GET K1 from Sti7111 STB

[sega25]

Hello friends,


I am working on a project. I have a box based on the STi7111 chipset , model DSI715TAT . This is a TATA SKY India DTH STB.


I want to extract the K1 key from this device, but I am facing some issues.


First, I tried using the UART port. I connected it and accessed it via PuTTY, but I only get the following logs:



TRACE BEGIN:TATASKY;DSI715;74;MX/GA320E#HY/H27U1G8F2B;CEA74A00048226146;844066735334;37070320;;;;;;;02.11.00 ;EPG;;;;;;;2906894401;2792759549;;748d16f48b000000;;;;;;;47;5281027927595498;;d9f7f010022d9c86;;7a#TRACE END


No commands can be typed or executed. I think the UART port might be disabled.


Then I tried using the JTAG port (20-pin). The chipset gets detected, and I receive the following JTAG logs:




IDCODE: 2D43B041 STI7111 detected


The CPU is detected successfully, but I am unable to read the flash.


Can anyone help me with this? I want to extract the K1 key.


Thanks in advance.

Spoiler

Sie müssen registriert sein, um angehängte Bilder zu sehen

 

[sega25]

Hello friends, I have a DSI715TAT Tata Sky STB box with the STi7111 chipset. I checked the UART port, and as I mentioned earlier, the UART port is blocked. The JTAG only reads this IDCODE: 2D43B041.


My next step was to glitch it and try to open the port, but that also did not work. After that, I removed the MX29GL320EH flash chip that contains the U-Boot, desoldered it, and successfully read the flash dump:


MX29GL320EH@BGA64.BIN


Now I need someone who can modify the U-Boot and enable the UART port. I already have all the required hardware tools; I just need a method to unlock/open the UART port. Can any brother help me with this?

 

[sega25]

Hi Friends,


I have a TATA SKY India STB with the STi7111 chipset, model DSI715TAT. As I mentioned earlier, its UART port is blocked and JTAG is also blocked.


I have an RT809H programmer and a BGA64 adapter, which I used to read the 4MB NOR flash (MX29GA320EH@BGA64). After reading the flash, I could not find U-Boot in the dump file. It may be encrypted.


If anyone has a U-Boot image with the UART port enabled/open, please share it. I can easily solder and desolder the flash IC.


I am also sharing a picture of the board.

Sie müssen registriert sein, um Links zu sehen

Sie müssen registriert sein, um Links zu sehen

Sie müssen registriert sein, um Links zu sehen

Flash DUMP

Sie müssen registriert sein, um Links zu sehen

 

[satelli]

sorry, file not found

 

[Token]

also hier ist das file downloadable.