(491) Error: Source element OPEN command 
failed
1858 02:22:59.280 streamer(491) Note: 
IPipelineArbitratorObserver::OnstateChanged STATE_FAILED reason: 
CommandOpen
1860 02:22:59.281 streamer(491) Note: [Rtsp Source] OnStateChanged 
state:5
1862 02:22:59.281 streamer(491) Note: PositionOffsetStates.cpp: Entering 
paused and no flow state
1863 02:22:59.281 streamer(491) Note: TPositionManager.cpp::Halt
1864 02:22:59.281 streamer(491) Note: 
IPipelineArbitratorObserver::OnstateChanged STATE_FAILED reason:
1865 02:22:59.281 streamer(491) Note: Source element changed to 
STATE_FAILED reason: Unknown

[Martin V. (m_v)]

One on ebay.de right now :
http://www.ebay.de/itm/Motorola-VIP-1963-HDMI-HDD-Recorder-2011-12-/161234229041

[Mortimer N. (Firma: privat) (ranseyer)]

Ich würde auch noch eine 1960 ohne HDD abgeben. Nen Zehner möchte ich 
dafür...

[Martin V. (m_v)]

Made an other one with server IP 192.168.1.21

[Aleš Hrubý (Gast)]

Please does anyone know how to cast Verimatrix motorola 1003? I have the 
key but do not know how to incorporate it

[cobramostar (Gast)]

Alcomys schrieb:
> Today i found the Jtag interface on the Motorola(VIP1853) STI7105.
> in the image you can see the connections.
>
> Regards

if you can not connect with 7105 or you get the error

thnax

[Aleš Hrubý (Gast)]

Please does anyone know how to cast Verimatrix motorola 1003? I have the
key but do not know how to incorporate it

I have rootcert.pem and verimatrix.ini but I do not know how to 
implement it.

[Martin V. (m_v)]

Look for the SDK, in the SDK there is info about the use of the 
verimatrix encryption.

[Aleš Hrubý (Gast)]

I have kreattv documentation but is not verimatrix :-(.
In sdk is not documentation

[Aleš Hrubý (Gast)]

Aleš Hrubý schrieb:
> I have kreattv documentation but is not verimatrix :-(.
> In sdk is not documentation on verimatrix :-/

[Aleš Hrubý (Gast)]

please do not know how to compile Verimatrix?
I have rootcert.pem and verimatrix.ini But where to insert as set :-(

# Configuration for kreatv-bi-test2.conf_1.0_st40_vip19x3.bin
# Boot image md5 sum: d9bc0e748cbf4248831f7317e9e7a41e
# Build date: 20140422  Build time: 111318
# $configuration:eval$
# Applications

kreatv-app-webkit-portal::cache=0
kreatv-app-webkit-portal::database_storage_path=/flash/database/webkit/
kreatv-app-webkit-portal::gfx_pixmap_memory_limit=32
kreatv-app-webkit-portal::http_secure_mode=0
kreatv-app-webkit-portal::ntp_wait_limit=10
kreatv-app-webkit-portal::startinfront
kreatv-app-webkit-portal::sys_pixmap_memory_limit=64
kreatv-app-webkit-portal::prop(GfxMemory)=27540
kreatv-app-webkit-portal::prop(DoubleBufferingEnabled)=true
kreatv-app-webkit-portal::prop(ShareOutputBufferEnabled)=false
kreatv-app-webkit-portal::prop(RenderingBufferMaxWidth)=1920
kreatv-app-webkit-portal::prop(RenderingBufferMaxHeight)=1080
kreatv-app-webkit-portal::prop(HdDisplayBufferMaxWidth)=1920
kreatv-app-webkit-portal::prop(HdDisplayBufferMaxHeight)=1080
kreatv-app-webkit-portal::prop(SdDisplayBufferMaxWidth)=720
kreatv-app-webkit-portal::prop(SdDisplayBufferMaxHeight)=576
kreatv-app-webkit-portal::url=http://172.28.0.100/motorola/index.php

#pip
kreatv-option-pip

### Fonts

kreatv-font-kreativ

# Licenses
kreatv-option-license::file=../products/kreatv_video_decode_mpeg2.licens 
e
kreatv-option-license::file=../products/kreatv_video_decode_h264.license

kreatv-option-toi2
kreatv-option-softwareservice
kreatv-option-application-download
kreatv-option-streamclients:rtsp,basic,http,bitband

# Central European Time
kreatv-option-ntp:server=0.pool.ntp.org,server=1.pool.ntp.org,server=2.p 
ool.ntp.org


kreatv-option-tz:CET-1CEST-2,M3.5.0/02:00:00,M10.5.0/03:00:00
kreatv-option-ui-langs:da-DK,en-US,fi-FI,no-NO,sv-SE
kreatv-option-usb
kreatv-option-kreatvinput-keymaps:pc-en
kreatv-option-kreatvgfx-stack
kreatv-option-kreatvgfx-subtitlerenderer:dvb,teletext,dvd,xsub


# Tools
#kreatv-tool-logging
kreatv-tool-telnet

kreatv-option-default-video-settings:HdmiMode=1080i50

[Martin V. (m_v)]

Compile image with the 
kreatv-option-ca-verimatrix_4.3.IAP30.3_st40_vip19x3.iip
The following is from the doc include in this IIP.


kreatv-option-ca-verimatrix:inifile=/extra/ca/verimatrix.ini,rootcert=/e 
xtra/ca/rootcert.pem


[VERIMATRIX]
COMPANY=Motorola_Linkoping
SERVERADDRESS=192.168.1.1
SERVERPORT=12697
STOREPATH=/flash
ROOTCERT=/tmp/rootcert.pem
MIN_KEY_RETRY_INTERVAL=300
TIMEOUT=10
ENABLE_IPV6=FALSE
KEEP_NULL_PACKETS=FALSE
ERRORLEVEL=0
DISABLELOG=TRUE
CLEARLOG=TRUE
LOGFILE=/var/log/verimatrix.log
MESSAGE_FORMAT=1154


The rootcert.pem is provided from the VCAS server. Contact
[e-mail] for further information on these files.

[Aleš Hrubý (Gast)]

kreatv-option-ca-verimatrix_4.3.IAP30.3_st40_vip19x3.iip

This file I have not got there I was wondering where I can find him or 
whether you do it?

[Martin V. (m_v)]

Beitrag "Re: Motorola Vip19x0 (Big brother of Vip1710)"

[Aleš Hrubý (Gast)]

sudo ./build_vip19x3.sh ./test2.conf
Error: could not find IIP 'kreatv-option-ca-verimatrix'

I not have reatv-option-ca-verimatrix_4.3.IAP30.3_st40_vip19x3.iip :-(
you do not have someone?
in /products is not

[Martin V. (m_v)]

Beitrag "Re: Motorola Vip19x0 (Big brother of Vip1710)"

The IIP I found are all on 4shared.
The SDK & start-kit include some and also there is 
"kreatv-extra-iip-package-ericsson_mu_4.3.IAP30.3.tgz" which include MP4 
and ca-verimatrix

[Aleš Hrubý (Gast)]

Martin V. schrieb:
> kreatv-extra-iip-package-ericsson_mu_4.3.IAP30.3.tgz

Martin V. schrieb:
> Beitrag "Re: Motorola Vip19x0 (Big brother of Vip1710)"
> The IIP I found are all on 4shared.
> The SDK & start-kit include some and also there is
> "kreatv-extra-iip-package-ericsson_mu_4.3.IAP30.3.tgz" which include MP4
> and ca-verimatrix



kreatv-extra-iip-package-ericsson_mu_4.3.IAP30.3.tgz


is not 
http://www.4shared.com/file/zofNzyxY/kreatv-extra-iip-package-erics.html 
:-(

[Zed Z. (mhzbg)]

Great Thread on this platform.
I have gotten a few of these boxes to test and was able to run the image 
and all the nice portals you guys have written on a VIP1003.
The remote is not working as expected.

I am still evaluating the box to port some code I have working on other 
similar STBs, but have not access to the API nor SDK. If we decide to 
use the platform we would probably by them but for the time being I need 
to test and tweak.

Unfortunately, the links to the SDK in this thread are all expired and I 
cant find anything on google.

I would really really appreciate it if some one has an archive and can 
send a link or IM to me. Does not matter if its older version, I just 
need to play with it and evaluate and also get my own image working 
right on the boxes I have.

I will give out plenty of beers if by any chance anyone can help me get 
the SDKs.

Thanks so much ! you guys have done a traffic job and gathered very 
valuable information.

[Martin V. (m_v)]

Remote not working might be because the wrong one is selected. The 
images found here for the 19xx series use the KPN remote.

[Zed Z. (mhzbg)]

Yes, the remote I know, the one on my box is kreatvir id 37, thus why I 
want to build my own image, but need the SDK which is no longer 
available in the links.

[Johny M. (mamonick)]

Hello,
does anybody know how to make sound from webportal? I tried some way 
what I found on internet but its looklike thats not supported by 
kreatv-app-webkit-portal.

[A_A (Gast)]

Hallo liebe Freunde.
Ich habe ein Motorola VIP 1003 und mit ihm das problem!
Kann mir jemand erklären, wie das flashing und dann installieren 
bootimage,

kreatv-kit-bootloader-ossk_KREATV-FIRMWARE-3-X_st40

oder...

Ich gehe in das Menü, aber ich kann die alte Version der Software nicht 
löschen.
Vielen Dank an alle und alles Gute ...

[A-A (Gast)]

Hello dear friends.
I have a Motorola VIP 1003 and the problem with it!
Can anyone explain how the flashing and then install
boot image,

KreaTV-kit-bootloader-ossk_KREATV FIRMWARE 3-X_st40

or ...

I go to the menu, but I can not use the old version of the software
. delete
Thanks to all and good luck ...

[HvanEik (Gast)]

Martin V. schrieb:
> ed at an other forum like twe

Hi Jan,

I Know what your problem is...
you stb is still connected with a user profile...
if you want to delete the box... PM me...
i think i can help you ;)

[Roma (Gast)]

Can anyone re-upload the file
kreatv-kit-starter-kit-emea_4.3.IAP30.3_i386.tgz and maybe all the files 
that were on 4shared.com ? THey all got delted

thanks

[Blagus (Gast)]

Yes, I also noticed that SDK is gone and I can't find it anywhere...

[Roma (Gast)]

Hi all
dont ask me but i found something on my HDD and uploaded

http://www.multiupload.nl/KYX8A7RMSY

its the kreatv-kit-starter-kit-emea_4.3.iap30.3_i386.tgz (109.11 MB)

hope it will be up for long

Now someone can reupload the IPP files ?

Regards

[Blagus (Gast)]

Thank you so much for the file! I hope there will be someone to share 
the rest of the files.

[Blagus B. (blagus)]

Did anyone manage to connect to these boards via JTAG?
I have FT2232 STMC Lite clone and I can interface with Albis STBs just 
fine, but I have no luck with Motorola. I have VIP1003 and VIP1963.
Closest I can get is when I use hdk7105 STMC targetpack with 
no_clockgen_config=1 option, but whatever I do I get some error and GDB 
can't attach to the board.

[Roma (Gast)]

Hi Blagus
can you contact me via email kotitius[AT]yahoo

Regards

[Blagus B. (blagus)]

I contacted you at yahoo.com, is that OK? (Or is it maybe yahoo de?)

[Blagus B. (blagus)]

Is this thread dead? No response to JTAG question, no one sharing IPP 
files...
Too bad, this was a very good resource for making something useful out 
of ISP's locked STBs...

[Werknemer303 (Gast)]

KPN had an callback/replace action for all 19xx boxes. The're replaced 
with Arcadyan's.. Think they get onto it. Well it was fun to play with. 
Thanks a lot for all the useful information in this thread!

Hope it will get some new life soon!

[Zed Z. (mhzbg)]

Thanks so much for these file they work like a charm. Also the docs is 
what I needed most to evaluate this platform.
Was able to compile, customise and run an image for my box.
Not sure what you mean on IPP files, but the ones I need are all 
working.
Thanks so much again !

[Bruter (Gast)]

I am myself trying to make something useful out of VIP 1903. So far I am 
able to make it connect to my webserver, which was easy of course, but 
none of the images I have downloaded here wont work. All I get "Could 
not start the system software". Seems there are no ports open so I 
cannot telnet. I can see from the web server logs that the device is 
connecting.

Could there be something I do wrong on the web-server side? There is 
just that simple xml -file that directs the box to the binary file. 
Should there be something else too?

I suspect that this device is made to work for one provider only.

Any final ideas? Just trash it?

[Blagus B. (blagus)]

@Bruter: I didn't try any images on my STBs yet, but these problems you 
have is exactly why I'm trying to JTAG it, to get direct NOR r/w access 
to replace the bootloader with something that won't complain about 
signing/securing the image...

[Mac (Gast)]

@Bruter, some boxes won't load with the image from Martin. Find the 
(non) OSS package (I have it somewhere, will upload it somewhere.) Those 
keys work. Compile and off you go. If you have any info about the JTAG 
please share. I know that the USBJTAG forum holds some info.

My 1963 had a old bootloader which was replaced a week ago with a new 
one. No secret code (service code) to upload my own image anymore. If 
anyone knows it for the 1853 it 'll probably work on the 1963 with new 
bootloader.

[Blagus B. (blagus)]

@Mac: Yes, there is some info, but they just say that "NOR is supported 
on most of the devices" and I don't see any confirmation.

Also, it's USBJTAGNT software, and I have STMC Lite clone which is used 
with ST's targetpacks and software. And none of the targetpacks work 
with Motorola VIP boards, it can't be initialized, and I tried with all 
of them involving STi7105 CPU (VIP1003, VIP1963).

Regarding non-OSS package, is it the one Roma uploaded a few posts 
above? (kreatv-kit-starter-kit-emea_4.3.iap30.3_i386.tgz)

[Bruter (Gast)]

Ok, I need to dig in to that non-OSS. I am just learning at the moment 
about all of this, but eager to make something useful out of this. About 
jtagging I have read, but never tried it myself.

For years I have used DVBViewer server and streamed the channels to my 
home network. Playstation 3 and laptops are used to view and control 
recordings from the media server which sometimes is too "techy" for the 
rest of the family. Would be nice to use this "wasted" Motorola to watch 
the live channels, and maybe control recordings, use it as simple-gui 
vdr-client.

[Martin V. (m_v)]

For a simple VDR client you can use the script I wrote and maintain.

http://projects.vdr-developer.org/projects/vdr-vipclient

[Blagus B. (blagus)]

@Martin: What about media player, fb, youtube apps?
My ISP has VIP1003 with ability to play media files uploaded to their 
filesharing service, facebook, and youtube access. Is it possible to 
grab the FW and extract those apps?
I'm not 100% sure, but I think they use Beenius middleware. However, 
there are mentions of Kreatel in info menu.

[Martin V. (m_v)]

It's not only the firmware but the middleware also.

The middleware I use is the above script I wrote.

[Pedro L. (pl125)]

Here is the UART pinout.

[Joost R. (Firma: Nederland Live) (joost_r)]

Hi All,

Nice to see more people hacking on these Motorola's!
I'm working on a project right now where i use mumudvb as a multicast 
streamer (http://www.mumudvb.net). Nice project, go check it out!
Now i was wondering how i could use the Motorola (VIP1963) as a client 
for it. The only thing i need (for now) is to be able to watch the 
multicast streams generated by Mumu.

So far i've flashed Martin's fw to the 1963 (thanx for that Martin!), 
set up a webserver with the portal script and are able to telnet / ssh 
in to the box, but it looks like the ip for the portal is fixed. I guess 
i need to create my own fw to be able to change that. Can someone 
confirm that's the way to go? If so, does anyone still have the tools 
for that (all kit links above ar dead ;-(). Or can i just use the 
sourceforge kit?

Is it also correct that there's no gui on the thing itself and 
everything gui related runs from a webserver?

I hope someone here can help me out with the above questions.

Thanx & regards,
Joost

Btw: This Motorola is (/was ;-)) a Dutch KPN box, but I have a different 
ISP.

[Martin V. (m_v)]

With the infocast server you can send an other portal address.
Or you can do it by hand after you telnet to the box.

toish setobject cfg.portal.whitelisturls 
"<PortalURLs><PortalURL>http://ServerIP/</PortalURL></PortalURLs>";

But this actions are needed after every reboot.

All the box does is displaying a stream. The gui for the menu is loaded 
from a webserver.

Older versions of kreatv had some gui, try the first images on this 
thread. But the later SDK (which was up for downloaded) doesn't have it. 
If you can write C you can write the GUI yourself.

[Joost R. (Firma: Nederland Live) (joost_r)]

Martin V. schrieb:
> With the infocast server you can send an other portal address.
> Or you can do it by hand after you telnet to the box.
>
> toish setobject cfg.portal.whitelisturls
> "<PortalURLs><PortalURL>http://ServerIP/</PortalURL></PortalURLs>";
>
> But this actions are needed after every reboot.
>
> All the box does is displaying a stream. The gui for the menu is loaded
> from a webserver.
>
> Older versions of kreatv had some gui, try the first images on this
> thread. But the later SDK (which was up for downloaded) doesn't have it.
> If you can write C you can write the GUI yourself.

Merci beaucoup Martin,

That and a little hacking on the vdr portal script gave me multicast TV 
from mumudvb!

Now i'm going to figger out how I could use the SAP announces from 
mumudvb to create the channel list automagically.. any hints on that? 
(SAP etc.. is all kind of new for me).

Anyone still have the KreaTV SDK available?! I like to create my own 
image / svg portal.

Greetz,
Joost

[AndrejkaB A. (andrejkab_a)]

Hello,

I have Motorola VIP1920 IPTV box hybrid version (with DVB-T tuner).
Originally this box works with local IPTV provider and DVB-T 
functionality is disabled. Is possible to build and load some own image 
only for DVB-T functionality?

Thanks a lot!

BR
Andrej

[Martin V. (m_v)]

@Joost:

Quote from the manual
"The Channel Table

The channel table contains the numbers, names and urls of the channels 
available in the TV application.

Channel Table

The cfg.media.channeltable setting is written in text format, as a 
semicolon separated list of channels, with one channel on each row. The 
format on each row is as follows:

<channel_number>;<channel_name>;<url>;
The <channel_number> is mapped to the number keys of the remote control.

Fields may be left empty, but the correct number of semicolons must be 
present.

Channel Table example

The name of this file in the evaluation configuration is 
channeltable.txt.

The example below is a valid file:

1;Channel1;224.5.7.10:5000;
2;Test channel;224.5.7.11:10000;
3;Channel3;230.1.2.3:12345;
"



@Andrej:

If you can find the SDK and find the modules, YES.
Else if you find only the SDK also yes but you need to program a lott 
more.

Basicly it should be possible to create an image for it.

But do the testing as long as you have access to your provider, so you 
can put their image back on if needed.

Greetz Martin

[AndrejkaB A. (andrejkab_a)]

Thanks for answer!

Sorry for my stupidness, but how to determine, for example SDK named 
"kreatv-kit-oss" has DVB modules or not? He not included by default?

Thanks!
BR
Andrej

[Martin V. (m_v)]

Try one of the images listed above and check the log file.
If the log shows it found and loaded the drivers the SDK has them. If 
not you have to compile them yourself

[Blagus B. (blagus)]

To ask again, did anyone have success with JTAG-ing into the boxes with 
STMC?

[AndrejkaB A. (andrejkab_a)]

Hello,

Can someone explain for me how to load firmware via Infocast2 server? As 
I understand bootloader is searching some files with specific names and 
extensions. What is correct config file name, extension and structure?

Here is the booting log from my box:

-> Link is up
Using DHCP
IP-Config: eth0 hardware address 00:02:9b:30:75:11 mtu 1500 DHCP
IP-Config: eth0 guessed broadcast address 192.168.1.15
IP-Config: eth0 complete (from 192.168.1.1):
 address: 192.168.1.7      broadcast: 192.168.1.15     netmask: 
255.255.255.240
 gateway: 192.168.1.1      dns0     : 192.168.1.1      dns1   : 0.0.0.0

Download parameters:
  Splash boot order: 313
  Kernel boot order: 313
  Bootcast address : 224.2.2.2:22222
  Sap address      : 224.2.127.254:9875

***** Loading splash image *****

Using Local Storage
LS: No valid splash image available.

