JTAG or RS232 and ODS2000C

[slugworth]

uctap v0.2b is an interface program for using st20 toolset and a receiver jtag program.
The jtag is wired differently than normal,the wire that usually goes to pin 19 on the receiver goes to pin 17 instead.Pin19 on the receiver goes to pin12 on the db25 via 100ohm resistor.The rest of the wires are the same.
Uctap is a command line program,so unzip to c:\uctap and install dropdos.
Drop to dos in the c:\uctap folder and run tap.bat
If the jtag is wired right you should get a screen like in the jpeg,except your processor will show instead of the sti5105.You then minimize the uctap screen(don't exit!) then you can hopefully run st20run along with the proper .lku file if/when one becomes available.St20run is part of the st20 embedded toolset,you will need v2.21 or later.St20run is also a command line program,so you will have to drop to dos for that also.Windows or any other firewall will complain,just unblock and allow the servers to run.
There is no reason to,but if you exit uctap for some reason you will have to reboot the pc to run it again,or you will get errors instead of the 3 successes.

[slugworth]

The source code for a sti5105 flash burner that runs under st20 toolset.
The code will have to be modified for the sst flash and your receiver processor.
The command line would be similar to st20run -i mb400.cfg -t yourtap wtmecburner.lku
The mb400.cfg is part of the st20 toolset and will have to be modified to match your receiver as well as the tap in the targets.cfg file(not included)

[inxhinieri]

You are great slugworth!

I'm trying to understand step by step the procedure, so when we have all necessary can test it in the right way.

Thanks again.

[slugworth]

The only thing you use st20 toolset for is the st20run.exe and support files.
When I was playing with it last year I got as far as the menu in wtmecburner,but it didn't detect the flash correctly.
Maybe a coder can look at it and tweak it to match the sst flash.
The technique is similar to the dcu3 jtag for the pace3100 receiver,that is what I am using as a guide.

[slugworth]

The source code for a sti5105 flash burner that runs under st20 toolset.
The code will have to be modified for the sst flash and your receiver processor.
The command line would be similar to st20run -i mb400.cfg -t yourtap wtmecburner.lku
The mb400.cfg is part of the st20 toolset and will have to be modified to match your receiver as well as the tap in the targets.cfg file(not included)

There are support files missing,so it will never be made into a .lku
If you look at the .tco files it tells you what version of toolset made it.
Sad,because that was the only .lku that had a menu and allowed you
to save the flash also.
It may work if you had the same processor and flash type.

[slugworth]

uctap jtag cable diagram.
any dcu3 attempts will require that.

[inxhinieri]

Means that for the sti5119 we can not do nothing?

[slugworth]

When doing dcu3 research you will need to know;
1. the processor type in the receiver,like sti5105,sti5517,sti5119 ect.
You need to know this for sure,if your receiver has a heatsink on the
processor you may have to take it off to get the processor type.
2. the type and number of the flash chip, like 29lv160, sst39vf3201, ect.
3. get the pdf file for your flash off the net.
4. the address the receiver uses for the flash chip.
Once you have that info you can play with making you own flashburner.lku
Use jkeys to get a full flash dump first.
This will verify all the above steps.

[slugworth]

A sti5119 with sst39vf3201 might be able to use the lku I made for the magnum3300,but I would need to know if the flash is indeed at address 40000000
Once that is verified, sti5119 receivers that have a 2meg flash would be able to use a modified lku file.
You need a good flash dump to play with first,or at least the bootstrap section of the firmware (1st 64k of flash if it's like the sti5105)

[slugworth]

Jkeys uses a 3 letter ascii string to determine the model of the receiver you are trying to dump.If you have a full dump and if you can find a string that is in all your receivers' dumps at the same place,you can edit the jkeys.def file to autodetect the model.

IRD, 24, "SkyView 1000", 15, 1, 1, 1, 2, 2, 0, 0, 0, 0,0x40010151, 0, "BA-", 3, 4
  IRDFlash, 24, "Flash 1(SST39VF3201)", 0x235B, 0x40000000, 0x400000, 2, 2, 0

In this case you would edit the "skyview 1000" to match your brand/model receiver;Find a short string and edit the "BA-" and finally put the address of the string instead of 0x40010151.In a hex editor you would write down the address of the string and add it to the 40000000 base address.So if "BOO"
as a part of the ascii "BOOT"was at address 70020 in a hex dump the jkeys address would be 40000000+70020 =40070020 If you are correct,when you run jkeys again it will detect the receiver and you don't have to manually enter the flash address and length before doing a dump.