How to save yer fooked AZbox HD...


New member
Thanx to terzic (my translation), his home-made brew...

One needs
TFTPD32 file/package
backup_kernel (you'll find it in TFTPD32 folder)
Serial Interface to connect to AZBox HD

You also need your PC's IP address (via command prompt):
Start -> Run -> write: cmd -> hit enter on your keyboard -> ipconfig -> enter -> your PC's IP address is there

If your PC IP address =
We choose AZbox HD IP address, let's say

1. Start TFTPD32
2. Start Putty, choose serial, put the COM port where your serial interface is, Speed = 115200
3. Connect serial interface with AZBox and switch AZBox ON
4. Press CTRL+C to stop the booting
5. Write:

setxenv y.ipaddr
setxenv y.gateway
setxenv y.subnetmask
net init
load -b tftp:// 0xb0100000
pflash write -f 0x80000 0xb0100000 0x680000

Wait till it erases a part of the FLASH, then write the new content in.
This lasts around 5-6minuts, be patient and when it finishes - reboot your AZBox.
If it went well, on your TV screen you will see a standard update you came to know so well...
Plug a USB stick with Official FW and proceed as usual.

I did it all like this, connecting AZbox with PC via rs 232 and LAN connection.

Home-made but works:



New member
Here's more, so we have it all in the same thread... ;)

Thanx to The_Ripper:

Guys, there is 2 type of "install" for E2,
-first one is over standard UPDATE screen and it's only flashing new linux kernel 2.6.22 over old one 2.6.15 , so if this is where you stuck on flash, there is no need for jtag ,just serial interface and then over YAMON bootloader reflashing kernel.
-Second "install" over Azup it's just install to DOM. So if first "install" go okey you should not stuck on BOOTING.

1) Thanx to milix (using online translation service, of course):

Original Manual:


Well seeing that many users have called for a tuto on how to use the RS232 port of Azbox and then use the console Yamón I make a little tuto of how.

Our Azbox has 4 pin connector on the motherboard as seen in the picture below, this port can not connect directly to the PC because it emits low-level signals and the PC serial port not readable data would arrive so we have to use TTL to RS232 converter chip or Max233 Max232 this converter you can buy on e_bay for about 8 euros and not worth building it, is worth any converter that whenever tengais adapteis connections like this in the graph.


Depending on the converter that I buy some will need a cable in my case what I did was take a power connector and a 3.5 floppy with a pin or needle You will be able remove their pins and then solder the wires in and inserts described Ordes new way you can use the device as many times as you want about how commode and easily.

Here I put a screenshot of TTL to RS232 converter with Max232:

After this you can connect to the PC we will use a serial cable OJO simplente important but not a simple nullmodem cable or DB9 serial cable, the connection must be made with both teams while Azbox PC or off.


The Azbox when we light the first thing is to start the zboot that passes control to Yamón which is software that is recorded in a part of the flash deficil delete access to prevent and is responsible for loading the kernel, has a series of basic commands that allow you to read, modify, flash and SDRAM in real time.

This has many advantages:
To change to change the kernel or load the kernel in the SDRAM Yamón exit and pass control to the kernel firmware and try to shut down the computer then becomes the original kernel stored in flash that is ideal for rapid testing without having to flash all day.

So that we understand the Jtag Yamón is like a very simple to use and with very simple stories with a serial cable and that anyone can do, that if, if we delete the portion of the flash where the Yamón if we have to use a Verderosa JTAG to recover azbox why probeis tell you, whatever you do it knowing where you do it.

