JP1 Remotes

I have a remote for a Dish satellite box which was made by UEI and which I'd like to program with RMIR.

The back of the case says:
40.0 UHF 2G
FCC ID: MG3-2015
EchoStar Technologies L.L.C.
186228

And the circuit board inside says:
UEI Echostar Xip Freescale Remote
URC-2015BC0-R
60272-2231000 V05
MAY.2011 REV:05

I can't find any mention of this model online in connection to the JP1 modding scene, so I started poking around the hardware.

The largest chip on the board is a QFN-48 with a Freescale logo marked "MCQE96C / 3M11J / CTHM1301". I'm assuming it to be a Freescale MC9S08QE96CFT MCU. There's also a QFN-32 with a Freescale logo marked "13202 / 4QXUB", which appears to be a Freescale MC13202FC "2.4 GHz Low Power Transceiver for IEEE 802.15.4". The only other serious IC is a DFP-8 with an ST Microelectronics logo marked "2SPE20VP / B2454" which I can't identify.

There's a set of six test pads in the battery compartment marked "JP1.4". I've taken a multimeter in connectivity mode and followed the traces:
1 => MCU 48
2 => Gnd
3 => MCU 47 RESET
4 => MCU 30 Vdd
5 => MCU 26 RxD1
6 => MCU 25 TxD1

Since it's marked "JP1.4" I assume it uses the JP1.4 interface, but I'm not sure since Rob once said that JP1.4 remotes should have a Samsung MCU and this one clearly has a Freescale MCU instead. Based roughly on the JP1.3 pinout as given by 3FG, I built a pogo pin adapter to connect my FTDI TTL-232R-3V3 cable: However, with that adapter attempting a Raw Download from RMIR v2.03 b14 on Mac OS 10.11.6 results in an "Unable to read the signature of the remote" error, plus this in the log: Unfortunately I don't have ready access to my logic analyzer right now, so I can't debug much further in hardware. Since the JP1.x Serial interface code in RMIR is loaded via JNDI I don't know how to increase its debug level, assuming that's even possible. This is my only non-USB JP1 remote and I've not used this FTDI cable or this computer for JP1 work before, so it could easily also be an interface or software issue.

Has anyone seen this model before? Is the JP1.4/Freescale platform something that's currently supported, or has any work been done on it? Can anyone confirm the pinout for this JP1.4 interface that's a 1x6 array of test pads instead of the normal 2x3 header?

This isn't JP1.4 (or JP1.4N); UEI don't always label the interfaces consistently. AFAIK the only Freescale processors that UEI have used that we know about were the HCS08 series in JP1.2 remotes.

I you have access to a Windows PC, try JP2Sniffer, which tends to be a bit more forgiving of odd/unknown remote types; also try the the lastest prototype build of RMIR - 2.04build6 (make sure you have the lastest version of jp12serial as well).

Hi Elemecca. As Knuckx points out, the development version RMIR v2.04 build 6 (and build 8) available here only contains jp12serial v0.22 beta for Windows OS. However, the release version v0.22 of jp12serial has now been compiled for Linux and Mac OS X as well, ready for the forthcoming public release of RMIR v2.04. You can find the full set of compilations here. To use the development versions of RMIR v2.04 with your Mac, use jp12serial v0.22 from the above link and DecodeIR from RMIR v2.03 build 14.

Knuckx wrote:This isn't JP1.4 (or JP1.4N); UEI don't always label the interfaces consistently. AFAIK the only Freescale processors that UEI have used that we know about were the HCS08 series in JP1.2 remotes.

For reasons not clear to me, the product number printed on this MCU "MCQE96C" is missing the digits that specify the core type: it only shows the testing level "MC" (Fully Qualified), the device family "QE", the flash size "96" (in KB), and the thermal range "C" (-40C to 85C). Fortunately I was able to find an errata document for its mask number "3M11J", which confirms that the full model number for the die is "MC9S08QE96". That adds the memory type "9" (flash-based) and the core "S08". I can, by looking at the shape and pin count of the chip, add the package type "FT" (QFN-48), so the full model number is almost certainly "MC9S08QE96CFT".

Given that it uses a Freescale S08 core, it seems reasonable to assume this remote is a member of the Freescale-based JP1.2 remote family already seen.

Knuckx wrote:I you have access to a Windows PC, try JP2Sniffer, which tends to be a bit more forgiving of odd/unknown remote types

I do indeed have a Windows PC I can use. JP2Sniffer 1.4 downloaded from your link doesn't seem to do any better than RMIR on my Mac did. Whether or not I'm holding the pogo pins to the pads, it says "Read operation timed outGet Info timed outBad AddressBad Length" when I click "Download from E2" on the "High level" tab, or just "Read operation timed out" when I click "Begin Comm" on the "Low level" tab. Are there any settings I should change from the defaults before trying to connect? Do I need to set the baud rate or other parameters on the port before I launch JP2Sniffer?

