Results 1 to 6 of 6

Thread: Sonicview Sv-1000 still work?

  1. #1
    Join Date
    Oct 2012
    Posts
    78
    Satfix Buxs
    697
    Thanks
    21
    Thanked 7x in 6 Posts

    Default Sonicview Sv-1000 still work?

    do Sonicview Sv-1000 still work? I see there are "no" posts for them. this guy I meet has one real cheap!

  2. #2
    runamok's Avatar
    runamok is offline Visiting Dignitary/NFL WEEK 16 & 18 CHAMP
    Join Date
    Sep 2012
    Location
    35.2532° N, 82.1971° W
    Posts
    4,661
    Satfix Buxs
    1,430,309
    Thanks
    27,000
    Thanked 19,485x in 4,181 Posts
    Items beerWhiskeyA BeerSprint carFootballYing & yangTreeDoll

    Default

    It will not work with iks/private servers that is why it is so cheap.

  3. #3
    Join Date
    Dec 2012
    Posts
    1,365
    Satfix Buxs
    7,987
    Thanks
    9
    Thanked 1,523x in 764 Posts

    Default

    But like just about all older boxes, the code could be modified to do IKS. That box should have some old N2 files and they are easy to modify to support serial output of required strings in coolsat format and to get the returned CWs via serial port too. If you find a file that still lets you do the N2 radio signals on 97 degree bird, it can be pretty easy to test how the box's code saves CWs. Use serial port output to help you find were the code is to send strings out the port (you usually see some sort of output at 115.2Kbaud as a box boots up ). You might have to do a little work, but overall it only requires a 100 bytes or so of code to do IKS.

  4. The Following 6 Users Say Thank You to jvvh5897 For This Useful Post:


  5. #4
    Join Date
    Oct 2012
    Posts
    78
    Satfix Buxs
    697
    Thanks
    21
    Thanked 7x in 6 Posts

    Default

    I might give it a try as I'm one of the few that still using a converted Nano2, which runs great some days and seams to freeze a whole lot on others. If it isn't any better than my Nano, I could always go back to my original plan an get an dreamlink HD T5
    Last edited by lamothefitz; 02-11-2014 at 03:30 PM.

  6. #5
    Join Date
    Dec 2012
    Posts
    1,365
    Satfix Buxs
    7,987
    Thanks
    9
    Thanked 1,523x in 764 Posts

    Default

    Well, in the past I took a look at the code in a "Charlie fix" file from 2008. It is NEC processor inside, so MIPS code and there are lots of MIPS tools around--gcc varient does compile C code. I have a note file on the file I looked at, so a few routines found inside. As I recall sv used a common checksum type on the files, so you should be able to un-pack the code mod and repack with checksum fixed. I happen to like MIPS code, so I would think it would be a good experimenters box, but to really know that would need a look at what chips are inside and how hard it is to mod hardware (if one has an interest in that stuff, I think hobby use of FTA boxes rather than stuff like single board gizmos like raspberry PI would be good way to use these cheap old boxes)

  7. The Following User Says Thank You to jvvh5897 For This Useful Post:


  8. #6
    Join Date
    Dec 2012
    Posts
    1,365
    Satfix Buxs
    7,987
    Thanks
    9
    Thanked 1,523x in 764 Posts

    Default

    It looks to me that your mods would follow the work done for sv4k in :
    http://www.satfix.net/showthread.php...ds-to-sv4k-box

    Baaically, dale used one of the game routine's space to get RAM dumps using the "send n bytes" routine. Then once a few spots with info required for rq-sssp were found, modded one of the old Nagra ecm routines to send out the required packets, and modded another routine (can't recall where) to receive the CWs and used one of the CW save routines to actually get the processor to decrypt the packets with them. You would have to do much the same. Your files have a zipped (PK type that 7-zip can do) mainsw section, so one of your first tasks would be to learn to pack and unpack. The checksum can be figured with Hexworkshop, or some other simple 32 bit byte-wise sum routine could be used (pretty easy to write a lcc-win32 routine to do that for you) with the aid of calculator to do the last XOR step.