Using Bootcast
BC: Download attempt 1 of 3
Loading control file motorola-vip1920t from 224.2.2.2:22222
Connection timeout.
BC: Download attempt 2 of 3
Loading control file motorola-vip1920t from 224.2.2.2:22222
Connection timeout.
BC: Download attempt 3 of 3
Loading control file motorola-vip1920t from 224.2.2.2:22222
Connection timeout.
Child process (/usr/bin/multicast) exited with failure!
BC: Failed!

Using Local Storage
LS: No valid splash image available.

Unable to successfully display a splash image. Skipping splash!

***** Loading kernel image *****

Using Local Storage
LS: No valid kernel image available.

Using Bootcast
BC: Download attempt 1 of 3
Loading control file motorola-vip1920t from 224.2.2.2:22222
Connection timeout.
BC: Download attempt 2 of 3
Loading control file motorola-vip1920t from 224.2.2.2:22222


Thank You!
BR
Andrej

[AndrejkaB A. (andrejkab_a)]

Hi,

Loading issues now solved. Can somebody tell me, why after uploading STB 
reports - 'image verification failed"? Maybe there is incorrect product 
code, i have 1920 hybrid with DVB-T tuner.
I tried various firmware files from this thread.

BR
Andrej

[Martin V. (m_v)]

With my DVB-C 1903 I have the same. Looks like they need an other key.

[AndrejkaB A. (andrejkab_a)]

To omit key checking we need some alternative bootloader?
But way to write initial bootloader is only JTAG?

Thanks!

P.S. Sorry for my questions, but I dont have experience in embedded 
systems;)

[Martin V. (m_v)]

Every firmware is signed with a key, it looks like the non DVB versions 
still accept the default developer key.

With a new bootloader or even with the bootloader of the non DVB 
versions the others might boot.
For safety backup the original bootloader ;)

If the bootloader is extracted from the box, you might even get the 1853 
working. This box has an other bootloader which isn't accepting the 
infocast server but only a SAP server

[AndrejkaB A. (andrejkab_a)]

Thanks Martin for explanation.

Can You explain in several words for how to write bootloader for the 
box?
Where i can find alternative bootloader?
Its can be done via bootcast? As I understand bootcast is used only for 
the retrieving main image.

Thank You!

[Martin V. (m_v)]

http://sourceforge.net/arris/vip19x0/news/2013/03/kreatv-3x-bootloader-oss-source-code-available-for-download/

The provider also sends the bootloader updates by infocast as far as I 
know. But they might be switched to SAP.

[AndrejkaB A. (andrejkab_a)]

Hi,

Earlier Blagus asking about JTAG-ing to STMC.
Here are interesting link to czech forum, device is different, but 
processor is the same.

http://forum.ican3800.zajsoft.net/viewtopic.php?f=5&t=592

BR
Andrej

[Gerard (Gast)]

Hallo,

I cannot find an infocastserver for kreatel.
Where can i get it.
I have a vip 1960

Gerard Brinkman

[Martin V. (m_v)]

Made a new image, no portal address included.
It can be set with:

 toish is setobject cfg.portal.whitelisturls "
<PortalURLs>
  <PortalURL>http://192.168.3.15/portal/webkit</PortalURL>
</PortalURLs>
" permanent

[Blagus B. (blagus)]

AndrejkaB A. schrieb:
> Hi,
>
> Earlier Blagus asking about JTAG-ing to STMC.
> Here are interesting link to czech forum, device is different, but
> processor is the same.
>
> http://forum.ican3800.zajsoft.net/viewtopic.php?f=...
>
> BR
> Andrej

As I said, I already use STMC and everything is set up properly. I can 
connect to all my ST boards except this VIP1003 (and I didn't test 1963 
yet).

[Henrik Andersen (Gast)]

Hei
I have a "Motorola VIP1910-9"
Can any one give me an Step By Step list to change the firmware,
A have an Raspberry pi or an Windows pc to work from.

I want to be able to stream video from my NAS.

[Johny M. (mamonick)]

Hello Martin,
I have problem when I use ajax (jquery) to change content of div 
everything works fine except closing socket. After ajax call there is 
one socket CLOSE_WAIT and it hangs. In few days number of those unclosed 
socket reach 1023 and webkit crash with error too many open files. When 
I try portal from PC (chrome browser) sockets are automaticly closed 
after 5s. In portal I use this jquery setting 
jQuery.ajaxSetup({async:false,cache: false,timeout:5000,crossDomain: 
true});

Have you same problem or you doesnt use jquery?

stb example:
/ # netstat -an |grep CLOSE_WAIT
tcp        1      0 10.1.99.67:55115        10.1.1.4:80 
CLOSE_WAIT
tcp        1      0 10.1.99.67:37826        173.194.65.104:443 
CLOSE_WAIT
tcp        1      0 10.1.99.67:33034        173.194.116.239:80 
CLOSE_WAIT
tcp        1      0 10.1.99.67:36506        10.1.1.4:80 
CLOSE_WAIT
tcp        1      0 10.1.99.67:37824        173.194.65.104:443 
CLOSE_WAIT
tcp        1      0 10.1.99.67:55114        10.1.1.4:80 
CLOSE_WAIT
tcp        1      0 10.1.99.67:36518        10.1.1.4:80 
CLOSE_WAIT
tcp        1      0 10.1.99.67:52913        173.194.116.249:443 
CLOSE_WAIT

[Martin V. (m_v)]

Hi Johny,

I'm sorry but I don't use Jquery.

Greetz

[Roma (Gast)]

Gerard here is the infocast  server and other tools
https://www.mirrorcreator.com/files/HASHBZQG/motorola_tools_0.rar_links

[Jonny (Gast)]

Hi All.
Im new at this.
I have a VIP 1903 from Comhem Sweden. My question is, if it possible to 
activate the two USB ports on it and if its possible to get the rest of 
the codes to display the menu options like 7532, 2357,

I have read all that I can find but so far no luck.

Im trying to use it on my network and on a secondary Tv.
Also looking for a pinout on how to add a hdd. I have checked and it 
seems like the 1903 and the 1963 using the same board.

thanks in advance

Jonny // Sweden

[Martin V. (m_v)]

As far as I know that are the only codes, there are no more options to 
set.

The usb can only be activated by other software but comhem uses a 
unknown key to sign the software so the software found here can't be 
used. (I also have a comhem 1903C box)

I don't think you can convert a 1903 to a 1963. Doesn't have comhem a 
1963? Maybe you can find one cheap on an auction site.

Question for you, can you capture the boot image of the comhem box? I 
like to get mine running again.

Greetz from Holland.

[Jonny (Gast)]

Hi Martin.

Hmm Ok. I got this box replaced. Comhem started to Use Tivo.

Its odd that it seems impossible to do a factory reset and install 
firmware that Motorola use. Or is it so that just this VIP boxes is only 
used as OEM like comhem or Telia (Sweden) ? As far as I know it uses 
linux like sw. So it would be possible to just reflash it.

I can try to capture the boot image but frankly I have no clue how to do 
that.

[Martin V. (m_v)]

Capture the software can only be done if the box is in active use by 
comhem. !! If not don't erase it because once erased you can't get 
software on it. !!

The box is running linux but accept only software/ firmware which is 
signed with a key.

Motorola gave the providers, like comhem, telia, comx, kpn the option to 
use default (developer) keys or custom keys. Comhem & Comx choice to use 
their own keys. I've tried every version of software I could find but 
none are accepted by the Comhem (and Comx) box I have.

[Jonny (Gast)]

Ok I see.
Well Im connected to Comhem network and I have erased it ones but due to 
the facked that Im on Comhem network it updated and downloaded new 
software.
So if you like to send me how-to on getting the image out of it I can 
try.

I going to try to talke to Comhem about it maby I can get hold of a tech 
that can help me but im not to sure ;-)

[Jonny (Gast)]

Hi Martin.
I just talked to a really nice person on Comhem support. He couldent 
help me right away but going to take contact to the tech department for 
Comhem in Stockholm and ask them. He going to mail me with info. Hope we 
can solv this with the sw on the boxes :-)

[Martin V. (m_v)]

Some info to get the images.
Find the server address, should be listed in the IP menu -> Metadata
Default is 224.2.2.2:22222

Download the file Infocast2Tools.v1.3.zip and compile it.

Connect the pc to the iptv port of the modem. Hopefully you get an ip. 
If not you can try to clone the mac address of the motorola. (this is 
better because maybe Comhem's loadbalancer uses the mac to send you to 
the right server)

Start the client software.

./client 224.2.2.2 22222 1

This shows what the multicast server has to offer.

With ./client 224.2.2.2 22222 2
it saves the files it get -> this is what is needed. This can take a 
long time!

For more info you can also connect me directly.

[Jonny (Gast)]

Ok Ill try.
Whats the best. Try to do this in Linux or Windows.

I have Linux mint on a test computer and Windows 7 om this one I write 
to you on.

I havent used Linux for a long time befor I started this.

[Martin V. (m_v)]

Doesn't matter, the tools should compile on both platforms. But I think 
compile and fake mac address is easier on linux.

[Jonny (Gast)]

Oki then..
Comhem dont use a specific IPTV port on the modem. Using cable modem and 
its connected to one of the 4 ports on that one. Then its connected to 
the wall for standard TV. Comhem using Netgear CG3100 as cablemodem.

So I have a problem to figure this out.

Is it possible to connect Motorola direct to the computer ??

[Martin V. (m_v)]

The files we want are send from comhem not from the motorola.

Looks like they put the boxes in a Vlan, so with mac spoofing your pc 
should be in the iptv vlan and the tools should capture the files.

[Jonny (Gast)]

Hmm Getting error
Error creating the socket<>: can not assign requested address

[Martin V. (m_v)]

Did you get an IP address? And are you root (linux) or Administrator 
(windows)

[Jonny (Gast)]

No I tryed arp -a as well but cant see it in the network. I have the MAC 
and going to try to clone it. hopefully i can figure this out.

[Mac (Gast)]

sudo root
nano /etc/network/interfaces

#############

auto eth0
iface eth0 inet dhcp
       hwaddress ether 01:02:03:04:05:06

############

ctrl+o
enter
reboot

replace 01:02..etc with the mac address of the Motorola.

If no IP after that try this:
Insert into /etc/network/interfaces:
clientid motorola_vip_1903    //probably, you need Wireshark to find out

If no IP after that try this:
You probably need to tweak the dhcp client also

Again Wireshark will tell you the Vendor Specific Options.

Insert those and you probably will get an IP.

Let me know

[Johny (Gast)]

Hi I tried this tool too.
I use windows version but I have to use switch with mirrored port and 
repeatly boot STB. When I try it only with pc I have no luck. When I 
disconnect STB multicast stop. There was some live check or heartbeat 
from STB. Maybe it helps you.

[Blagus B. (blagus)]

Hi.
Regarding VIP1003 JTAG I asked about earlier - it turns out that STi7105 
has JTAG lock feature, which Motorola uses. So there's no JTAG for 
VIP1003, unfortunately. However, STi7109 doesn't seem to have such 
protection, and I have VIP1910 and VIP1963 so I'll test it on them.

[Aleš Hrubý (Gast)]

hi you have someone IIP kreatv-option-ca-verimatrix or 
kreatv-extra-iip-package-ericsson_mu_4.3.IAP30.3.tgz it is never to be 
found. Thanks

[Johny (Gast)]

Ales give me some contact to you.

[Aleš Hrubý (Gast)]

Johny my email is [e-mail]

[Aleš Hrubý (Gast)]

How can you play channel with verimatrix? I have verimatrix.iip, 
configured .ini, but when I try to play channel, nothing happens. It 
doesn't even ask on verimatrix server, like I need to force it to get 
license. Do I miss something?

[Johny (Gast)]

Hi,
I have new stb VIP 1103 and I am looking for image for it. Can anybody 
help?
thx

[Martin V. (m_v)]

The 19x3 image must work, it is the same platform/ hardware.

[Johny (Gast)]

It doesnt work. I tried every image which I have. VIP 1003 boot fine but 
VIP 1103 doesnt. It has new splash screen too with progress bar. It from 
arris but it doesnt matter because I have motorola 1003 and arris 1003 
and they use same image.

[Ivan (Gast)]

Hei
i have a "Motorola VIP1910-9" and a "Motorola VIP1903C"
How can i make thes work like a Media center?

My real Wish is to make the "Motorola VIP1903C" work as a recive and 
viewer
and let the "Motorola VIP1910-9" all the recived data like DVB-C, VCR 
and USB-HDD.

But i will start to make it work as simple Media center.

Can some one pleace help me.

[Benny M. (michael_k79)]

Hi there

Any ideas as to why my VIP 1903 (C?) keeps rebooting after installing a 
custom firmware, when I alter the HTTP settings to fetch a new firmware 
from my local server?

It's downloading the file 
"kreatv-bi-vdr.config_4.3.IAP30.3_st40_vip19x3.bin" - installs it, saves 
it .. then it reboots, and downloads it once again. Keeps doing this 
until I remove the HTTP settings and let it download the firmware from 
my TV provider.

Thanks

[Martin V. (m_v)]

I've had the same problem with my Comhem box. Looks like they use an 
other encryption key.

If you have an Comhem box, I'm interested in the provider image. My 
Comhem box is just a paperweight right now.


@Ivan if you can find the SDK with the dlna & dvb-c module you can make 
an image and connect the boxes just like you want.

Greetz Martin

[Jacob S. (jacob_s)]

Martin V. schrieb:
>
> @Ivan if you can find the SDK with the dlna & dvb-c module you can make
> an image and connect the boxes just like you want.
>

Does anyone have a link to the starter kit sdk? None of the links in 
this thread seem to work anymore :-(

Alternatively, does anyone have an unencrypted, generic image? I'd just 
like to dig around the files to get a sense of everything.

[Mac (Gast)]

The Arcadyan can be hacked by using a timing attack on the cfe memory.
I have no idea when or what I did. I just stuck a paperclip onto the 
reset pins and by resetting the device and poking on the right moment it 
dumped me into cfe. Problem is I can not get out of it. But you can load 
your own firmware with it. Oh, anf ofcourse they are violating the GPL.

Just to let you know.

[Johny (Gast)]

Hello,
I try to setup SCART on vip1003 to svideo output. I want to use 
component cable because if I connect stb to 4k TV and after turn off and 
turn on stb crash down. But i see output only in booting, after apply 
defaultVideoSetting i got NO SIGNAL only. I have EMEA version of 1003. 
Could anybody help me with that?

[claude (Gast)]

Hello
Try set kernel and slash protocols to 323.
as some later say
"A string with the splash protocol-order to use when downloading the
splash image."

1 = BootCast
2 = TFTP
3 = Local Storage (if available)
4 = SAP (Session Announcement Protocol)
5 = DVD/CD (if available)
6 = HTTP (available from version 3.03)

323 try fist local store if has image load it, if dont have is try load 
tftp. If you trying use http try use protocols 363 etc.
tftp-server/client=http://tftpd32.jounin.net/tftpd32_download.html

I looked motorola vip 1903 specs and found that has advanced boot chip 
32mb and NAND512mb so if power go off is have boot image there.
Order is bootloader(32mb)[projected]->nand(512mb)[slow]->ram(2gb)[fast]

RAM(1gbx2chips)(flash2)
NAND(512mb)(flash)

df output
Filesystem           1K-blocks      Used Available Use% Mounted on
tmpfs                   116788        20    116768   0% /old_root
none                     64940        48     64892   0% 
/old_root/dynamic
/dev/rootdisk0           16512     16512         0 100% /old_root/static
unionfs                  64940        48     64892   0% /
none                     64940        28     64912   0% /tmp
/dev/mtdblock0             512       256       256  50% /flash
/dev/mtdblock2           65536     18016     47520  27% /flash2

mount output
rootfs on / type rootfs (rw)
tmpfs on /old_root type tmpfs (rw)
none on /old_root/proc type proc (rw)
none on /old_root/dynamic type tmpfs (rw)
/dev/rootdisk0 on /old_root/static type squashfs (ro)
unionfs on / type unionfs 
(rw,noatime,dirs=/old_root/dynamic=rw:/old_root/static=ro)
none on /sys type sysfs (rw)
none on /proc type proc (rw)
none on /tmp type tmpfs (rw)
none on /dev/pts type devpts (rw)
/dev/mtdblock0 on /flash type jffs2 (rw,nodev,noexec,noatime)
/dev/mtdblock2 on /flash2 type yaffs (rw,nodev,noexec,noatime)

BusyBox v1.13.3 () multi-call binary
Copyright (C) 1998-2008 Erik Andersen, Rob Landley, Denys Vlasenko
and others. Licensed under GPLv2.
See source distribution for full notice.

Usage: busybox [function] [arguments]...
   or: function [arguments]...

        BusyBox is a multi-call binary that combines many common Unix
        utilities into a single executable.  Most people will create a
        link to busybox for each function they wish to use and BusyBox
        will act like whatever it was invoked as!

Currently defined functions:
        [, [[, ash, awk, basename, brctl, bunzip2, bzcat, cat, chgrp,
        chmod, chown, chroot, clear, cp, cut, date, dd, df, dirname, 
dmesg,
        du, echo, egrep, env, expr, false, fdisk, fgrep, find, 
freeramdisk,
        ftpget, ftpput, grep, gunzip, gzip, halt, head, hostname, id,
        ifconfig, init, insmod, ip, ipaddr, iplink, iproute, kill, 
killall,
        ln, losetup, ls, lsmod, md5sum, mdev, mkdir, mkfifo, mknod, 
mkswap,
        mktemp, modprobe, more, mount, mv, netstat, nslookup, pidof, 
ping,
        poweroff, printf, ps, pwd, reboot, renice, reset, rm, rmdir, 
rmmod,
        route, sed, sh, sleep, sort, strings, swapoff, swapon, sync, 
tail,
        tar, telnet, telnetd, test, tftp, time, top, touch, tr, 
traceroute,
        true, udhcpc, umount, uniq, uptime, usleep, vi, watchdog, wc,
        wget, which, xargs, yes, zcat, zcip



Installed with "kreatv-bi-vdr.config_4.3.IAP30.3_st40_vip19x3.bin" used 
tftp. dmesg dont work so need use logclient to ip-address.VLC client 
working fine if has address installed and http-server on advanced 
settings.

so i have questions:
1.can some complete build with ext2/3/4 ???
2.can put PortalURL to set variable easer contorl ??
 exsample "<PortalURL>http://192.168.3.15/portal/webkit</PortalURL>"; to
          "<PortalURL>http://${PORTAL_URL)/portal/webkit</PortalURL>";
 export PORTAL_URL=192.168.3.15
3.can some write ir-codes for 1903 control is hard bind all ???

cd etc
rm irmap.conf
echo "
PROTOCOL=kreatvir,ID=38 # KPN
#codes found in irmaps_def
89,2  #1
105,3  #2
121,4  #3
28,5  #4
44,6    #5
60,7   #6
76,8  #7
92,9   #8
108,10   #9
29,0  #0

#inside ring
88,105  #left
104,106  #right
72,108  #down
56,103  #up

107,129  #mute
9,116  #power

#fix this

#outside ring
40,105  #left
24,106  #right
9,108  #down
127,103  #up

75,63  #red
63,64  #green
120,65  #yellow
31,66   #blue

43,67,29  #text
39,60,56  #rec

15,63  #OK select,play,pause

91,218  #back
73,88  #menu
124,59   #info
25,210  #tv

77,11  #vol +
61,12  #vol -

#fix this

">>irmap.conf
init-irdriver irmap.conf

4.can install ohter linux version example dsl,puppy,freenas ???
5.can install router firmwares tomato,dd-wrt ???

[claude (Gast)]

VLC-client enable as webportal:
View->Add interface->web
Now digibox need connect to PC-program VLC-client(webportal)
Is as http://localhost:8080/

more info as https://wiki.videolan.org/Control_VLC_via_a_browser/

[claude (Gast)]

To help with ir-codes need load ir-map and read codes with
read-irdriver then control works with webprotal.

