1. Chip Flashing
Flash or
no flash -
Flashing the
wrong firmware
can cause trouble
• Vitor finds a way to bring a satellite
meter back from the dead
• be careful when installing a new
software
• simple device programmers are helpful
• a soldiering iron is sufficient for
connecting the wires
• remember to make backups before
starting any work
110 TELE-satellite International — The World‘s Largest Digital TV Trade Magazine — 04-05/2012 — www.TELE-satellite.com www.TELE-satellite.com — 04-05/2012 — TELE-satellite International — The World‘s Largest Digital TV Trade Magazine 111

2. Chip Flashing
This is the story on how the
desire to change the localized
settings of a satellite meter
ended up with the external
programming of its flash chip
Vitor Martins Augusto
1
2 I own a satellite meter, which is be- made available from a different dis-
ing sold under many different brands. tributor. I expected to get some extra
It is easy to recognize the different functionality, but above all, I hoped
OEM versions, as they look pretty that the new settings would match my
much the same, with slight variations region. Actually, the only annoyance
on the colour and logo. Because my that got me to look for a different firm-
model came pre-configured with Asian ware in the first place was the fact that
locations and my distributor does not I could not edit the name of my loca-
provide any localized firmware for the tion. I had to program “Shanghai” with
European region, I figured that I could my latitude and longitude, but I could
upgrade the firmware with a release not change the name to my hometown
“Porto”. This annoyed me. A lot.
1. Picture of the main board of my After copying the new firmware file
satellite meter.
2. The ALI M3329D processor gives onto a USB pen, I activated the flash-
hopes that there is a possible JTAG ing procedure on my satellite meter
programming route to rescue the
firmware. and the device turned itself off, as
112 TELE-satellite International — The World‘s Largest Digital TV Trade Magazine — 04-05/2012 — www.TELE-satellite.com

