Remote bricked after connecting to the wrong JP1 interface ?

[unclemiltie]

Yep. Works fine. Here's how to connect:
http://www.hifi-remote.com/forums/viewt ... 948#127948

Thanks for the link. That is helpful! That looks solely as UART/serial mode... which might be ok (not sure yet) but I suspect the need will be more in a bit-bang mode. Thoughts?

Before I jump down this rabbit hole... I should ask, has anyone already done this? (written an entire flash recovery program targeted at say jp1.4 remotes?) If there is anything already out there anyone is aware of (short of multi thousand dollar hardware programmers/debuggers) it would be great to know. I've not seen anything open source or mentioned but my Google searches may have just been slack.

I don't know of anyone who has done it and we do know of a number of people who have bricked their JP1.3 remotes and suspect that the remote somehow got into tool mode.

Might be an interesting experiment although given that you can buy a new remote for $20 not sure that the time investment is worth it for the small number of remotes that you would "fix"

[digital_silence]

unclemiltie, you are definitely right wrt the value for effort. However, that would make a good learning exercise for those who want to see how it's all done.
So, the H/W and low-level protocol are clear. The biggest problem I can see now is where to get the BIN image to flash into the remote. It possibly can be read from the other remote of the same model, but the PDF document specifically outlines the "Read Protection" mode in which (I quote):
"Once Read protection is enabled, it can only be disabled by performing a Chip Erase."
I would be surprised if the OFA did not execute that option to prevent reading of their code from the uCU.

But if anyone has such BIN dump for Comcast URC1067Bx3 , I'd be prepared to give it a try.

[unclemiltie]

I *think* this is what you are looking for...
https://static.arantius.com/misc/S3%20E ... amming.pdf

It describes Tool Mode programming for the S3 / SAM8 protocol.

Let me know if this is helpful or I am off base. :D

yea, that looks like it. I finally got a chance to read it and it's definitely the details on how tool mode works on the S3 SAM8 processors.


If you can figure out how to put the device into Tool mode and write the flash that could open up a bunch of possibilities, one of which is fixing bricked remotes (at least the JP1.3 S3F80 ones)

Definitely following this thread!

[digital_silence]

That looks solely as UART/serial mode... which might be ok (not sure yet) but I suspect the need will be more in a bit-bang mode. Thoughts?

I may be wrong here, but it looks to me like there might be a bit of a confusion here between the two communication channels.

1) The JP1 channel is used to program the EEPROM inside the remote via Serial or I2C pins of the micro used in that remote. For that communication, you HAVE to have a flash program code (aka firmware) already loaded into the micro. JP1 communication can not re-program the micro and can not erase its program code (at least in theory)

2) The "ReFlashing" channel (described in your PDF document) is used to (re)program the micro (load the program code into its flash memory). It uses the hard-coded routines inside the micro's h/w, and therefore does not require any previously loaded firmware to operate (i.e. can program a completely blank micro). It requires a micro to be put in a special mode (often referred to as "programming") by holding designated pin(s) high or low during the power-up (see my post on the previous page)

In general, those two channels are using DIFFERENT pins of the micro, so I assume, the JP1 connector can NOT (generally) be used for ReFlashing.

Note also that Re-Flashing protocol (2) described in your PDF document is NOT a UART/serial mode as you assumed, but is rather some proprietary protocol, similar to I2C, but not quite the same. Also, hardware-wise, it takes a bit more than just a bit-bashing, as the data pin is bi-directional, and the DATA pin of the programming host will have to be changing direction between output and input.

Happy to be corrected by JP1 experts here.

[unclemiltie]

My take was that since we suspect that we somehow got the remotes into tool mode with the JP1.3 interface that there was a way to refresh. But yes, someone would have to take a look to make sure that the pins on the interface were the right ones.

One of the hardware experts could figure this out. Is Tommy Tyler still playing with JP1 stuff?

