Make Your Own Cable Converter Chip

me_arcade_1.jpg
Thats me, Phred, the Cox Communications Hater!

Copy the text below, and paste it into a text editor (Notepad will do).  Save it under the filename Super2.ASM" (The comments will be readable after the text is pasted)

;***** Copy the text below this line *****

;This is the first line of the program.
;***************** Ref: PIC 12c509 CHANNEL MAP BOOT JERROLD AUTOMAPPER **************************
; Not used at this time
;
; IMPORTANT NOTICE REGARDING FAULTY PIC CHIPS:
;
;
; It has come to light that despite MICROCHIP's denials a batch of PIC 508's and 509's have
; been manafactured with faulty internal oscillators. Microchip switched to a new production
; process which suffered high stray capacitance causing the internal oscillator EVEN WHEN
; CALIBRATED to be significantly OFF FREQUENCY. The faulty batch can be identified by the date code.
; On the PIC 12c508 the faulty batch are all chips manafactured with date codes from 9813 to 9830
; INCLUSIVE. On the PIC 12c508 the faulty batch are all chips manafactured with date codes from 9820
; to 9830 INCLUSIVE.
; Although operational chips cannot be guaranteed a modification has been implemented to the
; automapper in an attempt to compensate, though results may be erratic. UNCOMMENT FAULTY BATCH
; DEFINITION to make a compensated hex file, NOTE THIS HEX FILE CANNOT BE USED WITH NON-FAULTY PARTS
;
;
;#DEFINE FAULTY_BATCH TRUE
;
;
; THE LOGICAL ADDRESS USED BY THE TEST CHIP IS SET JUST AFTER THE BOOT SEQUENCE TABLE.
; IT CAN BE CHANGED TO * ANY * VALID ADDRESS IF NEEDED.
; REMEMBER : THE CABLE BOX NEEDS TO BE SET TO THE SAME ADDRESS AS THE TEST CHIP IS USING.
;
;                                                             PINOUT DETAILS :
;                                                             _______  _______
;                                                            |  *    \/       |
;                                                  +5V Vcc --+ 1 <<      >> 8 +-- Ground
;                                                            |                |
; OPTIONALLY Connect to ground DISABLES AutoMap on Power Up--+ 2 <<      >> 7 +-- DATA Output
;                                                            |                |
; OPTIONALLY Connect to ground to DISABLE Address tracking --+ 3 <<      >> 6 +-- DATA Input
;                                                            |                |
;  OPTIONALLY Connect via Normally Closed switch to ground --+ 4 <<         5 +-- Virtual Ground
;                                                            |                |   only for pin 4's
;                                                            +----------------+   switch
;
; IF pin 4 is connected to a NORMALLY CLOSED switch the test chip will then NOT REBOOT THE BOX
; when POWER IS APPLIED. The switch must be depressed WHILE POWER IS APPLIED to the box to reboot
; it. This allows the user to unplug the box without losing the map every time.
;
; THE DEFAULT MODE WITH A SWITCH UNCONNECTED IS FOR THE TEST CHIP TO REBOOT THE BOX ON POWER UP.
;
; Depressing the switch momentarily when the box is ON will FORCE THE TEST CHIP TO UPDATE THE
; CHANNEL MAP with the next available map on the cable system.
;
; IF pin 3 is grounded this will DISABLE the address tracking system which CONTINUOUSLY SCANS
; FOR UPDATED CHANNEL MAPS. Leave this pin TIED HIGH unless the box constantly "JUMPS" between
; channel maps on a multiple map system.
;
; IF pin 2 is grounded this will DISABLE the AUTOMAP ON POWER UP function which causes the test
; chip to search for the FIRST AVAILABLE channel map every time the box is powered up. Connecting
; pin 2 to ground will effectively LOCK THE CURRENT CHANNEL MAP and prevent it being updated.
;
; IF BOTH PINS 2 & 3 ARE GROUNDED ALL AUTOMAPPING SYSTEMS ARE DISABLED AND THE TEST CHIP WILL
; BEHAVE AS A NORMAL 4 WIRE AUTO-MULTIMODE TEST CHIP.
;
; Read all comments before using.  This is the best code I have ever seen.
;
;************************************************************************************************

 list P=12c509, R=dec

;#DEFINE LOCK2SITECODE TRUE ; UNCOMMENT THIS DIRECTIVE TO LOCK BOX TO SPECIFIED SITE CODE

#DEFINE AUTOMAP TRUE    ;COMMENT THIS DIRECTIVE TO DISABLE AUTOMAPPING CAPABILITY
#DEFINE BOOTBOX TRUE  ;COMMENT THIS DIRECTIVE TO DISABLE BOOT SEQUENCE FROM BEING EMITTED