Now you must use either the putty or hyperteminal to logically connect the cable converter having previously connected the azbox kindle the back button and you will get a log like this:

serial # eeb58f965774f62c6348aa0bdfca3a17 subid xosPe0 0x50
ok cs2 xenv
power supply: ok
dram0 ok (9)
dram1 ok (a)
zboot (0) ok
********************************* *****
* SMP863x zboot start ...
* Version: 2.4.0-
* Started at 0x91000000.
* Configurations (chip revision: 6):
* Use as 8KB DRAM stack.
* Support xload format.
* Enabled BIST mode.
* Enabled memory test mode.
* Use internal memory for stage0 / 1.
********************************* *****
Boot from flash (0x48000000) 0x8c000000 mapped to.
Found at 0x8c000000 XENV block.
CPU clock frequency: 300.37MHz.
System clock frequency: 200.25MHz.
DRAM0 dunit_cfg/delay0_ctrl (0xf34111ba/0x000a8788).
DRAM1 dunit_cfg/delay0_ctrl (0xf34111ba/0x00098887).
Using UART port 0 as console.
Board ID.: "852" E2 "
Chip Revision: 0x8634: 0x86 .. Matched.
Setting up H / W from block at 0x8c000000 XENV.
Avclk_mux> <SYSCLK Setting to 0x00000000.
Hostclk_mux> <SYSCLK Setting to 0x00000100.
Setting <IRQ lo> rise to edge trigger 0xff28ca00.
Setting <IRQ lo> to fall 0x0000c000 edge trigger.
Setting trigger edge hi> <IRQ rise to 0x0000009F.
Setting <IRQ hi> trigger edge to fall 0x00000000.
Setting GPIO <IRQ map> to 0x20090820.
Setting default <PB timing> to 0x10101010.
Timing0> <PB Setting to 0x10101010.
Setting <PB Use timing0> to 0x000003f4.
Timing1> <PB Setting to 0x00110101.
Setting <PB Use timing1> to 0x000003f3.
Setting <PB timing2> to 0x105f1010.
Setting <PB Use timing2> to 0x000003f8.
Cs PB config: 0x000e0040 (use 0x000e0040)
Enabled Devices: 0x00021ace
BM / IDE PCIHost USB Ethernet I2CS PCIDev2 PCIDev3 I2CM scard
MAC: 00:02:14:13: ef: f9
PCI IRQ routing:
IDSEL 2: INTA (# 14) INTB (# 14) INTC (# 14) INTD (# 14)
IDSEL 3: INTA (# 15) INTB (# 15) INTC (# 15) INTD (# 15)
Smartcard pin assignments:
OFF pin = 0
5V pin = 1
CMD pin = 2
Setting up Clean Divider 2 to 96000000Hz.
Setting up Clean Divider 4 to 33333333Hz.
Setting up Clean Divider 5 to 25000000Hz.
Setting up Clean Divider 6 to 20000000Hz.
Setting up Clean Divider 7 to 20000000Hz.
GPIO dir / data = 0x76000038/0x76000000
UART0 GPIO mode / dir / data = 0x6e/0x00/0x00
UART1 GPIO mode / dir / data = 0x6e/0x00/0x00
XENV completed processing block.
Existing memcfg Found: DRAM0 (0x08000000), DRAM1 (0x08000000)
Heap/Temp/Temp1/Dest start at 0x14000000/0x16000000/0x15000000/0x12000000.
Index boot Default: 0
Scanning image romfs at 0x8c040000 (0x48040000) .. Found.
Romfs found at 0x8c040000, Volume name = YAMON_XRPC
Found 1 file (s) to be processed in romfs.
Xrpc_xload_yamon_ES4_prod.bin Processing (start: 0x8c040090, size: 0x0002fe84)
Zboot Checking signature file .. Not found.
Trying xrpc_xload format .. OK
Zboot Checking file signature at 0x13000000 .. OK
Decompressing to 0x91200000 .. OK (453328/0x6ead0).
Load 173/255 msec total time.
Execute final at 0x91200000 ..

********************************* *
* Yamón ROM Monitor
* Revision 2.6-SIGMADESIGNS-01-
********************************* *
Memory: code: 0x11000000-0x11040000, 0x11200000, 0x11204000
reserved data: 0x11240000-0x12440000, PCI memory: 0x12440000-0x12840000
Environment variable 'start' EXISTS. After 1 seconds
it will be Interpreted as a Yamón command and execute.
Press Ctrl-C (or do BREAK) to bypass this.

