81
edits
Changes
m
[Page under construction - as yet incomplete]
<br />
(that's right, I still haven't found Ghidra or Cutter yet)
<br />
→Repairs -
PCB photos, Pinouts, Pin header, Device operation, Connections between subsystems. Notes on firmware structure, Machine language monitor program, DFU, firmware extraction, firmware update script (python)
===Goals-===
#De-solder NOR Flash and read firmware.
I connected to the Xilinx XC95144 using Bluetag, OpenOCD and XC3SPROG (open source Xilinx CLI) and was eventually able to read back ID codes and find IR Len etc. I was happy it was responding. It was fun, confusing and difficult to set up all these tools. I set most of them up on a Raspberry Pi as dedicated hacking server so I can connect remotely to the hot mess setup with my laptop, somewhere more comfortable : )
It seems strange to me that, this is a 100 pin CPLD, and only 4 inputs and 4 outputs are used! (solely RBUS data, 8 channels L/R in/out). Counter output from H8300H goes to clock pin of the Xilinx, through an inverter.
<gallery>
File:XC3SPROG id read.png|alt=XC3SPROG id read|'''XC3SPROG id read'''
<br />
===TL48 T48 Programmer-===I used a TL48 T48 programmer with a 48pin TTSOP to read the NOR Flash firmware contents -
In the image below are the settings needed for a good read. The NOR flash is 16 bit wide, but the CPU is reading it in 8 bit mode (8 bit mode pin is tied low). SHARP LH28F400BVE Parallel NOR Flash 512kb. The chip is from the late 1990s as the device is also, turn of the century 2000s.
===High Performance Embedded Workshop -===
[[File:HEW.png|thumb|High Performance Embedded Workshop]]
I downloaded HEW from Renesas, which still keeps this available online. Superannuated Software, total 1998 vibes (though I think its 2003) I love that look though! I managed to load the firmware into it, and yes, it appears to be recognised and loads in just fine. This is a big step, its the first time I'm looking at the disassembly, and it seems like its not badly corrupted (it loads it in) I enter the RAM addresses and sizes and mess about with it for a bit. . .
File:Dif-at-tracerepair4.png|CPU traces repaired. Sorry, not a great shot
</gallery>
== To Do - ==
I will update this when the device is fully tested. For now, be assured that it's back together, repaired, and starting to boot. There could be some small issues, which can be discovered and fixed with the UART function. I could only continue the marathon with a reboot myself.
Thanks for reading. I hope it's interesting and or useful! If you want the Cutter project file I can send it you, email me through the site.
==NOTES -==