#DEFINE FUSESINHEX TRUE  ;COMMENT THIS DIRECTIVE TO STRIP FUSE SETTINGS FROM HEX FILE

GP0 equ 0
GP1 equ 1
GP2 equ 2
GP3 equ 3
GP4 equ 4
GP5 equ 5

BOOTSWITCH_PIN equ GP3
DSNTRACK_PIN equ GP4
AUTOMAPONBOOT_PIN equ GP5

;       Register Definitions
;==========================================================================
W                            EQU     H'0000'
F                            EQU     H'0001'
;----- Register Files -----------------------------------------------------
INDF                         EQU     H'0000'
TMR0                         EQU     H'0001'
PCL                          EQU     H'0002'
STATUS                       EQU     H'0003'
FSR                          EQU     H'0004'
OSCCAL                       EQU     H'0005'
GPIO                         EQU     H'0006'
;----- STATUS Bits --------------------------------------------------------
GPWUF                        EQU     H'0007'
PA0                          EQU     H'0005'
NOT_TO                       EQU     H'0004'
NOT_PD                       EQU     H'0003'
Z                            EQU     H'0002'
DC                           EQU     H'0001'
C                            EQU     H'0000'
;----- OPTION Bits --------------------------------------------------------
NOT_GPWU                     EQU     H'0007'
NOT_GPPU                     EQU     H'0006'
T0CS                         EQU     H'0005'
T0SE                         EQU     H'0004'
PSA                          EQU     H'0003'
PS2                          EQU     H'0002'
PS1                          EQU     H'0001'
PS0                          EQU     H'0000'

;       RAM Definition
        __MAXRAM H'3F'
;       Configuration Bits
_MCLRE_ON                    EQU     H'0FFF'
_MCLRE_OFF                   EQU     H'0FEF'
_CP_ON                       EQU     H'0FF7'
_CP_OFF                      EQU     H'0FFF'
_WDT_ON                      EQU     H'0FFF'
_WDT_OFF                     EQU     H'0FFB'
_LP_OSC                      EQU     H'0FFC'
_XT_OSC                      EQU     H'0FFD'
_IntRC_OSC                   EQU     H'0FFE'
_ExtRC_OSC                   EQU     H'0FFF'

 IFDEF FUSESINHEX

 __FUSES _CP_ON & _WDT_ON & _IntRC_OSC & _MCLRE_OFF

 ENDIF

 cblock 0x07
  xmithreg
  xmitbitcount
  parity
  delaycount

  recv    ;Receive data holding register
  tempstat
  tempstat2

                tblcmd0
                cmdcmd1
  checksum
  tempcount1
  tempcount2
  tablelow

                la2
                la1
                la0

  memla1
  memla2

  trackla1
  trackla2
  trackla3

  sc0
  sc1
  sc2
  sc3
 endc

Rvector    
        org     0x00            ;Reset Vector
 bsf STATUS,PA0
 goto    dispatch_internalinit

cmdtabl
 movf tablelow,W
 incf tablelow,F
 addwf PCL,F

starttable

;----------------------ROM Boot Sequence table---------------------------

 IFDEF LOCK2SITECODE
   ; SITE CODE GOES HERE IN LEAST SIGNIFICANT NIBBLE OF LAST 4 BYTES
 dt      0x04, 0x0B ,0xFD ,0x4F, 0x19, 0x17, 0x0A, 0x06      ; D9 D7 CA C6
 ENDIF