[binky123]

So IDC-5 pin for JP1 is used for nRESET. The IDC-5 pin on a JP1.3 remote also goes to Pin 9 on S3F80 and can put chip into TOOL mode. Hence, it is recommended to not connect this pin when connecting to a JP1.3 remote.

I recall something about dangling wires also causing the S3F80 to go into TOOL mode as well.

It definitely looks doable to put the chip into TOOL mode using a special cable with IDC-5 connected.

[binky123]

Another thought is to reprogram the PIC controller on the JP1.3--JP1 dongle to put the JP1.3 remote into TOOL mode.

[unclemiltie]

So IDC-5 pin for JP1 is used for nRESET. The IDC-5 pin on a JP1.3 remote also goes to Pin 9 on S3F80 and can put chip into TOOL mode. Hence, it is recommended to not connect this pin when connecting to a JP1.3 remote.

I recall something about dangling wires also causing the S3F80 to go into TOOL mode as well.

It definitely looks doable to put the chip into TOOL mode using a special cable with IDC-5 connected.

But are the serial in/out bits the same in the JP1.3 mode and tool mode? IIRC the serial is done with one of the parallel IO ports on the SAM8 and it's really not a I2C interface but something that must be clocked properly for things to work

[binky123]

Yes, the pins are the correct ones for JP1.3 and TOOL mode.

P3.0 is SDAT.
P3.1 is SCLK.

3 P3.0/T0PWM/T0CAP/SDAT -- IDC-4 Rx RE3.0
4 P3.1/REM/SCLK -- IDC-6 Tx RE3.1
5 Vdd(+3v) -- IDC-1 V+
6 Vss(GND) -- IDC-3 GND
9 TEST -- IDC-5 +3v for TOOL mode for programming(use V+ from IDC-1).(in JP1 was nReset).

This is how some bytes are scrambled as it interprets SDAT/SCLK changes as valid commands.

So changing I2C Start and Stop doesn't seem too difficult.

[binky123]

The S3 Flash programming protocol uses inverted Start and Stop conditions, that is:
- Start condition SCLK = VDD, rising edge on SDAT
- Stop condition SCLK = VDD, falling edge on SDAT

I looked at libRemoteIf.pas file
original

// This procedure sends a "start" condition to the EEPROM. This is done by
// changing SDA's state from 1 to 0 while SCL is 1. We then set SCL to 0 in
// preparation for sending and receiving data.
procedure Start;
begin
OutPort(FiPortWriteAddr, FiOutBoth); // SDA=1, SCL=1
Delay(2);
OutPort(FiPortWriteAddr, FiOutSCL); // SDA=0, SCL=1
Delay(5);
OutPort(FiPortWriteAddr, FiOutNone); // SDA=0, SCL=0
Delay(2);
end;

// This procedure sends a "stop" condition to the EEPROM. This is done by
// changing SDA's state from 0 to 1 while SCL is 1. We make sure that SDA
// and SCL are both 0 when we start in order to guarantee that the transitions
// occur in the correct order.
procedure Stop;
begin
OutPort(FiPortWriteAddr, FiOutNone); // SDA=0, SCL=0
Delay(2);
OutPort(FiPortWriteAddr, FiOutSCL); // SDA=0, SCL=1
Delay(5);
OutPort(FiPortWriteAddr, FiOutBoth); // SDA=1, SCL=1
Delay(2);
end;

so for S3 Start and stop are now

// This procedure sends a "start" condition to the S3. This is done by
// changing SDA's state from 0 to 1 while SCL is 1. We then set SCL to 0 in
// preparation for sending and receiving data.
procedure Start;
begin
OutPort(FiPortWriteAddr, FiOutNone); // SDA=0, SCL=0
Delay(2);
OutPort(FiPortWriteAddr, FiOutSCL); // SDA=0, SCL=1
Delay(2);
OutPort(FiPortWriteAddr, FiOutBoth); // SDA=1, SCL=1
Delay(5);
OutPort(FiPortWriteAddr, FiOutSDA); // SDA=1, SCL=0
Delay(2);
end;

