FTA JTAG and REPAIR GUIDE

First of all, congratulations on buying a cable from Interface Place. I pride myself on
having some of the most innovative and best built JTAG cables you will find. You
should always be able to find the latest revision of this guide on my website,
www.interfaceplace.com. I will be doing my best to keep it updated, and I look forward
to hearing from anyone who has constructive criticism or ideas for the improvement of
this guide.

Following is a complete set of instructions for how to repair your receiver with JTAG. I
have performed the JTAG operation on my Pansat 2700A using both Skymax and jKeys
and documented some of the screen shots so that you can see what things should look
like. Some of the information seen in the screenshots may vary between my receiver and
yours.

Well, let’s get that receiver REPAIRED!!!!

The first thing you need to do once you receive the cable is determine how you will
connect it to your receiver.

You either need to have the header already installed in the board, or you need to install
the header I supplied with the cable.
If it is installed already, good. If not, here are some tips to help you install the header. I
don’t mind sharing tips on how to solder better, but this is not, nor is it intended to be, a
lesson in soldering.

If you have no pins, but holes, you will need to take the signal (green) board out to solder
in the header I include. Sometimes it is possible to take the board out just far enough to
allow it to be turned over without disconnecting everything, sometimes you need to
disconnect everything.

If you have solder in the holes (this sometimes happens) you will need to get some solder
wick/desoldering braid (Radio Shack catalog number 64-2090, $3.19) and use it with
your soldering iron to remove the solder.
Remove the solder (if present) from the holes using the braid.

Place the header in the holes and solder it in from the back.

Here’s a tip: Put or leave solder in 1 hole on the end of 1 row. When you are ready to
solder the header in, place all of it that you can in and apply pressure from the top with
your finger. It will be tilted, because of the solder in the one hole.

Heat the metal and solder, and when the solder flows, the pin will come through and
you can press the header flat to the board. Solder the hole on the opposite end next.
Now it will stay in place while you go through and solder the rest of the pins.

Once you have the header in place you need to know how to connect your cable. Refer to
the CD that I supplied with the cable for the orientation of the cable as relates to the
header pins.

To connect a Universal FTA cable you will need to know the pinout of the receiver you
are working on. Here are some common pinouts:

20-pin headers:
TRST Pin 19
TDO Pin 15
TDI Pin 13
TCK Pin 11
TMS Pin 9
GND Any even numbered pin

10-pin headers:
TRST Pin 8
TDO Pin 6
TDI Pin 1
TCK Pin 3
TMS Pin 4
GND Pin 9

12-pin headers:
TRST Pin 11
TDO Pin 7
TDI Pin 5
TCK Pin 3
TMS Pin 1
GND Pin 2 (any pin from the second row)
 Tip: When the circuit boards are designed, the header pads or silkscreening are
designed to show pin 1. In some cases, the pad for pin 1 is square, while the rest are
round. In other cases, the silkscreening will show a rectangle around the header holes,
and the corner with pin 1 will look cut off.

Now that your signal cables are hooked up, hook up the ground clip (various colors).
Check the ground. Wiggle the alligator clip a little bit so that it bites through any coating
that may be on the case or frame of the receiver.

Connect the DB25 end of the cable to your computer parallel port now.

Make sure that if you have the battery pack option, you have fresh batteries in the cable.

If you have the USB power option, plug it into the USB port on your computer now.

Using the switch on the back of the receiver, power it up.

There are two different programs you could use to communicate with your processor;
Skymax and jKeys.

Many people prefer Skymax for ease of use, but like jKeys, it can also have it’s quirks.

The basic procedure is this:

Skymax:
Before running the executable file (.exe), you should check to see that the program is
configured to work properly with your operating system.

If using Windows XP:

-Navigate to the folder that contains your Skymax executable file.
-Right click on the Skymax executable file.
-Select Properties
-Select the tab that says Compatibility
-Check the box next to “Run this program in compatibility mode for:”
-From the drop down menu, select Windows 98/Me
-Click Apply
-Click OK

If using other versions of Windows, no modification should be necessary.

Run Skymax.

Select the size of your flash memory (1MB or 2MB).

Click START.
You should see the text scroll and it will say Init JTAG, etc.

When Skymax gives you a Init OK :), you have communicated properly with the
receiver, and can begin the repair process. If Skymax returns Init Fail, you must re-check
your connections and go back and make sure that the power to the STB is on, the power
to the cable is good, and that you have a good ground.

Assuming all is well, the next step is to erase the flash memory.

Click Erase. Wait for the flash to erase.

