Previous Thread
Next Thread
Print Thread
Page 1 of 2 1 2
#123082 01/22/24 11:56 PM
Joined: Jun 2001
Posts: 274
M
Malice Offline OP
Senior Member
OP Offline
Senior Member
M
Joined: Jun 2001
Posts: 274
i'm going to start out with with posting info about this in case it's viable for emulation

# cd proc
# cat cpuinfo
system type : BCM97xxx Settop Platform
processor : 0
cpu model : MIPS 24Kc V7.12
cpu MHz : 339.96
BogoMIPS : 339.96 ( udelay_val : 169984 HZ = 1000 )
wait instruction : yes
microsecond timers : yes
tlb_entries : 64
extra interrupt vector : yes
hardware watchpoint : yes, count: 4, address/irw mask: [0x0000, 0x0004, 0x0000, 0x0000]
ASEs implemented : mips16
shadow register sets : 1
core : 0
VCED exceptions : not available
VCEI exceptions : not available

Joined: Jun 2001
Posts: 274
M
Malice Offline OP
Senior Member
OP Offline
Senior Member
M
Joined: Jun 2001
Posts: 274
cat hwinfo
CFE_BOARDNAME: BCM97633 B0-SEC
CFE_BD_MODEL: D6100-ZA
CFE_Loader_type: OR
CFE_PLUS_MID: 46
CFE_Boot Partiton: 2
CFE Version Magic Number: 0x00020115
CFE SUN_TOP_CTRL_PROD_REVISION: 0x76330000
Flash Type: NAND
Number of Flash Partitions: 32
- Partition 0: Name: flash0.ucfe, Base 0x00000000, Offset 0x00000000, Size 0x00200000
- Partition 1: Name: flash0.drmregion, Base 0x00000000, Offset 0x00200000, Size 0x00100000
- Partition 2: Name: flash0.drmregion.1, Base 0x00000000, Offset 0x00300000, Size 0x00100000
- Partition 3: Name: flash0.rawnvr, Base 0x00000000, Offset 0x00400000, Size 0x00100000
- Partition 4: Name: flash0.macadr, Base 0x00000000, Offset 0x00500000, Size 0x00000090
- Partition 5: Name: flash0.nvram, Base 0x00000000, Offset 0x00500090, Size 0x00000770
- Partition 6: Name: flash0.virtual, Base 0x00000000, Offset 0x00500800, Size 0x000ff800
- Partition 7: Name: flash0.cfe.0, Base 0x00000000, Offset 0x00600000, Size 0x00200000
- Partition 8: Name: flash0.cfe.1, Base 0x00000000, Offset 0x00800000, Size 0x00200000
- Partition 9: Name: flash0.vault-a, Base 0x00000000, Offset 0x00a00000, Size 0x00080000
- Partition 10: Name: flash0.rootfs.0, Base 0x00000000, Offset 0x00a80000, Size 0x00a00000
- Partition 11: Name: flash0.vault-b, Base 0x00000000, Offset 0x01480000, Size 0x00080000
- Partition 12: Name: flash0.rootfs.1, Base 0x00000000, Offset 0x01500000, Size 0x00a00000
- Partition 13: Name: flash0.vmlinux.0, Base 0x00000000, Offset 0x01f00000, Size 0x00500000
- Partition 14: Name: flash0.vault-c, Base 0x00000000, Offset 0x02400000, Size 0x00080000
- Partition 15: Name: flash0.vmlinux.1, Base 0x00000000, Offset 0x02480000, Size 0x00500000
- Partition 16: Name: flash0.splash, Base 0x00000000, Offset 0x02980000, Size 0x00600000
- Partition 17: Name: flash0.exe.0, Base 0x00000000, Offset 0x02f80000, Size 0x05080000
- Partition 18: Name: flash0.pstor, Base 0x00000000, Offset 0x08000000, Size 0x00d80000
- Partition 19: Name: flash0.exe.1, Base 0x00000000, Offset 0x08d80000, Size 0x05080000
- Partition 20: Name: flash0.eeprom, Base 0x00000000, Offset 0x0de00000, Size 0x00200000
- Partition 21: Name: flash0.appdat_cmm, Base 0x00000000, Offset 0x0e000000, Size 0x04000000
- Partition 22: Name: flash0.ofefw.0, Base 0x00000000, Offset 0x12000000, Size 0x00300000
- Partition 23: Name: flash0.ofews.0, Base 0x00000000, Offset 0x12300000, Size 0x00100000
- Partition 24: Name: flash0.ofefw.1, Base 0x00000000, Offset 0x12400000, Size 0x00300000
- Partition 25: Name: flash0.ofews.1, Base 0x00000000, Offset 0x12700000, Size 0x00100000
- Partition 26: Name: flash0.sec_drm.1, Base 0x00000000, Offset 0x12800000, Size 0x00700000
- Partition 27: Name: flash0.sec_drm.2, Base 0x00000000, Offset 0x12f00000, Size 0x00700000
- Partition 28: Name: flash0.widget, Base 0x00000000, Offset 0x13600000, Size 0x0c200000
- Partition 29: Name: flash0.ofefw.2, Base 0x00000000, Offset 0x1f800000, Size 0x00300000
- Partition 30: Name: flash0.ofefw.3, Base 0x00000000, Offset 0x1fb00000, Size 0x00300000
- Partition 31: Name: flash0.bbt, Base 0x00000000, Offset 0x1fe00000, Size 0x00200000