PROTOCOL=kreatvir,ID=38 # KPN version with 1903 use
#codes found in irmaps_def

[claude (Gast)]

To change hard way url is open:
vi /usr/applications/ekioh.conf
and change frist line:
application.homepage: http://192.168.3.15/ to
application.homepage: http://ip-address:8080/
And save file as ctrl+":" and :wq
kill ekioh pid with find ps and automatic digibox make new ekioh new
settings working and VLC-client open with mobile-control have fun lolz.

[claude (Gast)]

claude schrieb:
> To change hard way url is open:
> vi /usr/applications/ekioh.cfg
> and change frist line:
> application.homepage: http://192.168.3.15/ to
> application.homepage: http://ip-address:8080/
> And save file as ctrl+":" and :wq
> kill ekioh pid with find ps and automatic digibox make new ekioh new
> settings working and VLC-client open with mobile-control have fun lolz.

[claude (Gast)]

To change hard way url is open:
vi /usr/applications/ekioh.cfg
and change frist line:
application.homepage: http://192.168.3.15/portal/webkit to
application.homepage: http://ip-address:8080/
And save file as ctrl+":" and :wq
kill ekioh pid with find ps and automatic digibox make new ekioh new
settings working and VLC-client open with mobile-control have fun lolz.

[claude (Gast)]

claude schrieb:
> claude schrieb:
>> To change hard way url is open:
>> vi /usr/applications/ekioh.cfg
>> and change frist line:
>> application.homepage: http://192.168.3.15/portal/webkit to
>> application.homepage: http://ip-address:8080/
>> And save file as ctrl+":" and :wq
>> kill ekioh pid with find ps and automatic digibox make new ekioh new
>> settings working and VLC-client open with mobile-control have fun lolz.

[claude (Gast)]

white screen means with log:
webkit_portal.sh(521) Note: OPENING URL == http://192.168.3.15/
portal/webkit
So if digibox not find portal page so be white screen so put VLC client 
or
http-server up and put it to /usr/applications/ekioh.cfg and last kill 
ekioh pid

[Martin V. (m_v)]

Done some working on a KPN VIP19x3, KPN pushed a newer bootloader which 
won't work with my software. They also stripped Http & Bootcast. The 
settings menu has gone and the box has the same bootloader as a 1853.

System memory: 512 MB
Using Slot 2
Unpacking Image ...Done
Linux version 2.6.23.17_stm23_0121 (mcart@mcart) (gcc version 4.2.4 (snapshot) (STMicroelectronics Special 20090602) [build Oct 28 2009]) #1 PREEMPT Tue Jun 25 16:16:46 CEST 2013
Booting machvec: vip19x3
Reserve 10240 KiB for STAVMEM (0 KiB for graphics) @ 0x4f600000 - 0x4fffffff
Motorola VIP19x3 board initialisation
STx7105 version 3.x
Kernel command line: console=ttyAS0,115200 mtdparts=Onboard_Flash:0x00080000@0x00380000(FFS),0x00380000@0x0(Raw) bootdevice=nor bootfiles=raw systemmemsize=524288 rbl=2 rbl_mode=1 rbl_version=2.12 dbl=2 
Kernel has NOT DVR version 5 support size is 4096
Kernel has NOT DVB support
bpa2: partition 'bigphysarea' created at 0x4ab00000, size 16384 kB (0x01000000 B)
intc: missing unique irq mask for irq 18 (vect 0x0440)
intc: missing unique irq mask for irq 19 (vect 0x0460)
Using tmu for system timer
Using 25.000 MHz high precision timer.
console [ttyAS0] enabled
Dentry cache hash table entries: 65536 (order: 6, 262144 bytes)
Inode-cache hash table entries: 32768 (order: 5, 131072 bytes)
Memory: 490624k/524288k available (1245k kernel code, 446k data, 80k init)
SH4 450.00 BogoMIPS PRESET (lpj=225000)
NET: Registered protocol family 16
Generic PHY: Registered new driver
DMA: Registering DMA API.
Time: SuperH clocksource has been installed.
NET: Registered protocol family 2
IP route cache hash table entries: 16384 (order: 4, 65536 bytes)
TCP established hash table entries: 65536 (order: 7, 524288 bytes)
TCP bind hash table entries: 65536 (order: 6, 262144 bytes)
TCP: Hash tables configured (established 65536 bind 65536)
TCP reno registered
Unpacking initramfs...
Overmounted tmpfs
INITRAMFS: Compressed (LZMA) image found
 done
Freeing initrd memory: 579k freed
JFFS2 version 2.2. © 2001-2006 Red Hat, Inc.
io scheduler noop registered
io scheduler anticipatory registered (default)
Kboxdev: registered device with major 120
STMicroelectronics ASC driver initialized
stasc.0: ttyAS0 at MMIO 0xfd031000 (irq = 122) is a stasc
stasc.1: ttyAS1 at MMIO 0xfd032000 (irq = 121) is a stasc
Marvell 88E3015: Registered new driver
  GMAC - user ID: 0x10, Synopsys ID: 0x33
No valid MAC address yet; it will be set from the console later.
  eth0 - (dev. name: stmmaceth - id: 0, IRQ #134
  IO base addr: 0xfd110000)
STMMAC MII Bus: probed
eth0: PHY ID 01410e20 at 0 IRQ 246 (0:00) active
VIP19xx onboard flash device
Onboard_Flash: Found 1 x16 devices at 0x0 in 16-bit bank
Using word write for ST M28WXX0 FLASH
cfi_cmdset_0001: Erase suspend on write enabled
2 cmdlinepart partitions found on MTD device Onboard_Flash
Creating 2 MTD partitions on "Onboard_Flash":
0x00380000-0x00400000 : "FFS"
0x00000000-0x00380000 : "Raw"
i2c /dev entries driver
i2c_st40_pio: ST40 PIO based I2C Driver
i2c_st40_pio: allocated pin (2,2) for scl (0x801ccb50)
i2c_st40_pio: allocated pin (2,3) for sda (0x801ccb6c)
i2c_st40_pio: allocated pin (3,6) for scl (0x801cccd4)
i2c_st40_pio: allocated pin (3,7) for sda (0x801cccf0)
Software Watchdog Timer: 0.07 initialized. soft_noboot=0 soft_margin=60 sec (nowayout= 1)
DMA: Registering fdma_dmac.0 handler (16 channels).
platform fdma_dmac.0: SLIM hw 0.0, FDMA fw 6.1
DMA: Registering fdma_dmac.1 handler (16 channels).
platform fdma_dmac.1: SLIM hw 0.0, FDMA fw 6.1
stm_rng hardware driver 1.0 configured
TCP cubic registered
NET: Registered protocol family 17
Freeing unused kernel memorINIT STARTED
00:00:01 01.01.2000 src/main.c  116 DBG     > CHILD: New child process with PID: 227
SERVER STARTED
00:00:01 01.01.2000 os/ipc/shm.c  184 DBG     > _shmOpen: Waiting for SHM file /shmSegment1
00:00:01 01.01.2000 src/main.c  130 DBG     > PARENT: parent PID: 1, child PID: 227
00:00:01 01.01.2000 src/main.c  116 DBG     > CHILD: New child process with PID: 228
00:00:01 01.01.2000 src/main.c  925 DBG     > ------------
00:00:01 01.01.2000 src/main.c  926 DBG     > --- Init ---
00:00:01 01.01.2000 src/main.c  927 DBG     > ------------
00:00:01 01.01.2000 src/main.c  929 DBG     > ---- DBL 2.0.stmcore-display: using HDMI hotplug
stmcore-display: STi7105 display: probed
device probe found 2 display pipelines
2 ----
00:00:01 01.01.2000 src/requesting frm: 'component.fw', c1507af4/8aab9dc8
main.c  130 DBG     > PARENT: parent PID: 1, child PID: 228
00:00:01 01frm 'component.fw' successfully loaded
.01.2000 src/main.c  149 DBG     > _waitForChildProcessExit(): Waiting for child process with PID: 228
stmfb: fb0 parameters = "720x576-32@50:8m:0:PAL:YUV:RGB"
00:00:01 01.01.2000 os/ipc/shm.c  184 DBG     > _shmOpen: Waiting for SHM file /shmSegment1
stmfb: fb1 parameters = "720x576-32@50i:4m:0:PAL:CVBS"
00:00:01 01.01.2000 os/ipc/shm.c  184 DBG     > _shmOpen: Waiting for SHM file /shmSegment1
NAND device: Manufacturer ID: 0x20, Chip ID: 0x76 (ST Micro NAND 64MiB 3,3V 8-bit)
Creating 1 MTD partitions on "stm-nand-flex.1":
0x00000000-0x04000000 : "NAND home"
frontpanel: controller is mounted
frontpanel: LED character display board with 10 button/9 LED support
frontpanel: display version: 2
00:00:01 01.01.20input: Front Buttons as /class/input/input0
00 os/ipc/shm.c  184 DBG     > _shmOpen: Waiting for SHM file /shmSegment1
00:00:01 01.01.2000 19xx/board.c  142 WARNING > _getBasicFlashLayout(): Flash partition layout for device: stm-nand-flex.1 not found
00:00:01 01.01.2000 os/ipc/shm.c  184 DBG     > _shmOpen: Waiting for SHM file /shmSegment1
00:00:01 01.01.2000 os/ipc/shm.c  184 DBG     > _shmOpen: Waiting for SHM file /shmSegment1
00:00:01 01.01.2000 os/ipc/shm.c  184 DBG     > _shmOpen: Waiting for SHM file /shmSegment1
00:00:02 01.01.2000 os/ipc/shm.c  184 DBG     > _shmOpen: Waiting for SHM file /shmSegment1
00:00:02 01.01.2000 os/ipc/shm.c  184 DBG     > _shmOpen: Waiting for SHM file /shmSegment1
00:00:02 01.01.2000 os/ipc/shm.c  184 DBG     > _shmOpen: Waiting for SHM file /shmSegment1
00:00:02 01.01.2000 os/ipc/shm.c  184 DBG     > _shmOpen: Waiting for SHM file /shmSegment1
00:00:02 01.01.2000 os/ipc/shm.c  184 DBG     > _shmOpen: Waiting for SHM file /shmSegment1
00:00:02 01.01.2000 os/ipc/shm.c  184 DBG     > _shmOpen: Waiting for SHM file /shmSegment1
00:00:02 01.01.2000 os/ipc/shm.c  184 DBG     > _shmOpen: Waiting for SHM file /shmSegment1
00:00:02 01.01.2000 os/ipc/shm.c   55 DBG     > _shmCreate(): Unable to open shared memory, try to create new segment! (No such file or directory)
00:00:02 01.01.2000 os/ipc/shm.c  100 DBG     > _shmCreate(): Shared memory segment created with address: 0x29e1c000, size: 71303168B, fd: 5
00:00:02 01.01.2000 os/ipc/shm.c  211 DBG     > os_ipc_shm_initialize(): base segment data: address: 0x29e1c000, size: 71303168
00:00:02 01.01.2000 src/main.c  956 DBG     > main(): seed for random number generator 2607547071
00:00:02 01.01.2000 os/ipc/shm.c  179 DBG     > _shmOpen: SHM file created by master process
00:00:02 01.01.2000 os/ipc/shm.c  100 DBG     > _shmCreate(): Shared memory segment created with address: 0x2961c000, size: 71303168B, fd: 3
00:00:02 01.01.2000 os/ipc/shm.c  211 DBG     > os_ipc_shm_initialize(): base segment data: address: 0x2961c000, size: 71303168
00:00:02 01.01.2000 src/dhcp.c  110 DBG     > server_dhcp_initialize(): CALL
00:00:02 01.01.2000 src/ipc.c   77 ERROR   > _msqSysVOpen(): Unable to open message queue with key: 0x00000101 (No such file or directory)
00:00:02 01.01.2000 src/ipc.c  269 ERROR   > ipc_open(): Unable to open message queue, maybe not exist, try to create it for key: 0x101
00:00:02 01.01.2000 src/ipc.c   77 ERROR   > _msqSysVOpen(): Unable to open message queue with key: 0x00000100 (No such file or directory)
00:00:02 01.01.2000 src/ipc.c  269 ERROR   > ipc_open(): Unable to open message queue, maybe not exist, try to create it for key: 0x100
00:00:02 01.01.2000 /utils/ini.c   86 ERROR   > osd_utils_ini_parse: No such file or directory
00:00:02 01.01.2000 src/osd.c  334 ERROR   > _loadCustomTranslation(): Error parsing i18n file (1st pass)
00:00:02 01.01.2000 src/osd.c  767 ERROR   > osd_open(): _loadCustomTranslation() => 2097157 - assuming default translation
00:00:02 01.01.2000 /utils/ini.c   86 ERROR   > osd_utils_ini_parse: No such file or directory
00:00:02 01.01.2000 /utils/pam.c  387 ERROR   > osd_utils_pam_get: empty file name
00:00:02 01.01.2000 /utils/pam.c  387 ERROR   > osd_utils_pam_get: empty file name
00:00:02 01.01.2000 /utils/pam.c  387 ERROR   > osd_utils_pam_get: empty file name
00:00:03 01.01.2000 /utils/pam.c  387 ERROR   > osd_utils_pam_get: empty file name
00:00:03 01.01.2000 pplication.c 1542 DBG     > app_initialize()
00:00:03 01.01.2000 src/boot.c 1509 DBG     > boot_initialize: CALL
00:00:03 01.01.2000 src/dhcp.c   16 DBG     > dhcp_initialize(): PROXY CALL
00:00:03 01.01.2000 src/softup.c  660 DBG     > softup_initialize: CALL
00:00:03 01.01.2000 src/mmddf.c  528 DBG     > mmddf_initialize()
00:00:03 01.01.2000 src/mmddf.c   88 DBG     > _notifyTask(): START
00:00:03 01.01.2000 pplication.c   65 ERROR   > app_loadErrorMappings(): unable to open mapping file (No such file or directory)
00:00:03 01.01.2000 src/main.c 1006 DBG     > main(): Error mappings loading failed. Falling back to default.
00:00:03 01.01.2000 pplication.c  266 DBG     > _displayProgress(1, 1)
PHY: 0:00 - Link is Up100/Full00:00:06 01.01.2000 src/main.c 1043 DBG     > main(): sleeping 2100 ms before network attachment
00:00:08 01.01.2000 src/dhcp.c   34 DBG     > dhcp_setup(): PROXY CALL
00:00:08 01.01.2000 src/main.c  232 DBG     > SERVER: Received command IPC_COMMAND_TYPE_DHCP
00:00:08 01.01.2000 src/dhcp.c  139 DBG     > server_dhcp_handleCommand(): CALL
00:00:08 01.01.2000 src/dhcp.c  845 DBG     > dhcp_setup: CALL
00:00:08 01.01.2000 src/dhcp.c  899 DBG     > CALL for interface: eth0
00:00:08 01.01.2000 src/dhcp.c  184 DBG     > entering 2 listen mode
00:00:08 01.01.2000 src/dhcp.c  158 DBG     > _getNetworkInterfaceLinkState(): Link state: 1
debug, Sending discover...
00:00:08 01.01.2000 src/dhcp.c 1113 DBG     > dhcp_setup(): Current timeout (INIT_SELECTING): 3753
00:00:08 01.01.2000 src/dhcp.c  158 DBG     > _getNetworkInterfaceLinkState(): Link state: 1
00:00:08 01.01.2000 src/dhcp.c  158 DBG     > _getNetworkInterfaceLinkState(): Link state: 1
00:00:08 01.01.2000 src/dhcp.c  158 DBG     > _getNetworkInterfaceLinkState(): Link state: 1
debug, Sending select for 192.168.3.202...
00:00:08 01.01.2000 src/dhcp.c 1159 DBG     > dhcp_setup(): Current timeout (RENEW_REQUESTED, REQUESTING): 4400
00:00:08 01.01.2000 src/dhcp.c  158 DBG     > _getNetworkInterfaceLinkState(): Link state: 1
00:00:08 01.01.2000 src/dhcp.c 1329 DBG     > dhcp_setup(): Lease of 192.168.3.202 obtained, lease time 86400
00:00:08 01.01.2000 src/dhcp.c  444 DBG     > _fillDhcpParameters()
00:00:08 01.01.2000 src/dhcp.c  384 DBG     > _fillDownloadProtocol()
00:00:08 01.01.2000 src/dhcp.c  384 DBG     > _fillDownloadProtocol()
00:00:08 01.01.2000 src/dhcp.c  230 DBG     > _displayDhcpOptions()
00:00:08 01.01.2000 src/dhcp.c  232 DBG     > Ip Address                : 192.168.3.202
00:00:08 01.01.2000 src/dhcp.c  233 DBG     > TFTP Server Address       : 192.168.3.210
00:00:08 01.01.2000 src/dhcp.c  234 DBG     > Subnet mask               : 255.255.255.0
00:00:08 01.01.2000 src/dhcp.c  235 DBG     > Broadcast address         : 0.0.0.0
00:00:08 01.01.2000 src/dhcp.c  236 DBG     > Filename                  : 
00:00:08 01.01.2000 src/dhcp.c  237 DBG     > Boot Filename             : 
00:00:08 01.01.2000 src/dhcp.c  238 DBG     > DHCP Server Address       : 192.168.3.15
00:00:08 01.01.2000 src/dhcp.c  239 DBG     > Default gateway           : 192.168.3.1
00:00:08 01.01.2000 src/dhcp.c  240 DBG     > Routers                   :
00:00:08 01.01.2000 src/dhcp.c  245 DBG     > 192.168.3.1
00:00:08 01.01.2000 src/dhcp.c  248 DBG     > DNS servers               :
00:00:08 01.01.2000 src/dhcp.c  253 DBG     > 8.8.8.8
00:00:08 01.01.2000 src/dhcp.c  256 DBG     > Root Path                 : 192.168.3.210:/tftpboot
00:00:08 01.01.2000 src/dhcp.c  257 DBG     > TFTP Kernel filename      : kreatel-kernel
00:00:08 01.01.2000 src/dhcp.c  262 DBG     > TFTP server pool          : 192.160.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0
00:00:08 01.01.2000 src/dhcp.c  263 DBG     > TFTP pool atempts         : 8
00:00:08 01.01.2000 src/dhcp.c  264 DBG     > TFTP node atempts         : 2
00:00:08 01.01.2000 src/dhcp.c  265 DBG     > TFTP block size           : 1428
00:00:08 01.01.2000 src/dhcp.c  266 DBG     > TFTP read request timeout : 10
00:00:08 01.01.2000 src/dhcp.c  267 DBG     > TFTP splash filename      : spl
00:00:08 01.01.2000 src/dhcp.c  268 DBG     > TFTP timeout              : 10
00:00:08 01.01.2000 src/dhcp.c  269 DBG     > SAP address               : 224.2.127.254:9875
00:00:08 01.01.2000 src/dhcp.c  270 DBG     > SAP attemps               : 1
00:00:08 01.01.2000 src/dhcp.c  271 DBG     > SAP timeout               : 1
00:00:08 01.01.2000 src/dhcp.c  272 DBG     > Bootcast address          : 
00:00:08 01.01.2000 src/dhcp.c  273 DBG     > Bootcast attemps          : 0
00:00:08 01.01.2000 src/dhcp.c  274 DBG     > Bootcast timeout          : 0
00:00:08 01.01.2000 src/dhcp.c  275 DBG     > Swap server               : 0.0.0.0
00:00:08 01.01.2000 src/dhcp.c  276 DBG     > Kernel Protocol Order: 
00:00:08 01.01.2000 src/dhcp.c  280 DBG     > 2 
00:00:08 01.01.2000 src/dhcp.c  284 DBG     > Splash Protocol Order: 
00:00:08 01.01.2000 src/dhcp.c  288 DBG     > 2 
00:00:08 01.01.2000 src/dhcp.c  184 DBG     > entering 0 listen mode
00:00:08 01.01.2000 src/dhcp.c  785 DBG     > dhcp_clean()
00:00:08 01.01.2000 src/dhcp.c  162 DBG     > dhcp_setup(): RET
00:00:08 01.01.2000 src/main.c 1064 DBG     > Obtained network configuration from DHCP!
00:00:08 01.01.2000 src/main.c 1212 DBG     > Added DNS: 8.8.8.8
00:00:08 01.01.2000 src/main.c 1242 DBG     > Current IGMP version: 0
00:00:08 01.01.2000 src/main.c 1251 DBG     > IGMP version forced to 2
00:00:08 01.01.2000 pplication.c  266 DBG     > _displayProgress(1, 0)
00:00:08 01.01.2000 src/main.c 1323 DBG     > Trying to get SAP location from file /mnt/ffs/SAPaddress
00:00:08 01.01.2000 rc/sysinfo.c  391 ERROR   > sysinfo_getSapSetup: Unable to open file /mnt/ffs/SAPaddress
00:00:08 01.01.2000 src/main.c 1329 ERROR   > sysinfo_getSapSetup() => 513
00:00:08 01.01.2000 src/main.c 1394 DBG     > Trying to get SAP address from option 40
00:00:08 01.01.2000 src/utils.c  965 DBG     > _parseSapAddress(): prefix is different than 'SAP'
00:00:08 01.01.2000 src/main.c 1434 DBG     > Assuming default sap.stb.itvonline.nl as SAP domain name
Id: 2
Response: 1
Opcode: 0
Authoritative: 0
Truncation: 0
Recursion desired: 1
Recursion available: 1
Response code: 0
Questions: 1
Answers: 1
NS resource records: 0
Additional res. records: 0
00:00:08 01.01.2000 pplication.c  266 DBG     > _displayProgress(2, 2)
00:00:08 01.01.2000 src/main.c 1521 DBG     > Target DBL version is not set - skipping DBL update
00:00:08 01.01.2000 src/main.c 1712 DBG     > Boot from local storage is not requested - skipping system update
00:00:08 01.01.2000 pplication.c  266 DBG     > _displayProgress(3, 1)
00:00:08 01.01.2000 src/main.c 2016 DBG     > TFTP: using option 21 as boot filename
00:00:08 01.01.2000 src/boot.c 1542 DBG     > boot_boot: CALL
00:00:08 01.01.2000 src/boot.c  668 DBG     > _tftpBoot(): CALL
00:00:08 01.01.2000 src/boot.c  700 DBG     > _tftpBoot: Server pool attempt 0 of 8
00:00:08 01.01.2000 src/main.c  499 DBG     > _dblCallback(): DBL_CALLBACK_EVENT_BOOT_ATTEMPT_START
00:00:08 01.01.2000 src/boot.c  706 DBG     > _tftpBoot(): Trying to get file from 1 addres from pool
00:00:08 01.01.2000 src/boot.c  601 DBG     > _tftpGetFile()
00:00:32 01.01.2000 src/main.c  573 DBG     > _dblCallback(): BOOT_TFTP_DOWNLOAD_END
00:00:32 01.01.2000 src/main.c  503 DBG     > _dblCallback(): DBL_CALLBACK_EVENT_BOOT_ATTEMPT_PASS
00:00:32 01.01.2000 src/main.c  573 DBG     > _dblCallback(): BOOT_TFTP_DOWNLOAD_END
00:00:32 01.01.2000 src/main.c  521 DBG     > _dblCallback(): BOOT_READ_HEADER
00:00:32 01.01.2000 src/utils.c  192 ERROR   > utils_getSystemImageHeader: Wrong magic number 1434553
00:00:32 01.01.2000 src/boot.c  796 ERROR   > utils_getSystemImageHeader() => 65537
00:00:33 01.01.2000 src/boot.c 1556 ERROR   > _tftpBoot() => 65537
00:00:33 01.01.2000 src/main.c 2076 ERROR   > TFTP: boot_boot() => 65537
00:00:33 01.01.2000 pplication.c  324 DBG     > app_getErrorNumberByError()
00:00:33 01.01.2000 pplication.c  266 DBG     > _displayProgress(3, 3)
00:00:33 01.01.2000 pplication.c  324 DBG     > app_getErrorNumberByError()
00:00:38 01.01.2000 src/main.c 1974 DBG     > End of list describing boot protocol order reached
00:00:38 01.01.2000 pplication.c  324 DBG     > app_getErrorNumberByError()
00:00:38 01.01.2000 pplication.c  324 DBG     > app_getErrorNumberByError()
00:01:38 01.01.2000 src/boot.c 1527 DBG     > boot_reboot: CALL
Restarting system.
Watchdog reset!

