Sunstar ST-5000HD DVB-S2 HD HDMI receiver for $44 shipped

[KE4EST]

the no rs232 is a handicap.
I believe the openbox series with the same processor-the firmware is encrypted.

I've heard the same thing, but I wish someone could get too it, and change a few things. I like the X3, but it needs a few mods.

 

[Bugsy1]

Thanks for all the updates Bugs. Can you get some better pics of the guts that aren't blurry?

Im charging the battery pack in my camera so I can get some good pics of the board inside of it i also have a dasm of part of the code that says the chip is just about the same as a 3602

ROM:80017CFC li $a2, 0x24
ROM:80017D00 la $v0, aAliCorp # "ALi Corp"
ROM:80017D08 sw $v0, 0($s0)
ROM:80017D0C la $v0, aM3602HdStb # "M3602 HD STB"
ROM:80017D14 sw $v0, 4($s0)
ROM:80017D18 li $v0, 0x10001
ROM:80017D20 sw $v0, 0x20($s0)
ROM:80017D24 sw $0, 0x1C($s0)
ROM:80017D28 li $v0, 1
ROM:80017D2C sw $v0, 0x14($s0)
ROM:80017D30 lw $ra, 0x18+var_4($sp)
ROM:80017D34 lw $s0, 0x18+var_8($sp)
ROM:80017D38 jr $ra
ROM:80017D3C addiu $sp, 0x18


the chips arent marked well enough to get a pic of the numbers on them but the board has WSD_tv-1163 S2 V1.2
2011.05.30

the software version in the maincode is tdv10290-1-0-2-0

also it looks like it has a place on the board for a db9 connector under the riser board for the tuner but it would have to be rigged to fit it on the case with probably a ribbon cable so you could place it in a remote location on the case

 

[xtgold]

it looks like it has a place on the board for a db9 connector under the riser board for the tuner but it would have to be rigged to fit it on the case with probably a ribbon cable so you could place it in a remote location on the case

that would be well worth doing,then you can play with the euro firmware without ripping hair out.
remote tables would have to be edited to match your remote tho

 

[Bugsy1]

that would be well worth doing,then you can play with the euro firmware without ripping hair out.
remote tables would have to be edited to match your remote tho

Exactly I have the software and everything if anyone needs it I'm not sure if were allowed to upload it right here but anyone who is interested is welcome to pm me you can see this data in hexworkshop s3602f_test_port

 

[xtgold]

I run an older version of the TDVxxxx-x-x-x-x firmware on my openbox s10,so that looked familiar.

 

[Bugsy1]

I run an older version of the TDVxxxx-x-x-x-x firmware on my openbox s10,so that looked familiar.

yea im thinking all of the ALI Tech chips run the same software platform just different updates I have the remote codes now in a bin file for the sunstar so that will help breakdown the code


11001700130000001100BF001400000011004F00000000001100CD000100000011008F000200000011004D000300000011000D000400000011008D000500000011002F00060000001100AD00070000001100ED00080000001100AF000900000011000F001600000011009F002D000000110037001800000011001D000A000000110057000B00000011009D000C000000110097000D000000110055000E00000011005F000F0000001100E700100000001100B7002B00000011006D002C000000110027001D0000001100DD002A00000011006F00170000001100F500410000001100F50035000000110035004200000011003500360000001100750043000000

is the remote code it starts at 00352ce0 and goes to 00352e4f

 

[xtgold]

on the s10 I make sure the firmware boots,then the tuner works,then worry about getting the remote buttons working 100%

 

[Bugsy1]

on the s10 I make sure the firmware boots,then the tuner works,then worry about getting the remote buttons working 100%

Very true im looking for a better program to disassemble the code

 

[Bugsy1]

Identifiant du Block : 23010010
Offset : 0
Taille : 131072
Nom : bootloader
Version : DVBS2---0.1.0
Date : 2012-3-1


Identifiant du Block : 01FE0101
Offset : 131072
Taille : 1572864
Nom : maincode
Version : M3601S
Date : 2012-6-14


Identifiant du Block : 08F70100
Offset : 1703936
Taille : 65664
Nom : keydb
Version : 1.0.0
Date : 2011-12-8


Identifiant du Block : 02FD0100
Offset : 1769600
Taille : 32640
Nom : Radioback
Version : 1.0.0
Date : 2012-6-14


Identifiant du Block : 02FD0200
Offset : 1802240
Taille : 32768
Nom : BootLogo
Version : 1.0.0
Date : 2012-6-14


Identifiant du Block : 03FC0100
Offset : 1835008
Taille : 262016
Nom : defaultdb
Version : 1.1.0
Date : 2011-7-8


Identifiant du Block : 04FB0100
Offset : 2097024
Taille : 2097280
Nom : userdb
Version : 1.0.0
Date : 2012-6-14

 

[Bugsy1]

well i finally got a program to disassemble he code ST20 is working just fine on the decompressed code

 

[xtgold]

it shouldn't,different pro cessor

 

[Bugsy1]

it shouldn't,different pro cessor

I know IDA Pro was encrypted so I thought i would give it a try and it worked something very strange is going on this the MIPS code on the chips


00424924: ** str_424924: .string "M3601S/64M"
00424930: ** str_424930: .string "Software Ver"
00424940: ** str_424940: .string "TDV10290-1-0-2-0"
00424954: ** str_424954: .string "Product Ver"
00424961: ** str_424961: .string "N %s"
0042496c: ** str_42496c: .string "EPG Show logo"
0042497c: ** str_42497c: .string "EPG normal"
00424995: ** str_424995: .string "Port%d"
0042499c: ** str_42499c: .string "1Cascade M1: Port%d"
004249b0: ** str_4249b0: .string "1Cascade M2: Port%d"
004249c4: ** str_4249c4: .string "1Cascade M3: Port%d"
004249d8: ** str_4249d8: .string "2Cascades: Port%d"
004249f6: ** str_4249f6: .string "Port%d"
00424a00: ** str_424a00: .string "%d %04d/%d/%d %02d:%02d:%02d - %02d:%02d:%02d"
00424a30: ** str_424a30: .string "(%d/%d) "
00424a3c: 4e ldc #e
00424a3d: 6f 20 53 ldnlp #-ffd
00424a40: 61 74 ldl #-1c [var_-28]
00424a42: 00 nop
00424a43: 00 nop
00424a44: 4e ldc #e
00424a45: 6f 20 54 ldnlp #-ffc
00424a48: 50 ldnlp #0
00424a49: 00 nop
00424a4a: 00 nop
00424a4b: 00 nop
00424a4c: ** str_424a4c: .string "(%d/%d) %d %c %d"
00424a60: ** str_424a60: .string "Invaldi LNB type"
00424a74: 25 64 2d 25 64 00 j loc_8e1f2a
00424a7a: 00 nop
00424a7b: 00 nop
00424a7c: ** str_424a7c: .string "(%d-%d)"
00424a84: ** str_424a84: .string "Alle Satelliten"
00424a94: ** str_424a94: .string "All Satellite"
00424aa4: ** str_424aa4: .string "Moving dish,please wait... "
00424ac8: 0a j loc_424ad3
00424ac9: 2d 2d 3e ldnl #dde
00424acc: 3e ldnl #e
00424acd: 00 nop
00424ace: 00 nop

 

[Bugsy1]

I used disasmips and now have a full dasm of the code its mips32 based

 

[wallyhts]

I used disasmips and now have a full dasm of the code its mips32 based

Are you in Louisville KY? I would love to see this STB in person.

 

[Bugsy1]

Are you in Louisville KY? I would love to see this STB in person.

I am on the other end of the state Ashcamp, Kentucky this stb has a lot of potential for a cheap box I found another brand that has the same processor and tuner that has a SR range of 1-50 and does 1.0 1.1 1.2 2.0 2.1 2.2 so if i keep playing around with it maybe I can learn how to mod the firmware to do the same and make it a great investment

 

[rrob311]

Any progress on this receiver? Did any new firmware get released?