And when it comes to this point is to press Control + C to access the console then Yamón below to upload / send things we need to establish or authorize our Ethernet port with the following command:

net down

ethernet disconnected

Yamón> setenv bootserver

PC's IP address or server

Yamón> setenv gateway

address network gateway

Yamón> set ipaddr

's IP address azbox

Yamón> set netmask


net init
net up

started the network and the start.

We now have network connection to the PC I will now detail some commands:


In Linux we will have to activate the TFTP server and then the folder you've created for this purpose we put the file miarchivo.ram.srec this format is to load into RAM is obtained with this compiler and the kernel still must be studied how to get it.

How to install and boot ubuntu TFTP:

Yamón> load tftp: / /

With the load command can load the kernel in this case the eye is not in SDRAM flash.

Yamón> go. / Root = dev/mtdblock/0

go execute the command kernel that is already in RAM from the first bone block 0.


The file format to copy it in the TFTP sever will miarchivo.flash.srec this format is to burn the flash. I have to look more closely at the offset and size ± or messing them for no fat, hehe seguire widely across the tuto with more progress.

And here is a list of all available commands Yamón system and its functioning:


The Azbox has an 8-MB Flash NOR type your mapping is as follows:

Creating 5 MTD partitions on "CS2: Physically mapped flash":
0x00000000-0x00020000: "CS2-Part1" Size = 131 072 20 000 bytes hex
0x00020000-0x00040000: "CS2-Part2" Size = 131 072 20 000 bytes hex
0x00040000-0x00080000: "CS2-Par**" Size = 262 144 40 000 bytes hex
0x00080000-0x00700000: "CS2-Part4" Size 620 000 = 6,422,528 bytes hex
0x00700000-0x00800000: "CS2-Part5" Size 100,000 = 1,048,576 bytes hex

With the following telnet command mounted vestments can see how our system including different mtd flash and then that race will detail each part:

MMP [~] $ cat / proc / mtd
dev: size erasesize name
mtd0: 00.8 million 00.01 million "CS2: Physically mapped flash"
mtd1: 00.02 million 00.01 million "CS2-Part1"
mtd2: 00.02 million 00.01 million "CS2" Part2 "
mtd3: 00.04 million 00.01 million "CS2-Par**"
mtd4: 00.68 million 00.01 million "CS2-Part4"
mtd5: 00.1 million 00.01 million "CS2-Part5"

MTD0: Contains the 8mb of flash

MTD1 Part1: I am not sure but I think is the boot Boot
MTD2 Part2: Contains Zboot
MTD3 Par**: Contains the Yamón (xrpc_xload_yamon_ES4_prod.bin)
MTD4 Part4: Contains the Kernel (xrpc_xload_vmlinux_ES4_prod.bin)
MTD5 Part5: Contains the folder DISK1 azbox responsible for starting.

With this info and tweak and test You will be able I hope you help, now I'm very short of time so far I have stopped everything but what I hope will soon resume the investigations, however for tinkering You will be able to load the data in SDRAM so dañareis not flash and never turn it off and keep you that you had before.


2) Thanx to Kanber_Kav:

Kernel upload files and picture e2jtag



New member
Use an online translator... ;)

Thanx to PkPk:
- post br. 15!

En lo referente a adaptadores de RS232 (serie) a USB, bastarÃÂ*a con cualquiera que use el chip Prolific PL-2303, ..

Code: Word - PL-2303HX brochure 081309.pdf

+ Info en

PL-2303 USB to Serial Bridge Controller

    PL-2303 Datasheets
     PL-2303 Software and Drivers
     PL-2303 Application Note
     PL-2303 User Manual
     PL-2303 Reference Design Guide (For customers only)
     PL-2303 Test Reports (For customers only)

pero, CUIDADO, hay numerosos ejemplos de adaptadores chinos que llevan un chip clónico (sin encapsulado), que NO funcionan o lo hacen pésimamente, sin cumplir especificaciones básicas, como éstos ..