when sending "option KreaTV.kernel-protocol" with dhcpd you can't send :
1 = BootCast
5 = DVD/CD
6 = HTTP (available from version 3.03)

You'll get an error

00:00:09 01.01.2000 src/main.c 2249 ERROR   > Boot protocol type 'bootcast' is not supported

00:00:09 01.01.2000 src/main.c 2258 ERROR   > Unknown boot protocol type 6

Now wait for my Jtag to get here.

Greetz Martin

[claude (Gast)]

Hi Martin V try lower bootloader if support it.

firmware:http://www.mikrocontroller.net/attachment/164081/kreatv-bi-vdr.config_4.3.IAP30.3_st40_vip19x3.bin
TFTP-server:http://tftpd32.jounin.net/tftpd32_download.html

Download firmware and TFTP and put firmware inside TFTP folder and run 
TFTP-server.
Go settings in TFTP-server and setup:

[x]TFTP Server
[ ]TFTP Client
[ ]SNTP server
[ ]Syslog Server
[x]DHCP Server
[ ]DNS Server

And go digibox 19x3 when is go up press menu and press factor code:

2357(Ip settings)
7532(advanced menu)Go here

kernel protocol:323
slash  protocol:323
set TFTP-server your PC-address.

Digibox settings follow settings DHCP->TFTP->GET 
file->"kreatv-bi-vdr.config_4.3.IAP30.3_st40_vip19x3.bin"

My setup pc(rj-45)->router<-digibox(rj-45)
My internet connection is Router->modem-router(NDIS)->internet
My TFTP-server log Viewer:

Rcvd DHCP Discover Msg for IP 0.0.0.0, Mac 00:02:9B:8B:0F:92 [06/04 
21:49:22.137]
Client requested address 0.0.0.0 [06/04 21:49:22.140]
DHCP: proposed address 192.168.2.45 [06/04 21:49:22.140]
6832 Request 2 not processed [06/04 21:49:22.142]
Rcvd DHCP Rqst Msg for IP 0.0.0.0, Mac 00:02:9B:8B:0F:92 [06/04 
21:49:22.142]
Previously allocated address 192.168.2.45 acked [06/04 21:49:22.143]
6832 Request 2 not processed [06/04 21:49:22.144]
Connection received from 192.168.2.45 on port 49696 [06/04 21:49:22.600]
Read request for file 
<kreatv-bi-vdr.config_4.3.IAP30.3_st40_vip19x3.bin>. Mode octet [06/04 
21:49:22.601]
OACK: <blksize=512,tsize=18082314,timeout=5,> [06/04 21:49:22.601]
Using local port 64819 [06/04 21:49:22.601]
<kreatv-bi-vdr.config_4.3.IAP30.3_st40_vip19x3.bin>: sent 35318 blks, 
18082314 bytes in 15 s. 0 blk resent [06/04 21:49:37.692]


Logclient.exe:http://www.mikrocontroller.net/attachment/175928/http_example.rar 
inside has logclient run it, dmesg dont work so you need run logclient.

putty:http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html 
can run digibox 19x3  and give commands for it.

Digibox ipaddress easyly get in TFTP-server logviewer because settings 
is to set connect frist pc.
when you get digibox white screen then digibox running 
kreatv-bi-vdr-version but is need webportal install to pc.

Now next reboot digibox load 
kreatv-bi-vdr.config_4.3.IAP30.3_st40_vip19x3.bin inside 
flash[NAND512mb].

[claude (Gast)]

Webportal change need give command inside digibox 19x3:
vi /usr/applications/ekioh.cfg

frist line:
application.homepage: http://192.168.3.15/portal/webkit

to
application.homepage: http://pc-address:8080/

:w   saves the current file without quitting
http://www.cs.rit.edu/~cslab/vi.html vi-commands

ps and find [ekioh pid-number]
kill [ekioh pid-number]

Automatic digibox make new ekioh and new settings working. New webportal 
is geted form pc-address, if there has http-portal-server running or 
vlc-client with add interface->web.

[Martin V. (m_v)]

Guess who wrote most of the stuff in this topic ;)
Problem is KPN changed the bootloader and removed a lott of stuff. Menu 
isn't there anymore and it looks like the key is changed so the firmware 
isn't accepted from the tftp server.

Greetz Martin

[claude (Gast)]

TFTP-server inside settings has boot file need set as:
Tftppd Settings:

boot file:kreatv-bi-vdr.config_4.3.IAP30.3_st40_vip19x3.bin
Now press ok then DHCP-server give that boot file that digibox load it.

Tryed load multiple Firmwars this way but no success, because bootloader 
has security key so boot file need has secured boot file.

TFPT-server:http://www.ethernut.de/en/eboot/ settings
Build own 
Firmware:http://sourceforge.net/projects/vip19x0.arris/files/ST40/KreaTV%204.4/kreatv-kit-oss_4.4-st40.tgz 
350mb[source codes]
Need linux operation system build firmware.

Readme:

"This distribution covers the VIP19x0, VIP19x3 and VIP1003 series
set-top boxes, hereby referred to as VIP1900. To get the corresponding
description for VIP1903 or VIP1003, just replace the text "1900" with
"1903" in all places below.

VIP1900 STB's are only available in secure versions. Secure
versions will only boot signed software images. The resulting
kernel/boot images signed with the keys supplied with this
distribution (located in dist/config/keys) will boot on a development
kit secure VIP1900."

[claude (Gast)]

Ok Martin

But check your boot file frist error with:
"utils_getSystemImageHeader: Wrong magic number 1434553" that means no 
secured boot file cant boot.

Normaly digibox go protocols what kernel has but your settings has 
Kernel Protocol Order: 2 and Splash Protocol Order: 2

1 = BootCast
2 = TFTP
3 = Local Storage (if available)

But what is TFTP:"192.168.3.210" ip-address your pc ?
And "End of list describing boot protocol order reached" so no more 
protocols to follow try use secured boot file in tftp-server what you 
have there settings installed.

TFTP:192.168.3.210 if that is not your pc you can change your pc-address 
to same as what digibox setting has.

Then install TFTP-server and settings right and try reboot digibox.
Remove software inside digibox, before download firmware your digibox.

kreatv-kit-oss_4.4-st40\bootimage\tools\build_flash_secure_boot_image 
350lines with encryption with file so can secure boot file that digibox 
bootloader check security keys.

Simply build_flash_secure_boot_image has header check each boot file 
that is right magic number exsample my file:

kreatv-bi-vdr.config_4.3.IAP30.3_st40_vip19x3.bin frist line
53 45 43 01 80 00 02 13 E3 AB 84 FD 3A 8B EA 91

Try use diffrent versions bootfiles right getting digibox booted when 
white screen is coming.

[Johny (Gast)]

Hi Martin,
still looking for dlna? I found image 
kreatv-bi-eval_4.3.IAP30.3_st40_vip19x3.bin and there isnt set telnet 
password. If you boot it up you can copy out extracted iip. Log to stb 
via telnet use:
cd /
tar czf dlna.tar.gz /
ftpput -u <username> -p <password> <server address> dlna.tar.gz 
dlna.tar.gz

extract archive to sdk directory/extra/dlna

now open file with your image in bi directory 
kreatv-rootdisk-XXXXXXXXXXX_4.3.IAP30.3_st40_vip19x3.tgz and copy file 
from /etc/processlist.xml to directory extra/dlna/

edit this file and add line below before </SysmanConfig>:
<Program name="dlnamediacontroller" run="/usr/bin/start_dlna.sh" 
starttime="30"/>

now add this to your image config:
kreatv-tool-include-file:/usr/bin/start_dlna.sh=../extra/dlna/usr/bin/st 
art_dlna.sh,/usr/bin/dlnamediacontroller=../extra/dlna/usr/bin/dlnamedia 
controller,/usr/browser/plugins/libtoi-dlnaplugin.so=../extra/dlna/usr/b 
rowser/plugins/libtoi-dlnaplugin.so,/usr/lib/libdlnacommon.so=../extra/d 
lna/usr/lib/libdlnacommon.so,/usr/lib/libdlnacommon-1.2.so.1=../extra/dl 
na/usr/lib/libdlnacommon-1.2.so.1,/usr/lib/libdlnacommon-1.2.so.1.0.2=.. 
/extra/dlna/usr/lib/libdlnacommon-1.2.so.1.0.2,/usr/lib/libdlna.so=../ex 
tra/dlna/usr/lib/libdlna.so,/usr/lib/libdlna-1.2.so.1=../extra/dlna/usr/ 
lib/libdlna-1.2.so.1,/usr/lib/libdlna-1.2.so.1.0.2=../extra/dlna/usr/lib 
/libdlna-1.2.so.1.0.2,/usr/lib/libplatform-1.2.so.1=../extra/dlna/usr/li 
b/libplatform-1.2.so.1,/usr/lib/libplatform.so=../extra/dlna/usr/lib/lib 
platform.so,/usr/lib/libplatform-1.2.so.1.0.2=../extra/dlna/usr/lib/libp 
latform-1.2.so.1.0.2,/usr/lib/streamer/libdlnasourceelement.so=../extra/ 
dlna/usr/lib/streamer/libdlnasourceelement.so,/etc/processlist.xml=../ex 
tra/dlna/processlist.xml

now build image and use dlna plugin

logclient example:
833 13:20:33.760 webkit_portal.sh(550) Note: Registering plugin for 
application/motorola-teletext-plugin
835 13:20:33.848 webkit_portal.sh(550) Note: Registering plugin for 
application/x-motorola-toi-dlna
837 13:20:34.228 webkit_portal.sh(550) Note: Registering plugin for 
application/x-motorola-toi

add <embed type="application/x-motorola-toi-dlna" hidden="true" /> to 
your index and start using it :)

[Martin V. (m_v)]

Thnx.

I'll make an IIP out of it when I've got the time.

[Martin V. (m_v)]

DLNA files extracted from image

[Martin V. (m_v)]

Anyone any luck with 19x3 and a jtag?
Can't connect :(

[Mac (Gast)]

Dump from working Arcadyan_HMB2260 with possible key in debug
Same (middleware) software. It's based on Broadcom Nexus.
Ow, it runs a upnp server on some port beyond 40000
If you want the menu (html with javascript, plain, not encrypted), let 
me know. It seems more hackable.

-----------cut
00:04:15 01.01.1970 src/utils.c  118 DBG     > Image header:
00:04:15 01.01.1970 src/utils.c  119 DBG     > Magic number:               0x3143414b
00:04:15 01.01.1970 src/utils.c  120 DBG     > Header version:             0x3
00:04:15 01.01.1970 src/utils.c  121 DBG     > Header size:                0x229 (553)
00:04:15 01.01.1970 src/utils.c  122 DBG     > Force disabling splash:     0x0
00:04:15 01.01.1970 src/utils.c  123 DBG     > Encryption type:            0x1
00:04:15 01.01.1970 src/utils.c  124 DBG     > Encryption key size:        0x100 (256)


00:04:15 01.01.1970 src/utils.c  125 DBG     > Encryption key:             }N??  x[©=‹LE•k!¨ìºï6%ûP  “òM*s=&$êý„A
Ï¥àá„–}{œ°£j¾b.À‡†G`6B½˜9%ªKò]¦Ì·,x{¤kNe~VþÓНêàÕ@a±
©


########## Break by Mac
// Whoops? Is this a hex to asci screwed up version of the key? Or is 
the encrypted key in plain ascii form? Any thoughts?
########## End Break

00:04:15 01.01.1970 src/utils.c  126 DBG     > Kernel size:                0x20f3b0
00:04:15 01.01.1970 src/utils.c  127 DBG     > Kernel compression type:    0x2
00:04:15 01.01.1970 src/utils.c  128 DBG     > Kernel load address:        0x1000
00:04:15 01.01.1970 src/utils.c  129 DBG     > Kernel entry point address: 0x449cf0
00:04:15 01.01.1970 src/utils.c  130 DBG     > Kernel signature length:    0x100 (256)
00:04:15 01.01.1970 src/utils.c  131 DBG     > Kernel signature:           9|5H]7ëc™AÌù#p¼=|çjc?c¿XÅç§|ò  Шëä ÓP)ÖsýÀlOåù‰.‘¡à¢Bu™1‰¯·}!âƒí><Ï{O\
؍ïAm—¤Qšùîø«KeËjŒ4š—ÔsûP[¾Ú\Ú-ïApwpqbN  &²˜ç»n¸hú¯„J6ª}ý|ûæŠì¯ÿ7÷M
nV×C³zÍò±a\  ñ/Î
ûbèµ! $†Þ¼¾6Bº,{HÝôxæ÷™?/ô㇠«öÜL{Så‘êlE°)+°#–¤—c”°ËÎÙë<‘XÞ¾p‹ýÄÇS{

########## Break by Mac
// Is this a hex to asci screwed up version of the signature? Or is the 
encrypted signature in plain ascii form? Any thoughts?
########## End break by Mac

00:04:15 01.01.1970 src/utils.c  132 DBG     > Rootfs offset:              0xe00000
00:04:15 01.01.1970 src/utils.c  133 DBG     > Rootfs size:                0x3ae0010
00:04:15 01.01.1970 src/utils.c  134 DBG     > Rootfs filesystem type:     0x6
00:04:15 01.01.1970 src/utils.c  872 DBG     > utils_verifyKernel()
PuTTYPuTTY00:04:16 01.01.1970 src/main.c  UBIFS: un-mount UBI device 0, volume 0
423 DBG     > _dblCallback(): DBUBI: mtd4 is detached from ubi0
L_CALLBACK_EVENT_SYSTEM_DOWNLOAD_ATTEMPT_PASS
00:04:16 01.01.19NAND device: Manufacturer ID: 0xec, Chip ID: 0xdc (Samsung NAND 512MiB 3,3V 8-bit)
70 /utils/sdp.c brcmnand brcmnand.0: 512MiB total, 128KiB blocks, 2KiB pages, 16B OOB, 8-bit, Hamming ECC
 105 DBG     > _Bad block table found at page 262080, version 0x01
sdp_descriptionRBad block table found at page 262016, version 0x01
ecycle()
00:04:8 cmdlinepart partitions found on MTD device brcmnand.0
16 01.01.1970 srCreating 8 MTD partitions on "brcmnand.0":
c/softup.c  966 0x000000000000-0x000000100000 : "rbl"
DBG     > softup0x000000100000-0x000000200000 : "config"
_system_flash: C0x000000200000-0x000000a00000 : "dbl-primary"
ALL
00:04:16 010x000000a00000-0x000001200000 : "dbl-secondary"
.01.1970 src/mai0x000001200000-0x000001600000 : "ffs"
n.c  471 DBG    0x000001600000-0x00001f5c0000 : "system"
 > _dblCallback(0x000001600000-0x000002400000 : "kernel"
): SYSTEM_FLASH_0x000002400000-0x00001f5c0000 : "rootfs"
START
00:04:16 brcmstb_nand: NAND controller driver is loaded
01.01.1970 src/utils.c  197 DBG UBI: attaching mtd4 to ubi0
    > utils_getSUBI: physical eraseblock size:   131072 bytes (128 KiB)
ystemImageHeaderUBI: logical eraseblock size:    126976 bytes
: version = 3
0UBI: smallest flash I/O unit:    2048
0:04:16 01.01.19UBI: VID header offset:          2048 (aligned 2048)
70 src/utils.c  UBI: data offset:                4096
214 DBG     > utils_getSystemImageHeader: have version >= 3 - reading force disabling splash
00:04:16 01.01.1970 src/utils.c  118 DBG     > Image header:
00:04:16 01.01.1970 src/utils.c  119 DBG     > Magic number:               0x3143414UBI: max. sequence number:       709
b
00:04:16 01.01.1970 src/utils.c  120 DBG     > Header version:             0x3
00:04:16 01.01.1970 src/utilsUBI: attached mtd4 to ubi0
.c  121 DBG     UBI: MTD device name:            "ffs"
> Header size:  UBI: MTD device size:            4 MiB
              0xUBI: number of good PEBs:        32
229 (553)
00:04UBI: number of bad PEBs:         0
:16 01.01.1970 sUBI: number of corrupted PEBs:   0
rc/utils.c  122 UBI: max. allowed volumes:       128
DBG     > Force UBI: wear-leveling threshold:    4096
disabling splashUBI: number of internal volumes: 1
:     0x0
00:04UBI: number of user volumes:     1
:16 01.01.1970 sUBI: available PEBs:             0
rc/utils.c  123 UBI: total number of reserved PEBs: 32
DBG     > EncrypUBI: number of PEBs reserved for bad PEB handling: 2
tion type:      UBI: max/mean erase counter: 35/22
      0x1
00:04UBI: image sequence number:  0
:16 01.01.1970 sUBI: background thread "ubi_bgt0d" started, PID 387
rc/utils.c  124 DBG     > Encryption key size:        0x100 (256)
00:04:16 01.01.1970 src/utils.c  125 DBG     > Encryption key:             }N??  x[©=‹LE•k!¨ìºï6%ûP  “òM*s=&$êý„A
Ï¥àá„–}{œ°£j¾b.À‡†G`6B½˜9%ªKò]¦Ì·,x{¤kNe~VþÓНêàÕ@a±
©  
00:04:16 01.01.1970 src/utils.c  126 DBG     > Kernel size:                0x20f3b0
00:04:16 01.01.1970 src/utils.c  127 DBG     > Kernel compression type:    0x2
00:04:16 01.01.1970 src/utils.c  128 DBG     > Kernel load address:        0x1000
00:04:16 01.01.1970 src/utils.c  129 DBG     > Kernel entry point address: 0x449cf0
00:04:16 01.01.1970 src/utils.c  130 DBG     > Kernel signature length:    0x100 (256)
00:04:16 01.01.1970 src/utils.c  131 DBG     > Kernel signature:           9|5H]7ëc™AÌù#p¼=|çjc?c¿XÅç§|ò  Шëä ÓP)ÖsýÀlOåù‰.‘¡à¢Bu™1‰¯·}!âƒí><Ï{O\
؍ïAm—¤Qšùîø«KeËjŒ4š—ÔsûP[¾Ú\Ú-ïApwpqbN  &²˜ç»n¸hú¯„J6ª}ý|ûæŠì¯ÿ7÷M
nV×C³zÍò±a\  ñ/Î
ûbèµ! $†Þ¼¾6Bº,{HÝôxæ÷™?/ô㇠«öÜL{Så‘êlE°)+°#–¤—c”°ËÎÙë<‘XÞ¾p‹ýÄÇS{
00:04:16 01.01.1970 src/utils.c  132 DBG     > Rootfs offset:              0xe00000
00:04:16 01.01.1970 src/utils.c  133 DBG     > Rootfs size:                0x3ae0010
00:04:16 01.01.1970 src/utils.c  134 DBG     > Rootfs filesystem type:     0x6
00:04:16 01.01.1970 src/softup.c  986 DBG     > softup_system_flash(): header have information about rootfs
00:04:16 01.01.1970 src/softup.c 1003 DBG     > softup_system_flash(): All steps count: 4