Click Erase. Wait for the flash to erase.

Click Erase. Wait for the flash to erase.

That wasn’t a mistake, and you read that correctly. Erase it three times. That way you
can be sure that it is clean, and I don’t have to go into anything like what to do if you get
an error saying that your flash is not erased.
When prompted, click OK.

You are now ready to write a factory .bin to your STB.

Click Write.

Navigate to the factory .bin file and select it.

Click OK.
Once Skymax is done writing,
power off the STB, remove power from the JTAG cable, remove the cable from the STB,
and power up the STB.

You should have lights on the front, either a On or a 0000.

jKeys:
jKeys is a little more involved, but can be a very nice utility if understood.

One of the first things to understand about jKeys is about the .def, or definition file. This
file causes many headaches because people don’t take the time to read the documentation
that is supposed to come with each copy of jKeys.

The jkeys.def file contains the flash and processor information cross-referenced to each
STB. What happens sometimes is that people modify this file to include only the STB
info they need, and then when someone gets that copy they are screwed.
If you are interested in using jkeys to repair your receiver, check the flash memory of
your particular model. I mean actually check it. Open the cover of your STB and look at
the memory. Write down what it says on the chip. If you don’t have a heatsink in the
way, write down the processor information, as well.

Look in the jkeys directory on your computer and open the jkeys.def file with Notepad.
Read what it says, and read the other file that should be in the same directory, FLASH
and IRD definitions.txt. After reading and understanding this, make sure that your STB
information is in the jkeys.def file and it is correct.

Open jKeys.exe.

Your processor, flash info, and STB model should be displayed in the appropriate fields.
If your IRD Model does not appear in the proper field, use the drop down selection box to
choose it.
Example: the Pansat 2700A is listed in this “jkeys.def” file as “STi55xx_2M”, but I could
have easily changed the name to My Pansat 2700A, or anything I wanted, by editing the
info in the .def file.

Click File|Preferences and select Parallel Port.

Click OK.

Click Flash Programming.

You will see a window pop up that gives you two ways to enter the flash programming
mode. You will actually not use either of these methods for the majority of receivers.
Instead, when this window comes up, just click OK.

Once in the Flash Programming window, look in the upper right corner at the box called
Chip/Sector Programming. Make sure it reads Full; if not, use the drop down menu to
select Full.

Click Erase. Click Yes.

Wait for the flash to erase.

Click Erase. Click Yes.

Wait for the flash to erase.

Click Erase. Click Yes.

Wait for the flash to erase.

.
That wasn’t a mistake, and you read that correctly. Erase it three times. That way you
can be sure that it is clean, and I don’t have to go into anything like what to do if you get
an error saying that your flash is not erased.

You are now ready to write a factory .bin to your STB.

Click Program.

Navigate to the factory .bin file and select it.

Click OK.
Once jKeys is done writing,

power off the STB, remove power from the JTAG cable, remove the cable from the STB,
and power up the STB.

You should have lights on the front, either a On or a 0000.

Following are some exceptions to the above procedure. These are things that I have
accumulated over some time, and not all have I tested. If you can not get something to
work following the above steps, look below for some ideas.

Ogre

Ariza/Fortec Lifetime and Ultra:

Ogre:
If having problems getting into Flash Programming mode with jKeys, try turning the
power off and back on, then clicking OK within 3 seconds. This is one of the options
listed in the Flash Programming screen.

The rest of this is piecemeal that people have written on forums:

0xFFFFFFFF is mean Jtag wire is not connected with IRD .

0x00000000 is mean Jtag wire had connected mainboard but not turn on IRD yet .

solution: turn on switch on back Pansat2500A receiver .

Error reading from IRD (DCU Peek) .is mean Jkeys sw is not recornigze CPU Sti 5518 for Dianogtic..

