Interior of the Comsat TE 1050 HD tuner, firmware ripping, Flash memory partition format

p.kaczmarek2 759 12

Treść została przetłumaczona

Zobacz oryginalną wersję tematu

Report a violation of the law

Reply Cool? Ranking DIY | New topic

Notify about new articles

📢 Listen (AI):

» | Topic author Helpful post? (+12)

Post #1
21771875 05 Dec 2025 10:01

I invite you to another analysis of an older terrestrial TV receiver. In this topic I'll show its interior, view its board with a thermal camera, download the contents of its Flash memory and try to decode the partitions there myself in my own C++ program. At the end I will present the SDK I found, which may fit under this tuner.

The topic is not finished and any help is welcome.

Interior of TE 1050 HD
Standard - to start with a glimpse of the outside, the hardware is tiny, already without a remote control. It won't be of much use for TV anyway, it won't receive DVB-T2, but maybe it will be of use to an electronics engineer? At the very least, there must be some power supply inside, and maybe the housing can be used for something too.

There is a single PCB inside, not even a split for a separate power supply. There is also no display, so you can't use the parts to build a clock.

The board consists of two sections - the 'hot', primary side of the power supply, and the 'cold', low-voltage side. Most of the components are surface mounted.

The power supply is built quite well, there is even a filter against interference emissions, a fuse, a proper capacitor connecting the primary and secondary side.

The power supply is based on the TNY176DG in a surface-mount version. There is also space on the board for its through-hole counterpart.

Optocoupler for coupling primary to secondary side while maintaining galvanic separation:

On the secondary side you can see a classic - the "programmable Zener diode" TL431, it provides the reference voltage and takes part in the feedback loop of the power supply. Changing its resistors can change the output voltage to some extent.

The CPU sections can now be viewed. The board is signed as MC6379-M3801-VER1.0:

The power supply typically gives 5 V, so lower voltages for RAM and CPU are generated by additional inverters:

The program holds the Flash memory - 25Q32BSIG (4 MB):

EM6GC16EWXD-12H is a DDR3 DRAM , 64M x 16 bit.

The CPU itself appears to be an M3801 ALI. This agrees with the device data sheet.

Tuner turns on, gives picture, shows no signal.

What heats up in such a tuner?
A short play with the InfiRay P2 PRO. The equipment went 5 minutes without a signal, still displaying the image.

The CPU and the inverter heat up the most - separately its primary and secondary sides. On the primary side, the TNY and the current measurement resistor heat up:

On the secondary side, the Schottky diode:

A little the transformer is also heating up:

The inverters from the voltages for the CPU and RAM are much less heated:

UART port
The device has pads derived from the UART. There are four pads, 5 V (the same as on the USB goes, the main power line), ground, RX and TX.

RX and TX reaches here - I don't have a more precise probe at hand:

Boot log UART
At 115200 baud, residual messages can be received at startup. The tuner does not respond to any commands or special characters at boot. The Upgrade tool does not see it either.
Code: text Expand Select all Copy to clipboard
                                                                                                                                                                                                                                                                                                                                  APP  init! bl_flash_init! bl_verify_sw check_program! success! MC: APP  init ok << SDK4.0ba.4.0_20101217 >> Libcore version 8.1c.0@SDK4.0bd.8.7_20121127(gcc version 3.4.4 mipssde-6.06.01-20070420)(vic.wang@ Fri Nov 30 11:35:29 2012) Application version 1.0.0@SDK4.0bd.8.7_20121127byUSER

Flash memory upload
All you have to do is solder the bone and use CH341. On the computer side I use NeoProgrammer.

Tests with existing tools
Ali MainCode-BY-ARB Tech V 9 - BABAR decodes something there, but then crashes with an error. Unable to extract or insert code.

Ali Background Viewer manages to find one image:

Flash dump analysis
I started classically with binwalk , but it didn't give too many results, and in turn I didn't want to check again every result shown with the -I switch.
Code: text Expand Select all Copy to clipboard
tester@DESKTOP-6SD9MUK:/mnt/w/WaitingRoom/tuner202512$ binwalk dump.bin DECIMAL       HEXADECIMAL     DESCRIPTION -------------------------------------------------------------------------------- 2321543       0x236C87        Copyright string: "copyright laws as" 2636264       0x2839E8        Cisco IOS experimental microcode, for "']"

I quickly decided that I would play around manually. Right at the start you see something that resembles a header structure - you can see the inscriptions NCRCbootloader, 1.0.0 and some date.

I have highlighted it in red in the image. So it's easy to guess that the values earlier (underlined in blue) are probably some offsets or partition sizes.
Now just check each of them - maybe any of them are partition lengths?
I checked four bytes each, in two orders: big-endian and little-endian. Either the oldest byte is first, or the youngest. Then I would make a jump by a given value in my hex xvi32 editor and see where I landed:

The value just before the NCRC name leads to the next partition! You can outline the structure:
Code: C / C++
Log in, to see the code

You still need an auxiliary function to swap the byte order:
Code: C / C++
Log in, to see the code

And the whole thing can be analysed in the program.
Code: C / C++
Log in, to see the code

It is good, but it is not perfect:
Code: text Expand Select all Copy to clipboard
Partition 0 @ offset=0 (0x0) id=268435747 unk=0 len=130560 name=NCRCbootloader ver=1.0.0 dat=2009-06-18 Partition 1 @ offset=130560 (0x1fe00) id=128521 unk=1879048192 len=512 name=NCRCHDCPKey ver=Demo M3801 dat=2009-11-10 Partition 2 @ offset=131072 (0x20000) id=16907777 unk=2091331328 len=3145728 name=yÝĘ~maincode ver=M3801 DVBT dat=2013-2-1 Partition 3 @ offset=3276800 (0x320000) id=130306 unk=1651900416 len=65536 name=ułż°Radioback ver=1.0.0 dat=2009-05-08 Partition 4 @ offset=3342336 (0x330000) id=130051 unk=1611005952 len=130944 name= ver=1.1.0 dat=2013-2-1 Partition 5 @ offset=3473280 (0x34ff80) id=129796 unk=1879051008 len=0 name=NCRCuserdb ver=1.0.0 dat=2013-2-1 Stopping: invalid length at offset 3473280 Unused bytes at end: 721024 (0xb0080)

Those strange stamps at the beginning of partition names make it suggest that the NCRC is not part of the name (string), but a special field value, probably from the CRC....

Code: C / C++
Log in, to see the code

O much better:
Code: text Expand Select all Copy to clipboard
Partition 0 @ offset=0 (0x0) id=268435747 unk=0 len=130560 name=bootloader ver=1.0.0 dat=2009-06-18 Partition 1 @ offset=130560 (0x1fe00) id=128521 unk=1879048192 len=512 name=HDCPKey ver=Demo M3801 dat=2009-11-10 Partition 2 @ offset=131072 (0x20000) id=16907777 unk=2091331328 len=3145728 name=maincode ver=M3801 DVBT dat=2013-2-1 Partition 3 @ offset=3276800 (0x320000) id=130306 unk=1651900416 len=65536 name=Radioback ver=1.0.0 dat=2009-05-08 Partition 4 @ offset=3342336 (0x330000) id=130051 unk=1611005952 len=130944 name=defaultdb ver=1.1.0 dat=2013-2-1 Partition 5 @ offset=3473280 (0x34ff80) id=129796 unk=1879051008 len=0 name=userdb ver=1.0.0 dat=2013-2-1 Stopping: invalid length at offset 3473280 Unused bytes at end: 721024 (0xb0080)

I then started looking for information about the constant, which looks like a header identifier to me. Bingo - there are results on GitHub:
https://github.com/search?q=0x01FE0101&type=code&p=1

It corresponds to the constant - CHUNKID_MAINCODE.
You can find code showing how the application starts:
https://github.com/qttest1/PDK_GoBian/blob/master/uboot/board/ali-stb/norflash/flash.c#L109
Code: C / C++
Log in, to see the code

This also found the rest of the header structure:
Code: C / C++
Log in, to see the code

It looks like my first assessment was almost entirely correct - only the variable I specified as length is actually an offset to the next partition, and the partition length may be smaller.
Code: C / C++
Log in, to see the code

This is confirmed - the second int32 looks like the actual partition size (not the maximum):

Here we still have a mention of NOCRC:
Code: C / C++
Log in, to see the code

This would explain everything, after all, in ASCII 0x4E435243 is "NCRC". This is the special value used to mark partitions without CRC.

Correct CRC check
At this stage I have already managed to find the code where the CRC is verified:
Code: C / C++
Log in, to see the code

The mg_table_driven_crc function is also available, moreover it has no dependencies on other libraries. It can be easily ported.
https://github.com/erwinbsbqq/PDK_GoDroid/blo...63f95/uboot/board/ALi/ali_3503/fastCRC.c#L171
I added it to my program and from now on I can verify the CRC of partitions.

All CRCs are correct:

Compiler search
There is an interesting ACS_release_combo.rar package on GitHub. One of the traces leads to the mips architecture and the sde-6.06 compiler:
https://github.com/levi028/loader/blob/master.../app/demo/combo/sabbat_dual/platform/Makefile
I have included the command for GCC below:
Code: text Expand Select all Copy to clipboard
../bin/sde-gcc -membedded-data -ffunction-sections -g -EL -mips2 -O1 -msoft-float -fsigned-char -fno-builtin-printf -D_DEBUG_VERSION_ -D_M3711C_ -D_ALI_TDS_ -D_BOARD_DB_M3711C_01V01_ -D_RD_DEBUG_ -D_MPEG4_SUPPORT -D_GEN_CA_ENABLE_ -D_C1200A_ENABLE_ -D_DVBC_ENABLE_ -D_SUPPORT_TUNER_M3031_ -D_VFB_SUPPORT_ -D_COPY_OPTIMIZATION -D_OUC_LOADER_IN_FLASH_ -D_STRIP_PLUGIN_OUTPUT -DDUAL_ENABLE -DMAIN_CPU -D_BUILD_OTA_E_ -D_BUILD_USB_LOADER_ -D_BUILD_USB_LOADER_GEN -D_BUILD_OUC_LOADER_ -I/cygdrive/d/svn/3711C_NBC_PA_HIGH/GA15_NBC1.01.61_Dominican_COMCAST/ALi_UPG_128M_export/inc -I/cygdrive/d/svn/3711C_NBC_PA_HIGH/GA15_NBC1.01.61_Dominican_COMCAST/ALi_UPG_128M_export/inc/freetype2/freetype2 -I/cygdrive/d/svn/3711C_NBC_PA_HIGH/GA15_NBC1.01.61_Dominican_COMCAST/ALi_UPG_128M_export/inc/freetype2  -Wextra -Wall -Wall -Wno-unused-parameter -Wno-unused-function -Wformat=2 -D_FORTIFY_SOURCE=2 -I../lib/gcc/sde/3.4.4/include -I../sde/include -Wall -Wno-unused-parameter -Wno-unused-function -Wformat=2 -D_FORTIFY_SOURCE=2 -I../lib/gcc/sde/3.4.4/include -I../sde/include  -c -o ali_i2c_common.o ali_i2c_common.c make[6]: ../bin/sde-gcc: No such file or directory make[6]: *** [<builtin>: ali_i2c_common.o] Error 127 make[6]: Leaving directory '/cygdrive/w/GIT/loader/ali_upg_128m/src/bus/i2c/scb' make[5]: *** [Makefile:45: all] Error 2 make[5]: Leaving directory '/cygdrive/w/GIT/loader/ali_upg_128m/src/bus/i2c/scb' make[4]: *** [makefile:863: BUS_I2C_SCB] Error 2 make[4]: Leaving directory '/cygdrive/w/GIT/loader/ali_upg_128m/src' make[3]: *** [Makefile3711c.cmd:1753: release] Error 2 make[3]: Leaving directory '/cygdrive/w/GIT/loader/ali_upg_128m/prj/app/demo/combo/sabbat_dual' make[2]: *** [Makefile3711c:724: release] Error 2 make[2]: Leaving directory '/cygdrive/w/GIT/loader/ali_upg_128m/prj/app/demo/combo/sabbat_dual' make[1]: *** [MakefileCommon:124: all] Error 2 make[1]: Leaving directory '/cygdrive/w/GIT/loader/ali_upg_128m/prj/app/demo/combo/sabbat_dual' make: *** [Makefile:22: all] Error 2

Now the question where to get sde-gcc from....
https://github.com/search?q=sde-gcc&type=code
Code: text Expand Select all Copy to clipboard
#CC=/usr/groups/ecad/mips/sde-6.06/bin/sde-gcc

I'll stop here for now though, and continue the presentation in the next topic.
Other related material:
https://github.com/levi028/loader
https://github.com/jinfeng-geeya/3202C
https://github.com/erwinbsbqq/PDK_GoDroid
https://github.com/qttest1/PDK_GoBian
https://course.khoury.northeastern.edu/cs3650...XT-CD/Content/Software/SDElite/clickthru.html

Summary
I managed to find out the format of the partition in the flash dump, my program also checks the CRC correctly, so I can generate a new checksum if needed. I have posted the source code on GitHub:
https://github.com/openshwprojects/AliUnpacker
I have added a copy of the 4 MB from this device to my collection of memory dumps:
https://github.com/openshwprojects/FlashDumps/commit/c601366e6d63c2d1f65597aa96c4dfa477191aaf
At the moment I have another big progress - in a separate topic perhaps something simple can be run on the Ali M3801.
Has anyone tried to give a second life to these types of old tuners?

Attachments:

ACS_release_combo.rar Download (5.82 MB)

Cool? Ranking DIY
Helpful post? Buy me a coffee.
About Author
p.kaczmarek2 p.kaczmarek2

Moderator Smart Home
Offline

Joined: 26 Dec 2014

Posts: 13411

Help: 617

Posts rating: 11243

Points: 129382
p.kaczmarek2 wrote 13411 posts with rating 11243, helped 617 times. Been with us since 2014 year.
ADVERTISEMENT
#2 21772067 05 Dec 2025 13:13

władziowek władziowek

Level 23

» | Helpful post? (0)

Post #2
21772067 05 Dec 2025 13:13

p.kaczmarek2 wrote:
programmable Zener diode" TL431

Adjustable, nothing programmable there!
#3 21772166 05 Dec 2025 15:01

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

» | Topic author Helpful post? (+5)

Post #3
21772166 05 Dec 2025 15:01

As I was learning this term was normally in circulation, although in my post I used "

As you can see, opinions vary.

Thanks for pointing out this interesting naming issue, but I'd still rather focus on the tuner itself. I found a project that compiles and starts on this CPU. I am just getting the buttons working.

Is there an ALI M3801 pinout map available somewhere? I know that on my copy the up/down keys (channels) are on 31 and 9.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
ADVERTISEMENT
#4 21772644 06 Dec 2025 00:32

władziowek władziowek

Level 23

» | Helpful post? (0)

Post #4
21772644 06 Dec 2025 00:32

Whatever you call it, those who dabble in electronics will still be familiar with what a bug is and what you eat it with.
#5 21772652 06 Dec 2025 00:47

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

» | Topic author Helpful post? (0)

Post #5
21772652 06 Dec 2025 00:47

Indeed, the TL431 is a classic, although I also occasionally see an inferior solution (a simple Zener diode), and in newer PSRs (primary side regulation - as the name suggests, primary side regulation, without optocoupler and TL431). Similarly, I increasingly see a synchronous rectifier on the secondary side instead of the classic Schottky diodes (this is based on a MOSFET, and its resistance in the open state ensures less loss than would be the case on the voltage drop across the Schottky diode).

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
ADVERTISEMENT
#6 21772884 06 Dec 2025 13:07

keseszel keseszel

Level 26

» | Helpful post? (0)

Post #6
21772884 06 Dec 2025 13:07

I'm looking - analysis of old junk, which is probably a duck 😉 .... then I'm thinking to myself - it's going to be thick, accurate and a concrete post-mortem 😉
#7 21772907 06 Dec 2025 13:38

michas michas

Level 23

» | Helpful post? (0)

Post #7
21772907 06 Dec 2025 13:38

And any concrete ideas on what else can be made from this tuner ?

Greetings
Michael
#8 21772915 06 Dec 2025 13:48

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

» | Topic author Helpful post? (0)

Post #8
21772915 06 Dec 2025 13:48

Now I'm trying to start receiving data via the UART. I already thought I had the wrong pins, but no....

As a test, I disabled the parity even mode for the UART in the code - I disabled parity completely and it is already receiving something:

I have looked at the information on the web about the CH341 and come to the conclusion that:
- CH341 does not handle parity bits correctly
- or, more precisely, data with the even bit are not sent correctly (the receiver rejects them - bad parity or no parity??)
- but interestingly, when the device sends data with this bit to the CH341, the CH341 nevertheless receives it correctly, so in a way it misleads me by giving the impression that everything is ok....
I guess I'll have to check this with a logic analyser.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#9 21773080 06 Dec 2025 17:10

michas michas

Level 23

» | Helpful post? (0)

Post #9
21773080 06 Dec 2025 17:10

Then use a standard uart module on the FT232RL why bother.

Greetings
Michal
ADVERTISEMENT
#10 21773150 06 Dec 2025 18:34

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

» | Topic author Helpful post? (0)

Post #10
21773150 06 Dec 2025 18:34

michas wrote:
Any concrete ideas what can be made different from this tuner ?

Maybe it would be possible to make an SDR based on this, there was a similar project on the forum recently, but there only the head unit was used and the MCU was completely different externally added. I would also be interested in displaying something on HDMI.

michas wrote:
FT232RL

I don't think I have this classic, although I would have to look for it. I have a CH341, a CP2102 and an MCP2221. The CP2102 didn't make it either, I don't know about the MCP2221.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#11 21773272 06 Dec 2025 20:41

michas michas

Level 23

» | Helpful post? (+1)

Post #11
21773272 06 Dec 2025 20:41

Maybe try the Putty program it has never failed me.

Greetings
Michal
#12 21773379 06 Dec 2025 23:02

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

» | Topic author Helpful post? (0)

Post #12
21773379 06 Dec 2025 23:02

Unfortunately, I'm afraid it's not a PC software issue - it's more a driver issue for the USB to UART converter in question.

For now I've changed the mode in the code from even to none (no parity) and something can be received there, but I can see there's a long way to go with this. In the next topic I'll present exactly what I managed to fire off - what a project from Github, quite interesting overall.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
Create an account, log in here. You will receive points by participating in discussions.
Join this discussion.

Install Elektroda application

Didn't find an answer? Ask Artificial Intelligence

*I agree to send the question to OpenAI, Anthropic PBC, Perplexity AI, Inc., Kagi Inc., Google LLC - owners of language models in order to prepare the best response. The companies may monitor and log information entered into the form.

*I agree to publicly display my question and answer. The question and answer will be publicly available to everyone. The process may take a few minutes. Upon completion, you will be redirected to the page with the answer.

Wait...(2min)

Reply Cool? Ranking DIY | New topic

Notify about new articles

📢 Listen (AI):

Report a violation of the law

FAQ

TL;DR: This TE 1050 HD uses a 4 MB SPI flash; “All CRCs are correct.” It boots an ALi M3801 SoC and exposes UART at 115200. [Elektroda, p.kaczmarek2, post #21771875]

Why it matters: You can safely dump, verify, and repack firmware to repurpose the hardware, even though it lacks DVB‑T2.

Quick-Facts

SoC: ALi M3801; RAM: EM6GC16EWXD‑12H DDR3 64M×16; Flash: 25Q32BSIG 4 MB. [Elektroda, p.kaczmarek2, post #21771875]
Power: TNY176DG flyback with optocoupler + TL431 feedback; Schottky on secondary. [Elektroda, p.kaczmarek2, post #21771875]
Flash layout (named chunks): bootloader, HDCPKey, maincode, Radioback, defaultdb, userdb; header has ID/LEN/OFFSET/CRC. [Elektroda, p.kaczmarek2, post #21771875]
UART pads exposed: 5 V, GND, RX, TX; boot log at 115200; upgrade tool does not see device. [Elektroda, p.kaczmarek2, post #21771875]
Thermal hotspots after 5 minutes: CPU, inverter, TNY176, current-sense resistor; transformer warms, DC/DCs cooler. [Elektroda, p.kaczmarek2, post #21771875]

Quick Facts

- SoC: ALi M3801; RAM: EM6GC16EWXD‑12H DDR3 64M×16; Flash: 25Q32BSIG 4 MB. [Elektroda, p.kaczmarek2, post #21771875]
- Power: TNY176DG flyback with optocoupler + TL431 feedback; Schottky on secondary. [Elektroda, p.kaczmarek2, post #21771875]
- Flash layout (named chunks): bootloader, HDCPKey, maincode, Radioback, defaultdb, userdb; header has ID/LEN/OFFSET/CRC. [Elektroda, p.kaczmarek2, post #21771875]
- UART pads exposed: 5 V, GND, RX, TX; boot log at 115200; upgrade tool does not see device. [Elektroda, p.kaczmarek2, post #21771875]
- Thermal hotspots after 5 minutes: CPU, inverter, TNY176, current-sense resistor; transformer warms, DC/DCs cooler. [Elektroda, p.kaczmarek2, post #21771875]

What hardware is inside the Comsat TE 1050 HD?

It’s a compact DVB‑T receiver with a single PCB. Core parts: ALi M3801 SoC, EM6GC16EWXD‑12H DDR3 (64M×16), and a 25Q32BSIG 4 MB SPI flash. Power uses a TNY176DG flyback with optocoupler and TL431 feedback. No front display is present. The tuner powers up and shows video output but reports no RF signal without DVB‑T2 capability. [Elektroda, p.kaczmarek2, post #21771875]

Does the TE 1050 HD support DVB‑T2 broadcasts?

No. The author notes it “won’t receive DVB‑T2,” which limits TV use today. The unit can still serve as a development platform for power, enclosure, buttons, HDMI output experiments, or as a donor for parts. [Elektroda, p.kaczmarek2, post #21771875]

How is the flash partitioned and verified?

Firmware uses CHUNK headers: ID, LEN, OFFSET, CRC, then name/version/time. Named chunks found: bootloader, HDCPKey, maincode (about 3,145,728 bytes), Radioback, defaultdb, and userdb. CRC verification matches the vendor routine; NCRC marks regions without CRC. The author states, “All CRCs are correct.” [Elektroda, p.kaczmarek2, post #21771875]

How do I dump the 4 MB flash safely with common tools?

Three steps:

Desolder the 25Q32 and connect to a CH341 programmer.
Read using NeoProgrammer and save a full 4 MB dump.
Keep an untouched backup before any edits or repacks. This preserves recovery options and matches the thread’s workflow. [Elektroda, p.kaczmarek2, post #21771875]

What UART pads and settings work for boot logs?

Pads expose 5 V (USB rail), GND, RX, and TX. Use 115200 baud. You’ll see ALi SDK strings and version info during boot. The device does not accept input at boot, and the vendor Upgrade tool doesn’t detect it in this state. [Elektroda, p.kaczmarek2, post #21771875]

Why do I get parity errors with CH341 on this UART?

The author observed CH341 mishandling even parity on transmit, while receive looked OK. Disabling parity in the device code allowed reception. CP2102 also failed in tests. Workarounds: force no parity, try another USB‑UART (e.g., FT232RL), or verify with a logic analyzer. [Elektroda, p.kaczmarek2, post #21772915]

Any concrete ideas to repurpose this tuner?

Two practical directions emerged: use the RF head for an SDR front‑end, or drive HDMI for custom on‑screen output. Button inputs can support simple UI. These are exploratory projects but match the hardware’s strengths and available interfaces. [Elektroda, p.kaczmarek2, post #21773150]

Is there a published ALi M3801 pinout for buttons/GPIO?

A full pinout wasn’t shared. Known findings: the author’s unit maps channel Up/Down to pins 31 and 9. You can trace remaining keys with a meter or logic analyzer and confirm in firmware. “Is there an ALI M3801 pinout map available somewhere?” remains open. [Elektroda, p.kaczmarek2, post #21772166]

What components heat up the most, and should I add cooling?

Thermal imaging after five minutes shows hottest spots at the CPU, inverter, TNY176, and current‑sense resistor. The secondary Schottky runs warm; the transformer warms slightly; CPU/RAM regulators run cooler. Ensure airflow if you overclock or run heavier code. A small adhesive heatsink on the SoC can help. [Elektroda, p.kaczmarek2, post #21771875]

Is the TL431 really “programmable,” and why does wording matter?

Technically it’s adjustable, not programmable. Quote: “Adjustable, nothing programmable there!” This matters when discussing PSU mods; you change output by resistor values around TL431, not by writing code. Keep terminology precise in repair notes. [Elektroda, władziowek, post #21772067]

What versions appear in the boot log, and what do they imply?

Boot prints: “SDK4.0ba.4.0_20101217,” “Libcore 8.1c.0@SDK4.0bd.8.7_20121127,” and GCC 3.4.4 (mipssde‑6.06). That hints at the ALi SDE 6.06 MIPS toolchain lineage and helps match open SDK examples and build flags for experiments. [Elektroda, p.kaczmarek2, post #21771875]

Binwalk found little—how can I parse this firmware anyway?

Manually step through headers. Treat fields as big‑endian; swap as needed. Use LEN as chunk size and OFFSET to jump to the next. Verify CRC with the vendor algorithm; accept NCRC markers as ‘no CRC’. Extract named chunks for analysis or repacking. [Elektroda, p.kaczmarek2, post #21771875]

Why did parsing stop at the userdb chunk?

In the dump shown, userdb reported len=0, so the parser halted and flagged invalid length at offset 0x34FF80. About 721,024 bytes remained unused at the image end. Handle zero‑length chunks as an edge case to avoid false errors. [Elektroda, p.kaczmarek2, post #21771875]

How do I verify chunk integrity before flashing back?

Compute CRC over data starting at header+0x10 for ‘check_size’ bytes and compare with header CRC. If header CRC equals NCRC, skip validation. The author ported the mg_table_driven_crc function and confirmed all chunk CRCs matched. [Elektroda, p.kaczmarek2, post #21771875]

Can I interact with the bootloader over UART?

Not in the captured state. The board emits boot messages at 115200 but does not accept commands or special keys, and the Upgrade tool did not detect it. Plan for in‑system flashing via SPI or firmware hooks instead. [Elektroda, p.kaczmarek2, post #21771875]

Which terminal software should I use for UART?

Any stable terminal works for receive. A user recommended PuTTY, but the author found the issue lay in USB‑UART drivers, not PC software. Focus on adapter parity handling first. [Elektroda, p.kaczmarek2, post #21773379]

Interior of the Comsat TE 1050 HD tuner, firmware ripping, Flash memory partition format

Didn't find an answer? Ask Artificial Intelligence