Rewrote hidden_menu_probe.py from Winegard-hardcoded to auto-discovering:
detects prompt, error string, and submenu structure from any firmware console.
Extracted Winegard-specific candidate words to scripts/wordlists/winegard.txt.
Deep probe of all 12 G2 submenus discovered commands across A3981 (driver
diagnostics), ADC (RSSI monitoring + position sweep), DVB (extended help via
man, transponder selection), EEPROM (read/write), GPIO (pin R/W), LATLON
(calculator), MOT (azscan, sw), PEAK (EchoStar switch), and STEP (raw
stepper control). NVS submenu generates false positives — treats any input
as sequential index reads.
Safety: added q/Q to default blocklist, bare-CR check before navigate_to_root
to prevent accidental shell termination between submenus.
Position parser now matches the actual Angle[0]/Angle[1] format
instead of falling back to fragile raw-float extraction. RSSI parser
uses a proper named-group regex matching the real firmware output
format (Reads:<n> RSSI[avg: <v> cur: <v>]) — the old index-based
approach would fail on the actual 5-field response.
Motor test results: both axes move correctly, direction-dependent
overshoot of 0.01-0.06 degrees confirmed. DVB subsystem explored:
BCM4515 Rev B0, firmware v113.37, full command set documented
including DiSEqC 2.x, transponder scanning, and streaming AGC/SNR.
RSSI noise floor is ~500.
Confirmed via DSD TECH SH-U11 RS-422 adapter at 115200 baud:
- Firmware version 02.02.48, bootloader 1.01, Kinetis MCU, BCM4515 DVB
- Position format is Angle[0]/Angle[1], not AZ=/EL= like Trav'ler
- Prompts are TRK>/MOT>/NVS> (not bare >)
- NVS 20 disable tracker confirmed working after power cycle
- Full NVS dump captured (indices 0-143)
- RJ-12 wire colors documented (differ from Davidson's guide)
- RS-422 polarity swap symptoms documented (garbled RX vs silent TX)
- Cable wrap range confirmed: -423.33° to +23.33° (446.66° total)
