I removed the 512 Kbyte 8 pin flash chip from the convertor box and read the contents with SPIPGMW sort of like one jtag reads something using parallel port of PC. Have found that my older version of box has undocumented serial port (115.2Kbaud 8N1) and a menu that comes up giving you options to start an audio tone and test pattern display and other test functions that are not of much interest, but one option lets you use XModem protocol to send the box binary file to execute. I've used that option to dump the flash and RAM using code lifted from the disassembly of the flash dump.
Here is the code I used:
Why, you might ask? I like playing with code is part of it. The Broadcom processor uses a MIPS core, so I'm playing with mipsl code generation. I'm thinking I could use the box to monitor rf--not a lot of free memory in the flash, but I might be able to leave it in a remote location for a week or two and have it capture info.FF 50 11 3C FF FF 31 26-FE FF 21 06 00 00 00 00
C0 9F 10 3C 08 00 11 3C-00 00 04 92 40 B0 08 3C
80 01 08 35 01 00 0A 24-18 00 09 81 24 48 2A 01
FD FF 2A 15 00 00 00 00-1C 00 04 A1 01 00 10 26
FF FF 31 26 F4 FF 21 06-00 00 00 00 FF FF 00 10
00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00
Anyway, if you push power and ch+ at power up the box sends out message that you should start XModem download of zlib binary--I'm pretty sure that that overwrites the flash with a new image decompressed from what you send it. There is an option in the serial menu to download compressed file to RAM for execution, but I've tried every variation of zlib I can think of and it does not get the code running--not sure what is going on (there are compressed parts inside the flash that are zlib compressed with just Adler32 sum at the end--no crc32 or size info at the end, and just a 2 byte header-- the size for the chunks are hardcoded in the "boot" code.)