4

For the past few months, I have been using my spare time reverse engineering a set top box that will not be named. I am trying to run a media server or use it as a debian desktop. It is rocking a Broadcom BCM7410, which has little to no documentation as it was custom made for the company that builds the device. Right now I have found the serial header and have been communicating with it, it has CFE installed on it, but I can not abort the startup due to the integrated watchdog. Recently, via a datasheet for a similar chip in the same family,I was able to follow the traces on the bottom of the board, and find a very well hidden EJTAG solder points in a 14 pin formation (mentioned in the Linux MIPS wiki: https://www.linux-mips.org/wiki/JTAG). I found a piece of software that is compatible with a JTAG programmer I picked up designed to de-brick routers. It does seem to support the BCM7401, again which is in the same family, but the software will reject any chip that is not defined in the software, I was looking to add my device, but it requires something known as a "mpi register base". I could only think of it as meaning the Message Passing Interface base register, but I can't find any information on it. My question is, what does it mean and where/how can I find it? Thanks!

Link to required information in code: https://github.com/zoobab/zjtag/blob/master/zjtag.c#L285

Link to device list: https://github.com/zoobab/zjtag/blob/master/zjtag.c#L304

Improve this question

1 Answer 1

Reset to default
0

I would suggest just duplicating the BCM7401 definition, quite possibly it will just work. If not, try the other values in the table.

Improve this answer
3
  • 1
    I will give that a shot once the programmer comes in, I lost my last one :/ . Other devices have values of zero but what worries me is there is a family of chips that has different values for each product. I truly don't know what it does, and frankly, I have been a little lazy and haven't checked out the 3000+ lines of code to see what is does.
    – Rulon Rock
    Jul 20, 2019 at 18:09
  • It seems value of 0 triggers auto detection so you could try that as well
    – Igor Skochinsky ♦
    Jul 21, 2019 at 9:35
  • Good to know, once I get that programmer I will try that first. I'll accept the answer once I confirm it working.
    – Rulon Rock
    Jul 21, 2019 at 17:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.