logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

DVB-T2 HEVC H.265 Full HD terrestrial TV tuner and set-top box – internal components, firmware

p.kaczmarek2  15 1815 Cool? (+7)
Listen:

TL;DR LABEL_AI_GENERATED

  • A low-cost DVB-T2/HEVC Full HD terrestrial-TV set-top box is torn down, revealing hardware closely matching the previously examined DVBT005-SH Shark clone.
  • Its single GX6705_S168-17_7KEY V2.1 PCB combines a flyback S7133S 5 V supply, GX6706S5 SoC, SPI flash, FD650B-S display controller, and 3.3 V/1.7 V converters.
  • The decoder costs 60 zł, draws no more than 6 W, receives MUX1/2/3/4/6/8, and includes HDMI, SCART, RCA, USB playback, batteries, and an HDMI cable.
  • A CH341 programmer reads the flash chip's C46016 JEDEC ID and extracts its 4 MB firmware, including filesystem, panel/keymap settings, translations, IPTV URLs, and 8051 standby firmware.
  • The Polish-flag “designed in Poland” branding remains questionable: the casing says Made in PRC, while an 4110 A009 front-panel chip and some IPTV configuration purposes remain unidentified.
AI summary based on the discussion. May contain errors.

The product presented today stands out thanks to the clearly visible Polish flag on the packaging and is adorned with the caption "designed in Poland". I wonder what was actually designed here in our country – the logo? Nevertheless, there’s nothing to complain about; the price is low, just 60 zł, and it allows you to breathe new life into an old TV that’s incompatible with the modern aerial signal standard. The set is complete; it even includes an HDMI cable and batteries for the remote control. It also has SCART and RCA outputs, just in case you have a really old set-top box. It can receive MUX1, MUX2, MUX3, MUX4, MUX6, MUX8, supports 16:9 and 4:3 aspect ratios, teletext, parental controls and multimedia playback from USB. And all this with a power consumption of no more than 6 W.

The set is complete; it even comes with batteries – which is handy, especially when the set-top box is bought by someone less tech-savvy who might not remember such details.

The set-top box is very light, though what catches my eye more are the inscriptions on the back of the casing. Made in PRC. Well, yes... I wonder what that Polish flag meant.

PCB marking: GX6705_S168-17_7KEY V2.1 2025.04.09. There is a single board; the power supply is integrated with the low-voltage section.

As standard, we have one main microprocessor, Flash memory, separate print heads, and a display controller, probably something similar to the TM1650.

There is nothing else on the underside of the PCB:

The power supply is based on the S7133S, implemented in a flyback topology, providing 5 V:


The display is controlled by the FD650B-S, I have already discussed a similar chip .

The photo also shows converters generating 3.3 V and 1.7 V (I assume) from 5 V, for the microprocessor.

Next to the main SoC is a Flash memory chip with an SPI interface in an SO8 package.

The main chip is the GX6706S5 (GX6706).
I decided to desolder it and flash the memory via CH341:


NeoProgrammer does not recognise exactly which IC it is, but it reads its JEDEC ID – C46016, which indicates a size of 4 MB, and is able to read its contents correctly.
Backup:
https://github.com/openshwprojects/FlashDumps/commit/0138c07a7923b1038cd27aa7b15b22284995df6d
There is still a chip from the print head left – I cannot identify it: 4110 A009

That’s basically it; the device works, you can change the language, etc.:
TV screen showing “Installation Guide” menu with DVB‑T2 settings for Poland

I have already analysed the Flash memory from the GX6706 in a separate thread:
Internal components and analysis of the DVB-T2/HEVC DVBT005-SH Shark decoder’s flash memory
It’s similar here; you can extract the file system:
Windows File Explorer screenshot showing “rootfs_extracted” with a list of system directories
Sample files, dvb/theme/gpio.xml:
Code: text
Log in, to see the code

This looks like pin configurations, including those for the FD650.
panel.xml:
Code: text
Log in, to see the code

This is the configuration of the front panel itself; I can see two options here – FD650 and 1642. I wonder what the second chip is.
keymap.xml – this looks like the remote control buttons:
Code: text
Log in, to see the code

iptv_servers.xml – IPTV server URLs:
Code: text
Log in, to see the code

I don’t know how the local link is supposed to work for them; after all, it’s a LAN address. Perhaps it’s a remnant from production testing? The second link to Pastebin doesn’t work for me either; it shows a 404 error.
citylist.xml – a list of cities, but for what purpose?
Code: text
Log in, to see the code

The ‘language’ subfolder contains translation files, e.g. Polski.xml (I’ve shortened the content; the full version is 43 KB):
Code: text
Log in, to see the code

Also in lib/firmware is the gxlowpower.fw file, which is a mere 8 KB in size. It appears to be a program for the 8051, for standby mode with GX. It supports a 7-segment display (shows the time) and responds to wake-up via a button or remote control.
Screenshot of a disassembler: assembly instruction list on the left and C-like pseudocode on the right.

To sum up , I hadn’t planned this, but I’ve essentially come across a clone of what I’ve already presented – another GX6706, just like in the DVBT005-SH Shark . For this reason, I’ve shortened the description a bit, as it’s enough to simply refer to the previous post. One of the more interesting touches here was probably the Polish flag on the packaging, which I’m not quite sure what it’s meant to signify – is it some sort of creative marketing along the lines of ‘we import devices from the PRC, stick a flag on them and sell them’? I don’t know, I’m not familiar with the business side of electronics.
The basics are there: you can receive TV, there are Polish translations too, and that’s what counts.
Have you come across any DVB-T2 devices based on the GX6706 yet?
About Author
p.kaczmarek2
p.kaczmarek2 wrote 14792 posts with rating 12937 , helped 659 times. Been with us since 2014 year.

Comments

Darek.S 13 Jun 2026 10:11

On set-top boxes with this menu, you can copy the flash content to a USB stick directly from the menu. It’s simple, but you need to make a small change in the update settings first. https://obrazki.elektroda.pl/5154331800_1781338249_thumb.jpg... [Read more]

maciej_333 13 Jun 2026 10:29

It looks like an interesting chip. I can’t identify it either, but there aren’t many lines between the SoC and this chip in the head unit. That would suggest it isn’t outputting MPEG-TS, just a standard... [Read more]

funzen 13 Jun 2026 10:37

The printhead model is SI2141 SI2141 https://obrazki.elektroda.pl/9813518000_1781339824_thumb.jpg [Read more]

maciej_333 13 Jun 2026 12:39

If it is this chip, then I was indeed right: https://obrazki.elektroda.pl/3143077600_1781347044_thumb.jpg It might even be possible to get it working, although there isn’t a full datasheet. [Read more]

forest1600 13 Jun 2026 12:56

It just means that the order was sent from a Polish email address.... [Read more]

p.kaczmarek2 13 Jun 2026 13:12

The Si2141 would be suitable; it’s mentioned in ecos.bin: https://obrazki.elektroda.pl/2936816900_1781348926_bigthumb.jpg I can see that this is probably some sort of universal driver, as it also... [Read more]

maciej_333 13 Jun 2026 18:05

There’s also a driver for this chip: Link . I once extracted the relevant part for the AV2012 from this exceptionally versatile code. I might even buy the tuner shown here one day. Identifying the pinouts... [Read more]

E8600 14 Jun 2026 16:36

These new DVB-T2 set-top boxes may contain memory modules that are not supported by the CH341. [Read more]

p.kaczmarek2 14 Jun 2026 16:50

I wonder if you could specify exactly which types of memory you’re referring to? Are you talking about those with a parallel interface? [Read more]

funzen 14 Jun 2026 17:10

I'm curious too – what sort of memory is it? Or perhaps the programme doesn't support it? [Read more]

E8600 14 Jun 2026 17:15

I once wanted to read data from a Manta; I desoldered the memory module but couldn’t get it to work. I thought the programmer was faulty, but then I found out somewhere that this particular memory module... [Read more]

funzen 14 Jun 2026 17:58

If you’re referring to the memory mentioned in this post 20173560 https://obrazki.elektroda.pl/6990287400_1781452525_thumb.jpg then it can be read without any problems using the "SiberiaProg... [Read more]

p.kaczmarek2 14 Jun 2026 18:25

I recently had an issue with a memory module, and it turned out that the JEDEC ID read function was simply blocked, but all other Flash operations on it were still supported. Because of this, the software... [Read more]

Darek.S 14 Jun 2026 19:14

That is why this is the quickest and easiest option. If possible... [Read more]

E8600 14 Jun 2026 20:55

Yes, I remember that post – I couldn’t read it, and it wasn’t the first time I’d tried. I bought the CH341 programmer a long time ago specifically for DVB-T1 set-top boxes. That was four years ago, so... [Read more]

FAQ LABEL_AI_GENERATED

TL;DR: For owners of cheap DVB-T2 HEVC tuners, this FAQ shows how a 60 zł GX6706S5 box with 4 MB SPI flash was reverse-engineered, and why "you can extract the file system" matters for firmware inspection, tuner ID, and flash backup workflows. [#21920277]

Why it matters: This thread turns a low-cost TV box into a documented platform for flash dumping, firmware inspection, front-panel mapping, and tuner-chip identification.

Area Variant 1 Variant 2
Flash backup method CH341 programmer after desoldering SPI flash Direct copy to USB from menu after an update-setting change
Front-panel support in firmware FD650 1642
Tuner-driver references in ecos.bin Si2141 R836/R850, MxL608, ATBM2040/253/6032

Key insight: The most important finding is that this box is effectively another GX6706-family clone with reusable firmware structure. Once you dump the 4 MB flash, the XML files and low-power firmware reveal how the panel, remote, tuner support, and standby logic are wired.

Quick Facts

  • The box was bought for 60 zł, includes an HDMI cable and remote batteries, and is rated at no more than 6 W power consumption. [#21920277]
  • The PCB is marked GX6705_S168-17_7KEY V2.1 2025.04.09 and uses a single-board design with the mains supply integrated on the same PCB. [#21920277]
  • The power section uses S7133S in flyback layout to generate 5 V, then local converters derive about 3.3 V and 1.7 V for the main processor area. [#21920277]
  • The SPI flash returns JEDEC ID C46016, which the thread interprets as 4 MB, and the dump was read successfully even though NeoProgrammer did not name the exact chip. [#21920277]
  • gxlowpower.fw is only 8 KB and appears to target an 8051-class standby controller that keeps time on the 7-segment display and wakes the box by key or remote. [#21920277]

Which other DVB-T2 HEVC set-top boxes use the GX6706 or GX6706S5 SoC?

The thread directly confirms one close match: the DVBT005-SH Shark uses the same GX6706 family platform. The author calls this unit “essentially… a clone” of the earlier Shark analysis and says the firmware layout is similar enough that the previous flash-analysis post applies here too. That makes the Shark the clearest same-SoC comparison named in the discussion. [#21920277]

How can I dump the flash memory from a GX6706-based DVB-T2 tuner using a CH341 programmer?

You can dump it by removing the SPI flash and reading it externally with a CH341. 1. Desolder the SO8 SPI flash located next to the GX6706S5 SoC. 2. Connect it to a CH341-compatible programmer and read the JEDEC ID. 3. Save a full backup; in this case NeoProgrammer read ID C46016 and the full 4 MB contents correctly. This method works even when the software cannot name the exact flash model. [#21920277]

What change in the update settings enables copying the full flash contents from this type of set-top box directly to a USB stick?

The thread says a small change in the update settings unlocks copying the flash directly to USB, but it does not name the exact menu field or value. The confirmed takeaway is that boxes with this menu can export flash without a programmer once that update-setting tweak is made. The screenshot proves the option exists, but the precise parameter remains undocumented in the post. [#21920326]

Why does NeoProgrammer show JEDEC ID C46016 but fail to identify the exact SPI flash chip model?

NeoProgrammer can read the chip’s identification and capacity even when its built-in device list lacks the exact vendor-model match. In this case it returned C46016, inferred 4 MB, and still read the flash correctly. The practical result is simple: recognition of size worked, while database-level naming of the exact SO8 flash part did not. [#21920277]

What is a JEDEC ID in SPI flash memory, and how does it help determine chip capacity like 4 MB?

"JEDEC ID" is a flash-memory identification code that software reads from the chip, helping tools distinguish device family and storage size, even when the exact marketing model name is missing. In this thread, NeoProgrammer read C46016 and the author states that this value indicates a capacity of 4 MB. That is why the dump could proceed correctly despite incomplete chip naming. [#21920277]

What is flyback topology in a small set-top box power supply, and why is it used with chips like the S7133S?

"Flyback topology" is a small switch-mode power-supply design that converts the input supply into a lower regulated output, with compact parts and a single transformer stage. Here, the author identifies an S7133S-based flyback section that provides 5 V to the box. That 5 V rail then feeds local converters that generate about 3.3 V and 1.7 V for the processor section, which suits a low-cost one-board receiver. [#21920277]

How do I extract and inspect the firmware file system from a GX6706 DVB-T2 receiver flash dump?