    Here are some notes on that old 2008 sv1k file:
    SV1000_V0331P_Charlie&Beverly_Fixed 8/29/2008

    Like the sv4k files this is NEC processor code. MIPSb type code.
    SFBOOTLD installs at bfc00000 in flash
    SFBOOT01 installs at bfc02000
    SFMAINSW at bfc20000 but contents are un-packed to RAM at 80020000
    "SFSATINF" 0xBFD90000
    SFCHNINF 0xBFDA0000 ?0x3BE00 bytes?
    key data @ 0xBFD60000

    Search for "SV1000_P.bin", select from the "PK" just before that string to end of file and save the selected part of .bin as a .zip file and then use un-zip program to extract the contents.
    01EC09 to 125AEe gives an extracted 25D6b0 sized file. That file should be loaded to IDA Pro at base addr of 0x80020000.

    Same span of file as above simple sum is 089b9fd6 then XOR 19450815 = 11DE97C3 as seen at 0x1ebed (0xc bytes into SFMAINSW)

    Disassemble @8002087C ?does a big chunk of the code at start of file?
    But hit c at 80044008 to really kick off main code diassembly. This is just before an NEC copyright notice BTW.

    Using the sv4k IDC with start addr changed to 80044494 gives more complete disassembly of the code.
    note needed to manually kick off at 800F2F94 too--need to make that addiu search better!!

    note settings for gp and sp registers:
    ROM:80020034 la $sp, unk_80043058
    ROM:8002003C la $gp, unk_8003CCD8

    end of file @8027D6AF


    80142190 # Zmodem init (2a 2a 18)
    80143D3C # init zmodem xfer (0x18.....\r)
    80141CE8 # send null terminated string out serial port
    80141A9C # send byte out serial port
    80141AE0 # 2nd send byte out serial port
    80141D40 # send hex format byte to serial port
    801423C4 # send 2a 18 to serial port using 2nd routine
    8014410C # check the file extension
    80144CC4 # do "dxmain.rom"
    8015C9B0 # send "VX" serial message
    8015CA30 # serial send "........-" file header and VX message

    800DE95C # display msg on screen
    801D631C # memset
    801D6224 # memcpy
    801D8310 # memcmp?--string compare
    80145434 # test for file header like "SFMAINSW"
    8015CE7C # "Software Downloading..." and flash update
    8015E13C # read file from serial port
    8015D8A4 # "Data Uploading..."
    800BEB10 # do ui main
    800BBD7C # install task
    800BE02C # install ui
    8009229C # install a task handler?
    80162770 # save CWs? based on 0/1 even/odd
    8015F6DC # NAGR_ProcessEcmData
    8016383C # nagra2_ecm
    80164B2C # NAGRA2ECM
    8016AC60 # N2ECMNew
    80167C50 # nagra2_newecm

    800BC490 # read sw version stuff in flash--bfc02010, bfd90010

    800BC598 # S2010F test
    80145A80 # header checksum--uses 0x19450815
    80145ED8 # mainsw transfer
    80145914 # sw update callback?
    800BAF44 # delay?
    80188BBC # flash block erase?
    800D0CAC # 0xbfd80000
    800B435C # enter PIN code OSD
    800DC688 # OSD "Channel is locked"

    ?possible PIN codes? 0x7530 (30000), 0xEA60 (60000), 0x11170 (70000), 0x13880 (80000), 0x15F90, 0x15F91
    main PIN? 0x8C2 (2242)--yep, see it in lots of places
    in ui main:
    ROM:800BEE60 li $t9, 0x8C2

    800E132C # OSD "turn off after" "min"
    800D75F8 # OSD "AUDIO" "STEREO"
    801292D4 # OSD "MOVE" RESIZE ZOOM"

