I have started my DCT2000 crack a few months ago and just found this forum. What I did is solder a TSOP socket by my friend ( I know a BDM cable will save a lot of trouble and going to build me a one soon.) I also use a universal programmer. I also build a disassembler specifically for MC68331 on DCT2000. After disassemble two of the boxes, here is what I found and would like to share with you. 1. The firmware on the 2 Meg flash consist two parts. One called platform, the other called application. 2. I suspect that the platform firmware are all the same for all the service provider. The application is provider specific. 3. The NVRAM start at $200000 to $23ffff. Your PPV information has two copies. One stored at $233680 and the other at $216700. So a proper way to reset your cable box is to clone your NVRAM and start order PPV. After the box is full of ordering then restore the NVRAM. That will definitely work. 4. There is a code in the boot block to check the integrity of the platform code. If the code is modified, then the box will not start. This is quite easy to bypass. 5. There is a simple way to "activate" the box and all the analog channels are activated, all the digital box with type "CLR" can be unlocked. Also you can order PPV and use 3 to reset the box. 6. Simply clone the NVRAM of another unit will change your network address. Also you will receive "Hunt" for a while.
I have only worked on box in one area and would like to receive ROM files from another area so to prove my theory worked.