Number of UARTS: 1
- UART 0: Channel 0, Base_Address 0xb0406b00, Divisor 0x0000002c, Baud_Rate 0x0001c200, Data_Length 8, StopBits_Flag 0
DDR Bank 0 Size (MB): 256
DDR Bank 1 Size (MB): 256
Number of Ethernet controllers: 1
- Enet Controller 0: MAC Address 0x** ** ** ** ** **

Joined: May 2009
Posts: 2,184
Likes: 282
J
Very Senior Member
Offline
Very Senior Member
J
Joined: May 2009
Posts: 2,184
Likes: 282
Viable for emulation? Definitely, though I'd hazard a guess that the emulation will be on the slowish side. Atari/Midway Denver games sport a 250MHz MIPS CPU and hit full-speed on a reasonably high-end PC, but 340MHz might be pushing it a little. Still sounds like something that would be fun to look at. smile

Joined: Jun 2001
Posts: 274
M
Malice Offline OP
Senior Member
OP Offline
Senior Member
M
Joined: Jun 2001
Posts: 274
I think it should be a interesting device for people to learn from

Joined: Jun 2001
Posts: 274
M
Malice Offline OP
Senior Member
OP Offline
Senior Member
M
Joined: Jun 2001
Posts: 274
I've got a very good scan of the bottom of the motherboard the top is going to be harder since i'll need to use a camera instead.
https://i.imgur.com/qRdYgDe.jpeg
there seems to be one small serial eeprom that i'll dump too on the bottom.

Last edited by Malice; 01/23/24 04:58 PM.
Joined: Jun 2001
Posts: 274
M
Malice Offline OP
Senior Member
OP Offline
Senior Member
M
Joined: Jun 2001
Posts: 274
I got a image of the top with most chip marking visible
https://i.imgur.com/fc0dfaT.jpg

Joined: Jun 2001
Posts: 274
M
Malice Offline OP
Senior Member
OP Offline
Senior Member
M
Joined: Jun 2001
Posts: 274
The small serial eeprom on the bottom seems to just be simple config data.

[Linked Image from i.imgur.com]

Joined: Mar 2001
Posts: 17,125
Likes: 163
R
Very Senior Member
Offline
Very Senior Member
R
Joined: Mar 2001
Posts: 17,125
Likes: 163
Makes sense. The region has to go someplace that isn't totally hard-coded, and probably some branding info so the same board/software are sold as multiple units.

Joined: Jun 2001
Posts: 274
M
Malice Offline OP
Senior Member
OP Offline
Senior Member
M
Joined: Jun 2001
Posts: 274
Yeah this serial eeprom could be changed at any point with a clip connected to a eprom programmer much easier then trying to change the NAND storage. The fact they store BD Player makes me wonder if the NAND firmware is also used for Samsung smart TV's with minor changes of course.

Joined: Jun 2001
Posts: 274
M
Malice Offline OP
Senior Member
OP Offline
Senior Member
M
Joined: Jun 2001
Posts: 274
I got an initial dump of the nand flash looking though it i think i found text but there maybe endianness swapping going on or something

[Linked Image from i.imgur.com]

this is my first time dumping nand flash so any tips would be appreciated

Page 1 of 2 1 2

Link Copied to Clipboard
Who's Online Now
4 members (Pernod, Carbon, shattered, 1 invisible), 55 guests, and 0 robots.
Key: Admin, Global Mod, Mod
ShoutChat
Comment Guidelines: Do post respectful and insightful comments. Don't flame, hate, spam.
Forum Statistics
Forums9
Topics9,260
Posts121,256
Members5,064
Most Online1,283
Dec 21st, 2022
Our Sponsor
These forums are sponsored by Superior Solitaire, an ad-free card game collection for macOS and iOS. Download it today!

Superior Solitaire
Forum hosted by www.retrogamesformac.com