Find the JTAG on SpeedSteam 4100
I have a SpeedSteam 4100 Ethernet ADSL modem in spare after changing ISP as they didn’t want it back. But it seems like my previous ISP had there own firmware downloaded to the modem as I couldn’t get any contact via telnet or http to it. I guess it has been configured as pass-through.
Natually I opened it up to try to locate a JTAG / 3.3v serial port. I found two unpopulated headers and started to poking around with my new Rigol scope while booting it again and again. I found a data pin after a few tries.
I measured a puls width about 115Khz using the the Cursor function in the scope. A simple baudrate “guess” on 15200N81 proved right.
I connected my Nokia DLR-3 data cable converted into a 3.3V JTAG to the pin an beautiful console data showed up in good old Windows HyperTerminal. The RX pin is next to the TX pin. I couldn’t get it to work and a quick view with the scope showed that the HIGH was only about 1.7v, not enough to leave limboland between 0 and 1. It seems like either it draws to much current or it isn’t a normal RX pin. But I was able to send data to the console, although filled with garbage.
I might return to solve this issue another day, but anyway, it was fun poking around in the SpeedSteam 4100 Ethernet ADSL modem.
The console dump shows that my assumption about the ISP specific firmware were correct. This device was populated with a TDC specific firmware.