83
edits
Changes
→TL48 Programmer-: added python script
In the image below are the settings needed for a good read. The NOR flash is 16 bit wide, but the CPU is reading it in 8 bit mode (8 bit mode pin is tied low). SHARP LH28F400BVE Parallel NOR Flash 512kb. The chip is from the late 1990s as the device is also, turn of the century 2000s.
Although the strings are legible here, this is because the T48 is re-arranging the byte order automatically. The byte order must be swapped (little endian) in order to disassemble the firmware. I found this out after nonsensical strings were seen, without swapping byte order. I tried some 8 bit reads, but this garbled the strings in the T48. It was clear 16 bit wide was correct, but then byte order needed changing. I used a python script to swap the byte order of the entire dumped firmware file. <syntaxhighlight lang="python3"># swap_bytes.py
input_file = "INTEL_HEX_DIF_AT_LH28F400BVE@TSOP48.bin"output_file = "INTEL_HEX_DIF_AT_LH28F400BVE@TSOP48_byte_swapped.bin" with open(input_file, "rb") as f: data = f.read() # Create a new bytearray for swapped dataswapped = bytearray() # Swap every pair of bytes (i.e., 16-bit words)for i in range(0, len(data) - 1, 2): swapped.append(data[i + 1]) # high byte swapped.append(data[i]) # low byte # If the file has an odd number of bytes, keep the last oneif len(data) % 2 != 0: swapped.append(data[-1]) # Write the outputwith open(output_file, "wb") as f: f.write(swapped) print(f"✅ Done. Swapped file saved as: {output_file}")</syntaxhighlight>The strings are very interesting indeed. Not just a standard 'version' or 'release date' string - they are command strings!
As this device has no screen, a low level diagnostic routine is inferred from their discovery. Looking closely at the last string or two, I was worried that it might be corrupted as there are some missing letters in the string - (ADAT Sync port di onnected and Dectected rather than Detected).
== Roland RBUS ==
Here I will refer to the excellent site of Chris Xiong who made a converter from RBUS>ADAT (but not bi-directional) I bought two from him (though I have been too busy with reversing the official one to use them much).