Otro ejemplo de adaptador barato (menos de 5 euros) que lleva un PL-2303 original (comprobado !!) y que funciona perfectamente (con "drivers" Prolific, para XP, Vista y W7) es el siguiente (Y-105):





Disculpad que apunte a DX, os aseguro que no tengo ningún tipo de comisión .. :eek:kb:

Un saludo


New member
Thanx to Zeini!!!


Elite/Premium models

differs from




New member
Thanx to ERASEHEAD from (use the online translators, it should work fine):

A prouesta de algún compañero, y porque hay a quién pudiera venirle bien. Os paso un pequeño manualillo que ya he publicado en otro foro amigo (ACJ, si no pudiera poner el nombre por favor editarlo) de como me las he arrglado para el cable serie para sacar el deco de booting con lo que tenía por casa:


Lo primero es saludaros a todos, y lo siguiente es pasar a relatar los pasos que he seguido para comunicarme con el azbox, y recuperarlo del booting, con poco dinero, material que tenía por casa, y la inestimable ayuda de Kol y Dimoni68.

1º) Lo primero era conseguir un puerto serie y, en mi caso, no lo tenía el portatil (si tu lo tienes este paso te sobra) pero guardando polvo tenía uno como el de la foto de cuando cambiaba firmwares al FS-8080 combo. Además no me apetecía andar moviendo el deco al ordenador de sobremesa.



2º) Ahora ya tenemos una salida serie con el patillaje de la foto, pero sin las tensiones TTL´s adecuadas (el estándar RS232 tiene tensiones -3V +3V, pero no os preocupéis yo conecté Rx, TX y GND y lo intenté, no salía ni una palabra legible pero no se estropeó nada)


3º) Ya tenemos la salida del ordenador serie, bien porque nuestro ordenador la tenía, bien por el adaptador. Aquí necesitamos un cable RS232 como el de la figura de abajo. Lo más normal es que por casa tengáis uno normal (de los que se conectaban a los antiguos modem de 56K), o como es mi caso tenía un Null-Modem que me servía para conectarme a decos con entrada RS232. La diferencia está en el patillaje de salida. En el normal ya tenemos el patillaje arriba, y en el Null-Modem las patillas 2(Tx al deco) y 3(Rx del deco) se intercambian y la 4 (terminal preparado) pasa a ser la 6. La masa sigue siendo la cinco.


4º) La parte que nos interesa, a la que he puesto un conector para conectar al circuito en el mismo orden en que están en la placa base del azbox, que nos va a convertir la salida a tensiones TTL es:


5º) El esquema del circuito (suministrado por el compañero Dimoni68) es:


Patillaje de entrada:
1.- Tx (transmite datos al deco)
2.- DTR (Terminal preparado)
3.- Masa
4.- Rx (Recibe datos del deco)

de salida (azbox ):
1.- a Rx
2.- a VCC
3.- Masa
4.- a TX

Las patillas de salida están como en el Azbox Premium que es el que tengo yo, y tal como está en los manuales para recuperar Azbox.

6º) Una vez realizado el diseño con Orcad, me han quedado las pistas del circuito del siguiente modo (realización de circuito según medios: edding, placa fotosensible, etc...) :


Donde hay que destacar tres cosillas:
a) como podéis observar el patillaje de salida esta al revés (la patilla 4 arriba y la 1 abajo). Esto es importante si no queremos cargarnos el deco.
B) Esta es la cara de pistas, por lo que aunque están marcados colector y emisor de los transistores (Q1 y Q2), tened cuidado no lo pongáis al revés.
c) Esta tiene que ver con la anterior, el diseño está hecho para el BC549 y no para el 339 (y no sé si el patillaje y encapsulado coinciden).

Si no tenéis o queréis andar con ácidos y demás existen placas que sólo tienen nodos y las pistas las podéis hacer con cables (de nodo a nodo), ahora que del soldador y el estaño no os salva nadie.