Since the description of the tool is "Program to read/write from JP1.4, JP2, JP3 or USB (MAXQ processor) remotes", it seems likely that it just doesn't support this (probably) JP1.2 remote.

Knuckx wrote:also try the the lastest prototype build of RMIR - 2.04build6 (make sure you have the lastest version of jp12serial as well).

mathdon wrote:As Knuckx points out, the development version RMIR v2.04 build 6 (and build 8) available here only contains jp12serial v0.22 beta for Windows OS. However, the release version v0.22 of jp12serial has now been compiled for Linux and Mac OS X as well, ready for the forthcoming public release of RMIR v2.04. You can find the full set of compilations here. To use the development versions of RMIR v2.04 with your Mac, use jp12serial v0.22 from the above link and DecodeIR from RMIR v2.03 build 14.

With RMIR v2.04 build 8 and jp12serial v0.22 release on Windows 10 x64 I get a "No remotes found!" error when I attempt a Raw Download, plus this in the log: Trying that same version on my Mac results in the same error message and log output as I was seeing there before: It looks like on Windows it's failing to open the serial port. That doesn't change even if I run it as Administrator. On OS X it says it successfully opens the port, but even with the new versions it fails to read the signature.

I'm not really sure how to continue troubleshooting this, since I don't have anything here I can use to observe what the interface is doing at the hardware level. I'm at a family member's house, and this is their remote, which is why I don't have access to any of my normal equipment. Since these remotes are only ~$25 on eBay I bought one. It (and I) will be at my house in a week or so, at which point I should be able to investigate far more effectively.

Try doing a 983 Signature blink back. If it is a JP1.2 remote, it will have a 4 digit sig starting with "1". JP1.3 signatures are 4 digits starting with "3", JP1.4 are 5 digits starting with "3", and JP2 are 5 digits starting with "2".

JP2Sniffer won't work with JP1.2 or JP1.3 remotes.

It is strange that the Mac appears to open the interface but Windows doesn't. The Mac is odd, too, in reporting an interface type of 0. I have looked at the source code for jp12serial and cannot see how any recent version of jp12serial can return a successful open with an interface type 0. Can you go to Help > About in RMIR on the Mac and check that it says the JP1.X Serial version really is 0.22?

We have seen a surprising number of new interface types appearing recently in UEI remotes. JP1.4N and JP2N are variants of JP1.4 (Samsung processor)and JP2 (MAXQ processor) that jp12serial v0.20 and v0.21 could not open, and JP3.1 has a Texas Instruments processor that we haven't seen before. Perhaps you have yet another new type. If so, then initially it will be for the communication experts to explore with you. It is intriguing and I do think it worth pursuing, but at present I have no further suggestions to make.

Great detective work so far Elemecca. I'll share a few interesting facts about this remote which might help.

- UEI makes all DirecTV and Dish model remotes from the past several years, dozens of models, only one of which we attempted to integrate with RM/IR
- The DirecTV remote was hacked for JP1 years ago. But the effort was ultimately abandoned due to the difficulty of connecting the interface and the limited programming potential
- The 40.0 is already obsolete. The RF on it is incompatible with the latest Dish devices
- The 40.0 receives device upgrades from its host DVR via infrared already. To discover the data structure and contents, one would simply read the IR during a programming session. We could possibly use IR for programming it instead of a cable
- The 40.0 also receives the entire configuration of the host DVR via IR and stores it. It can then send the configuration back to the DVR via IR. So if/when you do read the remote's data, it may include all of the DVR configuration data as well, which would have to be handled somehow

3FG wrote:Try doing a 983 Signature blink back. If it is a JP1.2 remote, it will have a 4 digit sig starting with "1". JP1.3 signatures are 4 digits starting with "3", JP1.4 are 5 digits starting with "3", and JP2 are 5 digits starting with "2".

As mdavej pointed out, this remote uses a configuration GUI on the paired Dish receiver via its UHF radio interface. It doesn't seem to have the "hold a button and then enter a code on the number pad" configuration method common to other UEI remotes. I wasn't able to find a button that behaves like the Setup button on a normal UEI remote, so I can't figure out how to enter the 9** special codes.

mathdon wrote:It is strange that the Mac appears to open the interface but Windows doesn't. The Mac is odd, too, in reporting an interface type of 0. I have looked at the source code for jp12serial and cannot see how any recent version of jp12serial can return a successful open with an interface type 0. Can you go to Help > About in RMIR on the Mac and check that it says the JP1.X Serial version really is 0.22?

On the Mac, RemoteMaster's about page says "RemoteMaster v2.04 build 8" and "JP1.X Serial version 0.22", yes. Unfortunately I'm leaving here in a few hours, so I won't be able to debug this particular interface on this particular Mac any further for a few months. I do have a Mac at home that I can attempt to replicate this on, though.