 IFDEF BOOTBOX
        dt      0x04, 0x0A, 0xFD, 0x8C, 0x7F, 0x07, 0x0A
        dt      0x03, 0x06, 0xFE
        dt      0x04, 0x07, 0xFD, 0x8D
        dt      0x04, 0x09, 0xFD, 0x44, 0x00, 0x00
;        dt      0x04, 0x08, 0xFD, 0x95, 0x41
        dt      0x04, 0x08, 0xFD, 0x47, 0x7F
        dt      0x04, 0x08, 0xFD, 0x4A, 0x53
        dt      0x04, 0x08, 0xFD, 0x49, 0x00
   dt      0x04, 0x08, 0xFD, 0x4B, 0x02  ; SET GLOBAL TIMEOUT TO 4 HOURS
        dt      0x04, 0x08, 0xFD, 0x48, 0x00
        dt      0x04, 0x11, 0xFD, 0x4D, 0x1F, 0x0F, 0x7F, 0x7F, 0x7F, 0x7F, 0x1F, 0x1F, 0x63, 0x63
 ENDIF

  dt 0x03, 0x06, 0xF9
        dt      0x00 ; double 00 is used to flag end of command boot sequence

la      dt      0x00, 0xBF, 0x7F, 0x3E  ; ( ESN / DSN )

;-----------------------Subroutines start here--------------------------

cmdsync
        movlw   16                   ; number of inter-command FF's
parasyncframe
 bsf STATUS,PA0
 goto dispatch_parasyncframe

insertla
 bsf STATUS,PA0
 goto dispatch_insertla

xmitcheck
 bsf STATUS,PA0
 goto dispatch_xmitcheck

; SYNCHRONOUS TRANSMIT / RECEIVE ROUTINE   - 16 cycles between calls with 15 % margin = 5 cycles

synctx
 bsf tempstat,4
 bsf tempstat,5
       movwf   xmithreg  ; move byte in W to holding register

recvbyte

checkstart    ; wait for start bit in EXTSYNC
 clrf GPIO

waitforstopbit
 btfsc GPIO,GP1
 goto waitforstopbit      ; check GP1 for 0

waitforrise
 btfss   GPIO,GP1
 goto waitforrise ; check GP1 for 1

 bsf GPIO,GP0

 movlw 4  ; 17 cycle delay
 movwf delaycount
qtrbitloop
 decfsz delaycount,F
 goto qtrbitloop

 btfss GPIO,GP1 ; 18uS in to waveform,
 goto checkstart ; check SA1 @ 1/4 through start bit

 movlw 3
 movwf delaycount
halfbitloop1
 decfsz delaycount,F
 goto halfbitloop1

        btfsc   tempstat,3
        goto    switchtimealign
        btfsc   GPIO,BOOTSWITCH_PIN
 goto setchmapflag
switchtimealign
        btfsc   tempstat,3
        goto    ignoreswitch
ignoreswitch

 incf la0,F
 btfss STATUS,Z
 goto incrementalign
 incf la1,F
incrementalign
 btfss STATUS,Z
 goto checkmappingend
 incf la2,F
checkmappingend
 btfsc la2,6       ;  every 2minutes  ; 5   ;Initiate refresh every 27 minutes
 goto refresh
    ; 2+34+18 cycles, 54 uS = 3/4 start bit
 btfss GPIO,GP1 ; check SA1 @ 3/4 through start bit
 goto checkstart

 goto synxinit

xmitbyte

 bsf tempstat,4  ; tx data is emitted
 bcf tempstat,5  ; generate sync from internal timebase
        movwf   xmithreg  ; move byte in W to holding register

 movlw 19   ; delay loop for start bit in INTSYNC

synctmr0wait    ; using INTSYNC
 btfsc TMR0,7   ; wait for timer initiated start in INTSYNC
 goto synctmr0wait

 bsf GPIO,GP0  ; SET start bit
 movwf delaycount

synxinit    ; 9 cycles

 clrwdt

 bcf tempstat,6  ; CLEAR parity flag
 bcf tempstat,7  ; CLEAR end flag

 movf xmithreg,W
 btfsc tempstat,4  ; /4 is rx and passthrough, 4 is rx and tx indepently
       addwf   checksum,F  ; update checksum if in transmit mode

 comf xmithreg,F  ; invert it ready for TX
       bcf parity,0  ; initialise bit 0 in parity register to 1

 movlw 8
 movwf xmitbitcount  ; set bit loop counter for 8 interations

 btfsc tempstat,5  ; tempstat5 = EXTSYNC / ~INTSYNC
 goto waitforfall  ; goto check for startbit in EXTSYNC

