tvdrive tsop help

[wino]

hi i have managed to completly remove the glue from the chip with no damage took about 4 hours though and have removed the atmel which is a st m59w640f and i now have the proble that i have a labtool 48xp and it is not in the surported list so i dont know how to read it and start looking for the byte locations as i have the paired card for it any help would be great

 

[davidh]

hi i have managed to completly remove the glue from the chip with no damage took about 4 hours though and have removed the atmel which is a st m59w640f and i now have the proble that i have a labtool 48xp and it is not in the surported list so i dont know how to read it and start looking for the byte locations as i have the paired card for it any help would be great

there isnt a data sheet out for the chip m8
may be try with a similar chip from st
how did u remove the glue?

 

[benny59]

hi i have managed to completly remove the glue from the chip with no damage took about 4 hours though and have removed the atmel which is a st m59w640f and i now have the proble that i have a labtool 48xp and it is not in the surported list so i dont know how to read it and start looking for the byte locations as i have the paired card for it any help would be great

try everything in the list marked{m58lwxxxx=56ts} m8 1 by 1----"these are the nearest match considering the chip isn't listed anywere ???????"

dont worry about id'ing the chip "just read it anyway

if the sa4200 dumps are anything to go by----------"the loader data will be the 1st in the dump, { the ird and bk will be stored right next to each other amongst a loads of fffffffffff's after the loader data}

 

[danty]

hi i have managed to completly remove the glue from the chip with no damage took about 4 hours though and have removed the atmel which is a st m59w640f and i now have the proble that i have a labtool 48xp and it is not in the surported list so i dont know how to read it and start looking for the byte locations as i have the paired card for it any help would be great

what iwanna no is HOW THE FECK DID YA REMOVE THE CRAP ON THE CHIP..can you endulge us all please m8.

 

[wino]

dremeld it down as far as u can go then i used nitromorse and a hobby wire brush took about 4 hours but i got every last bit off and looks as if there was never any on there

 

[wino]

plus its a tsop48 not a tsop56 like alot think

 

[bammy]

any progress on reading this chip yet?

 

[wino]

someone on another forum has read both the 48 pin and the 56 pin and cannot even find the ird looks as if its encrypted i also swapped a paired 48 pin tsop to a non paired box and comes up with a error message so looks like it is checksumed somewhere else so cloning is out

 

[linked]

how about trying intel - TE28F640C3T, TE28F640C3B and so on as the SA4200 56 tsop is read as a Intel E28F320J3A in a clanzer and me up48-f and gets bk & ird in the correct way we know from block 1.
just worth a try seeing as its still an SA box.

 

[linked]

i found a data sheet on another forum here ya go fella's

 

[wino]

this is not the right data sheet as the chip is not a m29w640t it is a m59w640t so would of thought that would be of no help

 

[linked]

thats what there using on another site m8 ?
i'm just the messanger...

 

[PIJ]

thats what there using on another site m8 ?
i'm just the messanger...

bullet dodger

 

[linked]

bullet dodger

lol
oh yeah gotta dodge them bullets a..
: multi :

 

[wino]

what programmer surports the m29w640t chip i have a labtool48xp and its not in the list thanks

 

[linked]

how about trying intel - TE28F640C3T, TE28F640C3B and so on as the SA4200 56 tsop is read as a Intel E28F320J3A in a clanzer and me up48-f and gets bk & ird in the correct way we know from block 1.
just worth a try seeing as its still an SA box.

like i said here i use intel id for reading sa4200 so give it a try .

 

[davidh]

what programmer surports the m29w640t chip i have a labtool48xp and its not in the list thanks

try the M29W640DT@tsop48
that is listed

 

[Spectre]

The Beeprog from Elnec doesn't have the M59W640T and that has an extensive device support list.

The revision chip in the box was likely a custom die for the specific customer.

If you can get the unlock and read sequences from a datasheet then building a reader would be possible, these datasheets aren't officially published though.

A slightly more elaborate way would be to stick a logic analyser on it and watch it being accessed.

 

[PIJ]

dooh ........................................................

 

[nozzer]

I suspect the m59w640f is a fairly standard 64Mbit (4Mb * 16) Lightflash device with 3v operating voltage. If thats the case then it should read without any special commands as it presents a standard flash memory interface as far as device reading is concerned. You should only need to start worrying about special commands when you try to erase/write to the device !

And yes, its likely that the Boxkey is held in an encrypted or compressed form within the flash. A standard way of operating with these kinds of boxes is for the flash image to be compressed using something similar to the Zip file method. A very small loader will then copy/decompress the flash contents into RAM from where it is executed.