3. 3 X-Modem protocol, which is how the would actually support this flash chip, 6 desolder anything. Had I only known
firmware is flashed in with many other but not the ALI CPU. Again, I got hold about this tool two weeks ago!
satellite meters of the same kind. of the source code. Not satisfied, I wondered how this
I tried the obvious settings: 115200, The next attempt was pretty tool managed to establish a connec-
8N1, but got no reply. A little scared, straight forward: I implemented the tion through the serial port, since I
I started to press all conceivable key flash definitions of one source code hadn’t been able to do so in my own
combinations on the meter, hoping into the source code that had the ALI previous trials. The answer: the me-
that the boot loader would allow a CPU support. I soldered some wires ter uses even parity instead of none...
recovery USB flashing procedure. No to the JTAG on the board and tried if This must be the first device I see with
luck. I could connect though the JTAG port such configuration: 115200 8E1. Now
To make sure that the boot loader to the CPU and flash. Short answer: I I could see the boot loader messages
was at least operational, I opened couldn’t. Since there were too many on HyperTerminal, too.
both the original firmware, which I unclear factors (wrong connections to
had backed up before flashing the me- the JTAG, too long wires, errors in the
3. A JTAG interface is quickly found.
ter (the meter has this option and you compiled utility, etc.), I decided that Unfortunatly no success trying to
should definitely use it) and the firm- this route was too risky. program the firmware this way.
4. The flash chip, a Spansion
ware I just flashed with an HEX-editor This meant that I would have to pro- S25FL016A, had to be desoldered.
and both revealed the same boot load- gram the flash externally. Because I 5. No harm was done to the PCB. It is
4 er. All bytes were equal. This should did not own a device programmer, I important not to overheat the PCB, to
avoid traces popping out.
mean that even though I flashed a searched eBay to figure out if there
6. Due to a lack of a suitable chip
wrong firmware (at this point I was not was a cheap solution. I always wanted adapter, small wires were soldered on
certain if I had a different hardware to own a device programmer, anyway, the 8 pins of the chip.
revision or if the firmware had some as it is a really useful device. I was 7. The chip was connected to the
device programmer. Extra care was
kind of OEM check), at least the boot sick of having to build parallel port taken to avoid any mistake connecting
loader should be operational. programmers that would only sup- the right wires to the programmer.
Again, I tried several flashing tools port one single chip type, whenever I if the programmed bytes matched the 7
for hand held satellite meters, but needed to program a new chip. ones from the original file. Everything
none did seem to work. EBay revealed a huge amount of dif- went smoothly without any error.
At this point I was pretty certain ferent device programmers at a broad This gave me the courage to solder
that my only way out of having trans- price range. I decided to spend as lit- the Spansion back onto the board. I
formed my meter into a brick was to tle money as possible and bought one turned the meter on and... It worked
actually program the flash chip myself. for just 37 Euros and free shipping. I again!
There are two options for this: one is thought that the risk was small, plus Not satisfied I did a more exhaus-
to look out for a JTAG-adapter on the the list of supported devices did in- tive Google search and this time came
main board, the other is to use an ex- clude my Spansion flash! up with a support site for yet another
ternal device programmer to write the After two weeks the device pro- OEM version of my meter. Though the
5 flash chip. grammer finally arrived. I installed the website was in Russian language, I got
I opened up the meter and looked software and tried to read and write around with Google’s translator and
for the typical flash chip but somehow some Atmel chips. Everything worked found out that it actually offered two
didn’t find it! Only after a long search fine. firmware releases, a flashing tool and
did I notice that this board was using The next step was to desolder the a settings editor. Despite the fact that
a serial Eeprom, which means that the S25FL016A from my dead satellite me- the tools were in Russian language
flash chip is actually a tiny chip with ter. Unfortunately I only own a regu- too (using Cyrillic characters), I tried
only 8 pins (4 each side). I found pins lar soldering iron and I was not able them out and this time I checked the
which correspond to a regular JTAG, to desolder this chip, mainly because hardware revision of my satellite me-
but the main CPU of the board was I didn’t want to destroy it. Instead, I ter and compared it with the pictures
an ALI chip. I had no JTAG utility that asked a friend for help, who owns a shown on the website: they matched.
would program a Spansion S25FL016A professional soldering station with So after having returned the me-
through an ALI CPU. A Google search tweezers and within 2 seconds, the ter from the brick-land for just half
did, however, point me to two inter- chip was desoldered without any harm an hour, I flashed it with this firm-
esting facts: done on either the chip or the PCB. ware version, only to find out that the
1) There are plenty of satellite re- Back home, I connected wires to meter was dead again. No problem, I
ceivers using the exact same CPU, un- each of the 8 pins, since I didn’t own thought. I could always flash it exter-
expected. Unfortunately, it would not fortunately with different flash chips. a compatible chip holder for my pro- nally with my new programmer.
turn on again: I was holding a dead Someone had adapted a flashing util- grammer. After connecting all wires to But since I would have to ask my
device! ity for this CPU and even included the the device programmer, the chip was friend to desolder the Spansion again,
“No big deal”, I thought, since this source code (C++). indeed recognized and I started the I tried the flashing tool first. Without
meter is provided with an extra RS- 2) From the router hacking scene programming cycle. The software of being able to understand any message
232 cable, that fits in the Audio/Video (DD-WRT and OpenWRT), I found out the programmer erased the chip (all displayed, I managed to figure out how
jack. Since no flashing software was that this Spansion S25L016A is not so bytes are set to &HFF), programmed to use it and who would have guessed
provided, I assumed that the flashing uncommon with routers and that later my original backup of the firmware it! It worked! I was able to flash my
could be done with HyperTerminal’s revisions of the same flashing utility and finally did a verification, to check backup to the meter, without having to
114 TELE-satellite International — The World‘s Largest Digital TV Trade Magazine — 04-05/2012 — www.TELE-satellite.com www.TELE-satellite.com — 04-05/2012 — TELE-satellite International — The World‘s Largest Digital TV Trade Magazine 115

4. 8 sure that you have a plan B, if things
go wrong. Normally, boot loaders do
provide a way to flash the firmware,
even if your device is dead (unless you
managed to delete the boot loader,
too).
3) You are totally at ease, if you own
an external programmer, which sup-
ports your flash chip. My cheap pro-
grammer has proven to be very good
value for money. It is impressive how
such a cheap programmer manages to
support that many devices. Another
thumbs up for this device, because
it works even if you just solder some
wires to the pins of your chip, instead
of using a proper adapter. Professional
9
10
Conclusions programmers would not work in such
1) Never trust a firmware-image way, requiring for each chip package
from a different OEM model, even if it the correct adapter (and such adapt-
looks exactly as yours! You might have ers cost more than my cheap program-
a different hardware revision, or the mer).
OEM producers might have implement- After this adventure, I can say that
ed some kind of firmware-check, that I am much more fond of my satellite
prevents cross flashing. The reason is meter and I have a deep respect on
of course the different level of support how miniaturized it is. It is a pretty
that each brand invests in its devices. good meter for standard installations
2) Before flashing a device, make and for amateur enthusiasts of satel-
8. Selection of the chip using the software
lite reception. Not being able to use it
included with the programmer. for two weeks made me realize how
9. The flashing operation was successful! much I depended on it. So I promised
10. After programming, the chip was myself to not flash it with any firmware
soldered back to the board and the meter
is working again! again…
116 TELE-satellite International — The World‘s Largest Digital TV Trade Magazine — 04-05/2012 — www.TELE-satellite.com