intstartloop
 decfsz delaycount,F
 goto intstartloop
 goto readbyte  ; goto start of bit processing loop

readbyteloop
 btfsc tempstat,5 ; check again for sync mode
 goto transitionwaitsense ;if EXTSYNC goto wait for clock transition
intsync
 movlw 5  ; in INTSYNC delay to start of clock transition
 movwf delaycount
intsyncparitywait
 goto intsyncloop ; 2 cycle delay
intsyncloop
 decfsz delaycount,F 
 goto intsyncloop
 goto readbyte ; then goto bit processing loop

transitionwaitsense  ; in EXTSYNC check edge of clock transition we are looking for
 btfss GPIO,GP1
 goto waitforone
waitforfall
 btfsc GPIO,GP1
 goto waitforfall
 goto readbyte
waitforone
 btfss GPIO,GP1
 goto waitforone
 goto readbyte

readbyte   ; Main bit processing loop
 comf GPIO,F  ; invert output for clock transition

       movlw   7         ; delay 18 cycles for clock half of bit cell
 movwf delaycount
clockbitloop   
 decfsz delaycount,F 
 goto clockbitloop

 btfsc tempstat,7
 goto endsynctx

 btfsc tempstat,4 ; check whether we are transmitting or passing through
 goto txindependent
passthroughdata   ; If in passthough mode then pass incoming data to output
 rrf GPIO,F
 rrf GPIO,F
 rrf GPIO,F
 rrf GPIO,F
 rrf GPIO,F
 rrf GPIO,F
 rrf GPIO,F
 rrf GPIO,F
 rrf GPIO,F
 rrf GPIO,F
 rrf GPIO,F
 rrf GPIO,F

 goto synxreadbit

txindependent    ; if transmitting then get ready to transmit the bit
 movlw 2   ; 28 uS
 movwf delaycount  ; If here, we are transmitting data bits

 btfsc tempstat,6  ; check whether we are transmitting the data or parity bits
 goto synctxparity

 rrf xmithreg,F  ; rotate right (LSB 1st) into C
 movf STATUS,W  ; C is status:0 into W
 xorwf parity,F  ; update parity register
 rlf GPIO,F   ; emit data out of bit 0      - 34 uS

synxreadbitdelay
 decfsz delaycount,F 
 goto synxreadbitdelay
synxreadbit
 btfsc tempstat,6
 bsf tempstat,7

 rrf recv,F
 bsf recv,7  
 btfsc GPIO,GP1           ; 54 uS
 bcf recv,7

 decfsz xmitbitcount,F
 goto readbyteloop     ; 58uS in passthrough & tx independent

 bsf tempstat,6
 incf xmitbitcount,F
 incf xmitbitcount,F

 movf recv,W
 movwf xmithreg

 btfsc tempstat,5
 goto transitionwaitsense ;if EXTSYNC goto wait for clock transition

 movlw 3
 movwf delaycount
 goto intsyncparitywait

synctxparity    ; If here, we are transmitting data bits
 bcf parity,1  ; clear bit 1 of parity register to use as a stop bit
 rrf parity,F  ; load the relevant bit into CARRY
 rlf GPIO,F   ; transmit the bit in CARRY   - 34uS

 decf delaycount,F
 goto synxreadbitdelay

endsynctx

 movlw 0xD8   ; (function overhead) - number of cycles in 36uS
 movwf TMR0

 movf xmithreg,W
 movwf recv
 btfss tempstat,4
        addwf   checksum,F

 clrf GPIO
 return

;  ***********************************************************************
; ********************** Program start point ****************************
; ***********************************************************************

start  

 clrf tempstat      ; Clear map update / map request / switch present flags
 clrf tempstat2
 clrf GPIO

 IFDEF AUTOMAP
 btfsc GPIO,BOOTSWITCH_PIN
 ENDIF
 bsf tempstat,3

 movlw 20
 movwf tempcount2 
timeupdelay
 movlw   0xFF                 ; number of FF's for parasyncframe
        call    parasyncframe
        decfsz tempcount2,F
        goto timeupdelay

