Source code released

[jccp49]

I saw on another site that the source code for coolsats has been released so this is real good for coolsat owners if and when a fix is released cause now the coding community can put out their own fixes without waiting for NORw to put them out

[Ritchie63]

Thanks 4 the info.

[fossil112]

watch it turn into a Linux type community

[emsudos]

Its been out for a loooooooooong time now probably about 4-6 months.

hxxp://rs90.rapidshare.com/files/229870527/cs5k_6k.zip

hxxp://rapidshare.com/files/229866555/cs4000.zip

[pepere1]

what is that source.
give the site so everyone can enjoy

[davidki]

I saw this before also, but there is nothing on the newer units like the 7 or 8k units just the older ones.

[creativegenius]

This might be very handy for the Telephonica fans in the house, in the event that anyone has an outside interest in that.

Creative Genius

[marty napier]

thinks for the info!

[boboisno1]

The source for the 4,5,6 has been out for a very, very long time now. On the other hand since CS has gone under anything is possible as far as the other makes are concerned.

[emsudos]

Originally Posted by pepere1

what is that source.
give the site so everyone can enjoy

There is no "site". That is the source code for the CS 4,5,6 posted on rapidshare. I found those several months ago and posted them on my home site....but that will do you little good as I'm now posting them here.

[tomcat01]

emsudos is right this has been out for a long time at least 5 months ago you still need the compilier and then edit tools like jtag cables software i use hexeditors XVI32 which is free .. this is a big job to do we can post the source code but if it was that esy to do jvvh would have had it done by now still missing some key parts so no it is not a full source as i think they are still missing the chips data if you do not know where the data is on the chip (as coolsat will not give you)then it is a search .. and a big one encrpytion.. i know very little about it but more than some i have tried to learn but if you do not have someone who knows this stuff then it is very hard to learn

some of the guys to watch are slugworth and jvvh they are really having fun with the code but not easy when you do not have all the info ..

eg: of what they have done

I got the code working! Change:

in flash.h:

#if 0//defined(USE_ROM_EMULATOR) modded to if 0 from if 1 JVVH
#define FLASH_BASE_ADDR 0x20200000
#define FLASH_BANK 1
#else
#define FLASH_BASE_ADDR 0x20000000
#define FLASH_BANK 0
#endif

I'm using the ADS w/o patch, Bomb_coosat5000 and debug_mode enabled, E006.ndf but the channel list that was in the box--will try some varients later but wanted to give you this report. It works!--I get a couple of free ch and Current with the correct key.

The code was trying to addr flash starting at 0x20200000 rather than 20000000 and I guess the addr lines do not virtual duplicate the flash at that addr.


c/p
ECMs come in 0x4a and 0x6a sizes--that has been true for while now. I think that is why they started talking about MECM40 and MECM60 stuff (the encrypted contents of the packet are 0x40 and 0x60 after you remove the headers).

Creating a pop up could be done, I suppose, now that we have the source.

I've been looking into what would be needed to hijack the CNX patch--it is conexant code, small enough to fit in the pac space--but I don't have a clue about how it runs. It is gzipped with non-standard header and before gz it is encrypted in 8 byte blocks with a 16 bit key--my best guess right now is that it uses something like a CRC routine. I've been looking at the cypto package routines to see if it is blowfish, des, idea, or RSA but none seem to quite do what I'm seeing in the machine code (though all of those are 8 byte block encryptions and can use 16 byte keys).end c/p

just some info and alot of this is encrypted and that is where the problems are ..cool that these guys are working hard to find out how to compile he code to get a working box .. way way over my head .. i like watchign what they are doing i have alot of respect for the way they do this big a$$ puzzle

[tomcat01]

c/p

I've been playing in much the same way. The way I did the replacement "main" for DRD430 use of pansat 2700 bins is likely going to be the easiest. You build up the info needed for a particular bin as to where data is stored and where known subroutines are, then put that info into source form with calls to subroutines as __asm {ldc sub_address; gcall;} and have the parameters passed to that gcall sub as needed by what is in the cs code. You often have to do a bunch of playing around to get the code working as wanted. If you want to have the nn routines as part of the source you build (it will be bigger but not by that much--in that test compile I did of the nn_1.c I seem to recall it was not large).

At the gcall table (much as I showed in that script I posted) you have any map call above say 0x1c go to your generated machine code--and as I showed in the same script set, you could use the 32K byte image 07 space that I freed as the place that code is located.

I've been playing with the ST Toolset to see if a more creative way of doing some of the above is posible (I saw that the win-ARM compiler could do some stuff that I would like to be able to do with ST asm code, but haven't figured out how to do it yet).

Basically I to was trying to use the domap() format, which is much like the module1 contents. Now, I'm not sure if the domap is all that is needed. I've shown that a mod to a similar pansat 2700 map handling routine is all that is needed for that bin, but the cs4k seemed to not have the level of emu that pansat does--perhaps there is something that needs modding to call domap at the right points.

I've gone through the serial output of 193 bin with debug messages on (the other script I put out a few days ago) and I've found that the emu1 and emu2 decrypt is find, then you see an output of four groups of array of 0x100 bytes--those seem to be comming from the serial EEPROM and are something called UDAP (as I recall without my notes) and I find the same non-zero section of those arrays in the pansat2700 code. The "seed" generated is correct (though cemu only has the first 6 bytes of the coolsat's seed--don't know why cs includes a few bytes from the header of the raw cmd07 packet--even back older copies of cemu they only used the 6 bytes). After that the cs output starts doing map calls and I think correctly for the first few steps, but eventually starts getting into calls that need fixing.

Long winded, but hope you see some hints that it could be done and where you might look in stuff already posted.

Oh, the simple ST Toolset compile of the existing nn_1 code only took up 7K byte. And for most of the above I slipped into thinking I was in the cs4k thread, but much of the info is good for ARM code too--you do the ST Toolset differently--but I went over much of that with the win_ARM project that I posted for cs5k export of cmd04 and cmd07 under serial port command some time back.

wow alot of talent woth these guys

[tomcat01]

the following are missing from 5-6k source;
BN_ADD.c
BN_CTX.c
BN_DIV.c
BN_DIV.c
BN_LIB.c
BN_MOD.c
and the directory;
..\cnxtapi\APPL\HAPI\BN\

[slugworth]

Originally Posted by tomcat01

in flash.h:

#if 0//defined(USE_ROM_EMULATOR) modded to if 0 from if 1 JVVH
I'm using the ADS w/o patch, Bomb_coosat5000 and debug_mode enabled, E006.ndf but the channel list that was in the box--will try some varients later but wanted to give you this report.

It took about 12 pages of threads before jvvh figured that one out. You have to use ADS without the patch,or your homemade .stb file won't boot. Again we see that newer isn't always better.

[slugworth]

The euro cousins let you add/replace games via .stb files. I did manage to compile 1 example that had pacman and other games added,but I couldn't add games the .stb way. Pacman using the remote as a controller sucked anyway,but made a good conversation piece.

[slugworth]

Originally Posted by tomcat01

the following are missing from 5-6k source;
BN_ADD.c
BN_CTX.c
BN_DIV.c
BN_DIV.c
BN_LIB.c
BN_MOD.c
and the directory;
..\cnxtapi\APPL\HAPI\BN\

If you read the log files after a compile,there are a lot of burps but the .stb file will still work.The sourcecode is from the v127 card in slot days,so it's just for training purposes.