EMU 9400

A brand new firmware for Samsung 9400 Viaccess receiver has been recently issued.

A Samsung 9400 v136 soft was taken as a source soft, and I have added the emulator from Samsung 9500 ver. 3.8. The soft has been somewhat modified while porting, the emulation algo though remained the same. That is, all CA systems from ver. 3.8 should work here as well. As a matter of fact they already do work J)) :)

The soft should be fused into a receiver through JTAG-interface.

Great deal of receivers was fused, so I’ll try to explain how to do it and keep your tuner alive.

Two different types of mainboard can be met:

        

           

For the 1^st one it’s more advisable  to solder JTAG to the bottom side of the board where the needed pins are situated

P9 - TMC, P11 - TCK, P13 - TDI, P15 - TDO, P19 - TRST. It looks like this:

 … although there was a diagram in Internet on how to solder to metallized PINs, I for one disliked it.

2^nd  variant: the JTAG PINs are covered with some compound on both sides of the board.

 

In the latter case 2 ways have been used:

1. The compound can be drilled out from the parts side, then you can solder to the pins without tuner disassembling (you’ll have to disassemble it anyway, I’m going to explain why later):

         

Bear in mind you’ve got to drill very carefully for the drill can “jump” away and you will drill all the way through the board.

2. The compound can be also erased from the solder side, and JTAG pins will become available for soldering. If you choose the latter you’ll have to disassemble the receiver completely.

This is how the pinout looks like (standard connection):

 

So now we know where our “magic” JTAG pins are, and here’s what’s got to be soldered there.

There are 2 commonly used Jtag diagrams:

The resistors diagram I used for rather a long time, it needs no power supply which is a good feature. I only have no idea how it’s gonna work on other computers, it’s quite possible you’ll have to change the resistors’ values and try all that out on someone else’s computer (so that your own doesn’t die). Cable connection for this one should be as short as possible and well electromagnetically shielded. I for one used shielded cable with two blocking wires, approx. 0,5 meter long.

The diagram using the chip is more or less stable, no elements values correction is needed. It would be a good idea to add a LED-indicaion to it (i.e. power indication), as well as a ZENER diode to enable voltage protection (in case more than 3.3V were applied). It seemed the tuner worked faster with the latter diagram.

Do not connect to receiver whilst it’s already switched on. Tuner should be disconnected from everything, and the computer is advisable to ground well. First of all solder the interface, next connect it to your PC, and then only switch the receiver on. To switch all the stuff off, do every step backwards.

There is one more nuance. When you wish to change the keys, or to correct your settings? You’ll have to every time open up your tuner to get to RS232 port. That’s as I believe is annoying, so I propose to solder the RS232 port pins to SCART connector as shown:

       ...that’s how the wires go.

 

And here’s how to make the cable:

           ...this is my universal.

 

Going further... let’s get to fusing.

You’ll need these programs to fuse the receiver:

Jkeys2 9.10 (Jkeys by D2 v.9.10)

SetEdit9500 or Semkoedit

So, solder Jtag to your tuner, connect COM-port to SCART, connect Jtag to Lpt-port, and finally switch the tuner on. If all was done correctly, tuner should start as usual and shift either onto STANDBY (red LED on) or POWER ON (green LED on).

If you want to save your settings and channels, strat SetEdit9500, press CONFIG, choose COM-port, press ОК, then FILE, READ.

 

 

 

 

 

 

 

 

 

Wait until program saves your settings and save them.

Now launch Jkeys2 9.10:

The program should identify the flash type. Press Flash Programming and watch this:

In Base Address window please print in 7FE00000 and press Detect. To save your existing flash image, press Read and wait until the program finishes reading. Then save it somewhere on your hard drive.

To enable flash writing, you must erase it first – so press Erase:

 press YES and wait until the working window becomes active.

This is it, your tunr’s flash is empty, and it would be a cool thing not to have the mains off :)

Proceed by pressing Program, choose the file you want to write and press ОК. The picture should look like this:

…on finishing press ОК and exit the program.

After exiting the JKeys please switch off the tuner and in 5 seconds switch it on again. It should strat as usual. Now launch SetEdit9500 , load our setting previously saved settings, press FILE, WRITE.  I personally used to edit my settings a little bit, deleting the unnecessary transponders and stuff...