Reviving an Ultra

The following method has revived two Ultras that were “dead,” both had ….BTC-70 chips, and the units
were dated Nov 2004 and Jan 2005.
Another one was revived 11/29/05 and the following steps were used. Following these steps should
eliminate the DCU Fail error messages. Hopefully, I remembered what I did better this time. Since then,
many Ultras revived.
All the files that I used can be found in the Revive Ultra Loader and bin zip files that are attached to avoid
hunting for them. Download them both to a folder and unzip them.
First thing is to hook up the jtag cable ( or a printer extension cable between the Ultra and the computer).
The approach below should be followed to the letter to avoid DCU Fail error messages.
Turn the Ultra ON in the back.
Run the SKYMAX_up1.3.exe program (see picture below).
Click on START.
Click on Erase. Wait till it competes.
Turn the Ultra OFF in the back. Wait 10 seconds.
Turn the Ultra back ON in the back.
Click on START.
Click on Erase. Wait till it completes.
Turn the Ultra OFF in the back. Wait 10 seconds.
Turn the Ultra back ON in the back.
Click on START.
Click on Erase. Wait till it completes.
Turn the Ultra OFF in the back. Wait 10 seconds.
Turn the Ultra back ON in the back.
Click on START.
Click on Write this time.
You will be asked for a bin. Use the fta.bin file that is in the Revive Ultra bin.zip file. Presumably, you
unzipped the Revive Ultra Loaders and bin.zip files to a new folder you created.
You should see the 00000000 window changing. I think the all zero window counts up to 7FFFF000 when
it is finished. Wait several minutes till this completes, and turn the unit OFF and disconnect the jtag cable.
If an error message occurs, Exit, turn OFF the unit, and repeat the sequence till no error message occurs.
Upon turning power back ON, you ought to see the clock/channel lights. At this point you are ready to load
a functioning bin.
Attach the serial cable now, and load the file pusser122105.bin which was made with new keys from 282t3
using Blacklist STB UPDATER 1.3.exe, all of which are included in the Revive Ultra Loaders and bin zip
files attached, and then scan the satellite of interest.
If you use FortecLoader, select Flash, then pull down the menu to get LifeTime Ultra, browse to enter the
bin and Download. Should the FortecLoader not work, I’ve also substituted Blacklist STB UPDATER
1.3.exe.
Hope this saves someone some time, and the DCU Fail error does not cause a problem.

Here are the ultra chipsets that are good with Pansat bins:

GOOD COMBOs

good ==cpu>sti5518bvc chipset>39vf800a 70 4c ek

good ==cpu>sti5518bvc chipset>29lv800 btc 90

bad(meaning do not flash with pansat bins)

BAD COMBOs

bad == cpu>sti5518bqc chipset>39vf800a 70 4c ek

bad ==cpu>sti5518bvc chipset>29lv800 bbtc 70

Bad (meaning not to flash with Pansat bins)

As previuosly posted: - bad == cpu>sti5518bqc chipset>39vf88a 70 4c ek
bad == cpu>sti5518bvc chipset>29lv800 bbtc 70

ADD ---------------------- bad == cpu>sti5518bvc chipset>29lv800BE - 70 PFTN

Fortec Ultra

This was posted by 4q2 at al7bar and it surely applies here too:

Warning...warning...warning
--------------------------------------------------------------------------------

It seems that there are many members that cannot understand what a WARNING means. They choose to
ignore warnings and then whine about their failures to heed warnings.

Current official releases for Pansat receivers will contain code designed to prevent the file from being used
on clone boxes.

They have done this to protect their business from clone boxes that use their technology by copying it.
Coolsat does the same thing. There are no Viewsat clones at this time but when there are, I'm sure they will
follow suit. There are huge shipments of cloned Fortecs enroute to the market right now.

Pansat files damaged a few genuine Pansat boxes recently. They took it on the chin and repaired those
FREE and even paid the return shipping to the owner. They made a mistake and worked hard to fix that
mistake. I have no reason to believe that other brands would not do the same. Viewsat has been very good
to stand behind their products.

If you choose to save a couple of dollars by purchasing a clone, be advised that the coding teams are going
to do everything they can to prevent you from being able to use it. Currently their files are modified to
remove their protective code and then reposted as "clone tested" or some other version. They will be
working to make that more and more difficult with the intent to make it impossible.

There are some boxes on the market that have no real support. There are others that are well supported.
Naturally, those that are supported have the largest market share. They intend to keep it. That's business.

If you own a clone and screw it up with a file, you're on your own. Current files have not damaged genuine
boxes. Were it to happen, I hope that the manufacturers would respond as they did a few weeks ago with
Pansats.

There are also a lot of fear mongers that are trying to spread hate and discontent through malicious posts
about malicious code. They are jealous or have other agendas. This thread will not become a vehicle for
their rants. Nor will it become an altar for buttkissing. These are facts. Deal with them.

You've been warned (again and again and again)!!!

It doesnt matter, original or clone!

I never ask people to download Pansat firmware for Ultras.
Just tell me, DO WE HAVE PROBLEMS WITH PANSATS!?
NO!

