TELE-audiovision International — The World‘s Largest Digital TV Trade Magazine
13. In the Putty window, confirm you
received the files with the “ls” command.
Notice that the “update” file is listed
in grey. This means that it cannot be
14. Use the “chmod 755 update” command
to change the privileges, so that “update”
can be executed.
15. Repeat the “ls” command: “update” is
now listed in green, meaning that it can be
16. Execute the command “./update
backup_kernel_344” to flash the backup
kernel into the flash. This will take a few
minutes and the receiver will then restart
automatically. It may be necessary to turn
the receiver off and on again. It will boot
with a kernel that can be upgraded using
the normal procedure with a USB pen and
AZUp. Congratulations! The receiver is
for themselves when used to unsol-
der chips or small SMA components.
You can get a good model starting at
around 150 Euros.
In just a few seconds I unsoldered
two matching resistors labeled 103
from an old motherboard using a hot-
air soldering iron and soldered them to
the AZBox circuit board. It‘s nice that
this little resistor is sucked correctly
onto the contacts thanks to the sur-
face tension of the solder.
It‘s not easy to check this with the
naked eye. It‘s actually easier than it
The JTAG interface was finished in a
few minutes; I could now get started.
Using the OpenSource OpenOCD soft-
ware the Flash process is run. But I
soon became disillusioned: the Flash
process is slow. Not slow in the normal
sense, but snail slow.
According to my calculations the
complete 8MB flash process would take
eight weeks to complete! So I decided
to have a look at the firmware file with
a hex editor.
It‘s easy to recognize on the
„straight“ hexadecimal address if a
new memory location starts. You have
to think of the Flash memory like a
diskette on which different files are
In between the files up until the next
„straight“ memory address there‘s al-
ways a free space that is filled with ei-
ther &H00 or &HFF.
Since the kernel is also housed in the
Flash and I already had a file like this
on my PC, I could quickly figure out
where to find it in the Flash. It definite-
ly pays to snoop around in a Flash file;
the OpenSource Hex editor „Frhed“ is
perfect for this.
My investigation found that the 8192
KB is divided is follows:
– First Bootloader
– Linux Kernel
– First File System
It should be good enough to only
write the first &H80000 bytes instead
of the complete &H800000. This flash
process should be completed in just
Therefore, I copied the first &H80000
bytes into a new file using the Hex edi-
tor and then flashed it using OpenOCD.
Sure enough, the next morning I
was able to start my receiver as far as
YAMON. Next I transferred the recov-
ery image again into RAM via TFTP.
To make sure I didn‘t once again
lose both the Bootloader and YAMON, I
used the Hex editor to delete the first
&H80000 bytes and then flashed the
remaining file starting at memory lo-
cation &H008000. This process only
needed a few minutes.
Now look at that: the receiver start
up again and I was able to quite nor-
mally upload the firmware using AZUp.
The receiver was successfully raised
from the dead.
And there you have it: with the help
of a TTL adapter and the availability of
YAMON, you can directly write a kernel
to every AZBox.
You won‘t ever have to use a dead
AZBox as a brick when building a new
house because you can simply bring it
back to life!
This AZBox Ultra HD receiver has re-
ally grown on me; after a few sleep-
less nights, some soldering and incor-
porating a JTAG interface, I am now
much more intimately familiar with the
inside of this box than with any other