    801D83FC # strcmp?
    8017FC08 # year/mo/day?
    8016CE68 # RSAmod load for EMMs?
    8016F428 # idea/RSA steps
    80163DA4 # ?autoroll?
    80182170 # "sc_cass_process" EMM handling?
    80181D58 # "sc_cass_process" ECM handling?
    8010F6A0 # OSD "Stand-by mode AutoRoll"
    8010DFD0 # OSD "Auto Dolby Select" "No Template Loaded !"
    8010B944 # OSD "TV Type" "AV Settings"
    800C83F8 # something to do with chinf? 0x3BE00 bytes
    800CF03C # copy chinf from flash
    800E07CC # Edit CHINFO and save
    8015DAF0 # set up sat and ch info for send to PC?
    8015DCDC # send sat and ch info?
    80188D2C # erase bfda0000 area
    80074D34 # low level serial port routine. note B2001000 register use
    8007485C # Read? low level serial port routine. note B2001000 register use
    80076A9C # send n bytes out serial port?
    (handle?port?, buffer/location ,n) port usually = 1
    800769BC # read n bytes from serial port w/timeout
    (port#, buffer, n, timeout)
    8015CE0C # serial port task handler--installed as "ui_beep"?
    ------------------------------------------
    IR custom code 7d 37 (125 55) NEC1--Hum lirc and other sv-1000 jp1 file shows 00 FF
    801B0550 # "PIN_HISR" task
    801B0584 # "REM_CBT" task
    801B22E0 # "RTC_CBT"
    801AF8F4 # "GPIO_CBQ"
    8019E260 # "GRP_RGA"
    800740B0 # install Uart RX/TX
    80076C88 # "VENCDRVA"
    8009C9F8 # "TunerTask" install
    800B3F80 # CC on/off OSD
    800BB1B4 # "APP_SEM"
    800BB284 # "APP_Q"
    800F0B74 # part of un-zip?
    801261D4 # something about volume /view
    8012B5D4 # something about volume and multipicture
    80128B28 # multipicture OSD

    8010CAD8 # Version info OSD
    80174A38 # select dump of card
    801D6F24 # sprintf

    ROM:8006E420--?part of remote look up table?

    8008544C # get a waiting AMES?
    80085AC0 # get waiting HISR
    800EA9F0 # part of EPG OSD?--has CC ON/OFF step
    800C79C8 # box init: move CH data from flash to RAM and test for proper header
    800BE6A8 # get button pressed code?
    800AB8FC # delete/save OSD
    800D93DC # edit sat OSD
    800A4BE4 # put a menu OSD on screen w/ title
    800D8BB4 # fav sat OSD
    800DAAC4 # another sat OSD
    800DF094 # select lang OSD
    800E22D8 # previous ch OSD
    800E3D90 # EPG reminder OSD
    800E5C1C # channel list edit
    800FDBC8 # another ch edit OSD--includes the FTA/CAS menu
    801120EC # dish settings OSD
    80117398 # transponder edit
    8011E568 # sort OSD
    801201DC # channel guide OSD
    801464CC # data transfer OSD

    8014BF34 # dish settings/blind scanning OSD
    80151934 # event timer/sleep/mode OSD
    801523E8 # another channel list OSD?
    8015ADA0 # Catagory OSD
    80105A60 # FTA/CAS OSD
    800FABD0 # OSD includes FTA/CAS--not called?
    8011A188 # send cmd by index
    800D13B0 # menu system
    80131920 # Tetris game
    8012EDA8 # Hexa game
    8012F360 # "Sokoban" game
    80105DB8 # "User Settings"
    800F2F94 # dish setting TAB OSD
    800DCAE8 # "Factory Reset"
    800A064C # put on-screen menu title string
    800B0A88 # put a string at a "line" on the screen
    800A99B8 # Debug message?
    800BDFD8 # get user response code
    8012ED34 # game over message
    If you have some specific questions about the way to do this, you can ask, but I have an ongoing project of my own that is taking most of my time, so I'm not going to walk you through it.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •