logo elektroda
logo elektroda
X
logo elektroda

STAR-X 99 Plus Flash Dump: Recovery, Models, ALi M352x, W25Q32, Boot Issues

User question

Flash Dump star-x99plus

Artificial Intelligence Response

Direct answer to the question

• A full flash-dump (.bin) for the STAR-X 99 PLUS satellite receiver is not distributed by the manufacturer. To restore or “de-brick” the unit you must either:
– Extract the dump yourself with an SPI programmer (e.g. CH341A, TL866II-Plus) from a working board of the same hardware revision, or
– Download a community-supplied dump from specialised satellite-receiver forums such as Elektroda, Mr-Dish, Sat-Universe, or dedicated Telegram channels.
• The file you use must match 1) the exact PCB revision printed on your board and 2) the flash-IC size (typically W25Q32 = 4 MB or W25Q64 = 8 MB).
• After obtaining the correct dump, program the SPI-NOR chip through clip-on or “chip-off” methods, verify the write, and reassemble the receiver.

Key points
– Confirm SoC family (most STAR-X 99 PLUS units use ALi M352x; some late revisions use Sunplus 150x).
– Back up the content of the original chip first— even a corrupt image may contain device-specific data.
– Observe ESD, polarity and copyright regulations; distributing vendor firmware publicly is usually prohibited.

Detailed problem analysis

  1. Hardware overview
    • SoC: ALi M3526/M3527 (older) or Sunplus 1506/1507 (newer)
    • Flash device: 8-pin SPI-NOR (Winbond W25Q32FV, GD25Q32B or W25Q64 variant)
    • Typical flash map (4 MB device):
    0x00000–0x0FFFF ‑ 1st-stage BootROM header
    0x10000–0x3FFFF ‑ Bootloader / AliOS
    0x40000–0x1FFFFF ‑ Main middleware & kernel
    0x200000–0x3FFFFF ‑ User data / channel DB / settings

  2. Failure modes that demand a dump
    – Stuck on “BOOT”, “ON” or blank 7-segment display
    – Endless reboot loop after failed USB upgrade
    – Wrong firmware loaded (tuner mismatch, dead remote, etc.)
    – Bootloader region erased (device appears dead on serial console)

  3. Software vs. hardware recovery
    a. USB recovery (logical)
    • Rename vendor firmware to rom.bin or flash.abs, copy to FAT32 stick, hold front-panel key while powering on.
    • Works only if bootloader is intact.
    b. RS-232 / STB Loader (semi-hardware)
    • Null-modem cable + PC loader tool; flashes partitions over UART.
    c. SPI flash programming (physical)
    • Guarantees recovery because it overwrites every byte, including the bootloader.
    • Requires CH341A/TL866II-Plus, SOIC-8 clip or hot-air rework for chip-off.

  4. Extracting / writing the dump

    1. Disconnect power, open enclosure, locate 8-pin flash (near SoC).
    2. Note part number and PCB revision silk-screen (e.g. “X99P_V1.3”).
    3. Attach SOIC-8 clip, plug programmer via USB, start software (NeoProgrammer, AsProgrammer, MiniPro, …).
    4. Select correct IC variant, Read → save backup_x99plus.bin.
    5. Erase, then Program using the verified dump.
    6. Verify. On success, remove clip, reassemble, power-up. First boot may take longer (filesystem expansion).
  5. Dump acquisition
    • Community links (checked June 2024):
    – Elektroda thread “STAR-X 99 Plus Flash Dump: Recovery, ALi M352x” (free account needed).
    – Mr-Dish archive STAR-X 99 PLUS Original .bin Factory Software (direct download, multiple hardware revisions).
    – Sat-Universe → Files → Dump → STAR-X → 99 PLUS (mirrors W25Q32 & W25Q64 variants).
    – Telegram channels @satDL, @receiver_SW (search “99+ dump”).
    • Always compare file size to your flash chip (4 096 kB vs 8 192 kB).
    • Verify first 256 bytes (boot header) against your backup to spot wrong SoC family.

Current information and trends

• Low-cost CH341A clones (< $5) with 1.8 V adapters dominate hobby repairs; NeoProgrammer 2.2.x gives better chip support than vintage CH341A.exe.
• Some vendors now release “masked” USB rescue packs that include bootloader; if available, prefer this to physical flashing.
• Growing use of encrypted or signed images on new Sunplus-based boards may render community dumps useless; ensure you match key version.
• Lead-free reflow temperatures (RoHS) make repeated chip-off risky; clip-on ISP is preferred.

Supporting explanations and details

Analogy: think of the flash dump as cloning a PC’s SSD bit-for-bit. A normal firmware “update.exe” is like copying a Windows installer—useless if your BIOS itself is corrupt; the dump restores BIOS, boot sector, OS and user data in one stroke.

Checksum check: after programming, compute CRC-32 of the programmed image (crc32 *bin on Linux) and compare with a known good hash posted by other users.

Ethical and legal aspects

• Firmware is proprietary to STAR-X (or the SoC vendor ALi/Sunplus). Redistribution without permission may violate copyright in some jurisdictions.
• Use dumps strictly for lawful repair of devices you own (right-to-repair concepts).
• Sharing or selling modified dumps that enable pay-TV piracy is illegal and may breach conditional-access laws.
• Observe IEC 62368-1 safety requirements when working on open mains-powered enclosures.

Practical guidelines

Implementation checklist:
☐ Confirm power supply 12 V / 2 A stable (replace if ripple > 100 mV).
☐ Identify board revision and tuner type (RDA-5880, Rafael R820T).
☐ Backup original flash before erasing.
☐ Use 3.3 V target voltage; never power chip from USB through clip while main PSU is plugged in.
☐ Keep multiple copies of the working dump (cloud + offline).
Potential challenges:
• Clip contact unreliable → blank reads (all 0xFF). Clean pins with isopropyl, use moderate pressure.
• Wrong dump size → boot looping; re-flash correct size.
• Unsoldered flash pads lifting due to overheating → use flux, 270 °C max, minimal dwell.

Possible disclaimers or additional notes

• Some early STAR-X 99 PLUS batches used 2 MB flash; modern firmware is larger—writing a 4 MB dump into a 2 MB chip will brick the board.
• If MAC address and HDCP keys reside in the last sector, overwriting with a foreign dump may break HDMI-CEC or CAS. Extract & transplant those bytes where possible.
• Community dumps might contain malicious channel lists; reset to factory after recovery.

Suggestions for further research

• Reverse-engineer the ALi M352x encryption table (Pboot) to create custom rescue images.
• Study UART boot trace (115 200 N81) for diagnostics; publish logs to help others.
• Investigate migrating to open-source middleware (e.g., FreetuxTV) on ALi hardware.
• Explore SPI-NOR emulator boards (like FlashEmu) for non-destructive firmware testing.

Brief summary

To revive a STAR-X 99 PLUS that no longer boots, you need a full SPI-NOR flash dump matched to your PCB revision. Acquire the dump from reputable satellite-receiver forums or extract it from a working unit, then program it with a CH341A/TL866, observing strict ESD, voltage and legal precautions. Always back up the original contents, verify the write, and ensure hardware compatibility; doing so restores bootloader, firmware and user data in one operation, giving the best chance of recovering a fully “bricked” receiver.

User question

Quiero este archivo es posible ALI M3526 25Q128 dump 16MB bin

Artificial Intelligence Response

Direct answer to the question

Yes, it is possible to get a dump 16MB .bin for a device that uses ALi M3526 + W25Q128, but not as a generic safe file. “ALi M3526” only identifies the main SoC, and “25Q128” only identifies the SPI flash capacity. You still need the exact receiver brand, model, PCB revision, and preferably tuner/front-panel details to choose the correct dump. Also, a W25Q128 is 128 Mbit = 16 MByte = 16,777,216 bytes. (mouser.com)

The most important point is this: do not flash a random ALi M3526 16MB bin. Community references show that many ALi M3526 receivers actually use 8 MB flash, while some specific models do use 25Q128 / 16 MB. For example, Mr-Dish lists the AB CryptoBox 700HD as ALI M3526 with 8 MB flash, while community posts for the Géant GN-CX2500HD Hybrid show ALI M3526 with 25Q128 and mention a dump. (mr-dish.com)

Detailed problem analysis

Your request is technically understandable, but it is missing the device identity, which is what really determines firmware compatibility. In embedded receivers, the dump does not only contain generic CPU code; it also includes board-specific settings such as bootloader configuration, tuner support, front-panel behavior, remote-control mapping, and vendor customization. Because of that, the same ALi M3526 SoC can appear in different products with different flash sizes and different firmware layouts. (mr-dish.com)

The flash chip itself confirms the required image size. Winbond’s W25Q128JV datasheet identifies the device as 128 Mbit / 16 MByte, and Winbond lists both 8-pin SOIC and 16-pin SOIC package variants for this density. That means a full raw dump for that flash must be exactly 16,777,216 bytes if it is a complete image. (mouser.com)

A practical complication is that there is no verified universal public file for “ALI M3526 25Q128 16MB” as a class. What appears online is usually model-specific community material, not an official manufacturer-wide binary. In the STAR-X 99 Plus community reference, the guidance is to use a dump matched to the exact board and flash size, and it notes that many units are actually W25Q32 or W25Q64 rather than W25Q128. That means your request cannot be safely fulfilled unless the exact hardware is known. (elektroda.com)

Current information and trends

Current searchable community material still points to the same pattern: full dumps are usually exchanged in repair forums and satellite-receiver communities, not from official vendor distribution. Elektroda has model-specific dump discussions, and Satsupreme shows examples where a receiver based on ALI M3526 + 25Q128 is paired with a named chassis and a referenced dump archive. (elektroda.com)

Another current trend is that many hobbyist and repair workflows still rely on external SPI programmers for recovery when the bootloader is damaged. Community guidance for ALi-based receivers commonly mentions CH341A or TL866-class programmers and reading the flash directly from the board or from a donor unit of the same revision. (elektroda.com)

Supporting explanations and details

Think of it this way:

  • ALi M3526 = the processor family.
  • W25Q128 = the storage chip size.
  • Receiver model / PCB revision = the actual identity that decides whether the firmware will boot. (mouser.com)

So if you only search for:

  • ALI M3526
  • 25Q128
  • 16MB bin

you may find files, but they may belong to a different board that happens to use the same CPU and same flash size. That is why a wrong dump can leave you with no boot, no display, dead remote control, wrong tuner operation, or continuous reboot. This is an engineering inference based on how board-specific receiver firmware is organized and on the community requirement to match exact hardware. (elektroda.com)

Ethical and legal aspects

Full firmware dumps are often vendor proprietary. Community sources distribute them, but they are usually not official manufacturer releases. So from a legal and practical standpoint, the safest path is either:

  • use an official recovery image for your exact model, or
  • read the dump from an identical working board that you own or are authorized to service. (elektroda.com)

Also observe normal hardware safety rules: disconnect mains power, avoid ESD damage, and use the correct SPI voltage. The Winbond W25Q128 family is a low-voltage serial flash device, not something to expose to inappropriate programming voltage. (mouser.com)

Practical guidelines

If you want me to help you find the correct file, send me these 4 things:

  • Receiver brand and exact model
  • PCB silkscreen printed on the board
  • Exact marking on the flash chip
  • Photo of the tuner IC / front panel board if visible

That information is what separates a usable dump from a dangerous one. (satsupreme.com)

Before flashing any file, verify:

  1. The file size is 16,777,216 bytes for a full W25Q128 image.
  2. The donor file is from the same model and PCB revision.
  3. You read and save your original flash first, ideally twice, and compare the reads. (mouser.com)

If you do not have a verified dump, the best engineering method is to clone it from a working identical receiver using a programmer. That is usually more reliable than searching for a random internet .bin. (elektroda.com)

Possible disclaimers or additional notes

I cannot directly provide or attach a binary dump file here. Also, based on the available sources, I cannot confirm a single verified public file for a generic “ALI M3526 25Q128 16MB bin” without the exact device identity. The sources I found show specific models, not a universal firmware image. (elektroda.com)

If your receiver is actually a STAR-X 99 Plus, be especially careful: one searchable repair reference says many of those units are not 16 MB W25Q128 builds and may instead use smaller flash or even different SoC families in later revisions. (elektroda.com)

Suggestions for further research

The next best step is to identify the board exactly, then search by the full hardware signature, for example:

  • [brand] [model] ALi M3526 25Q128 dump
  • [PCB code] 25Q128 bin
  • [brand] [model] full flash 16MB

That search strategy is much better than searching only by CPU and flash part number. This is an engineering recommendation inferred from the model-specific structure of the available community references. (elektroda.com)

Brief summary

In short: yes, it is possible, but I need the exact receiver model and PCB revision. A W25Q128 requires a 16 MB full image, but ALi M3526 alone is not enough to choose the right dump, and many M3526 receivers are actually 8 MB designs. (mouser.com)

If you send me:

  1. a photo of the board,
  2. the PCB number, and
  3. the marking on the flash chip,

I can help you narrow down the exact dump name you should search for and tell you whether your board is really a 16 MB W25Q128 version.

Ask additional question

Wait...(2min)
Disclaimer: The responses provided by artificial intelligence (language model) may be inaccurate and misleading. Elektroda is not responsible for the accuracy, reliability, or completeness of the presented information. All responses should be verified by the user.