#######################

Dropbear...public key 

Starting openntpd
Creating Dropbear SSH server RSA host key.

Public key portion is:
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC5T19/eJCp31Ro+pRSooDSr+hfKtbCLQ2S2E+29Ay21JLD5YGdvDrmB1NOiA4OwcRsAICEIjgRTnDyXPAHUhsH74Bv6jPn+D5tf2csaUSEcfKfcdJ3pG+wc3JU2LB9X6rvNLi89on+uYC16r5REwUmltOoE4XU7pym1YGf1j93D3DttVKe0B7mHKWBlitufmRGeLarKc/20nx8/wVFUcSMplQgIh9pzZzGVe2fCJaQccCYrjDyEnLsdWkPSGMsHiJ2Eic3FFdYJC7WP02Pl8EyAHXFG6zn8BiIo7DQ5txJGB790id4jwgKdaf9cjvOMT1at3gJ8KVDsETCslntzAM9 root@stb
Fingerprint: md5 bf:34:4c:5c:02:2f:bf:32:ba:1c:87:2f:f9:6a:ce:77
Starting Dropbear SSH server: dropbear.

I will dump the serial output from a working VIP 1963 tomorrow.

[Martin V. (m_v)]

Arcadyan is a total other platform, don't think it uses kreatv. The 
Arris is more the same because it uses the kreatv firmware even when it 
is an other hardware platform. Be carefull putting an old 1963 on an 
active KPN line, it might get the new firmware.

[Mac (Gast)]

Hi Martin,

they(KPN/XS4ALL) stopped using kreatv last year..it's all Broadcom Nexus 
middleware from now. Thats why they changed bootloaders.
(nexus../magnum/portinginterface) Do a Google on that)
Every firmware has the same debug. Take a look at this. Factory resetted 
vip 1963 from boot 'till download and start. No prob. This one still 
active.
Don't mind the obfuscated dhcp output. It's an configuration behind a 
router. (long succesfull story) All else is original.

[code]

[  352.407070] <vqec-event>Received SIGKILL - terminating input loop
[  353.463277] Restarting system.


System memory: 512 MB

Using Slot 2

Unpacking Image ...Done

Linux version 2.6.23.17_stm23_0121 (mcart@mcart) (gcc version 4.2.4 
(snapshot) (STMicroelectronics Special 20090602) [build Oct 28 2009]) #1 
PREEMPT Tue Jun 25 16:16:46 CEST 2013
Booting machvec: vip19x3
Reserve 10240 KiB for STAVMEM (0 KiB for graphics) @ 0x4f600000 - 
0x4fffffff
Motorola VIP19x3 board initialisation
STx7105 version 3.x
Kernel command line: console=ttyAS0,115200 
mtdparts=Onboard_Flash:0x00080000@0x00380000(FFS),0x00380000@0x0(Raw) 
bootdevice=nor bootfiles=raw systemmemsize=524288 rbl=2 rbl_mode=1 
rbl_version=2.12 dbl=2
Kernel has NOT DVR version 5 support size is 4096
Kernel has NOT DVB support
bpa2: partition 'bigphysarea' created at 0x4ab00000, size 16384 kB 
(0x01000000 B)
intc: missing unique irq mask for irq 18 (vect 0x0440)
intc: missing unique irq mask for irq 19 (vect 0x0460)
Using tmu for system timer
Using 25.000 MHz high precision timer.
console [ttyAS0] enabled
Dentry cache hash table entries: 65536 (order: 6, 262144 bytes)
Inode-cache hash table entries: 32768 (order: 5, 131072 bytes)
Memory: 490624k/524288k available (1245k kernel code, 446k data, 80k 
init)
SH4 450.00 BogoMIPS PRESET (lpj=225000)
NET: Registered protocol family 16
Generic PHY: Registered new driver
DMA: Registering DMA API.
Time: SuperH clocksource has been installed.
NET: Registered protocol family 2
IP route cache hash table entries: 16384 (order: 4, 65536 bytes)
TCP established hash table entries: 65536 (order: 7, 524288 bytes)
TCP bind hash table entries: 65536 (order: 6, 262144 bytes)
TCP: Hash tables configured (established 65536 bind 65536)
TCP reno registered
Unpacking initramfs...
Overmounted tmpfs
INITRAMFS: Compressed (LZMA) image found
 done
Freeing initrd memory: 579k freed
JFFS2 version 2.2. © 2001-2006 Red Hat, Inc.
io scheduler noop registered
io scheduler anticipatory registered (default)
Kboxdev: registered device with major 120
STMicroelectronics ASC driver initialized
stasc.0: ttyAS0 at MMIO 0xfd031000 (irq = 122) is a stasc
stasc.1: ttyAS1 at MMIO 0xfd032000 (irq = 121) is a stasc
Marvell 88E3015: Registered new driver
  GMAC - user ID: 0x10, Synopsys ID: 0x33
No valid MAC address yet; it will be set from the console later.
  eth0 - (dev. name: stmmaceth - id: 0, IRQ #134
  IO base addr: 0xfd110000)
STMMAC MII Bus: probed
eth0: PHY ID 01410e20 at 0 IRQ 246 (0:00) active
VIP19xx onboard flash device
Onboard_Flash: Found 1 x16 devices at 0x0 in 16-bit bank
Using word write for ST M28WXX0 FLASH
cfi_cmdset_0001: Erase suspend on write enabled
2 cmdlinepart partitions found on MTD device Onboard_Flash
Creating 2 MTD partitions on "Onboard_Flash":
0x00380000-0x00400000 : "FFS"
0x00000000-0x00380000 : "Raw"
i2c /dev entries driver
i2c_st40_pio: ST40 PIO based I2C Driver
i2c_st40_pio: allocated pin (2,2) for scl (0x801ccb50)
i2c_st40_pio: allocated pin (2,3) for sda (0x801ccb6c)
i2c_st40_pio: allocated pin (3,6) for scl (0x801cccd4)
i2c_st40_pio: allocated pin (3,7) for sda (0x801cccf0)
Software Watchdog Timer: 0.07 initialized. soft_noboot=0 soft_margin=60 
sec (nowayout= 1)
DMA: Registering fdma_dmac.0 handler (16 channels).
platform fdma_dmac.0: SLIM hw 0.0, FDMA fw 6.1
DMA: Registering fdma_dmac.1 handler (16 channels).
platform fdma_dmac.1: SLIM hw 0.0, FDMA fw 6.1
stm_rng hardware driver 1.0 configured
TCP cubic registered
NET: Registered protocol family 17
Freeing unused kernel memorINIT STARTED
00:00:01 01.01.2000 src/main.c  116 DBG     > CHILD: New child process 
with PID: 227
SERVER STARTED
00:00:01 01.01.2000 os/ipc/shm.c  184 DBG     > _shmOpen: Waiting for 
SHM file /shmSegment1
00:00:01 01.01.2000 src/main.c  130 DBG     > PARENT: parent PID: 1, 
child PID: 227
00:00:01 01.01.2000 src/main.c  116 DBG     > CHILD: New child process 
with PID: 228
00:00:01 01.01.2000 src/main.c  925 DBG     > ------------
00:00:01 01.01.2000 src/main.c  926 DBG     > --- Init ---
00:00:01 01.01.2000 src/main.c  927 DBG     > ------------
00:00:01 01.01.2000 src/main.c  929 DBG     > ---- DBL 
2.0.2stmcore-display: using HDMI hotplug
stmcore-display: STi7105 display: probed
device probe found 2 display pipelines
 ----
00:00:01 01.01.2000 src/mrequesting frm: 'component.fw', 
c1507af4/8aab9dc8
ain.c  130 DBG     > PARENT: parent PID: 1, child PID: 228
00:00:01 01.frm 'component.fw' successfully loaded
01.2000 src/main.c  149 DBG     > _waitForChildProcessExit(): Waiting 
for child process with PID: 228
stmfb: fb0 parameters = "720x576-32@50:8m:0:PAL:YUV:RGB"
00:00:01 01.01.2000 os/ipc/shm.c  184 DBG     > _shmOpen: Waiting for 
SHM file /shmSegment1
[DBG: 486]: hdmi_enable_link(): m->mode:             6d
[DBG: 487]: hdmi_enable_link(): m->ActiveAreaHeight: 576
[DBG: 488]: hdmi_enable_link(): m->ActiveAreaWidth:  720
[DBG: 489]: hdmi_enable_link(): m->ActiveAreaXStart: 132
[DBG: 490]: hdmi_enable_link(): m->FrameRate:        50000
[DBG: 491]: hdmi_enable_link(): m->FullVBIHeight:    44
[DBG: 492]: hdmi_enable_link(): m->OutputStandards:  -2147483136
[DBG: 494]: hdmi_enable_link(): m->ScanType:         1d
[DBG: 495]: hdmi_enable_link(): m->0denominator:     15
[DBG: 496]: fb: fb1 parameters = "720x576-32@50i:4m:0:PAL:CVBS"
stmhdmi_enable_link(): m->0numerator:       16
[DBG: 497]: hdmi_enable_link(): m->1denominator:     45
[DBG: 498]: hdmi_enable_link(): m->1numerator:       64
[DBG: 500]: hdmi_enable_link(): m->HDMIVideoCodes:   17
[DBG: 501]: hdmi_enable_link(): m->HDMIVideoCodes:   18
00:00:01 01.01.2000 os/ipc/shm.c  184 DBG     > _shmOpen: Waiting for 
SHM file /shmSegment1
NAND device: Manufacturer ID: 0x20, Chip ID: 0x76 (ST Micro NAND 64MiB 
3,3V 8-bit)
Creating 1 MTD partitions on "stm-nand-flex.1":
0x00000000-0x04000000 : "NAND home"
frontpanel: controller is mounted
00:00:01 01.01.2000 os/ipc/shm.c  184 DBGfrontpanel: LED character 
display board with 10 button/9 LED support
     > _shmOpen: Waiting for SHM file /shmSegment1
frontpanel: display version: 1
input: Front Buttons as /class/input/input0
00:00:01 01.01.2000 19xx/board.c  142 WARNING > _getBasicFlashLayout(): 
Flash partition layout for device: stm-nand-flex.1 not found
00:00:01 01.01.2000 os/ipc/shm.c  184 DBG     > _shmOpen: Waiting for 
SHM file /shmSegment1
00:00:01 01.01.2000 os/ipc/shm.c  184 DBG     > _shmOpen: Waiting for 
SHM file /shmSegment1
00:00:01 01.01.2000 os/ipc/shm.c  184 DBG     > _shmOpen: Waiting for 
SHM file /shmSegment1
00:00:02 01.01.2000 os/ipc/shm.c  184 DBG     > _shmOpen: Waiting for 
SHM file /shmSegment1
00:00:02 01.01.2000 os/ipc/shm.c  184 DBG     > _shmOpen: Waiting for 
SHM file /shmSegment1
00:00:02 01.01.2000 os/ipc/shm.c  184 DBG     > _shmOpen: Waiting for 
SHM file /shmSegment1
00:00:02 01.01.2000 os/ipc/shm.c  184 DBG     > _shmOpen: Waiting for 
SHM file /shmSegment1
00:00:02 01.01.2000 os/ipc/shm.c  184 DBG     > _shmOpen: Waiting for 
SHM file /shmSegment1
00:00:02 01.01.2000 os/ipc/shm.c  184 DBG     > _shmOpen: Waiting for 
SHM file /shmSegment1
00:00:02 01.01.2000 os/ipc/shm.c  184 DBG     > _shmOpen: Waiting for 
SHM file /shmSegment1
00:00:02 01.01.2000 os/ipc/shm.c   55 DBG     > _shmCreate(): Unable to 
open shared memory, try to create new segment! (No such file or 
directory)
00:00:02 01.01.2000 os/ipc/shm.c  100 DBG     > _shmCreate(): Shared 
memory segment created with address: 0x29e1c000, size: 71303168B, fd: 5
00:00:02 01.01.2000 os/ipc/shm.c  211 DBG     > os_ipc_shm_initialize(): 
base segment data: address: 0x29e1c000, size: 71303168
00:00:02 01.01.2000 os/ipc/shm.c  179 DBG     > _shmOpen: SHM file 
created by master process
00:00:02 01.01.2000 os/ipc/shm.c  100 DBG     > _shmCreate(): Shared 
memory segment created with address: 0x2961c000, size: 71303168B, fd: 3
00:00:02 01.01.2000 os/ipc/shm.c  211 DBG     > os_ipc_shm_initialize(): 
base segment data: address: 0x2961c000, size: 71303168
00:00:02 01.01.2000 src/dhcp.c  110 DBG     > server_dhcp_initialize(): 
CALL
00:00:02 01.01.2000 src/ipc.c   77 ERROR   > _msqSysVOpen(): Unable to 
open message queue with key: 0x00000101 (No such file or directory)
00:00:02 01.01.2000 src/ipc.c  269 ERROR   > ipc_open(): Unable to open 
message queue, maybe not exist, try to create it for key: 0x101
00:00:02 01.01.2000 src/ipc.c   77 ERROR   > _msqSysVOpen(): Unable to 
open message queue with key: 0x00000100 (No such file or directory)
00:00:02 01.01.2000 src/ipc.c  269 ERROR   > ipc_open(): Unable to open 
message queue, maybe not exist, try to create it for key: 0x100
00:00:02 01.01.2000 src/main.c  956 DBG     > main(): seed for random 
number generator 2607323087
00:00:02 01.01.2000 /utils/ini.c   86 ERROR   > osd_utils_ini_parse: No 
such file or directory
00:00:02 01.01.2000 src/osd.c  334 ERROR   > _loadCustomTranslation(): 
Error parsing i18n file (1st pass)
00:00:02 01.01.2000 src/osd.c  767 ERROR   > osd_open(): 
_loadCustomTranslation() => 2097157 - assuming default translation
00:00:02 01.01.2000 /utils/ini.c   86 ERROR   > osd_utils_ini_parse: No 
such file or directory
00:00:02 01.01.2000 /utils/pam.c  387 ERROR   > osd_utils_pam_get: empty 
file name
00:00:02 01.01.2000 /utils/pam.c  387 ERROR   > osd_utils_pam_get: empty 
file name
00:00:02 01.01.2000 /utils/pam.c  387 ERROR   > osd_utils_pam_get: empty 
file name
00:00:03 01.01.2000 /utils/pam.c  387 ERROR   > osd_utils_pam_get: empty 
file name
00:00:03 01.01.2000 pplication.c 1542 DBG     > app_initialize()
00:00:03 01.01.2000 src/boot.c 1509 DBG     > boot_initialize: CALL
00:00:03 01.01.2000 src/dhcp.c   16 DBG     > dhcp_initialize(): PROXY 
CALL
00:00:03 01.01.2000 src/softup.c  660 DBG     > softup_initialize: CALL
00:00:03 01.01.2000 src/mmddf.c  528 DBG     > mmddf_initialize()
00:00:03 01.01.2000 src/mmddf.c   88 DBG     > _notifyTask(): START
00:00:03 01.01.2000 pplication.c   65 ERROR   > app_loadErrorMappings(): 
unable to open mapping file (No such file or directory)
00:00:03 01.01.2000 src/main.c 1006 DBG     > main(): Error mappings 
loading failed. Falling back to default.
00:00:03 01.01.2000 pplication.c  266 DBG     > _displayProgress(1, 1)
PHY: 0:00 - Link is Up100/Full00:00:06 01.01.2000 src/main.c 1043 DBG 
> main(): sleeping 1300 ms before network attachment
00:00:07 01.01.2000 src/dhcp.c   34 DBG     > dhcp_setup(): PROXY CALL
00:00:07 01.01.2000 src/main.c  232 DBG     > SERVER: Received command 
IPC_COMMAND_TYPE_DHCP
00:00:07 01.01.2000 src/dhcp.c  139 DBG     > 
server_dhcp_handleCommand(): CALL
00:00:07 01.01.2000 src/dhcp.c  845 DBG     > dhcp_setup: CALL
00:00:07 01.01.2000 src/dhcp.c  899 DBG     > CALL for interface: eth0
00:00:07 01.01.2000 src/dhcp.c  184 DBG     > entering 2 listen mode
00:00:07 01.01.2000 src/dhcp.c  158 DBG     > 
_getNetworkInterfaceLinkState(): Link state: 1
debug, Sending discover...
00:00:07 01.01.2000 src/dhcp.c 1113 DBG     > dhcp_setup(): Current 
timeout (INIT_SELECTING): 3256
00:00:07 01.01.2000 src/dhcp.c  158 DBG     > 
_getNetworkInterfaceLinkState(): Link state: 1
00:00:07 01.01.2000 src/dhcp.c  158 DBG     > 
_getNetworkInterfaceLinkState(): Link state: 1
debug, Sending select for (obfuscated)...
00:00:07 01.01.2000 src/dhcp.c 1159 DBG     > dhcp_setup(): Current 
timeout (RENEW_REQUESTED, REQUESTING): 4569
00:00:07 01.01.2000 src/dhcp.c  158 DBG     > 
_getNetworkInterfaceLinkState(): Link state: 1
00:00:07 01.01.2000 src/dhcp.c 1329 DBG     > dhcp_setup(): Lease of 
(obfuscated) obtained, lease time 86400
00:00:07 01.01.2000 src/dhcp.c  444 DBG     > _fillDhcpParameters()
00:00:07 01.01.2000 src/dhcp.c  610 DBG     > _get_vendor_option(): 
get_option() returned no data
00:00:07 01.01.2000 src/dhcp.c  230 DBG     > _displayDhcpOptions()
00:00:07 01.01.2000 src/dhcp.c  232 DBG     > Ip Address 
: (obfuscated)
00:00:07 01.01.2000 src/dhcp.c  233 DBG     > TFTP Server Address 
: (obfuscated)
00:00:07 01.01.2000 src/dhcp.c  234 DBG     > Subnet mask 
: 255.255.255.0
00:00:07 01.01.2000 src/dhcp.c  235 DBG     > Broadcast address 
: (obfuscated)
00:00:07 01.01.2000 src/dhcp.c  236 DBG     > Filename 
: ÿ
00:00:07 01.01.2000 src/dhcp.c  237 DBG     > Boot Filename 
: (not working)
00:00:07 01.01.2000 src/dhcp.c  238 DBG     > DHCP Server Address 
: (obfuscated))
00:00:07 01.01.2000 src/dhcp.c  239 DBG     > Default gateway 
: (obfuscated)
00:00:07 01.01.2000 src/dhcp.c  240 DBG     > Routers 
:
00:00:07 01.01.2000 src/dhcp.c  245 DBG     > (obfuscated)
00:00:07 01.01.2000 src/dhcp.c  248 DBG     > DNS servers 
:
00:00:07 01.01.2000 src/dhcp.c  253 DBG     > (obfuscated)
00:00:07 01.01.2000 src/dhcp.c  256 DBG     > Root Path 
:
00:00:07 01.01.2000 src/dhcp.c  257 DBG     > TFTP Kernel filename 
:
00:00:07 01.01.2000 src/dhcp.c  262 DBG     > TFTP server pool 
: 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0
00:00:07 01.01.2000 src/dhcp.c  263 DBG     > TFTP pool atempts 
: 0
00:00:07 01.01.2000 src/dhcp.c  264 DBG     > TFTP node atempts 
: 0
00:00:07 01.01.2000 src/dhcp.c  265 DBG     > TFTP block size 
: 0
00:00:07 01.01.2000 src/dhcp.c  266 DBG     > TFTP read request timeout 
: 0
00:00:07 01.01.2000 src/dhcp.c  267 DBG     > TFTP splash filename 
:
00:00:07 01.01.2000 src/dhcp.c  268 DBG     > TFTP timeout 
: 0
00:00:07 01.01.2000 src/dhcp.c  269 DBG     > SAP address 
:
00:00:07 01.01.2000 src/dhcp.c  270 DBG     > SAP attemps 
: 0
00:00:07 01.01.2000 src/dhcp.c  271 DBG     > SAP timeout 
: 0
00:00:07 01.01.2000 src/dhcp.c  272 DBG     > Bootcast address 
:
00:00:07 01.01.2000 src/dhcp.c  273 DBG     > Bootcast attemps 
: 0
00:00:07 01.01.2000 src/dhcp.c  274 DBG     > Bootcast timeout 
: 0
00:00:07 01.01.2000 src/dhcp.c  275 DBG     > Swap server 
: 0.0.0.0
00:00:07 01.01.2000 src/dhcp.c  276 DBG     > Kernel Protocol Order:
00:00:07 01.01.2000 src/dhcp.c  284 DBG     > Splash Protocol Order:
00:00:07 01.01.2000 src/dhcp.c  184 DBG     > entering 0 listen mode
00:00:07 01.01.2000 src/dhcp.c  785 DBG     > dhcp_clean()
00:00:07 01.01.2000 src/dhcp.c  162 DBG     > dhcp_setup(): RET
00:00:07 01.01.2000 src/main.c 1064 DBG     > Obtained network 
configuration from DHCP!
00:00:07 01.01.2000 src/main.c 1104 DBG     > main: No kernel protocol 
order is supplied, assuming defaults
00:00:07 01.01.2000 src/main.c 1212 DBG     > Added DNS: (obfuscated)
00:00:07 01.01.2000 src/main.c 1242 DBG     > Current IGMP version: 0
00:00:07 01.01.2000 src/main.c 1251 DBG     > IGMP version forced to 2
00:00:07 01.01.2000 pplication.c  266 DBG     > _displayProgress(1, 0)
00:00:07 01.01.2000 src/main.c 1323 DBG     > Trying to get SAP location 
from file /mnt/ffs/SAPaddress
00:00:07 01.01.2000 rc/sysinfo.c  391 ERROR   > sysinfo_getSapSetup: 
Unable to open file /mnt/ffs/SAPaddress
00:00:07 01.01.2000 src/main.c 1329 ERROR   > sysinfo_getSapSetup() => 
513
00:00:07 01.01.2000 src/main.c 1366 DBG     > Trying to get SAP location 
from DHCP option 67
00:00:07 01.01.2000 src/utils.c  965 DBG     > _parseSapAddress(): 
prefix is different than 'SAP'
00:00:07 01.01.2000 src/main.c 1372 ERROR   > Unable to get SAP location 
from kreatv-bi vdr.config_4.3.IAP30.3_st40_vip19x3.bin
00:00:07 01.01.2000 src/main.c 1377 DBG     > Trying to get SAP location 
from DHCP filename header option
00:00:07 01.01.2000 src/utils.c  950 DBG     > _parseSapAddress(): 
address shorter that 15 characters no space for 'SAP/x/0.0.0.0:0'
00:00:07 01.01.2000 src/main.c 1383 ERROR   > Unable to get SAP location 
from ÿ
00:00:07 01.01.2000 src/main.c 1424 DBG     > SAP location hasn't been 
specified - fallback to hardcoded
00:00:07 01.01.2000 src/utils.c  965 DBG     > _parseSapAddress(): 
prefix is different than 'SAP'
00:00:07 01.01.2000 src/main.c 1434 DBG     > Assuming default 
sap.stb.itvonline.nl as SAP domain name
Id: 2
Response: 1
Opcode: 0
Authoritative: 0
Truncation: 0
Recursion desired: 1
Recursion available: 1
Response code: 0
Questions: 1
Answers: 1
NS resource records: 2
Additional res. records: 2
00:00:07 01.01.2000 rc/sysinfo.c  157 ERROR   > _readFile(): file open 
error
00:00:07 01.01.2000 rc/sysinfo.c  198 ERROR   > _readFile() => 513
00:00:07 01.01.2000 src/main.c 1493 DBG     > Unable to get data from 
configuration file: assuming that system update is necessary
00:00:07 01.01.2000 pplication.c  266 DBG     > _displayProgress(2, 2)
00:00:07 01.01.2000 src/main.c 1521 DBG     > Target DBL version is not 
set - skipping DBL update
00:00:07 01.01.2000 src/main.c 1753 DBG     > Attempting to install 
default system version: vip1963
00:00:07 01.01.2000 pplication.c  266 DBG     > _displayProgress(2, 1)
00:00:07 01.01.2000 src/softup.c  848 DBG     > softup_system_download: 
CALL system version: vip1963
00:00:07 01.01.2000 src/softup.c  333 DBG     > softup_mmddf_download: 
CALL
00:00:07 01.01.2000 src/main.c  419 DBG     > _dblCallback(): 
DBL_CALLBACK_EVENT_SYSTEM_DOWNLOAD_ATTEMPT_START
00:00:07 01.01.2000 src/mmddf.c  583 DBG     > mmddf_mmf_open: CALL
00:00:07 01.01.2000 src/mmddf.c  611 DBG     > mmddf_mmf_open: socket 
descriptor: 8, address: 0x060203e0
00:00:07 01.01.2000 src/mmddf.c  628 DBG     > mmddf_mmf_open: added IP 
membership to SAP
00:00:07 01.01.2000 src/mmddf.c  815 DBG     > 
mmddf_mmf_getSessionDescription()
00:00:07 01.01.2000 /utils/sdp.c   39 DBG     > sdp_descriptionInit()
00:00:08 01.01.2000 src/mmddf.c  911 DBG     > 
mmddf_mmf_getSessionDescription(): received bytes: 395