You extract it from the flash dump and then inspect the XML and firmware files inside the resulting file system tree. The thread explicitly says the GX6706 dump lets you “extract the file system,” then shows readable files such as dvb/theme/gpio.xml, panel.xml, keymap.xml, iptv_servers.xml, citylist.xml, language XML files, and lib/firmware/gxlowpower.fw. That proves the dump is not opaque raw data only; it contains structured configuration content. [#21920277]

What do gpio.xml, panel.xml, and keymap.xml control inside the firmware of a GX6706 terrestrial TV tuner?

They control board pins, front-panel behavior, and remote-button mapping. gpio.xml shows pin-related items such as powercut, panel, mute, xtal 24000000, and GPIO levels. panel.xml defines front-panel type, LED behavior, key values, and digit mapping. keymap.xml maps infrared codes to actions like EPG, teletext, record, subtitle, navigation, and colored keys. Together, these XML files expose how the box’s user interface hardware is wired and interpreted. [#21920277]

FD650 vs 1642 front panel controller support in panel.xml — what is the difference and how can I tell which one my box uses?

panel.xml shows two supported front-panel types: FD650 and 1642. In this box, the active configuration points to board type value "0", and the XML maps value 0 to fd650 and value 1 to 1642. The author also notes that the actual display controller on the board is FD650B-S, so this unit uses the FD650 path. If your dump shows board type 1 instead, the firmware is set for the 1642 variant. [#21920277]

Why would a DVB-T2 set-top box firmware contain iptv_servers.xml links such as a local 192.168.x.x address and a dead Pastebin URL?

The most likely explanation in the thread is leftover test or placeholder data rather than a working consumer IPTV service. One entry points to 192.168.1.132, which is a LAN address, and the second Pastebin link returned 404 for the author. He explicitly suggests the local URL may be a remnant from production testing, and nothing in the post shows either link functioning on the retail unit. [#21920277]

What is the unidentified tuner chip marked 4110 A009, and how was it identified as Silicon Labs Si2141?

The unidentified 4110 A009 tuner was identified as a Silicon Labs Si2141 by matching the marking to an SI2141 listing and photo. The thread reply names the printhead model as SI2141 and provides a reference image consistent with that identification. That turns the earlier unknown tuner marking into a specific chip family name used by the box. [#21920340]

How can I verify from ecos.bin or other firmware files which tuner drivers are included, such as Si2141, MxL608, R836, R850, or ATBM2040?

You verify it by searching ecos.bin for tuner names and driver-function strings. The author reports that ecos.bin mentions R836, R850, MxL608, Si2141, ATBM2040, ATBM253, and ATBM6032. He also lists related symbols such as GXDemod_i2c_get_reg, GXDemod_i2c_send_data, and a tuner-error debug print. That combination strongly indicates the firmware includes a universal-style tuner support layer. [#21920451]

What does the gxlowpower.fw file do in GX6706 firmware, and how is an 8051 used for standby mode and wake-up from the remote?

gxlowpower.fw appears to be a small standby-control program for an 8051 used by the GX platform. The file is only 8 KB, and the author says it supports the 7-segment display, keeps the time visible, and wakes the receiver from a button or the remote control. That means standby behavior is not handled only by the main TV application; a separate low-power controller remains active. [#21920277]

How do the remote control codes in keymap.xml map to actual buttons like EPG, teletext, record, and subtitle on these DVB-T2 boxes?

They map hexadecimal IR codes to named GUI actions inside three remote profiles: public1, public2, and public3. For example, public1 assigns EPG to GUIK_E = 0xbb8f, TELETEXT to GUIK_T = 0xbbc7, record to GUIK_PRINT = 0xbbfd, and subtitle to GUIK_B = 0xbb27. The same file also maps navigation, colored keys, playback, and USB/media shortcuts, so one XML file defines most user-input behavior. [#21920277]

What does 'designed in Poland' on this DVB-T2 tuner packaging likely mean when the device itself is marked Made in PRC?

In this thread, it reads more like branding or marketing than evidence of Polish hardware manufacturing. The box packaging shows a Polish flag and “designed in Poland,” but the chassis marking says Made in PRC. One reply jokes that it may only mean the order came from “a Polish email address,” which captures the skepticism around the label. The thread offers no technical proof of any Poland-specific hardware design work. [#21920438]
AI summary based on the discussion. May contain errors.
%}