 IFDEF AUTOMAP
 btfss tempstat,3
 goto chanact
 ENDIF

xmitboot                   ; *** Transmit boot sequence table
 clrf tablelow 
xmittblcmdlp
 clrf checksum
 movlw 2
 movwf   tempcount2

 call    cmdtabl  ; LA insertion sequence vector in W
 movwf tempcount1 

 call    cmdtabl
 iorlw   0                   ;just to get the STATUS bits updated
        movwf   cmdcmd1
        btfsc   STATUS,Z
        goto chanact              ; THIS IS THE FUNCTION EXIT !!!
        call    xmitbyte
 decf cmdcmd1,F

xmittbllp
        call    cmdtabl
        call    xmitbyte
 incf tempcount2,F
 movf tempcount1,W
 subwf tempcount2,W
 btfss STATUS,Z
 goto noinsertla

        movlw 4       ; length of LA
 subwf cmdcmd1,F      ; remove length of LA from Command sequence length 
 call insertla

noinsertla   
 decfsz  cmdcmd1,F
        goto    xmittbllp

 call xmitcheck       

 call    cmdsync
        goto    xmittblcmdlp        ; jump to get another command sequence

chanact
 bsf STATUS,PA0
 goto dispatch_chanact
chanactreturn


;       INITIATE CHANNEL MAP UPDATE REQUEST

initmapupdate
 btfsc GPIO,AUTOMAPONBOOT_PIN
setchmapflag
 bsf tempstat,1 ; set channel map update rq flag
clrmapupdateflag
 bcf tempstat,2 ; clear map update in progress flag
; map update in progress flag IS ALREADY CLEARED BY CLRF TEMPSTAT IN START PROGRAM

; ACTIVE LOGICAL ADDRESS FILTER
refresh
 clrf la0
 clrf la1
 clrf la2

 bcf tempstat,0
 btfss tempstat,1      ; IF we are not looking for automap on boot
 bsf tempstat,0           ; set LA track flag to re-acquire
WDTrefresh
 call la+1
 movwf memla1
 call la+2
 movwf memla2

 movlw 0xFF
 call parasyncframe

 clrf checksum
        movlw   0x07
 call xmitbyte
        movlw   0xFD
 call xmitbyte
        movlw   0x8E
 call xmitbyte

 call insertla
refreshcheck
 call xmitcheck
 
killcommand
 call cmdsync

filterinit    ; *** INITIALLISE RECVBYTE FUNCTION ***
 bcf tempstat,4  ; tx data is passed through
 bsf tempstat,5  ; generate sync from external synchronisation
       
LAfilter    ; cycles 19 cycles MAXIMUM !!! = 63 uS to check for start bit

 movf recv,W
 movwf tempcount2 ; USED TO SAVE THE COMMAND LENGTH BYTE FOR LATER ANALYSIS

 clrf checksum

 call recvbyte

 movf recv,W

 xorlw 0xFD               ;FD 8E E0 ; fd 5f e0
 btfsc STATUS,Z
 goto through8e5f

 xorlw 0xFD ^ 0xE0        ;E0 LA LA LA
 btfsc STATUS,Z
 goto throughla1

 xorlw 0xE0 ^ 0xD8
 andlw 0xF8
 btfsc STATUS,Z 
 goto detsitecode

 movlw 0x04  ;04 FD 7E
 subwf recv,W
 andlw 0xFB  ;08 FD 7E SI TE CO DE ; 08 FD 4E LA LA LA LA V CHK
 btfss STATUS,Z
 goto LAfilter

throughFD
 call recvbyte 
 movf recv,W

 xorlw 0xFD
 btfss STATUS,Z
 goto LAfilter

 call recvbyte 
 movf recv,W

 xorlw 0x4E
 btfsc STATUS,Z
 goto statmulti        ;statmulti

 xorlw 0x4E ^ 0x5E
 btfsc STATUS,Z
 bsf tempstat2,0

 movlw 0x7E  ; 7E
 subwf recv,W
 andlw 0xFD  ; 81
 btfss STATUS,Z
 goto LAfilter
 goto killcommand

detsitecode

 IFDEF LOCK2SITECODE
 goto LAfilter
 ELSE

 movf recv,W
 movwf sc0
 call recvbyte 
 movf recv,W
 movwf sc1
 andlw 0xF8
 xorlw 0xD0
 btfss STATUS,Z
 goto LAfilter

 call recvbyte 
 movf recv,W
 movwf sc2
 andlw 0xF8
 xorlw 0xC8
 btfss STATUS,Z
 goto LAfilter

