Set-top box research

Goals & Motivation

These Machines have decent specifications, but are completely useless without their "Command & Control Server"
I want to document them, find out what debug facilities they have, and try to run Software on them, to make them more than e-waste again.

The boxes in question

Telekom Media Receiver 500 Sat

MIPS based, UART available, just bootloader output

Specifications

SOC	Broadcom BCM7405, 400 MHz
RAM	256 MB DDR2
Flash	4 MB
Storage	500 GB SATA Drive
Networking	100 Mbps Ethernet
Operating System	Windows CE 5.0

BCM7405 Datasheet
Reference Design
Memory Map
Seagate ST3500312CS

External interfaces

Front:
Power Button, VFD? (12x2 Cells of 7x5 Pixels plus 6 Symbols), 8 Buttons, USB 2.0
Back:
SCART IN, SCART OUT, Analog Stereo, Composite, S-Video, S/PDIF Coaxial, S/PDIF Optical, HDMI, eSata, Ethernet, USB 2.0, Reset Button, Smartcard Reader, 2x Satellite, Power, Power Switch

Internal interfaces

3x UART (Only 1 confirmed, with pin header)
Sata Data and Power (no 3.3V)
7x2 unpopulated header, possibly EJTAG 12V in, flex cable for front panel, connection to tuner

7x2 pinout

PCB corner is bottom left

	|DINT|SRST|TCK |TMS |TDO |TDI |TRST|
	|0V  |3.3V|3.3V|3.3V|3.3V|3.3V|0V  |
	------------------------------------
	|3.3V|0V  |GND |GND |GND |GND |GND |
	|VIO |    |    |    |    |    |    |

Since the ground connections, and voltage levels are as expected for EJTAG, and SRST does reset the System when pulled low, this really looks to be EJTAG.
DINT is optional as per EJTAG spec, and not mentioned in the BCM7405 datasheet so I assume it is not implemented.
Unfortunately have been unable to get JTAG communications going so far, using a Raspberry Pi 4B as a probe with urjtag, I may try again with openocd and/or with a Pi Pico as the probe, but I don't expect that to make much of a difference.
As far as I can tell there a few options why EJTAG might no work.

Disabled with SecureDebug
Disabled in a SoC-specific way
TDI/TDO/TMS/TCK are only pulled up to 3.3V, not connected to the SoC
Same as above, but just needs some pads bridged to work

Of course there is always the option that I'm just doing something wrong, which is very possible, since I have never done this before.

Boot process

No HDD, No Network

UART

	Cisco IPTV bootstrap
	Stage 1 started

	Cisco IPTV bootstrap
	Stage 1 started

	Cisco IPTV Boot v2.8.21.1


	Loading 2nd stage

	Launching 2nd stage

	BRCM74050011
	cT1FVJ
	|	Microsoft IPTV Bootloader --- Loader Module starting....

	BRCM74050011
	cTHD1FVJ
	Microsoft IPTV Bootloader, build (1021)
	Built by BM-VM-1804, Jul 10 2012 12:05:37

	HALTING

Front panel

	Fehler Ini-
	tialisierung

Display output

Holding Menü & OK (I redacted the Device Identity)

UART

	Cisco IPTV bootstrap
	Stage 1 started

	Cisco IPTV bootstrap
	Stage 1 started

	Cisco IPTV Boot v2.8.21.1


	Loading 2nd stage

	Launching 2nd stage
	1R[B1]!|

	***[ Cisco S2NL v1.13.8.1 ]***


	Device Identity:
	SN=000000000  MAC=00:00:00:00:00:00  GUID={0000000000-0000-0000-0000-0000000000}
	VenId,HwID=0,0000  DNCS=00000,00,0x000000  [Ignore-SecSi]

	USB: Checking for boot file...


	Download Server: Obtaining app

Front panel

	USB Boot
	Launch Dir.

Pictures

ToDo

Telekom Media Receiver 601 Sat

ARM based, UART available (2mm pitch pin header), just bootloader output

Specifications

SOC	Broadcom BCM7252S, 12000 DMIPS
RAM	2048 MB DDR4
Flash	512 MB NAND
Storage	500 GB SATA Drive
Networking	1 Gbps Ethernet
Operating System	Linux

External interfaces

Front:
Standby Button, OLED Display, 4 Buttons (UP, DOWN, TV, MUSIK)
Back:
2x Sattelite, S/PDIF Optical, S/PDIF Coaxial, HDMI, 2x USB 3.0, Ethernet, Power, Power Switch, Reset Button, HDD Tray

Internal interfaces

Flex cable for front panel, JBBS3501 1x4 (BBS=Broadband Studio, May be I²C or SWD), UART (2mm pitch pins), SATA Data and Power, JDEBUG_MCU2400 2x6 (Name suggests JTAG, seems redundant if JBBS is SWD)

Pictures

ToDo