Regards
Blacklist

Ultrasat
bin found in downloads, coolsat files, jtag a coolsat using coolsat resucitator kit. I used jkeys set
to 4900 recvier. not cooltec recvier. good luck

JTAG a Coolsat using Coolsat Resucitator Kit

Hello to everyone. Today I got a new Coolsat4000Pro and I soldered a 20-pin header to the JTAG
connector on the main board. The connection diagram is the same as Pansat 2500a so, any JTAG
built for Pansat 2500a can be used with Coolsat. After that, I reset the box to its Factory Settings
using the option given in the Menu. Then, I connect my buffered JTAG to it, and using skymax
did a read of the flash memory saving this file as Coolsat4000Pro Factory Flash. This file and all
that is needed to bring a Coolsat4000Pro receiver back to life, including a how to document, is
contained in the Coolsat4000Pro Resucitator Kit.rar.Good Luck and Happy testing !

PanTec
Ogre:
The first thing to do here is figure out if you have a PanTec MX or MS. This task alone
can be difficult, as there seem to be many different variations of the PanTec. There are
many knowledgeable people on the forums that can give you lots of good information
and help you determine your model.

MX:
This receiver does not have a JTAG header, nor does it have a place to install one.
Because of the technical nature of the JTAG install, I will not be including instructions on
installing a JTAG to this box; at least not in the first version of this how to.

MS:
This receiver usually has a 10 pin JTAG header installed. If not, you will have to install
it yourself. I provide a header with the FTA cables I sell.
Once the header is installed, if you purchased the cable from me, you can refer to the
picture below to connect your cable.
After that, it is simply a matter of following the instructions for the software program you
are using (jKeys or Skymax).
Digiwave
7000
In the Pansat 2700a download section
Downloaded the Pansat 2700a J-Tag Repair Kit
Download Skymax 2.1

Now i used Skymax 2.1 first

hook your J-Tagg cabl;e up and click on start on Skymax and it'll find your incode and all that
stuff
now click on erase and erase 3 times
Exit out of skymax and use the unlocker program found in the Pansat j-tag repair kit
Now when you open up the unlockler program click on detect and should detect ird # and box
keys
Now it will open up unlock and at the very top you'll see full
click on unlock and it'll unlock all sectors
Now click on Flash programming and use the j-tag dump bin file found in the Digiwave download
section under J-Tag Digiwave by YONO
After all that unhook j-tag cable, turn power off from switch on the back of the receiver and your
ready to flash!!!

6800
Flash Digiwave

Quote:

Originally Posted by
i am stuck in boot mode (6800), i tryed the tricks to download firmware as read but no luck.
so i am trying to jtag the ird, i build the simple resistor version it detects fine but when i try to
erase the chip i get Flash time out (DQ5 set) .click ok and get
error detected erasing sector
i always used a buffered jtag before this is the 1st time i am useing the simple version, would i
be better off useing the buffered vesion?

HI it is such as this ..... ground Resistor R005 (is pin115 of Sti5518 for DCU peek poke not for
Cpu boot from Rom )...still not solutions ..must put pin 7 epprom to H level ..or Pulse 12vpp by
osciloscope ...for disable protect mode for erase it ...total 34 Sector ...made It s stuck on "boot"
..Then.Flash by firmwaver any ver Digi ...that' ok

just to make sure on my part pin 7 of the small eeprom and not the 2Mb flash, correct? If you
know designator of the chip would be excellent, ie. Uxx. can you point me to the
orignal threat of . thanks in advance. I tried to searh and nothing came up.

yes It is here ....but Jtag for Digiwave when erase is not OK ...seem hard fix it ..hope your
endeavor is affect success. I importance first ..must ground Resistor R005 at side CPU Sti5518
...when you power on IRD 3 sec ....for after not error massege
Poor Mans Jtag fix.

You may also use wall v2 to hold the cpu low and use jkeys 211 with correct def file for digiwave
,D ground pin 7 of the JTAG header with a toggle switch . You can use old computer MB push on
connector on the end of you jtag for no solder quick fit. Wall V2 is picky so timing is key first turn
on recvr then click reset uP in wall v2(ignore errors) then open jkeys and you will get no errors
selct D7000 for your recvr type enter flash programming flip toggle switch to gnd pin 7 of header
then you may click read to save orig then erase 2 times(when correctly erasing it will pulse
rythmicly to count 34) then load up the known good bin of your choice. sometimes the erase will
dump halfway through just keep telling it to erase untill is 100 percent successful. then loadup.
This is best done with buffered Jtag with external batt pwr source. 5v

EOF.

I am not done yet!

There are people out there with more information,

that they think should go into this guide!

If you are one of them, send me an email at

interfaceplace@verizon.net or from my website,
www.interfaceplace.com.