 call recvbyte 
 movf recv,W
 movwf sc3
 andlw 0xF8
 xorlw 0xC0
 btfss STATUS,Z
 goto LAfilter

 btfsc la2,7
 goto LAfilter
 bsf la2,7

 movlw 0xFF
 call parasyncframe

 clrf checksum
        movlw   0x0B
 call xmitbyte
        movlw   0xFD
 call xmitbyte
        movlw   0x4F
 call xmitbyte
 call insertla

 movlw sc0 - 1
 movwf FSR
sendscloop
 incf FSR,F
 movf INDF,W
 andlw 0x1F
 call xmitbyte

 movlw sc3
 xorwf FSR,W
 andlw 0x1F
 btfss STATUS,Z
 goto sendscloop

 goto refreshcheck
 
 ENDIF

throughla1
 call recvbyte 
 movf recv,W
 xorwf memla1,W
 btfss STATUS,Z
 goto LAfilter
throughla2
 call recvbyte 
 movf recv,W
 xorwf memla2,W
 btfss STATUS,Z
 goto LAfilter
 goto killcommand

through8e5f
 call recvbyte
 movf recv,W

 xorlw 0x5F
 btfss STATUS,Z
 goto check8E
 bsf tempcount1,0
 goto checkE0
check8E
 IFDEF AUTOMAP
 xorlw 0x5F ^ 0x8E
 btfsc STATUS,Z
 goto checkE0

 xorlw 0x8E ^ 0x4C
 andlw 0xFE
 btfsc STATUS,Z
 goto passchmap
 ENDIF

 goto LAfilter

checkE0
 call recvbyte
 movf recv,W
 xorlw 0xE0
 btfss STATUS,Z
 goto LAfilter

 btfsc tempcount1,0
 goto killcommand        ;      changeFD5F

acquireLA
 IFDEF AUTOMAP
 btfss tempstat,0
 goto LAfilter

 movlw 0x10  ; Check we are in a compressed timer refresh command
 subwf tempcount2,W
 btfss STATUS,C
 goto LAfilter 

 call recvbyte
 movf recv,W
 movwf trackla1
 call recvbyte
 movf recv,W
 movwf trackla2
 call recvbyte
 movf recv,W
 movwf trackla3

 bcf tempstat,0       ; clear LA acquire flag
 bcf tempstat,2  ; clear channel map in progress flag
 goto LAfilter
 ENDIF

statmulti
 btfsc tempstat2,0
 goto LAfilter ; ABORT FD 4E Revector IF Global Multimode command detected 

 call recvbyte
replaceLA
 call la + 1
 call synctx
 call la + 2
 call synctx
 call la + 3
 call synctx
 movlw 1
 goto passchan

passchmap
 IFDEF AUTOMAP
 call recvbyte
 movf recv,W
 xorlw 0xE0
 btfss STATUS,Z
 goto LAfilter

 btfsc tempstat,2 ; check map update in progress flag
 goto mapupdate

 btfsc tempstat,1 ; check map update request flag
 goto mapupdate

        btfss   GPIO,DSNTRACK_PIN
 goto killcommand ; Map updates on the box's LA are STILL CAUGHT BY THE FILTER via the LA

mapupdate

 movlw 0x11
 addwf checksum,F

 call la + 1
 call synctx

 btfss tempstat,1
 goto chktrack1
 movf recv,W
 movwf trackla1

chktrack1
 movf trackla1,W
 subwf recv,W
 btfss STATUS,Z
 goto killcommand
mapupd1
 call la + 2
 call synctx

 btfss tempstat,1
 goto chktrack2
 movf recv,W
 movwf trackla2

chktrack2
 movf trackla2,W
 subwf recv,W
 btfss STATUS,Z
 goto killcommand
mapupd2
 call la + 3
 call synctx

 btfss tempstat,1
 goto chktrack3
 movf recv,W
 movwf trackla3

 bcf tempstat,1
 bsf tempstat,2
chktrack3

 movf trackla3,W
 subwf recv,W
 btfss STATUS,Z
 goto killcommand
mapupd3
 bcf tempstat,4  ; tx data is passed through
 bsf tempstat,5  ; generate sync from external synchronisation
 call recvbyte
checkmapb
 movlw 0x10
 subwf recv,W
 btfss STATUS,C
 goto notmapb
 movlw 0x1F
 subwf recv,W

