Firstly I am using the GX6622 version right now. I have one GX6605s version which requires the usb wifi but not yet powered it up. Still finalising the track layout and pin out under the microscope.
But my understanding is both chip versions with different brand names sold here in Indonesia both have telnet. I have seen a few variants of the board layout but all seem to have the same components.
The GX6622 version has 100+ pins, 1gb of external DDR, 8mb SPI flash, RS232, 2 USB and cat5 ethernet.
The GX6605S version is 68 pins, 512mb internal, 4mb SPI flash and 2 USB. Uart 3v TTL TXD pin 26 RXD pin 27 to pads under the board if not on top.
There is another version GX????, I suspect latter cpu version which uses a 16mb SPI flash.
The size of your firmware image would confirm the GX chip you have. Because the flash is 8 pin SOIC SPI external it is possible to swap to a 16mbyte flash and mod the code to use it. Also as you can reflash the flash IC so you cant brick the box.
I am using putty by ip on port 23 as per defaults for telnet. Possibly your firmware is different? I cant find those ports you mention open here, only 23.
There is no ssh in the firmware here, I wonder what your open ports are for.
The serial is at 115200, in my box it puts out about 10 characters and then seems to wait on something from the uploading program.
I have spend many weeks searching in Chinese and other languages for this project and have accumulated quite some info. The problem is while the Csky C610 processor is documented on github and their site is very active with support of newer Csky cpu's, there is no release of the rest of the Soc data which is produced by another company.
Makes it hard without the IO datasheet. There is a helpful pinout Gx 6605s in the Csky dev board schematic on their Github.
So reverse engineering the code to use the IO seems unavoidable. Fortunately the IO is separate in modules, not in the main app.
Some of the config and test tools I have found indicate the main app can work with large number of io devices, so expect the main dvb ap code to have may options of tuner and demod code within, somewhere there will be in the flash "data" block definitions of which one is used as they are configurable in the flash with config software tools.
Here is a list of the IO kernel modules I have you may already have found, and an what I think they do.
av.ko is video output
fe.ko is I2C for the front end, probably GX3211 demod in the Soc and a RDA5815M tuner chip under the shielding.
gpio.ko -still investigating connections.
panel.ko is I2C for a custom chip for which I have a datasheet, drives up to 4 led, 4 press button and the 7 seg displays.
rt5370sta.ko is the wifi.
So I have collected a lot of firmware tools, code and snippets for these chips also some datasheets of devices in the GX family. Shortly I will start uploading it and links to github as linux project, firstly I want to make one into a DVB-S2 weather satellite receiver but have no data on the GX3211 demod in the Soc as yet.
It seems the I2C and Spi Flash are used via standard linux methods like ioctl and mtb, flash tools etc.
As soon as I verify the pinout and schematic of the GX6605s board, I will sort out and start uploading all the info I cave collated and work I have done and as a RE project on my github. It will also take some time.
BTW what kink of hack do you wish to implement on the STB?