00:00:08 01.01.2000 src/mmddf.c  930 DBG     > 
mmddf_mmf_getSessionDescription(): first packet received - set timeout 
to SAP timeout
00:00:08 01.01.2000 src/mmddf.c  956 DBG     >

---cut

00:04:44 01.01.2000 src/main.c  493 DBG     > _dblCallback(): 
SYSTEM_FLASH_END
00:04:44 01.01.2000 src/softup.c 1227 DBG     > softup_system_free(): 
CALL
00:04:45 01.01.2000 pplication.c  266 DBG     > _displayProgress(3, 1)
00:04:45 01.01.2000 src/boot.c 1542 DBG     > boot_boot: CALL
00:04:45 01.01.2000 src/boot.c 1009 DBG     > _nandBoot(): CALL
NAND device: Manufacturer ID: 0x20, Chip ID: 0x76 (ST Micro NAND 64MiB 
3,3V 8-bit)
Creating 1 MTD partitions on "stm-nand-flex.1":
0x00000000-0x04000000 : "flash"
00:04:45 01.01.2000 src/boot.c 1034 DBG     > _nandBoot(): Read image 
header from: /dev/mtd2
00:04:45 01.01.2000 src/main.c  521 DBG     > _dblCallback(): 
BOOT_READ_HEADER
00:04:45 01.01.2000 src/utils.c  197 DBG     > 
utils_getSystemImageHeader: version = 3
00:04:45 01.01.2000 src/utils.c  214 DBG     > 
utils_getSystemImageHeader: have version >= 3 - reading force disabling 
splash
00:04:45 01.01.2000 src/utils.c  118 DBG     > Image header:
00:04:45 01.01.2000 src/utils.c  119 DBG     > Magic number: 
0x3143414b
00:04:45 01.01.2000 src/utils.c  120 DBG     > Header version: 
0x3
00:04:45 01.01.2000 src/utils.c  121 DBG     > Header size: 
0x229 (553)
00:04:45 01.01.2000 src/utils.c  122 DBG     > Force disabling splash: 
0x0
00:04:45 01.01.2000 src/utils.c  123 DBG     > Encryption type: 
0x1
00:04:45 01.01.2000 src/utils.c  124 DBG     > Encryption key size: 
0x100 (256)
00:04:45 01.01.2000 src/utils.c  125 DBG     > Encryption key: 
°›s¼qS4ÒZà“¦:pÍŽêp€¿ÎÅRyoYG:1 
pR nÚ}Ù´vÕ$8ƒ1Š&íŸUÞÀǨ!ýºæÃc-½O;´§ö’½IQæ;ǾÓ9óyçu<:í^¢/YˆÛQ£ðt:PÍSoèë[Ñ 
ϸ‡²"©2Vp
àcøF#Áfæ6«+`ëd B8o®
«üû36[Ìê܍Ûú½†g­\«
00:04:45 01.01.2000 src/utils.c  126 DBG     > Kernel size: 
0x1ad2f0
00:04:45 01.01.2000 src/utils.c  127 DBG     > Kernel compression type: 
0x2
00:04:45 01.01.2000 src/utils.c  128 DBG     > Kernel load address: 
0x80700000
00:04:45 01.01.2000 src/utils.c  129 DBG     > Kernel entry point 
address: 0x80701000
00:04:45 01.01.2000 src/utils.c  130 DBG     > Kernel signature length: 
0x100 (256)
00:04:45 01.01.2000 src/utils.c  131 DBG     > Kernel signature: 
>Âmž³×:;œ
j£–„ZO‘™Ñý
00:04:45 01.01.2000 src/utils.c  132 DBG     > Rootfs offset: 
0x310000
00:04:45 01.01.2000 src/utils.c  133 DBG     > Rootfs size: 
0x2e04010
00:04:45 01.01.2000 src/utils.c  134 DBG     > Rootfs filesystem type: 
0x6
PuTTY00:04:45 01.01.2000 src/main.c  525 DBG     > _dblCallback(): 
BOOT_VERIFY_KERNEL
00:04:45 01.01.2000 src/utils.c  872 DBG     > utils_verifyKernel()
00:04:49 01.01.2000 src/boot.c 1129 DBG     > _nandBoot(): Decrypted 
kernel size: 1757926 (encrypted size: 1757936)
00:04:49 01.01.2000 src/main.c  529 DBG     > _dblCallback(): 
BOOT_DECOMPRESS_KERNEL
00:04:49 01.01.2000 src/boot.c 1149 DBG     > _nandBoot(): Decompressed 
kernel size: 3381112
00:04:51 01.01.2000 src/main.c  533 DBG     > _dblCallback(): 
BOOT_LOAD_KERNEL
00:04:51 01.01.2000 src/boot.c  215 DBG     > _createKernelCommandLine: 
CALL
00:04:51 01.01.2000 src/boot.c  273 DBG     > ntp servers count 0
00:04:51 01.01.2000 src/boot.c  359 DBG     > 
_createKernelCommandLine(): Creating mtdparts parameter!
00:04:51 01.01.2000 src/boot.c  185 DBG     > 
_getDeviceNumberFromDevicePath(): Found number: 4
00:04:51 01.01.2000 src/boot.c  185 DBG     > 
_getDeviceNumberFromDevicePath(): Found number: 4
00:04:51 01.01.2000 src/boot.c  499 DBG     > 
_createKernelCommandLine():UBI  mtd device number: 4
00:04:51 01.01.2000 src/boot.c  565 DBG     > _createKernelCommandLine: 
RET
00:04:51 01.01.2000 src/boot.c 1176 DBG     > _nandBoot(): Booting 
kernel from flash with cmdline: console=ttyAS0,115200 
mtdparts="Onboard_Flash:0x80000@0x380000(FFS),0x380000@0x0(Raw);stm-nand 
-flex.1:0x4000000@0x0(system),0x310000@0x0(kernel),0x3cf0000@0x310000(ro 
otfs)"  bootdevice=nor bootfiles=raw systemmemsize=524288 rbl=2 
rbl_mode=1 rbl_version=2.12 dbl=2 cdv=2.0.2 
ip:(obfuscated)::(obfuscated):255.255.255.0 
nwhwconf=device:eth0,hwaddr:00:02:9b:68:97:cf serverid=(obfuscated) 
root=ubi0:rootfs rw rootfstype=ubifs ubi.mtd=4, length: 427
00:04:51 01.01.2000 src/main.c  537 DBG     > _dblCallback(): 
BOOT_RUN_KERNEL
00:04:51 01.01.2000 pplication.c  266 DBG     > _displayProgress(3, 2)
Starting new kernel
kexec information
  segment[0]: 0x80700000 - 0x80a3a000 (0x0033a000)
  start     : 0x80701000

[    0.000000] Linux version 2.6.23.17-stm23-0123 
(buildbot@dccbuilder-2) (gcc version 4.2.1 20070719 (experimental) 
(STMicroelectronics Special) [build Mar 31 2015]) #1 PREEMPT Tue Mar 31 
20:21:32 CEST 2015
[    0.000000] Booting machvec: vip19x3
[    0.000000] Reserve 115712 KiB for STAVMEM (0 KiB for graphics)
[    0.000000] STx7105 version 3.x
[    0.000000] Kernel command line: console=ttyAS0,115200 
mtdparts="Onboard_Flash:0x80000@0x380000(FFS),0x380000@0x0(Raw);stm-nand 
-flex.1:0x4000000@0x0(system),0x310000@0x0(kernel),0x3cf0000@0x310000(ro 
otfs)"  bootdevice=nor bootfiles=raw systemmemsize=524288 rbl=2 
rbl_mode=1 rbl_version=2.12 dbl=2 cdv=2.0.2 
ip=(obfuscated)::(obfuscated):255.255.255.0 
nwhwconf=device:eth0,hwaddr:00:02:9b:68:97:cf serverid=(obfuscated) 
root=ubi0:rootfs rw rootfstype=ubifs ubi.mtd=4
[    0.000000] Kernel has NOT DVR version 5
[    0.000000] Kernel has NOT DVB support
[    0.000000] bpa2: partition 'bigphysarea' created at 0x40e6b000, size 
16384 kB (0x01000000 B)
[    0.000000] Using tmu for system timer
[    0.000047] Using 25.000 MHz high precision timer.
[    0.000238] console [ttyAS0] enabled
[    0.002784] Dentry cache hash table entries: 65536 (order: 6, 262144 
bytes)
[    0.006385] Inode-cache hash table entries: 32768 (order: 5, 131072 
bytes)
[    0.030527] Memory: 376960k/524288k available (2254k kernel code, 
695k data, 344k init)
[    0.031533] SH4 450.00 BogoMIPS PRESET (lpj=225000)
[    0.037191] NET: Registered protocol family 16
[    0.051276] Pre-powerdown KEYSCAN
[    0.052044] Powered down KEYSCAN!
[    0.063586] Generic PHY: Registered new driver
[    0.065869] SCSI subsystem initialized
[    0.072000] Time: SuperH clocksource has been installed.
[    0.076577] NET: Registered protocol family 2
[    0.087190] IP route cache hash table entries: 16384 (order: 4, 65536 
bytes)
[    0.089572] TCP established hash table entries: 65536 (order: 7, 
524288 bytes)
[    0.095896] TCP bind hash table entries: 65536 (order: 6, 262144 
bytes)
[    0.098676] TCP: Hash tables configured (established 65536 bind 
65536)
[    0.099017] TCP reno registered
[    0.173825] platform_add_pm_devices:
[    0.180839] squashfs: version 3.4 (2008/08/26) Phillip Lougher
[    0.181133] Registering unionfs 2.5.1 (for 2.6.23.17)
[    0.182480] JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
[    0.183623] JFS: nTxBlock = 2945, nTxLock = 23565
[    0.190154] yaffs Mar 31 2015 20:21:26 Installing.
[    0.191350] io scheduler noop registered
[    0.192025] io scheduler anticipatory registered (default)
[    0.221487] stm_hwrandom stm_hwrandom: STM Random Number Generator 
ver. 0.1
[    0.222126] Kboxdev: registered device with major 120
[    0.223060] STMicroelectronics ASC driver initialized
[    0.224422] stasc.0: ttyAS0 at MMIO 0xfd031000 (irq = 122) is a stasc
[    0.226084] stasc.1: ttyAS1 at MMIO 0xfd032000 (irq = 121) is a stasc
[    0.231285] loop: loaded (max 8 devices)
[    0.233157] Marvell 88E3015: Registered new driver
[    0.235435]   GMAC - user ID: 0x10, Synopsys ID: 0x33
[    0.237304]   eth0 - (dev. name: stmmaceth - id: 0, IRQ #134
[    0.237319]   IO base addr: 0xfd110000)
[    0.241170] STMMAC MII Bus: probed
[    0.242037] eth0: PHY ID 01410e20 at 0 IRQ 246 (0:00) active
[    0.246176] scsi0 : sata_stm
[    0.248224] ata1: SATA max UDMA/133 cmd 0xfe209000 ctl 0xfe209820 
bmdma 0x00000000 irq 72
[    0.552035] ata1: SATA link down (SStatus 0 SControl 300)
[    0.554968] VIP19xx onboard NOR flash device
[    0.555211] Onboard_Flash: Found 1 x16 devices at 0x0 in 16-bit bank
[    0.556089] Using word write for ST M28WXX0 FLASH
[    0.557015] cfi_cmdset_0001: Erase suspend on write enabled
[    0.558093] 2 cmdlinepart partitions found on MTD device 
Onboard_Flash
[    0.559019] Creating 2 MTD partitions on "Onboard_Flash":
[    0.560034] 0x00380000-0x00400000 : "FFS"
[    0.562803] 0x00000000-0x00380000 : "Raw"
[    0.564839] No NAND device found!!!
[    0.565073] No NAND device found!!!
[    0.567218] NAND device: Manufacturer ID: 0x20, Chip ID: 0x76 (ST 
Micro NAND 64MiB 3,3V 8-bit)
[    0.569320] 3 cmdlinepart partitions found on MTD device 
stm-nand-flex.1
[    0.570035] Creating 3 MTD partitions on "stm-nand-flex.1":
[    0.571024] 0x00000000-0x04000000 : "system"
[    0.574653] 0x00000000-0x00310000 : "kernel"
[    0.576636] 0x00310000-0x04000000 : "rootfs"
[    0.580399] UBI: attaching mtd4 to ubi0
[    0.581032] UBI: physical eraseblock size:   16384 bytes (16 KiB)
[    0.582047] UBI: logical eraseblock size:    15872 bytes
[    0.583016] UBI: smallest flash I/O unit:    512
[    0.584013] UBI: sub-page size:              256
[    0.585015] UBI: VID header offset:          256 (aligned 256)
[    0.586020] UBI: data offset:                512
[    1.069105] UBI: volume 1 ("homedir") re-sized from 13 to 923 LEBs
[    1.074498] UBI: attached mtd4 to ubi0
[    1.075027] UBI: MTD device name:            "rootfs"
[    1.076054] UBI: MTD device size:            60 MiB
[    1.077016] UBI: number of good PEBs:        3895
[    1.078013] UBI: number of bad PEBs:         5
[    1.079013] UBI: max. allowed volumes:       92
[    1.080019] UBI: wear-leveling threshold:    4096
[    1.081016] UBI: number of internal volumes: 1
[    1.082031] UBI: number of user volumes:     2
[    1.083013] UBI: available PEBs:             0
[    1.084011] UBI: total number of reserved PEBs: 3895
[    1.085017] UBI: number of PEBs reserved for bad PEB handling: 38
[    1.086012] UBI: max/mean erase counter: 0/0
[    1.087027] UBI: background thread "ubi_bgt0d" started, PID 244
[    1.093014] i8042.c: i8042 controller self test timeout.
[    1.094747] mice: PS/2 mouse device common for all mice
[    1.096368] i2c /dev entries driver
[    1.101390] Software Watchdog Timer: 0.07 initialized. soft_noboot=0 
soft_margin=60 sec (nowayout= 1)
[    1.102568] stm_rng hardware driver 1.0 configured
[    1.105374] stlpc device driver registered
[    1.106758] ip_tables: (C) 2000-2006 Netfilter Core Team
[    1.107122] TCP cubic registered
[    1.108072] NET: Registered protocol family 1
[    1.109036] NET: Registered protocol family 17
[    1.111664] st40 cpu frequency registered
[    1.112133] sh4 suspend support registered
[    1.625524] stmmac_timer: TMU2 Timer ON (freq 256Hz)
[    2.644318] IP-Config: Complete:
[    2.645016] 
device=eth0ddr=(obfuscated)ask=255.255.255.0w=(obfuscated),
[    2.649011]      host=(obfuscated), domain=, nis-domain=(none),
[    2.650015] 
bootserver=255.255.255.255ootserver=255.255.255.255ootpath=[ 
2.653026] Freeing unused kernel memorù[    2.699342] UBIFS: mounted UBI 
device 0, volume 1, name "homedir"
[    2.700027] UBIFS: file system size:   10951680 bytes (10695 KiB, 10 
MiB, 690 LEBs)
[    2.701019] UBIFS: journal size:       165888 bytes (162 KiB, 0 MiB, 
11 LEBs)
[    2.702020] UBIFS: media format:       4 (latest is 4)
[    2.703014] UBIFS: default compressor: lzo
[    2.704014] UBIFS: reserved for root:  0 bytes (0 KiB)
[    3.400174] PHY: 0:00 - Link is Up100/Full
init started: BusyBox v1.22.1 (2015-03-31 19:05:47 CEST)