 bsf tempstat2,1
 movlw 0x08
 btfsc STATUS,Z
 goto passchanmain
 btfss STATUS,C
 goto killcommand
notmapb
 movlw 0x09
 ENDIF
passchan    ; *** INITIALLISE RECVBYTE FUNCTION ***
 bcf tempstat2,1
passchanmain
 movwf tblcmd0
 bcf tempstat,4  ; tx data is passed through
 bsf tempstat,5  ; generate sync from external synchronisation
passchanloop
 call recvbyte
 decfsz tblcmd0,F
 goto passchanloop

 movlw 0x63
 btfsc tempstat2,1
 call synctx

passchancsum
 comf checksum,F
 incf checksum,W
 call synctx

 goto filterinit


;************************* 2ND HALF OF COMMAND BOOT SEQUENCE TABLE *******************************
 org 0x200
cmdtbl2
 addwf PCL,F

 org 0x300

dispatch_chanact
        movlw   0xE8
        movwf   tblcmd0
chanactcmd1lp

 bcf STATUS,PA0

        clrf    checksum
        movlw   0x07
        call    xmitbyte
        movf    tblcmd0,W
        call    xmitbyte

 call insertla
 movlw 0xFF
 call xmitbyte 

 call xmitcheck

 call cmdsync

 incf    tblcmd0,F

 movlw   0xF8
        subwf   tblcmd0,W

 bsf STATUS,PA0

        btfss   STATUS,Z
        goto    chanactcmd1lp

chanactcmd2
        movlw   0xB0
        movwf   tblcmd0
        movlw   0xE8
        movwf   cmdcmd1

;        87 FD B1 E9 E0 BF 7F 00 FF 01 FF 02 FF 03 FF 04 FF ... 3E FF 3F FF 05
chanactcmd2lp

 bcf STATUS,PA0

        clrf    checksum
        movlw   0x09
        call    xmitbyte
        movlw   0xFD
        call    xmitbyte
        movf    tblcmd0,W
        call    xmitbyte
        movf    cmdcmd1,W
        call    xmitbyte

 call insertla

 movlw 0xFF
 call xmitbyte

 call xmitcheck

 call cmdsync

        incf    cmdcmd1,F
        incf    tblcmd0,F
        movlw   0xC0          ; this is the last command + 1
        subwf   tblcmd0,W

 bsf STATUS,PA0

        btfss   STATUS,Z
        goto    chanactcmd2lp

chanactcmd3
 bcf STATUS,PA0
 goto chanactreturn

dispatch_xmitcheck
 bcf STATUS,PA0

 comf checksum,F
 incf checksum,W
 call xmitbyte
 return

dispatch_parasyncframe
        movwf   tempcount1
psflp
 bcf STATUS,PA0
        movlw   0xFF
        call    xmitbyte
 bsf STATUS,PA0       
 decfsz  tempcount1,F
        goto    psflp               ; transmit another FF
 bcf STATUS,PA0
        return

dispatch_insertla
 bcf STATUS,PA0

 movlw 0xE0
 call xmitbyte
 call la + 1
 call xmitbyte
 call la + 2
 call xmitbyte
 call la + 3
 call xmitbyte
 return

dispatch_internalinit
 movwf OSCCAL
 
 IFDEF FAULTY_BATCH
 movlw 0x14
 addwf OSCCAL,F
 ENDIF
 
 movlw   b'00001111'     ;Set WDT prescaler = 1:128 (f_osc=4MHz)    
 option
 movlw   b'11111010'     ;Port A, GP0 output, GP1:5 inputs
 tris GPIO
 
 bcf STATUS,PA0
 btfss STATUS,NOT_TO
 goto WDTrefresh
 goto start
 end    ; This is the last line of the program


;***** Copy the text above this line ****

This is a sample of what a Cable Box looks like inside with the chip installed.

dbpp7514-installed.jpg
General Instruments model DBPP7514 modified.

 
If you would like to recive the .ASM file in text format:

This source code is provided as is with no warrantee or technical assistance. If you plan to use this information to steal cable, I must caution you that such a practice is illegal.  If you choose to do so, that is between you, the authorities, and Cox your cable operator.