logo elektroda
logo elektroda
X
logo elektroda

DVB-T2 HEVC H.265 Full HD terrestrial TV tuner and set-top box – internal components, firmware

p.kaczmarek2 1092 15

TL;DR

  • A low-cost DVB-T2/HEVC Full HD terrestrial TV tuner/set-top box with HDMI, SCART, RCA, USB playback, teletext, parental controls, and MUX1/MUX2/MUX3/MUX4/MUX6/MUX8 support.
  • Inside, a single-board design uses a GX6706S5 main SoC, S7133S flyback power supply, FD650B-S display driver, and SPI Flash, with low-voltage rails generated from 5 V.
  • The unit costs 60 zł and draws no more than 6 W, while the SPI Flash reports JEDEC ID C46016, indicating 4 MB.
  • Dumping the Flash with a CH341 reveals the filesystem, including gpio.xml, panel.xml, keymap.xml, IPTV server lists, citylist.xml, language files, and gxlowpower.fw for standby.
  • The box works and supports language changes, but it appears to be another GX6706 clone, and the packaging’s Polish branding does not match the PRC marking on the case.
Generated by the language model.
ADVERTISEMENT
Treść została przetłumaczona polish » english Zobacz oryginalną wersję tematu
📢 Listen (AI):
  • DVB-T2 HEVC H.265 Full HD terrestrial TV tuner and set-top box – internal components, firmware
    The product presented today stands out thanks to the clearly visible Polish flag on the packaging and is adorned with the caption "designed in Poland". I wonder what was actually designed here in our country – the logo? Nevertheless, there’s nothing to complain about; the price is low, just 60 zł, and it allows you to breathe new life into an old TV that’s incompatible with the modern aerial signal standard. The set is complete; it even includes an HDMI cable and batteries for the remote control. It also has SCART and RCA outputs, just in case you have a really old set-top box. It can receive MUX1, MUX2, MUX3, MUX4, MUX6, MUX8, supports 16:9 and 4:3 aspect ratios, teletext, parental controls and multimedia playback from USB. And all this with a power consumption of no more than 6 W.
    DVB-T2 HEVC H.265 Full HD terrestrial TV tuner and set-top box – internal components, firmware
    The set is complete; it even comes with batteries – which is handy, especially when the set-top box is bought by someone less tech-savvy who might not remember such details.
    DVB-T2 HEVC H.265 Full HD terrestrial TV tuner and set-top box – internal components, firmware
    The set-top box is very light, though what catches my eye more are the inscriptions on the back of the casing. Made in PRC. Well, yes... I wonder what that Polish flag meant.
    DVB-T2 HEVC H.265 Full HD terrestrial TV tuner and set-top box – internal components, firmware DVB-T2 HEVC H.265 Full HD terrestrial TV tuner and set-top box – internal components, firmware
    PCB marking: GX6705_S168-17_7KEY V2.1 2025.04.09. There is a single board; the power supply is integrated with the low-voltage section.
    DVB-T2 HEVC H.265 Full HD terrestrial TV tuner and set-top box – internal components, firmware
    As standard, we have one main microprocessor, Flash memory, separate print heads, and a display controller, probably something similar to the TM1650.
    DVB-T2 HEVC H.265 Full HD terrestrial TV tuner and set-top box – internal components, firmware
    There is nothing else on the underside of the PCB:
    DVB-T2 HEVC H.265 Full HD terrestrial TV tuner and set-top box – internal components, firmware
    The power supply is based on the S7133S, implemented in a flyback topology, providing 5 V:
    DVB-T2 HEVC H.265 Full HD terrestrial TV tuner and set-top box – internal components, firmware
    DVB-T2 HEVC H.265 Full HD terrestrial TV tuner and set-top box – internal components, firmware
    The display is controlled by the FD650B-S, I have already discussed a similar chip .
    DVB-T2 HEVC H.265 Full HD terrestrial TV tuner and set-top box – internal components, firmware
    The photo also shows converters generating 3.3 V and 1.7 V (I assume) from 5 V, for the microprocessor.
    DVB-T2 HEVC H.265 Full HD terrestrial TV tuner and set-top box – internal components, firmware
    Next to the main SoC is a Flash memory chip with an SPI interface in an SO8 package.
    DVB-T2 HEVC H.265 Full HD terrestrial TV tuner and set-top box – internal components, firmware
    The main chip is the GX6706S5 (GX6706).
    I decided to desolder it and flash the memory via CH341:
    DVB-T2 HEVC H.265 Full HD terrestrial TV tuner and set-top box – internal components, firmware
    DVB-T2 HEVC H.265 Full HD terrestrial TV tuner and set-top box – internal components, firmware
    NeoProgrammer does not recognise exactly which IC it is, but it reads its JEDEC ID – C46016, which indicates a size of 4 MB, and is able to read its contents correctly.
    Backup:
    https://github.com/openshwprojects/FlashDumps/commit/0138c07a7923b1038cd27aa7b15b22284995df6d
    There is still a chip from the print head left – I cannot identify it: 4110 A009
    DVB-T2 HEVC H.265 Full HD terrestrial TV tuner and set-top box – internal components, firmware
    That’s basically it; the device works, you can change the language, etc.:
    DVB-T2 HEVC H.265 Full HD terrestrial TV tuner and set-top box – internal components, firmware TV screen showing “Installation Guide” menu with DVB‑T2 settings for Poland

    I have already analysed the Flash memory from the GX6706 in a separate thread:
    Internal components and analysis of the DVB-T2/HEVC DVBT005-SH Shark decoder’s flash memory
    It’s similar here; you can extract the file system:
    Windows File Explorer screenshot showing “rootfs_extracted” with a list of system directories
    Sample files, dvb/theme/gpio.xml:
    Code: text
    Log in, to see the code

    This looks like pin configurations, including those for the FD650.
    panel.xml:
    Code: text
    Log in, to see the code

    This is the configuration of the front panel itself; I can see two options here – FD650 and 1642. I wonder what the second chip is.
    keymap.xml – this looks like the remote control buttons:
    Code: text
    Log in, to see the code

    iptv_servers.xml – IPTV server URLs:
    Code: text
    Log in, to see the code

    I don’t know how the local link is supposed to work for them; after all, it’s a LAN address. Perhaps it’s a remnant from production testing? The second link to Pastebin doesn’t work for me either; it shows a 404 error.
    citylist.xml – a list of cities, but for what purpose?
    Code: text
    Log in, to see the code

    The ‘language’ subfolder contains translation files, e.g. Polski.xml (I’ve shortened the content; the full version is 43 KB):
    Code: text
    Log in, to see the code

    Also in lib/firmware is the gxlowpower.fw file, which is a mere 8 KB in size. It appears to be a program for the 8051, for standby mode with GX. It supports a 7-segment display (shows the time) and responds to wake-up via a button or remote control.
    Screenshot of a disassembler: assembly instruction list on the left and C-like pseudocode on the right.

    To sum up , I hadn’t planned this, but I’ve essentially come across a clone of what I’ve already presented – another GX6706, just like in the DVBT005-SH Shark . For this reason, I’ve shortened the description a bit, as it’s enough to simply refer to the previous post. One of the more interesting touches here was probably the Polish flag on the packaging, which I’m not quite sure what it’s meant to signify – is it some sort of creative marketing along the lines of ‘we import devices from the PRC, stick a flag on them and sell them’? I don’t know, I’m not familiar with the business side of electronics.
    The basics are there: you can receive TV, there are Polish translations too, and that’s what counts.
    Have you come across any DVB-T2 devices based on the GX6706 yet?

    Cool? Ranking DIY
    Helpful post? Buy me a coffee.
    About Author
    p.kaczmarek2
    Moderator Smart Home
    Offline 
    p.kaczmarek2 wrote 14611 posts with rating 12622, helped 654 times. Been with us since 2014 year.
  • ADVERTISEMENT
  • #2 21920326
    Darek.S
    Level 34  
    Posts: 6683
    Help: 215
    Rate: 973
    On set-top boxes with this menu, you can copy the flash content to a USB stick directly from the menu. It’s simple, but you need to make a small change in the update settings first.

    “Software update” menu showing “memory dump” option and “press OK” prompts

    I hadn’t thought of that myself, and previously I’d been copying it using a programmer.
    But a fellow forum member, Funzen, pointed this option out to me here on the forum, for which I thank him once again.
  • #3 21920337
    maciej_333
    Level 38  
    Posts: 4226
    Help: 487
    Rate: 1594
    p.kaczmarek2 wrote:
    There’s still a chip from the head unit left – I can’t identify it: 4110 A009

    It looks like an interesting chip. I can’t identify it either, but there aren’t many lines between the SoC and this chip in the head unit. That would suggest it isn’t outputting MPEG-TS, just a standard IF or perhaps ZERO IF. It’s another matter how simple these tuners have become these days.
  • #4 21920340
    funzen
    Level 25  
    Posts: 524
    Help: 73
    Rate: 251
    The printhead model is SI2141
    SI2141


    Two QFN-24 3×3 mm ICs; label “Si2141-A10-GMR” and marking code “4110”.



    SI2141.PDF (206.9 kB)You must be logged in to download this attachment.
  • #5 21920423
    maciej_333
    Level 38  
    Posts: 4226
    Help: 487
    Rate: 1594
    funzen wrote:
    The head chip is the SI2141

    If it is this chip, then I was indeed right:
    DVB-T2 HEVC H.265 Full HD terrestrial TV tuner and set-top box – internal components, firmware
    It might even be possible to get it working, although there isn’t a full datasheet.
  • ADVERTISEMENT
  • #6 21920438
    forest1600
    Level 20  
    Posts: 616
    Help: 10
    Rate: 168
    p.kaczmarek2 wrote:
    Made in the PRC. Well, well... I wonder what that Polish flag was all about.

    It just means that the order was sent from a Polish email address....
  • #7 21920451
    p.kaczmarek2
    Moderator Smart Home
    Posts: 14611
    Help: 654
    Rate: 12622
    The Si2141 would be suitable; it’s mentioned in ecos.bin:
    DVB-T2 HEVC H.265 Full HD terrestrial TV tuner and set-top box – internal components, firmware
    I can see that this is probably some sort of universal driver, as it also mentions the ATBM2040 and others.
    - Rafael Micro: R836 & R850
    - MaxLinear: MxL608
    - Silicon Labs: Si2141
    - AltoBeam: ATBM2040, ATBM253, ATBM6032
    Functions:
    - GXDemod_i2c_get_reg
    - GXDemod_i2c_send_data
    - GXDemod_i2c_send_reg
    - GXDemod_i2c_stop
    - GXDemod_io_init
    - GXDemod_Catch_All_Reg_Data
    Debug print:
    -line:%d--*tuner error*--Read Byte GXDEMOD_SYS_I2C_00 count=0x%x,IIC_CON=0x%x
    Attachments:
    • ecos.bin (5 MB) You must be logged in to download this attachment.
    Helpful post? Buy me a coffee.
  • #8 21920649
    maciej_333
    Level 38  
    Posts: 4226
    Help: 487
    Rate: 1594
    There’s also a driver for this chip: Link . I once extracted the relevant part for the AV2012 from this exceptionally versatile code. I might even buy the tuner shown here one day. Identifying the pinouts is really no big deal.
  • ADVERTISEMENT
  • #9 21921184
    E8600
    Level 41  
    Posts: 8921
    Help: 529
    Rate: 2493
    These new DVB-T2 set-top boxes may contain memory modules that are not supported by the CH341.
  • #10 21921191
    p.kaczmarek2
    Moderator Smart Home
    Posts: 14611
    Help: 654
    Rate: 12622
    I wonder if you could specify exactly which types of memory you’re referring to? Are you talking about those with a parallel interface?
    Helpful post? Buy me a coffee.
  • #11 21921206
    funzen
    Level 25  
    Posts: 524
    Help: 73
    Rate: 251
    I'm curious too – what sort of memory is it? Or perhaps the programme doesn't support it?
  • #12 21921208
    E8600
    Level 41  
    Posts: 8921
    Help: 529
    Rate: 2493
    I once wanted to read data from a Manta; I desoldered the memory module but couldn’t get it to work. I thought the programmer was faulty, but then I found out somewhere that this particular memory module couldn’t be read using that programmer. I don’t remember what type of memory it was, but it’s possible I posted about it on a forum. It was a Manta with DVB-T2 that I was repairing for a friend.
    It’s possible it was the software, as I only tried using the CH341.
  • ADVERTISEMENT
  • #13 21921229
    funzen
    Level 25  
    Posts: 524
    Help: 73
    Rate: 251
    If you’re referring to the memory mentioned in this post 20173560

    DVB-T2 HEVC H.265 Full HD terrestrial TV tuner and set-top box – internal components, firmware
    then it can be read without any problems using the "SiberiaProg CH341A v1.43" programme
  • #14 21921251
    p.kaczmarek2
    Moderator Smart Home
    Posts: 14611
    Help: 654
    Rate: 12622
    I recently had an issue with a memory module, and it turned out that the JEDEC ID read function was simply blocked, but all other Flash operations on it were still supported. Because of this, the software wouldn’t read it.
    Flash memory connected but the programmer can’t see it? Solving the CH341 NeoProgrammer issue
    Helpful post? Buy me a coffee.
  • #15 21921296
    Darek.S
    Level 34  
    Posts: 6683
    Help: 215
    Rate: 973
    Darek.S wrote:
    On set-top boxes with this menu, the flash content can be copied to a USB stick directly from the menu.

    That is why this is the quickest and easiest option. If possible...
  • #16 21921389
    E8600
    Level 41  
    Posts: 8921
    Help: 529
    Rate: 2493
    Yes, I remember that post – I couldn’t read it, and it wasn’t the first time I’d tried. I bought the CH341 programmer a long time ago specifically for DVB-T1 set-top boxes. That was four years ago, so perhaps the old version of the software didn’t support it, or was the identification blocked? It would be useful to have a bundle of a few tried-and-tested programs for this programmer.
📢 Listen (AI):

FAQ

TL;DR: For owners of cheap DVB-T2 HEVC tuners, this FAQ shows how a 60 zł GX6706S5 box with 4 MB SPI flash was reverse-engineered, and why "you can extract the file system" matters for firmware inspection, tuner ID, and flash backup workflows. [#21920277]

Why it matters: This thread turns a low-cost TV box into a documented platform for flash dumping, firmware inspection, front-panel mapping, and tuner-chip identification.

Area Variant 1 Variant 2
Flash backup method CH341 programmer after desoldering SPI flash Direct copy to USB from menu after an update-setting change
Front-panel support in firmware FD650 1642
Tuner-driver references in ecos.bin Si2141 R836/R850, MxL608, ATBM2040/253/6032

Key insight: The most important finding is that this box is effectively another GX6706-family clone with reusable firmware structure. Once you dump the 4 MB flash, the XML files and low-power firmware reveal how the panel, remote, tuner support, and standby logic are wired.

Quick Facts

  • The box was bought for 60 zł, includes an HDMI cable and remote batteries, and is rated at no more than 6 W power consumption. [#21920277]
  • The PCB is marked GX6705_S168-17_7KEY V2.1 2025.04.09 and uses a single-board design with the mains supply integrated on the same PCB. [#21920277]
  • The power section uses S7133S in flyback layout to generate 5 V, then local converters derive about 3.3 V and 1.7 V for the main processor area. [#21920277]
  • The SPI flash returns JEDEC ID C46016, which the thread interprets as 4 MB, and the dump was read successfully even though NeoProgrammer did not name the exact chip. [#21920277]
  • gxlowpower.fw is only 8 KB and appears to target an 8051-class standby controller that keeps time on the 7-segment display and wakes the box by key or remote. [#21920277]

Which other DVB-T2 HEVC set-top boxes use the GX6706 or GX6706S5 SoC?

The thread directly confirms one close match: the DVBT005-SH Shark uses the same GX6706 family platform. The author calls this unit “essentially… a clone” of the earlier Shark analysis and says the firmware layout is similar enough that the previous flash-analysis post applies here too. That makes the Shark the clearest same-SoC comparison named in the discussion. [#21920277]

How can I dump the flash memory from a GX6706-based DVB-T2 tuner using a CH341 programmer?

You can dump it by removing the SPI flash and reading it externally with a CH341. 1. Desolder the SO8 SPI flash located next to the GX6706S5 SoC. 2. Connect it to a CH341-compatible programmer and read the JEDEC ID. 3. Save a full backup; in this case NeoProgrammer read ID C46016 and the full 4 MB contents correctly. This method works even when the software cannot name the exact flash model. [#21920277]

What change in the update settings enables copying the full flash contents from this type of set-top box directly to a USB stick?

The thread says a small change in the update settings unlocks copying the flash directly to USB, but it does not name the exact menu field or value. The confirmed takeaway is that boxes with this menu can export flash without a programmer once that update-setting tweak is made. The screenshot proves the option exists, but the precise parameter remains undocumented in the post. [#21920326]

Why does NeoProgrammer show JEDEC ID C46016 but fail to identify the exact SPI flash chip model?

NeoProgrammer can read the chip’s identification and capacity even when its built-in device list lacks the exact vendor-model match. In this case it returned C46016, inferred 4 MB, and still read the flash correctly. The practical result is simple: recognition of size worked, while database-level naming of the exact SO8 flash part did not. [#21920277]

What is a JEDEC ID in SPI flash memory, and how does it help determine chip capacity like 4 MB?

"JEDEC ID" is a flash-memory identification code that software reads from the chip, helping tools distinguish device family and storage size, even when the exact marketing model name is missing. In this thread, NeoProgrammer read C46016 and the author states that this value indicates a capacity of 4 MB. That is why the dump could proceed correctly despite incomplete chip naming. [#21920277]

What is flyback topology in a small set-top box power supply, and why is it used with chips like the S7133S?

"Flyback topology" is a small switch-mode power-supply design that converts the input supply into a lower regulated output, with compact parts and a single transformer stage. Here, the author identifies an S7133S-based flyback section that provides 5 V to the box. That 5 V rail then feeds local converters that generate about 3.3 V and 1.7 V for the processor section, which suits a low-cost one-board receiver. [#21920277]

How do I extract and inspect the firmware file system from a GX6706 DVB-T2 receiver flash dump?

You extract it from the flash dump and then inspect the XML and firmware files inside the resulting file system tree. The thread explicitly says the GX6706 dump lets you “extract the file system,” then shows readable files such as dvb/theme/gpio.xml, panel.xml, keymap.xml, iptv_servers.xml, citylist.xml, language XML files, and lib/firmware/gxlowpower.fw. That proves the dump is not opaque raw data only; it contains structured configuration content. [#21920277]

What do gpio.xml, panel.xml, and keymap.xml control inside the firmware of a GX6706 terrestrial TV tuner?

They control board pins, front-panel behavior, and remote-button mapping. gpio.xml shows pin-related items such as powercut, panel, mute, xtal 24000000, and GPIO levels. panel.xml defines front-panel type, LED behavior, key values, and digit mapping. keymap.xml maps infrared codes to actions like EPG, teletext, record, subtitle, navigation, and colored keys. Together, these XML files expose how the box’s user interface hardware is wired and interpreted. [#21920277]

FD650 vs 1642 front panel controller support in panel.xml — what is the difference and how can I tell which one my box uses?

panel.xml shows two supported front-panel types: FD650 and 1642. In this box, the active configuration points to board type value "0", and the XML maps value 0 to fd650 and value 1 to 1642. The author also notes that the actual display controller on the board is FD650B-S, so this unit uses the FD650 path. If your dump shows board type 1 instead, the firmware is set for the 1642 variant. [#21920277]

Why would a DVB-T2 set-top box firmware contain iptv_servers.xml links such as a local 192.168.x.x address and a dead Pastebin URL?

The most likely explanation in the thread is leftover test or placeholder data rather than a working consumer IPTV service. One entry points to 192.168.1.132, which is a LAN address, and the second Pastebin link returned 404 for the author. He explicitly suggests the local URL may be a remnant from production testing, and nothing in the post shows either link functioning on the retail unit. [#21920277]

What is the unidentified tuner chip marked 4110 A009, and how was it identified as Silicon Labs Si2141?

The unidentified 4110 A009 tuner was identified as a Silicon Labs Si2141 by matching the marking to an SI2141 listing and photo. The thread reply names the printhead model as SI2141 and provides a reference image consistent with that identification. That turns the earlier unknown tuner marking into a specific chip family name used by the box. [#21920340]

How can I verify from ecos.bin or other firmware files which tuner drivers are included, such as Si2141, MxL608, R836, R850, or ATBM2040?

You verify it by searching ecos.bin for tuner names and driver-function strings. The author reports that ecos.bin mentions R836, R850, MxL608, Si2141, ATBM2040, ATBM253, and ATBM6032. He also lists related symbols such as GXDemod_i2c_get_reg, GXDemod_i2c_send_data, and a tuner-error debug print. That combination strongly indicates the firmware includes a universal-style tuner support layer. [#21920451]

What does the gxlowpower.fw file do in GX6706 firmware, and how is an 8051 used for standby mode and wake-up from the remote?

gxlowpower.fw appears to be a small standby-control program for an 8051 used by the GX platform. The file is only 8 KB, and the author says it supports the 7-segment display, keeps the time visible, and wakes the receiver from a button or the remote control. That means standby behavior is not handled only by the main TV application; a separate low-power controller remains active. [#21920277]

How do the remote control codes in keymap.xml map to actual buttons like EPG, teletext, record, and subtitle on these DVB-T2 boxes?

They map hexadecimal IR codes to named GUI actions inside three remote profiles: public1, public2, and public3. For example, public1 assigns EPG to GUIK_E = 0xbb8f, TELETEXT to GUIK_T = 0xbbc7, record to GUIK_PRINT = 0xbbfd, and subtitle to GUIK_B = 0xbb27. The same file also maps navigation, colored keys, playback, and USB/media shortcuts, so one XML file defines most user-input behavior. [#21920277]

What does 'designed in Poland' on this DVB-T2 tuner packaging likely mean when the device itself is marked Made in PRC?

In this thread, it reads more like branding or marketing than evidence of Polish hardware manufacturing. The box packaging shows a Polish flag and “designed in Poland,” but the chassis marking says Made in PRC. One reply jokes that it may only mean the order came from “a Polish email address,” which captures the skepticism around the label. The thread offers no technical proof of any Poland-specific hardware design work. [#21920438]
Generated by the language model.
ADVERTISEMENT