starting pid 269, tty '': '/etc/rc.sysinit'
Please wait: booting...
mknod: /dev/ptmx: File exists
mount: mounting shm on /dev/shm failed: No such file or directory
ip: RTNETLINK answers: Operation not supported

starting pid 306, tty '': '/etc/init.d/init_hal.sh start'
[    5.184424] sttbx_early_core: module license 'ST Microelectronics' 
taints kernel.
[    5.474284] Load module stos_core [?]    by init_hal (pid 311)
[    5.528973] Load module stsys_ioctl [253]    by init_hal (pid 311)
[    5.662401] ehci_hcd: Unknown symbol usb_free_urb
[    5.664501] ehci_hcd: Unknown symbol usb_hub_tt_clear_buffer
[    5.665635] ehci_hcd: Unknown symbol usb_hcd_resume_root_hub
[    5.694413] ehci_hcd: Unknown symbol usb_calc_bus_time
[    5.722427] ehci_hcd: Unknown symbol ehci_cf_port_reset_rwsem
[    5.724553] ehci_hcd: Unknown symbol usb_put_hcd
[    5.726164] ehci_hcd: Unknown symbol usb_get_urb
[    5.744686] ehci_hcd: Unknown symbol usb_hcd_giveback_urb
[    5.746344] ehci_hcd: Unknown symbol usb_hcd_poll_rh_status
[    5.747639] ehci_hcd: Unknown symbol usb_create_hcd
[    5.748678] ehci_hcd: Unknown symbol usb_remove_hcd
[    5.766707] ehci_hcd: Unknown symbol usb_add_hcd
[    5.768618] ehci_hcd: Unknown symbol usb_root_hub_lost_power
Error while inserting module ehci-hcd.ko
[    5.792058] ohci_hcd: Unknown symbol usb_hcd_resume_root_hub
[    5.807755] ohci_hcd: Unknown symbol usb_disabled
[    5.810232] ohci_hcd: Unknown symbol usb_calc_bus_time
[    5.812639] ohci_hcd: Unknown symbol usb_put_hcd
[    5.834366] ohci_hcd: Unknown symbol usb_hcd_giveback_urb
[    5.835682] ohci_hcd: Unknown symbol usb_hcd_poll_rh_status
[    5.837529] ohci_hcd: Unknown symbol usb_create_hcd
[    5.839408] ohci_hcd: Unknown symbol usb_remove_hcd
[    5.861777] ohci_hcd: Unknown symbol usb_add_hcd
[    5.863700] ohci_hcd: Unknown symbol usb_root_hub_lost_power
Error while inserting module ohci-hcd.ko
[    5.869820] hcd_stm: Unknown symbol stm_ohci_hcd_register
[    5.871892] hcd_stm: Unknown symbol stm_ohci_hcd_unregister
[    5.875818] hcd_stm: Unknown symbol stm_ehci_hcd_unregister
[    5.890656] hcd_stm: Unknown symbol stm_ehci_hcd_register
Error while inserting module hcd-stm.ko
[    6.871054] LXLOAD(audio1)  : LX loaded => Base=0x40400000 - 
Last=0x4056a434 - Size=1483828
[    7.349776] LXLOAD(video1)  : LX loaded => Base=0x40000000 - 
Last=0x40152b24 - Size=1387300
[    7.376114] frontpanel: controller is mounted
[    7.448194] frontpanel: LED character display board with 10 button/9 
LED support
[    7.489504] frontpanel: display version: 1
[    7.536076] input: Unspecified device as /class/input/input0
WARNING! /dev/front_panel not found!
Cannot open /dev/front_panel
[    9.198534] Load module stevt_core [?]    by init_hal (pid 311)
[    9.200054] Load module stcommon_core [?]    by init_hal (pid 311)
[    9.202077] Load module sttbx_core [?]    by init_hal (pid 311)
[    9.203088] Load module stclock_core [253]    by init_hal (pid 311)
[    9.205585] Load module stclkrv_core [?]    by init_hal (pid 311)
[    9.206033] Load module stpower_core [252]    by init_hal (pid 311)
[    9.207091] Load module stfdma_core [251]    by init_hal (pid 311)
[    9.210633] Load module stmerge_core [?]    by init_hal (pid 311)
[    9.211050] Load module stavmem_core [?]    by init_hal (pid 311)
[    9.223534] Load module stbuffer_core [?]    by init_hal (pid 311)
[    9.224052] Load module stinject_core [?]    by init_hal (pid 311)
[    9.225020] Load module stpio_core [?]    by init_hal (pid 311)
[    9.226018] Load module stdenc_core [?]    by init_hal (pid 311)
[    9.227016] Load module stlayer_core [?]    by init_hal (pid 311)
[    9.228016] Load module stvout_core [?]    by init_hal (pid 311)
[    9.229016] Load module stvtg_core [?]    by init_hal (pid 311)
[    9.230016] Load module stvid_core [?]    by init_hal (pid 311)
[    9.231016] Load module stvin_core [?]    by init_hal (pid 311)
[    9.232016] Load module stos_core [?]    by init_hal (pid 311)
[    9.233028] Load module stvmix_core [?]    by init_hal (pid 311)
[    9.234019] Load module stgxobj_core [?]    by init_hal (pid 311)
[    9.235025] Load module staudlx_core [249]    by init_hal (pid 311)
[    9.237145] Load module stcc_core [?]    by init_hal (pid 311)
[    9.238021] Load module stttx_core [?]    by init_hal (pid 311)
[    9.239094] Load module stvbi_core [?]    by init_hal (pid 311)
[    9.240021] Load module stblit_core [?]    by init_hal (pid 311)
[    9.241065] Load module stsmart_core [246]    by init_hal (pid 311)
[    9.243043] Load module stnet_core [?]    by init_hal (pid 311)
[    9.244036] Load module stpti4_core [?]    by init_hal (pid 311)
[   10.005512] Load module stevt_ioctl [245]    by init_hal (pid 311)
[   10.006077] Load module stcommon_ioctl [244]  by init_hal (pid 311)
[   10.007037] Load module sttbx_ioctl [243]    by init_hal (pid 311)
[   10.008027] Load module stclkrv_ioctl [242]    by init_hal (pid 311)
[   10.009025] Load module stpower_ioctl [241]    by init_hal (pid 311)
[   10.010166] Load module stfdma_ioctl [240]    by init_hal (pid 311)
[   10.011088] Load module stmerge_ioctl [238]    by init_hal (pid 311)
[   10.012036] Load module stavmem_ioctl [237]    by init_hal (pid 311)
[   10.013038] Load module stbuffer_ioctl [236]  by init_hal (pid 311)
[   10.014034] Load module stinject_ioctl [235]  by init_hal (pid 311)
[   10.015296] Load module stspi_ioctl [233]    by init_hal (pid 311)
[   10.016054] Load module stpio_ioctl [232]    by init_hal (pid 311)
[   10.017042] Load module stdenc_ioctl [229]    by init_hal (pid 311)
[   10.018050] Load module stlayer_ioctl [228]    by init_hal (pid 311)
[   10.019067] Load module stvout_ioctl [227]    by init_hal (pid 311)
[   10.020047] Load module stvtg_ioctl [226]    by init_hal (pid 311)
[   10.021061] Load module stvid_ioctl [225]    by init_hal (pid 311)
[   10.022047] Load module stvin_ioctl [224]    by init_hal (pid 311)
[   10.023055] Load module stvmix_ioctl [223]    by init_hal (pid 311)
[   10.024047] Load module stgxobj_ioctl [222]    by init_hal (pid 311)
[   10.025067] Load module stcc_ioctl [220]    by init_hal (pid 311)
[   10.026045] Load module stttx_ioctl [219]    by init_hal (pid 311)
[   10.027032] Load module stvbi_ioctl [218]    by init_hal (pid 311)
[   10.028042] Load module stblit_ioctl [217]    by init_hal (pid 311)
[   10.029240] Load module stsys_ioctl [211]    by init_hal (pid 311)
[   10.030086] Load module stnet_ioctl [210]    by init_hal (pid 311)
[   10.031051] Load module stpti4_ioctl [209]    by init_hal (pid 311)
[   10.125072] Module stapler_core (rev: STAPLER-REL_1.7.0) loaded by 
(pid -257)
[   10.166279] Load module sttkdma_core by  (pid -257)
[   10.176630] Load module sttkdma_ioctl by  (pid -257)
[   10.237287] input: IR Remote as /class/input/input1
[   10.260744] lirc lirc: : probe found data for platform device lirc
[   10.261060] lirc lirc: ioremapped register block at 0xfd018000
[   10.262018] lirc lirc: ioremapped to 0xfd018000
[   10.263025] lirc lirc: Bound to irq 125.
[   10.264175] lirc lirc: Registered IR-Wakeup device.
[   10.265096] Registered IR-Wakeup driver.

starting pid 442, tty '': '/etc/init.d/load_vqe.sh start'
[   11.010663] <vqec-dev>Registered vqec device with major-id 207

starting pid 449, tty '': '/etc/init.d/udploggerd.sh start'

starting pid 455, tty '': '/etc/init.d/player.sh start'

starting pid 472, tty '': '/etc/init.d/update-dbl-bootscreen.sh start'
Missing /etc/nsn/dbl-bootscreen.version
DBL bootscreens updated!

starting pid 475, tty '': '/etc/init.d/rbl-upgrade.sh start'

can't run '/etc/init.d/rbl-upgrade.sh': No such file or directory

starting pid 476, tty '': '/etc/init.d/dropbear start'

starting pid 477, tty '': '/etc/init.d/sda.sh start'

starting pid 479, tty '': '/etc/init.d/openntpd start'

starting pid 482, tty '': '/etc/init.d/appman.sh start'

starting pid 486, tty '': '/etc/init.d/syslog start'

starting pid 489, tty '': '/etc/init.d/rmnologin start'

starting pid 491, tty '': '/usr/local/bin/databases_integrity_checker.sh 
start'
grep: /etc/nsn/system.properties: No such file or directory
Starting syslogd/klogd: Starting openntpd
Creating Dropbear SSH server RSA host key.
done
Starting ntpd (-f /etc/nsn-static/ntpd.conf)
Generating key, this may take a while...
Public key portion is:
ssh-rsa 
AAAAB3NzaC1yc2EAAAADAQABAAABAQDSqNdppCnpqC/b/EJRG6B8fbqmoTuI5q2UxULJFvwR 
1CPRlPMjJtlSH68af4Fy+QvKhzik1v8e+VKThBrM3Li/ZtCmgzBtv0vRLAta0YYArSsskfox 
Haxk4D8f8j/uOSoETZO80/KUA1RCbAzVmP97ETeWAjqBnxiMvPJieaWet3g/Wl85wdzS/2UP 
Kl1oInIxGJXkg+wkpeAFw0+AbVevElBYPn+aAUTdIOjTLZal8nIAIIji4LCyl1Cjs8OLjj+P 
lqEGm3oSxGL1Hv7GqD5SrA8qMYxogAuPke8isw4BmsP/jXTKI7FOf8QHIHXHCwjQXKPqBthl 
m/MOP50vEn3f  root@stb
Fingerprint: md5 ab:22:15:82:86:fa:7a:b7:5d:e1:44:96:f9:b0:61:a9
Starting Dropbear SSH server: dropbear.
[  149.902735]  <VQE_UTILS-6-VQE_MP_TLV_INFO> MP_TLV related info 
message (detail: MP - Decoded TSRAP TLV data, tlv proc=7, TS pkts 
generated=14)

[code]

[Mac (Gast)]

You might like this attachment

[Alcomys (Gast)]

Maybe we can also use this manual to the STI7105 ?

[Zeljko P. (zeljko_p)]

Hello, is it possible to get image for Arris VIP1003 in which remote 
works. I have tried few of these and they work but remote does not 
function? I have a lot of these devices and would like to use them in my 
iptv if i can find correct image for them. You can contact me on email 
info[at]meganet[dot]ba.

[Zeljko P. (zeljko_p)]

Is this thread dead?

[Martin V. (m_v)]

Nope. Search for the SDK and you can make your own images.

Or post the remote code so someone with the SDK  can make you an image.

[Zeljko P. (zeljko_p)]

I already downloaded SDK, compile it successfully. Im not so familiar 
with all this things, and im stuck in how to make .bin file? If you can 
help me with this it would be really good. Thank you in advance.

[Zeljko P. (zeljko_p)]

Anyone can help me with this? :)

[Artem (Gast)]

Hi Martin,

I have Set-top box motorola vip1003(Sonera).
Set-top box flashing on tftp absolutely normal, but after flashing - 
error 4, after reboot Set-top box - error 3....
I understand the problem is bootkast id?

[Blagus B. (blagus)]

@Martin

Regarding your question about 19x3 and JTAG. I was able to connect to 
1963 and dump full 32MB NOR, and even write it back to STB and it's 
still alive.
BL version is 2.xx (I'm not sure which one).
I can send you the dump if you want it.

Can you please send me the EMEA SDK kit which keeps disappearing from 
the internet? My mail is reg.blagus[gmail]

[Martin V. (m_v)]

How did you connect? I can't connect to the 1963 or 1903

[Blagus B. (blagus)]

I used FTDI's FT2232HQ Mini Module (FT4232H is fine too) and official 
STMC toolset.
You also need STburner which you have to modify so it can recognize 
1963's NOR. I had that copy of STburner somewhere, compiled for 1963, 
I'll try to find it and send it to you, together with 2.xx bootloader 
dump I made.

As far as I can remember, NOR also contains some default configuration, 
XML files, MAC and serial and there might be some keys (in XML files), 
but I'm not sure.

That's the least thing I can do as a thanks for your mail.

[Mac (Gast)]

Hi Martin,

"option KreaTV.kernel-protocol" for boot order.
What option number is that?

[claude (Gast)]

Hi Mac,

I think you mean for:

1 = BootCast
2 = TFTP
3 = Local Storage (if available)
4 = SAP (Session Announcement Protocol)
5 = DVD/CD (if available)
6 = HTTP (available from version 3.03)

I used as 323 kernel/slash

[claude (Gast)]

Hi all,

Kernel setup:
1.run logclient.exe 192.168.2.200
2.run putty -telnet 192.168.2.200
3.vi /usr/applications/ekioh/ekioh.cfg
4.add line application.homepage:http://192.168.2.131
5.killall ekioh

that is right order.

[Mac (Gast)]

Hi Claude,

not really what I meant. I meant which DHCP option since our boxes have 
a new bootloader which cannot be programmed by hand. I saw that Martin 
had this in his debug:

00:00:08 01.01.2000 src/dhcp.c  276 DBG     > Kernel Protocol Order:
00:00:08 01.01.2000 src/dhcp.c  280 DBG     > 2

So I assume he knows what DHCP option that is.

[claude (Gast)]

Hi Mac,

That be nice have new bootloader im using old version but loading.

kreatv-bi-eval_4.3.IAP30.3_st40_vip19x3.bin(new)FW
kreatv-bi-vdr.config_4.3.IAP30.3_st40_vip19x3.bin(old)FW

It old bootloader has public key hide.

I have little problem with New-FW ekioh settings dont stay after reboot 
setting are cone.

Tryed "toish is SetObject config.ekioh.application.homepageurl 
http://192.168.2.131/index.html permanent" but is dont read them.

Puted /flash/securestroage is flash parition as NAND.
Now i need put script but init dont have them.

old version that toish command worked fine so. i stay new one or old one 
heh.

[claude (Gast)]

Old bootloader working

5 green balls meaning while loading FW

1.1 ball loading FW TFTP/bootloader/http
1.1 small ball loading FW

2.1ball extract FW to flash
2.2 small ball flashing FW

3 ball check is FW unic to keys

4 ball load FW to RAM

5 ball run FW

Wrong version FW crash in 3 ball sector

[Arca D. (arcadyan)]

Does anyone have a dump of a KPN branded box with the new bootloader? 
I'd like to figure out if we can get custom code running.

Alternatively, any VIP19xx/18xx dump would be welcome, I currently have 
none.

I'm also still looking for the SDK.

Email is username AT gmx com

Thanks!

[claude (Gast)]

/#toish
Usage: toish [<component>|<component alias>] <operation> [arguments...]

