eng TELE-audiovision 1307

13 14
15 16
TTL Recovery
13. In the Putty window, confirm you
received the files with the “ls” command.
Notice that the “update” file is listed
in grey. This means that it cannot be
executed!
14. Use the “chmod 755 update” command
to change the privileges, so that “update”
can be executed.
15. Repeat the “ls” command: “update” is
now listed in green, meaning that it can be
executed.
16. Execute the command “./update
backup_kernel_344” to flash the backup
kernel into the flash. This will take a few
minutes and the receiver will then restart
automatically. It may be necessary to turn
the receiver off and on again. It will boot
with a kernel that can be upgraded using
the normal procedure with a USB pen and
AZUp. congratulations! The receiver is
alive again.
for themselves when used to unsolder
chips or small SMA components.
You can get a good model starting at
around 150 Euros.
In just a few seconds I unsoldered
two matching resistors labeled 103
from an old motherboard using a hotair
soldering iron and soldered them to
the AZBox circuit board. It‘s nice that
this little resistor is sucked correctly
onto the contacts thanks to the surface
tension of the solder.
It‘s not easy to check this with the
naked eye. It‘s actually easier than it
looks.
The JTAG interface was finished in a
few minutes; I could now get started.
Using the OpenSource OpenOCD soft-
ware the Flash process is run. But I
soon became disillusioned: the Flash
process is slow. Not slow in the normal
sense, but snail slow.
According to my calculations the
complete 8MB flash process would take
eight weeks to complete! So I decided
to have a look at the firmware file with
a hex editor.
It‘s easy to recognize on the
„straight“ hexadecimal address if a
new memory location starts. You have
to think of the Flash memory like a
diskette on which different files are
stored.
In between the files up until the next
„straight“ memory address there‘s always
a free space that is filled with either
&H00 or &HFF.
Since the kernel is also housed in the
Flash and I already had a file like this
on my PC, I could quickly figure out
where to find it in the Flash. It definitely
pays to snoop around in a Flash file;
the OpenSource Hex editor „Frhed“ is
perfect for this.
My investigation found that the 8192
KB is divided is follows:
• &H000000-&H0040000
– First Bootloader
• &H004000-&H0080000
– YAMON
• &H008000-&H0700000
– Linux Kernel
• &H070000-&H07FFFFF
– First File System
It should be good enough to only
154 TELE-audiovision International — The World‘s Largest Digital TV Trade Magazine — 07-08/2013 — www.TELE-audiovision.com
write the first &H80000 bytes instead
of the complete &H800000. This flash
process should be completed in just
one night.
Therefore, I copied the first &H80000
bytes into a new file using the Hex editor
and then flashed it using OpenOCD.
Sure enough, the next morning I
was able to start my receiver as far as
YAMON. Next I transferred the recovery
image again into RAM via TFTP.
To make sure I didn‘t once again
lose both the Bootloader and YAMON, I
used the Hex editor to delete the first
&H80000 bytes and then flashed the
remaining file starting at memory location
&H008000. This process only
needed a few minutes.
Now look at that: the receiver start
up again and I was able to quite normally
upload the firmware using AZUp.
The receiver was successfully raised
from the dead.
And there you have it: with the help
of a TTL adapter and the availability of
YAMON, you can directly write a kernel
to every AZBox.
You won‘t ever have to use a dead
AZBox as a brick when building a new
house because you can simply bring it
back to life!
This AZBox Ultra HD receiver has really
grown on me; after a few sleepless
nights, some soldering and incorporating
a JTAG interface, I am now
much more intimately familiar with the
inside of this box than with any other
receiver.