// This procedure sends a "stop" condition to the S3. This is done by
// changing SDA's state from 1 to 0 while SCL is 1. We make sure that SDA
// and SCL are both 0 when we start in order to guarantee that the transitions
// occur in the correct order.
procedure Stop;
begin
OutPort(FiPortWriteAddr, FiOutNone); // SDA=0, SCL=0
Delay(2);
OutPort(FiPortWriteAddr, FiOutSDA); // SDA=1, SCL=0
Delay(2);
OutPort(FiPortWriteAddr, FiOutBoth); // SDA=1, SCL=1
Delay(5);
OutPort(FiPortWriteAddr, FiOutSCL); // SDA=0, SCL=1
Delay(2);
end;

[unclemiltie]

Yes, the pins are the correct ones for JP1.3 and TOOL mode.

Cool, so this might work to unbrick some remotes

[Phobia]

Hello all,

I've got a pair of RCA RCRP05BR remotes that no longer work. I really like this particular remote as it has a ton of hard buttons, so I'm hoping to get these back in operation.

I've been reading and trying a few things to see what might be possible. I've downloaded the JP2Sniffer tool, and am not getting anything to return on the low test:

00 02 51 53 00

I've been reading this thread which talks about remotes similar to mine.

As I believe my remote has the same processor, I'm wondering if my problem started with me inserting the JP1 cable incorrectly into my remote, (which connects PIN 5) and somehow corrupted things.

Interestingly, if I reverse the JP1 cable on the dead remote, I do get a lot of data on the screen when removing or inserting batteries:

Code: Select all

FE F8 00 00 00 20 00 00 00 00 7F 01 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 C0 00 B4 3E 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 C8 20 00 00 00 00 00 20 00 00 00 00 00 00 00 FC 00 00 00 00 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 FC 01 64 11 FC 00 20 20 06 00 DC 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 7C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 F0 00 00 00 00 00 00 00 00 3A 00 FF FD E6 FF 00 00 00 00 00 00 F8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 20 00 44 00 00 20 00 00 00 00 00 00 00 20 00 00 00 DC AA 00 00 00 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 C0 04 00 00 00 00 0C 10 00 00 00 00 00 48 29 04 00 00 02 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 88 13 B4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 

Maybe this is mostly garbage - but I'm wondering if the folks working on an interface to reprogram this processor made any progress after the work happening on the thread above?

Thanks!

P

[vickyg2003]

It used to be that with simple JP1 remotes that it didn't matter what direction you plugged the cable in, it just didn't work if it was in the wrong way.

THAT IS NOT TRUE FOR JP1.3

When you plug a JP1.3 cable in upside down it will usually brick the remote, so it is very important to have PIN1 clearly marked on your cable and the remote.

[Phobia]

It used to be that with simple JP1 remotes that it didn't matter what direction you plugged the cable in, it just didn't work if it was in the wrong way.

THAT IS NOT TRUE FOR JP1.3

When you plug a JP1.3 cable in upside down it will usually brick the remote, so it is very important to have PIN1 clearly marked on your cable and the remote.

Thanks @vickyg2003 - any way to un-brick these? (did that thread ever go anywhere as far as you know?)

[Phobia]

Yes, the pins are the correct ones for JP1.3 and TOOL mode.

Cool, so this might work to unbrick some remotes

Hi there - sorry to reopen what appears to be a dormant thread, but I'm having a similar issue to that described above. I believe I bricked my remotes by inadvertently connecting my JP1 cable in a reverse orientation, which connects the interface to pin 5.

Just wondering - has any progress been made on a way to fix bricked remotes as described above?

Interestingly, if I reverse the JP1 cable (on one of the dead remotes) and run JP2Sniffer on low mode, I get data when removing or inserting batteries...

P