i have the echostar isd 2200 model receiver, and dont have a jtag port, nor do i have a chassis beneeath the receiver, nor can i find the tsop chip to solder stuff....

in the ressource pages, there s a guide, but which mentions a 3k-4.5k.zip that is not there anymore...

so does anyone know how i can get the keys from this particular model if the card (rom2) is no help?

i did a memory dump on screen using teh remote control and it gave it on line NVM 0010, all 0000000000

meaning no keys are on the receiver's memory

what to do know ?

im in canada, cant call dishnetwork


- just started with DISH and this is the single biggest blocker to freetv anf fun for me :)

ok so i can pull the bk s from the card, but how do i wipe my tsop if the receiver was hit ? on this particular 2200 model ?

i really really need this info

if your model 2200 ever gets hit by ecm, heres a good way to fix it;;

thanks to x-15 and others for this one


For those of you with an ECM'ed 1000, 3000, 4000 and any similar IRD, there may be a simple way to force a reload of the receiver's firmware.

This seemed to work:

Hold the MSB address line of the TSOP low during power up. A steady hand and a jumper should be sufficient. Then, remove the jumper and connect the satellite cable.

If you don't know what the preceeding paragraph means, it is probably best you not attempt this. At least give the more electronic-savvy testers a chance to verify the results.



x-15

This info is for IRDs with the am29f040bs (or any other 29xx040 chip)
Just to let everyone know, A18 is the MSB address line. On the DIP layout, it is pin1. On the TSOP layout, it is pin 9. Even if you have a TSOP, you can still use the DIP layout's pin1 as the jumping point.
On the DIP layout, pin 16 is the GND line (to hold the line low), and pin 24 is the GND line of the TSOP layout.

The method put forth in this thread is a modest extension of an idea developed elsewhere. A simple way to force an update on an IRD is to corrupt the flash memory image. It would seem that on power up the boot-strap code (also in flash memory, so that cannot be the part corrupted) makes a few CRC checks on the rest of the flash. If the tests fail, the IRD enters a forced reload state.

Holding the most significant bit of the address line low lets the IRD execute the boot-strap code, but the boot-strap gets incorrect data when trying to verify the upper half of the flash. CRC tests fail, and so the boot-strap code forces a reload.

I am sure others may have thought of this method, as well (right Todd?). My only claim, here, may be that of first publication.


x-15

P.S. There are some risks with this technique, by the way. Shorting an address line to ground puts a strain on the logic circuits trying to drive the address line high. As an ECM-recovery method it seems to work; as a general purpose update forcing method, I would advise caution