Hacking M3 Lite Language Changer

[lenselijer]

I recently bought both the M3 Lite Chinese & English versions.

Compared both pcb boards but they look exactly the same, so why cant i use english firmware on the chinese m3 lite.
The chinese version is cheaper then the english one, so it would be nice

Here is a picture:

Nothing special, unless you look close, you see 4 gold pads in the top right.
They say: TDO, TCK, TDI, TMS
This is a typical JTAG Port. I use it to program cable modems and settop boxes.
Looked it up on google:
Test Clock (TCK), Test Mode Select (TMS), Test Data In (TDI), and Test Data Out (TDO).

You can program the Altera Max II chip using this port.
My idea is to try to read the contents of my chinese m3 lite, because i dont care if that one breaks

When it's successful I will read out my english m3 lite and use the firmware to flash the chinese one.
I think this would work, but I need to know if i'm on the right track. Is the firmware really stored inside this Altera Max II chip? or is it somewhere else?

 

[shaunj66]

Well the firmware is hardly going to be stored in one of the resistors is it? I'm pretty certain you have the right idea, hehe.

It will be interesting to see your results, but I doubt it will really benefit anyone else in the long run as they'd have to build or purchase their own JTAG cable.

 

[tama_mog]

promising project, let us know how it comes out.

 

[lenselijer]

Well the firmware is hardly going to be stored in one of the resistors is it? I'm pretty certain you have the right idea, hehe.

True, but there are some more chips on the other side too

I will try to solder my jtag cable onto these points, hope it will work

 

[shtonkalot]

Cool idea! I'd always wondered what the difference must be between the different language versions.

Is the JTAG cable you use the same or similar to this one?
Do you need a driver for the cable to work or just some specific software?

I'm very interested to see how this turns out.

 

[Extreme Coder]

If this is done correctly, then there would be no reason to justify buying the more expensive english version of the M3. Good Luck!

 

[cory1492]

They may have not enabled/added in system programming, and even if it does have an interface, most likely the language settings are stored in the user locked area (requireing a key to read/write).

More likely the JTAG is used for quality assurance tests / debug info when its actually running.

Any rate, good luck - MaxII/CPLD's are generally quite secure from being read out (and in the case of M3, they double crypt most everything to try and ensure the competition doesnt clone their products).

edit:/btw, with older M3 SD, it was possible to change the firmware version to English, but after e19 or so it stopped booting into the menu.

 

[Vincent Vega]

Nice experiment. Good luck!

 

[iza]

seems like a lot of work to save a few bucks.......but i really have no clue.