83
edits
Changes
Jump to navigation
Jump to search
m
[Page under construction - as yet incomplete]
<br />
(that's right, I still haven't found Ghidra or Cutter yet)
<br />
The LEDs had metal fatigued off with all the repairs. I ground away the solder resist After some months working on this, and was able to solder them directly to seeing the board LEDs blink again. (it took an embarrassingly long time to realise they are were pulled high) I was satisfied I could take a custom design packageshort break from it. Also, I like to use will complete the repair by fully testing it and running the originalUART Monitor program. Only the legs were broken after all)
→Repairs -
PCB photos, Pinouts, Pin header, Device operation, Connections between subsystems. Notes on firmware structure, Machine language monitor program, DFU, firmware extraction, firmware update script (python)
===Goals-===
#De-solder NOR Flash and read firmware.
I connected to the Xilinx XC95144 using Bluetag, OpenOCD and XC3SPROG (open source Xilinx CLI) and was eventually able to read back ID codes and find IR Len etc. I was happy it was responding. It was fun, confusing and difficult to set up all these tools. I set most of them up on a Raspberry Pi as dedicated hacking server so I can connect remotely to the hot mess setup with my laptop, somewhere more comfortable : )
It seems strange to me that, this is a 100 pin CPLD, and only 4 inputs and 4 outputs are used! (solely RBUS data, 8 channels L/R in/out). Counter output from H8300H goes to clock pin of the Xilinx, through an inverter.
<gallery>
File:XC3SPROG id read.png|alt=XC3SPROG id read|'''XC3SPROG id read'''
<br />
===TL48 T48 Programmer-===I used a TL48 T48 programmer with a 48pin TTSOP to read the NOR Flash firmware contents -
In the image below are the settings needed for a good read. The NOR flash is 16 bit wide, but the CPU is reading it in 8 bit mode (8 bit mode pin is tied low). SHARP LH28F400BVE Parallel NOR Flash 512kb. The chip is from the late 1990s as the device is also, turn of the century 2000s.
===High Performance Embedded Workshop -===
[[File:HEW.png|thumb|High Performance Embedded Workshop]]
I downloaded HEW from Renesas, which still keeps this available online. Superannuated Software, total 1998 vibes (though I think its 2003) I love that look though! I managed to load the firmware into it, and yes, it appears to be recognised and loads in just fine. This is a big step, its the first time I'm looking at the disassembly, and it seems like its not badly corrupted (it loads it in) I enter the RAM addresses and sizes and mess about with it for a bit. . .
<br />
== Repairs - ==
After confirming the firmware of the CPLD and the Flash seem intact. I flashed the firmware onto a new NOR flash chip. I also replaced the SRAM (these are almost a consumable, and I have had one of this range fail before, in a different package)
I replaced the other chips I had removed. I fixed the traces on the board with new pcb traces. I had to repair a leg of a custom Alesis IC (there are three, two small one large). The chip was bridged with a factory bodge of a capacitor. Removing that, broke the leg off the IC. I was able to grind away the epoxy and solder a new leg in place. Almost 20 traces have been repaired. The LEDs had metal fatigued off with all the repairs. I ground away the solder resist and was able to solder them directly to the board again. (they are a custom design package. Also, I like to use the original. Only the legs were broken after all)<gallery>File:Dif-at-tracerepair.png|alt=Traces replaced and connected.|Traces replaced and connected.File:Dif-at-tracerepair2.png|traces tinned (way too much, I took some off with wick)File:Dif-at-tracerepair3.png|placing componentFile:Dif-at-tracerepair4.png|CPU traces repaired. Sorry, not a great shot</gallery> == To Do - ==
I will update this when the device is fully tested. For now, be assured that it's back together, repaired, and starting to boot. There could be some small issues, which can be discovered and fixed with the UART function. I could only continue the marathon with a reboot myself.
Thanks for reading. I hope it's interesting and or useful! If you want the Cutter project file I can send it you, email me through the site.
==NOTES -==
Ic 18 (opto-isolator) -
Ic 16 (opto-isolator) - to Ic 28 (multiple pins, bridged) (mux)'<nowiki/>'''<nowiki>'''''</nowiki>'''''<nowiki>'''''</nowiki>'''''
Ic 14 (opto-isolator) - to Alesis cpld pin 58