Environment variables used:
  NAMESERVICE_ADDRESS  The address of the name service, this has 
precedence
  NS_ADDRESS_FILENAME  A file from which the name service address can be 
read
                       Defaults to /tmp/nameservice_address

Available components and operations:
applicationservice, as:
  Activate <application id>
    Activate application <application id>
  ActivateWithUri <application id> <uri> <mime type>
    Activate application and load uri with it
  RegisterApplication <property file path>
    Register new application
  Kill <application id>
    Kill application <application id>
  LoadUri <uri> [MIME type] [whitelist]
    Load the URI <uri>; the MIME type is guessed if not specified
    If "whitelist" is appended, the uri is added
    to the portal whitelist (as volatile)
  Info
    Get info on registered applications

informationservice, is:
  GetObject <object name> | all
    Returns object value ("all" is for all objects)
  GetObjectNames [<adapter> | all]
    Returns the names of all objects provided by <adapter> or by all
    adapters (default) in alphabetical order.
  SetObject <object name> <value> [volatile | permanent]
    Set the object, default storage type is volatile
  SetObjectFromFile <object name> <file> [volatile | permanent]
    Set the object, default storage type is volatile
  UnsetObject <object name> [volatile | permanent]
    Remove object, default storage type is volatile

platformservice, platform, ps:
  RebootNow
    Perform a controlled reboot, with components being shut down 
properly.
  RebootAtNextStandby
    Reboot the platform the next time the system goes to standby state.
  SetStandbyMode  [ true | false | 0 | 1 ]
    Deprecated. Same as SetStandby.
  SetStandby  [ true | false | 0 | 1 ]
    Enter or leave standby.
    True corresponds to standby, while false corresponds to normal 
operation.

uriloaderservice, uriloader, uri:
  LoadUri <uri> [MIME type]
    Deprecated; use "applicationservice LoadUri" instead

videooutputservice, videooutput, vos:
  SetDefaultVideoMode [ HD | SD ] [ disable | 480i | 576i | 576p | 720p 
| 1080p                                                               | 
1080i ]
    Sets the default video mode for an output, i.e. the video mode to 
use if no 
adaptive rules have been set.
  SetVideoSafeMode
    Sets the video outputs in safe mode configuration.
  SetScartMode [CVBS | YC | RGB]
    Sets scart output mode.

Found command that reboot remember settings with
toish is setobject cfg.portal.whitelisturls "
<PortalURLs>
  <PortalURL>http://192.168.2.131</PortalURL>;
  <PortalURL>http://192.168.2.131/index.html</PortalURL>;
</PortalURLs>
" permanent

Now all working great.

log1.log has old loader log-file reboot to startup

Thanks for all!

[Martin V. (m_v)]

@Mac from the SDK

I set it to tftp from dhcp but I think the key is wrong so it won't work 
with the newer bootloader.

# KreaTV Vendor Specific Information
option space KreaTV;
option KreaTV.splash-protocol      code   1 = string;
option KreaTV.kernel-protocol      code   2 = string;
option KreaTV.bootcast-address     code  10 = string;
option KreaTV.bootcast-attempts    code  11 = unsigned integer 8;
option KreaTV.bootcast-timeout     code  12 = unsigned integer 8;
option KreaTV.tftp-splash-filename code  20 = string;
option KreaTV.tftp-kernel-filename code  21 = string;
option KreaTV.tftp-server-pool     code  22 = array of ip-address;
option KreaTV.tftp-pool-attempts   code  23 = unsigned integer 8;
option KreaTV.tftp-node-attempts   code  24 = unsigned integer 8;
option KreaTV.tftp-rrq-timeout     code  25 = unsigned integer 8;
option KreaTV.tftp-timeout         code  26 = unsigned integer 8;
option KreaTV.tftp-blocksize       code  27 = unsigned integer 16;
option KreaTV.sap-address          code  40 = string;
option KreaTV.sap-attempts         code  41 = unsigned integer 8;
option KreaTV.sap-timeout          code  42 = unsigned integer 8;
option KreaTV.http-server          code  60 = string;
option KreaTV.http-port            code  61 = unsigned integer 16;
option KreaTV.http-timeout         code  62 = unsigned integer 8;
option KreaTV.http-attempts        code  63 = unsigned integer 8;
option KreaTV.renewal-method       code 100 = boolean;
vendor-option-space KreaTV;

subnet 192.168.0.0 netmask 255.255.255.0 {

      option routers  192.168.0.1;
      option subnet-mask  255.255.255.0;
      range dynamic-bootp  192.168.0.40 192.168.0.80;  
    default-lease-time  1200;
      max-lease-time  43200;

      # Common parameters
      next-server  192.168.0.3;
      filename "/tftpboot/kreatv-kernel";
      filename "SAP/2/224.2.127.254:9875";
      option swap-server 192.168.0.4;
      option root-path "/extra/nfs/kreatv-nfs";

      option KreaTV.splash-protocol "3,1,3";
      option KreaTV.kernel-protocol "3,1,3";
      option KreaTV.bootcast-address "224.2.2.2:22222";
      option KreaTV.bootcast-attempts 3;
      option KreaTV.bootcast-timeout 10;
      option KreaTV.tftp-splash-filename "/tftpboot/spl";
      option KreaTV.tftp-kernel-filename "/tftpboot/kreatv-kernel";
      option KreaTV.tftp-server-pool 192.168.0.2, 192.168.0.5;
      option KreaTV.tftp-pool-attempts 8;
      option KreaTV.tftp-node-attempts 2;
      option KreaTV.tftp-rrq-timeout 10;
      option KreaTV.tftp-timeout 10;
      option KreaTV.tftp-blocksize 1428;
      option KreaTV.sap-address "224.2.127.254:9875";
      option KreaTV.sap-attempts 3;
      option KreaTV.sap-timeout 10;
      option KreaTV.renewal-method off;
}

[Mac (Gast)]

Hi Martin,

thanxx for the dhcp options! You also included the numbers so I could 
put them directly in dnsmasq. The reason that your (or any, even 
official) old FW isn't working anymore is because the new bootloader 
expects a new encryption. KAC1 (According to the header)

[sab (Gast)]

hi claude
please can you help me on 1853?

regards

[Renze (Gast)]

Can someone re-upload the sdk? The 4shared link is dead...

[Blagus B. (blagus)]

Here are the instructions on using JTAG to dump/write NOR flash on 
VIP1963.
You need:
FT2232HQ or FT4232HQ mini module (or another 2232/4232 breakout board).
Wire and setup everything according to the instructions in this PDF:
http://www.avi-plus.com/repair-tips-forum/miscellaneous-software/others/st40-stb71xx-jtag-interfacing/page-2.html#658
(post #658)
(On Windows, grab official FTDI drivers and add modified VID/PID. Linux 
will do the magic itself.)

Install latest ST40 Tools and STMC2 from here:
http://ftp.stlinux.com/pub/tools/products/

If you're on Windows 8/10, set compatibility options to Win7+Run as 
Admin.

If you're on Linux, you'll also need to add tools dir and libs to PATH 
and do some magic regarding the targetpacks location - I can't remember 
what exactly, so I'll come back to it in a later post - but error 
messages will lead you in the right direction.

Download this:
http://www.mediafire.com/download/gz430oxs3fah6q8/STBurner_vip1963.7z

Inside you'll find 4mib.bin - first 4MiB dump of my Motorola VIP-1963.
I have to play more with block sizes and add some debug output to make 
it read all 32MiB instead of looping on first 4, but the essential part 
- RedBoot and Linux image - are there.
Serial and MAC is spoofed. If you're brave enough, edit them to match 
your STB and try writing it - worst case scenario is that you'll end up 
with non-bootable STB until you (or me) figure out actual block size 
values for STBurner which will read/write the dump correctly.

Executable is flasher.out, which is sent to the device with sh4xrun 
utility. Targetpack for 1963 is mb448 (I used non-"se", 29-bit version).
Example commands are in run.bat file. Linux and Windows syntax is the 
same.
-r option is for reading,
-p option is for writing.

[Blagus B. (blagus)]

If you need more help with setting up STLinux and STBurner, read this:
http://blagus.info/stlinux-env-setup-part1/

[Martin V. (mightyzen)]

I bought a KPN VIP 1960 from a thrift shop here in holland. It looks 
absolutely unused and has even older firmware than the unit Martin V. 
opened this thread with.

RBL 1.7, Firmware 2.20

Booting...
System memory: 256 MB
Video memory: 64 MB
Using Slot 1
Unpacking Image ...Done
Commandline: console=ttyAS0,115200 bigphysarea=2048 mtdparts=Onboard_Flash:0x00070000@0x00390000(FFS),0x00390000@0x0(Raw) ramtopaddress=0xAC000000 systemmemsize=262144 videomemsize=65536 dbl=1 fw=2.20
Linux version 2.6.17.14-sh (erik@xenalinux) (gcc version 3.4.3 (STMicroelectronics Special) [build Feb 5 2007]) #1 Fri Mar 28 12:13:53 CET 2008
STMicroelectronics STb7100 Reference board initialisation
STb7109 version 3.x
....

The kernel is compiled a few months earlier than Martin V.'s 1960 unit. 
I was expecting no problem booting from his images. However I get this 
error message:

Using Bootcast
BC: Info download attempt 1 of 90
Loading control file motorola-vip1960-9-256 from 224.2.2.18:22222
BC: Image download attempt 1 of 90
  Kernel name: kernel-1960
  Kernel address: 224.2.2.18:22222
Unable to read from file /tmp/bootimage_version: error 22
Verifying image...
secman: Data verification failed on /tmp/bootimage.gz.sec!

Using Local Storage
LS: No valid kernel image available.
Reboot.
Disabling FDMA
Shuting down STMMAC TX and RX DMA

I tried every image I could find, including the evaluation images from 
motorola. Same error message every time! Any help is appreciated!

[Martin V. (m_v)]

Strange, all the 19x0 boxes I've had so far can be used. Only none KPN 
boxes I couldn't use because they use an other key.

[Martin V. (mightyzen)]

I was finally able to install the images by switching from bootcast to 
tftp.

Absolutely no idea why the bootcast download did not work. It worked 
fine to install the splash image, so the server was set-up correctly as 
far I know.

I lost some time figuring out how to specify the filename for the tftp 
download, as my box did not use the name specified in the advanced 
settings menu. It did for the splash filename, but not for the 
bootimage. You need to specify the name in dhcp option 67.

May be it only uses the data from the advanced menu with static ip. I 
did not test that (yet).

[Roma (Gast)]

http://www.multiupfile.com/f/67c031c4
here kreatv-kit-starter-kit-emea_4.3.iap30.3_i386.tgz
Regards

[Mitja K. (veso266)]

Hi everybody I am new here and I am looking for 4shared files that had 
been removed

So does anyone still have:

kreatv-doc-sdk-user-manual_4.3.IAP30.3.tgz and
kreatv-extra-iip-package-ericsson_mu_4.3.IAP30.3.tgz

Thanks for Anwsering and Best Regards

[Mitja K. (veso266)]

PS: I is there any difrence between Starter Kit and SDK if someone can 
send me SDK (beacuse I only have starter kit so far) it would be great

Thanks for Anwsering and Best Regards

[claude (Gast)]

Hi sab

Sorry belate message, but im using version 1903 version.
Ohter version i don't know how they working is take some time lookout,
how they working.

Is there software(OS) or bios(FW) replaisment ?
Bios need open box and use UART(3-4pins) and use Console(COM1).
Software can replaise with right version each boxes as unic security 
key.

So wrong version don't boot but finding right verison need ask ohter 
people find same version with right Software(OS).

Look luck finding
-----------------------------------------------------------------------
Source codes can build with VIP19X0/VIP19X3/VIP1003/VIP1853 set-tops
http://sourceforge.net/projects/vip19x0.arris/files/ST40/KreaTV%204.6%20-%204.9/

1.Download file
2.Config settings right version. (./configure)
2.2 read more information inside README file with notepad
3.Build it(make)
4.Then is ready right version with security code and OS.

Uploaded with how build with OS with security key script.
http://www.multiupfile.com/f/acb9316e
Found inside kreatv-kit-oss_4.4-st40.tar

Key finding is diffrent story how find it.
but that good find Blagus B dump 4mb(NAND) they meybe has right security 
key.

Claude
Software engineering

[claude (Gast)]

kreatv-kit-oss_4.4-st40.tar was
http://sourceforge.net/projects/vip19x0.arris/files/ST40/KreaTV%204.4/

Claude

[claude (Gast)]

ok i meybe find it.
---------------------------------------------------------
check_3pp_license(file has information how build it)
----------------------------------------------------
file=3PPLICENSE
elif [ -f $FILENAME ]; then
    sha1=$(sha1sum $FILENAME | cut -f 1 -d ' ')
---------------------------------------------------------
3PPLICENSE(key code)
----------------------------------------------------
NAME=STLinux
VERSION=stm23_A27
LICENSE=GPLv2
TARGET=vip19x[03]
FILENAME=stlinux23-STAPI-kernel-sh4-2.6.23.17_stm23_A27-123.noarch.rpm
SHA1=d81112551394a0b0e19e69d0ecea0eab48d14d1f
END_HEADER
END_ATTRIBUTION
------------------------------------------------------------
GPLv2(key)[18kb]
--------------------------------------------
GNU GENERAL PUBLIC LICENSE
etc.
etc.
etc.
use the GNU Lesser General
Public License instead of this License.
----------------------------------------------
So GPLv2 need encode with OS header then is working right.

http://www.gnu.org/licenses/old-licenses/gpl-2.0.html#SEC1
there has too that GPLv2(key)(file)

claude

[Igor (Gast)]

Hello,

did someone finally make something of latest sdk available on 
sourceforge. I was able to make image with 4.3 starter kit for my 
vip1003, but with latest sdk I can't do anything. Since 4.3 is quite 
old, ekioh/webkit on it is unusable. I saw that there are available 
images with newer software, like this here:

<?xml version="1.0"?>
<!DOCTYPE StbConfig SYSTEM "stbconfig.dtd">
<StbConfig>
  <BootParams>
    <KernelUrl>http://82.199.133.52/static/bootimage/v9.9/kreatv-bi-vip1003.config_4.9.case954144.devdrop2_v9.9_vip1003_st40_vip10x3.bin</KernelUrl>;
    <KernelVersion>4.9.case954144.devdrop2_v9.9_vip1003</KernelVersion>
    <SplashUrl>http://82.199.133.52/static/bootimage/v9.9/splash_vip1003.bin</SplashUrl>;
    <SplashVersion>3.2</SplashVersion>
  </BootParams>
</StbConfig>

Anyone know how to extract this image?

[Martin V. (m_v)]

Flash it to a box and hopefully it has telnet so you can get in.

[Igor (Gast)]

Nope, it doesn't have telnet enabled. I've spend few days looking for 
some solutions, but seems only jtag is solution, if I found correct 
pin-out and then somehow unpack firmware. I know that update firmware is 
encrypted, but don't know is flash encrypted. Basically, I just want 
newer version of webkit browser from image. The image mentioned above 
has 536 version, but this one from starter kit is 532, which is way too 
old.

[Mamonick (Gast)]

Igor you have to use script from: 
Beitrag "Re: Pollin MOTOROLA VIP1710"

but you need key for VIP1003 and you will need find right start position 
to decrypt from. After decryption you use binwalk to check result. If 
binwalk find something, use parameter -e to extract it.

Good luck

[Momchil Minkov (Gast)]

Hi there, I have VIP1853 but not remote control. Please give me solution 
to enter in secret menu and delete original firmware. I use sound files 
to set my Samsung TV (and unlock hidden menu). May sombody digitalize 
menu, digits arrows, OK and Exit (I think that's enough) to use with 
smartphone and 2 infrared leds

[Poul-Henning H. (poulhenning_h)]

Hey all,

A Little help here please (hope this topic isn't closed).

I'm working with a Motorola VIP 1903. I want to make a client to 
tvheadend witch may be possible. BUT first things first. The bootload 
image(s). I'm was not able to get bootcast server to work. So I went 
ahead and tried the tftp boot.

My tftp bootserver (and webserver, dhcp server) is on a synology ds 
1815+ NAS server which can do tftp and pxe boot. PXE boot works fine on 
pc boots. So I thought I just put bootimage in tftp root and pointed 
boot file to the .bin boot file downloaded from this site. Then I set 
the boot protocol on Motorola box to 313 (Local, tftp, local).

Tried with these:

kreatv-bi-eval_4.3.IAP30.3_st40_vip19x3.bin
kreatv-bi-test.config_4.3.IAP30.3_st40_vip19x3.bin
kreatv-bi-vdr.config_4.3.IAP30.3_st40_vip19x3.bin

No luck.

Then I thought of giving the box it's own static ip. No luck

Then I tried booting from webserver (.bin file in root folder) With 
static or dynamic ip (and bootprotocol set to 363). Still no luck

I think there is some kind of information that I have missed. When setop 
box is booting the first two balls goes green. By the third ball there 
comes this error message: An error occur updating the software.......

Question is what didn't I do right? I hope someone can help me. This 
project could really turn into something big.

[Martin V. (m_v)]

Problem might be the wrong keys in the image. Try to log what the 1903 
does during boot.
Look for logclient in this thread.

Greetz

[Momchil Minkov (Gast)]

Hi again, I found remote control like this 
https://www.google.bg/imgres?imgurl=https%3A%2F%2Fstatic.kpn.com%2Fspecials%2Fafstandsbedieningtool%2Fafstandsbediening-kort.png&imgrefurl=https%3A%2F%2Fwww.kpn.com%2Fservice%2Ftelevisie%2Finstalleren%2Fafstandsbediening%2Finstellen.htm&docid=b0JEP3haMTJjFM&tbnid=4J34tqU_CoC2lM%3A&vet=10ahUKEwjfra-z_pbUAhWElxoKHQ2-A2AQMwg0KBEwEQ..i&w=640&h=360&client=firefox-b&bih=859&biw=1851&q=motorola%20vip1853%20kpn%20remote%20control&ved=0ahUKEwjfra-z_pbUAhWElxoKHQ2-A2AQMwg0KBEwEQ&iact=mrc&uact=8 
but when box booting nothing happend when I push menu button. On 19x3 
with new boot loader is the problem same or simply my remote control not 
for vip1853.

[Carl (Gast)]

Hello Martin et al,

With the expertise about Vip19x0 found in this thread, I hope this is a 
good place to ask this question:
I have a Motorola VIP1920-9C Conax/ComHem box, so it seems locked to 
only be used with ComHem, but I wonder if there is any way to use its 
onboard DVB-C to view the free, non-ComHem cable channels available 
where I live now?

From reading this thread, my guess is that the answer is that this box 
is totally locked down and that there is no known way around this, but I 
thought I'd ask anyway. Maybe things have changed in the last year or 
so?

Anyway - great thread! Take care, everybody!

[Martin V. (m_v)]

Hi, I've also a Comhem cable box with remote (and even keyboard I think)
Worked fine on Dutch Cable with Comhem software for FTA channels, untill 
I started to try and replace the software which didn't work because of 
missing keys.

Greetz

[anonymous (Gast)]

My box successfully boots 
kreatv-bi-test.config_4.3.IAP30.3_st40_vip19x3.bin (and 
kreatv-bi-vdr.config_4.3.IAP30.3_st40_vip19x3.bin) from above. Which AES 
key I can use to decrypt those images with decrypt.c 
(Beitrag "Re: Pollin MOTOROLA VIP1710")? 
Can I use the same key to decrypt the original firmware of my box?

[Martin V. (m_v)]

I think files are created from SDK with default developer keys. So if 
you find SDK you'll find the keys.

[anonymous (Gast)]

I found kreatv-kit-starter-kit-emea_4.3.IAP30.3.zip, but the keys are in 
"KreaTV format" with SEC header and I understand that the keys 
themselves are encrypted. At least using last 32 bytes of the 41-byte 
file as an AES key did not work.

Since I can boot kreatv-bi-test.config_4.3.IAP30.3_st40_vip19x3.bin, I 
can of course telnet to the box and read the flash, but I don't know how 
to interpret the comment in decrypt.c: "Seems to come from section at 
0x1cf700 in NOR. More work needs to be done to figure out how it is 
decrypted."

I tried to use 32 bytes from position 0x1cf700 of the NOR flash as the 
key, but that did not work. Then I checked all sections starting with 
"SEC", but none of them looked like an AES key. The comment in decrypt.c 
seems to imply that the key itself is encrypted. Yet 
http://www.duff.dk/zaptor/ writes that "the key for decryption is piece 
of cake to extract"???

Thanks for any hints!

[Mark (Gast)]

Hello, someone knows how to decrypt biss in 4.4.
The server streams mpegts which is encrypted with biss. Can anyone 
suggest?

[Naveed A. (naveed_a)]

I want to access Firmware setting menu for Arris VIP4302 STB. But I 
don't know the four digit code to access the advance menu. I am trying 
7532 but it does not work. So, it might not be for this model. Does any 
one now this code? Thanks