It may happen the settings would not fuse into the tuner, this means the settings are of different version. Just convert them then:

Now we’ll download the keys with dsr9400edit:

I presume all is clear by now, get the keys from Internet, and write the according to CA system...BISS and CW keys are printed in the same way in this very window:

On how to manage BISS keys..all info is available on forums... I’ll tell some words, anyway. By pressing twice the (і) button on your remote control you’ll get SID and PMTPID data.

Some SIDs and PMTPID you can find in the table below:

0001 0020 - DISCOVERY 42°E	0004 0103- ENTV, NSS 7 at 22.0°W	0001 0101 -Nat Geo 16°E
0001 0020 -TV - 8 42°E	1F06 1EEC -Encrypted Feed 13°E	0001 0020 -Fox sport 16.0°E
0001 1079 -Минск-ТВ 53°E	0001 0020 -Prime Sports 49°E	0007 0700 -1+1Intern 4°W
0011 02BC-90°E Cпорт	0002 0023 -Tyumen 49°E	0001 1079 -5 kANALAS 4°W
0004 0020- NBA TV 42°E	0001 0020 -GTRK Yamal 49°E	2135 0020 -Rai - 13°E
0005 0500 -Мегаспорт4°W	07DA 010A -Disney ME 10°E	377D 06A4- Fox Tv 13°E
0065 0068- ABS 75°E	0001 0100 -OPT 40°E	17DE 17DE -TET 5°E
0063 0100 -MGM 10°E	0002 0101- Russia 40°E	0010 0258- Canal 4 30°W
0006 0070 -M1 4°W	0005 0104- Russia-2 40°E	0016 1579-AXN Portugal 30°W

 

Next please input the keys using this format: 00 00 00 ХХ 00 00 00 ХХ  (ХХ are omitted).

CW keys are inserted as BISS keys, just find the channel using CW and press OK, check out its SID and PMTPID, then input the key itself 000000ХХ000000ХХ. If there are 2 CW keys (00 1234567890123456;  01 1234567890123456;), you’ll have to try both to find out the working one.

Saving the keys. To download the keys switch the tuner on (green LED should be ON), if the tuner has the antenna connected please go to any FTA channel. In dsr9400edit press Write, on finishing switch the tuner off with your remote (red LED on).

There is one variant more, it’s alas is not quite fished as yet. Having the tuner in any mode download the keys into it and send code 03h to the port. I simply did not have enough time to finish this (so that program did 03h by itself).... maybe someday... someone.. :)

That’s it!!! The keys are in, the tuner is almost ready for work, BUT! The soft has been compiled so that it’s necessary to insert the card with CONAX CA to activate the EMU. Consider it as the key for EMU activation. 

The card.

I have worked with 3 types of cards (there maybe more of them), namely they were Gold Card, Silver Card, and Fun Card. All the stuff for these types of cards can be found all over the Internet or on the forum. When you switch the tuner onto a scrambled channel,  a request for key is sent out to the card. The built-in emulator intercepts this request and supplies its own key.

You can fuse the keys into the card and this will work, the only thing you’d have to do is to delete the Provider ID from EMU.

Emulator management and drawbacks.

It may happen that emulator will interfere with the work with the official card (say NTV card), then simply disable the EMU. Press buttons GP-, PG+, Audio(blue) on your remote, and you’ll see Emulator Disable. Repeat the combination to activate the emulator.

It also may happen that you’ve supplied the right keys but the channels won’t open. It’s in case of SIMULCRYPT (several CA systems at once), and the emulator has chosen the wrong ident. Then press twice button Exit, in window that appears using buttons vol+, vol- choose the needed ident and press OK(some idents will not be shown). To avoid this annoying work, constantly edit so called “CaId List”. These data are included into our software, but still there maybe some mistakes or not all data entered... How to do it and program to use please check out the forum...

Bugs :)

As I wrote above a good deal of tuners was fused, so some problems were encountered. Sometimes it may happen that the tuner will hang up while “jumping” from one channel to another. There will be no sound, the video remains normal. This crap happens very rarely, but if you find any regularity when this does happen, please report it. May be the problem can be corrected.

One more thing, sometimes tuner may shut down settings to default ones (no channels will be seen). All in all it’s the bug of the very software I have ported, and not of the emulator. This shutdown may occur, e.g. when the tuner has been switched off incorrectly. I for one never experienced this bug as yet.

And as always:

All you do according to this instruction is to your own risk.

I do not want to be held responsible for someone’s mistakes...simple as it is.

 

English translation by

YARO

01.07.2007