Los datos del circuito son:

Transistores: Q1 y Q2 BC549 (Como dije no tenía BC339, pero valen muchos siempre que sean NPN porque sólo trabajan en corte y saturación)
R1= 1K5
R2= 4K7
R3= 3K9
R4= 22K

Todo el diseño, para Orcad 10.5, lo podeis encontrar aquí:


El circuito me quedó así:


Y para llevarlo a la entrada serie de la foto (insisto en que la salida está al revés 4-3-2-1) me la ingenié con un cable de sonido de los que llevan todos los ordenadores como el que podéis ver en la foto.



El resto ya lo tenéis en el hilo del manual para recuperar Azbox de la misma sección.


New member
Ta to KIDsat:




This is the USB to RS232 TTL Converter Module , which is a good item to connect your RS232 TTL Devices or demo board to your PC via the USB port .



Based TTL PC-PL2303 Chip
USB to RS232
Can be Selected the +3.3V or +5V

Driver Download :


Package Include:

1 X USB to RS232 TTL Converter Module


New member
How to recover AZBox HD died during an upgrade

by andressis2k (.pdf file) and

How to recover a blocked Azbox only displaying:

by PR2 & co. (the big file).

All you need is here!:thum:


New member
well well i have save my azbox elite !!!!!!!
it was blocked only displaying
(booting) i have make a stupit thing brooking up the upgrade process ... but with stuff here finaly a recover my azbox it`s alive again...!!!!


New member
reg dead azbox premium hd

dear sir
i am having booting problem in my azbox premium hd box
i have tried with recover azbox putty tool after login page user as root
and password as azbox
its gives invaild user and password
pl help me sir


New member
@Admin, not that I am complaining but this thread could also be stuck, as many members keep asking about these problems with AZbox HD...



New member
well well i have save my azbox elite !!!!!!!
it was blocked only displaying
(booting) i have make a stupit thing brooking up the upgrade process ... but with stuff here finaly a recover my azbox it`s alive again...!!!!
hi ,

glad to read that you and your azbox are ok .

' we ' here arent ..

do you mind describing how you did it ?

in these kind of situations ; every detail counts ..



New member
.. , as many members keep asking about these problems with AZbox HD...


hi ,

do you think that the latest version of images could have caused all this epidemic situation ?


i think if this kind of stories keep repeating , it wd be better to warn members here too .

just as a suggestion to mods here ..


New member
No, it was the earlier ones that were dangerous and esp. the flashing SW, it seems...

Read my guide for PB-E2 VX in AZ HD... ;)


New member
hi guys im hopeing someone can help me i was having trouble with my azbox premium hd on original setup it was cutting out and freezing so i tried installing the new e2 image but when it got to 37% it just stopped and froze now its just stuck in booting mode im no computer wiz so i dont know what to do to fix this can someone please help me?:mecry::mecry:


New member
Try to re-do it from scratch... As explained million times...

That's the first step. After that YAMON, as described above...

Good luck!


New member

Everything goes fine, but when I give the command: 'cd/tmp' in putty:

"AZBOX[~]$ cd/tmp
-sh: cd/tmp: No such file or directory"

I do not understand this, because with 'filezilla', I am able to see that the folder 'tmp' is present.

For what reason is putty not able to detect 'tmp'?

Many thanks.
Last edited:


New member
Mind the gap! :D

Linux is case sensitive. You must be careful what you write. There's no space for errors or a type of misspelling, broken English etc.

On top of that, if there are empty spaces they must be obeyed, too!

cd (= change directory) is always followed by an empty space and then the rest of the command...

This one, to go to /tmp directory should be

cd /tmp

Here is another command to see the point:

cd /EMU/OpenXCAS/MboxCAS/

Get it? Best to Copy and Paste!

Good luck!


New member
AZBOX[tmp]$ ./update /MMP/backup_kernel

-sh: update: Permission denied

Please, what is incorrect?