Web Hosting by Netfirms | Free Domain Names by Netfirms

Concepts, Hardware, Software

What are boxkeys and why do I need them?

Box keys are the "secret" keys contained on your CAM and in the TSOP of your IRD. These numbers are required to run camless (emulation or Atmega128). Extracting these keys depends on the model of your IRD.

Jtag accessible models:
2700, 2800, 2900 series. 
3700, 3800, 3900 series 
4700, 4800, 4900 series 
DP501/5100 and dp301/3100 
and with different pin out, the 6000 

Card reader models:
1000, 2150, 2300, 3000, 3500, 4000, 4500, 
5000, 5500, 7100, 7200 

To extract your boxkeys, connect your Jtag to your parallel port on computer. Place the pogo pins on the Jtag pads and plug in the IRD (do not turn on with power button or remote). Run Jkeys 2.x and your keys will appear. Sometimes you may need to re-open Jkeys a few times to get the keys. Make sure your Jtag pins are one the pads and you have the correct pinouts.

Having said that, you could try another method to extract from 3500 to 4500 model IRDs. This method is for the adventurous, and will require some familiarity with electronics.

Note from a board member who completed the read:
Posted by DTVTester

Yeah, after some jigging around I was able to extract them. I did the extraction over a 2 day period.... sounds like an operation... doesn't it. 8-)
The method that worked good for me was instead of soldering the 32 pin IC mount right over the chip, I inserted cat 5 wires to the main board,then I soldered the cat 5 wires to the 32 pin IC mount. The cat 5 wires inserted very nicely into the holes on the mainboard just by touching the end with the soldering iron.
This was a lot easier than trying to clean up the 32 pin holes on the main receiver board and inserting the IC mount

After that it was pretty clear sailing...

If you follow the directions word for word, it will work, but I would recommend checking all connections before you apply the 5 volts or 3.3v (through diodes)to the appropiate pins.

Thanx to Maestra for this excellent guide!

3500 - 4500 MODELS

READING BOXKEYS WITHOUT REMOVING TSOP FROM RECEIVER

What you will need:

1. IC socket 32 pins
2. Voltmeter
3. Soldering iron (15 watts or so)
4. Wires
5. Spec. Sheet for your TSOP (you can find it on the web site of the manufacturer.)
6. Good +5 VDC power supply (PC power supply is great)

Notice:

1. All the pin-out given here refer to TSOP made by AMD (AM29F040). If your TSOP was not made by AMD you will have to cross-reference the pin-out. Here's the schematic from AMD:

Steps to follow:

1. Open the receiver and find your TSOP inside. Your TSOP will look similar to that:



 

2. Around your TSOP you will see 32 little soldering pads. Gently heat them with your soldering iron and remove the solder in each holes.
3. Install your 32 pins IC sockets in position and solder it. Be careful where's is located pin #1 on the 32 pins IC socket.



4. Install 1 wire (6 inches long) in each IC socket hole except for holes #13,14,15,17,18,19,20,21
5. Tied together wires from pins # 1,2,16,22,24,30 and hooked it up to the ground wire of the power supply.
6. Tied together wires from pins # 3,4,5,6,7,8,23,25,26,27,28,29,31,32 and hooked it up to the +5 VDC wire of the power supply.
7. Now there is 4 wires left. Those wires will serve to give the right address at the TSOP to read.

Now a little bit theory:

We will read 12 different addresses from the TSOP, 4 of them for the receiver number (to validate the way we read it) and 8 of them will be the boxkeys.

Suppose your receiver number is R00 1234 5678 you just take 1234 5678 for our purpose and convert it to hexadecimal value using Windows calculator. Open your Windows calculator and put it in scientific mode then click on Dec radio button. Write down your number and then click on Hex radio button, you will have :

Because the answer is not 8 digits long but 6 we will add two zero at the beginning so BC614E will become 00 BC 61 4E. If your number is 7 digits long you will have to add only one zero at the beginning.

Now the first pair of digit from your receiver number (00) is located at address FFF0 in the TSOP, the second pair of digit (BC) is located at FFF1, the third pair (61) of digit is located at FFF2 and finally the last pair (4E) is located at FFF3.

The put the TSOP at the address we want to read you just follow this:

Example:

To read the first pair of digit from the receiver number at address FFF0. Pin #9, #10, #11 and #12 must be at zero. That mean you connect the wire from pin #9, #10, #11 and #12 from your IC socket to the ground wire (0) of your power supply.

Then you turn on your Voltmeter and put it on VDC 0~5 or 0~12 scale. Connect the negative probe to the ground of your power supply.

You turn on the external power supply ONLY…not the receiver

A voltage below 2.2VDC is consider as 0 and a voltage higher is consider as 1

Repeat the process for each of the four addresses of the IRD number and you will end with something like that:

Now because the eight values read at address FFF0 are all 0 this mean that you don't consider it.

Take the eight value located at address FFF1 (110111100) and convert it for binary to hex. Open the Windows calculator in scientific mode and click on binary radio button. Write down 110111100 and then click on the Hex radio button…the calculator will give you BC. Write down this value.

Repeat this process for the two remaining addresses FFF2 and FFF3.

After the whole process you will end with BC 61 4E. To validate your work, open your calculator and click on the Hex radio button and write down BC614E and then click on Dec radio button…the result will be 12345678 which is the receiver number used here.

Now to read the boxkeys you will have to read eight different addresses in the same manner. Here's is the addresses and the value you will have to use for pin #9,10,11,12

Remember that a voltage below 2.2VDC is consider as 0 and a voltage higher is consider as 1

Note: Be sure of what you are doing….if not sure don't do it…. This method is given "as-it" without any guarantee….if you blow-up your receiver that's your fault not mine !!!

This method was made be possible with the help of "Baja" a great member of ID. Thanks….

Maestra

March 16, 2002