Page 5 of 10
Re: Reading eeprom from delco PCM, MC68336 based
Posted: Sat Apr 25, 2015 10:11 am
by j_ds_au
The most common problem I've seen caused by static is increased threshold voltage of P-channel MOSFETs, so they no longer switch on with normal voltage levels. More drastic damage depends on how high the zap, the dV/dt and what series impedance is in the discharge path.
Anyway, two more thoughts :
- Keep your mobile phone, etc. well away.
- If you do multiple reads and get the same data, then the marginal Vih level isn't giving you garbled data.
Joe.
Re: Reading eeprom from delco PCM, MC68336 based
Posted: Tue Apr 28, 2015 11:58 am
by iblackford
So I got my USBDM today, I hooked it up...it cannot detect my type of flash. This is to be somewhat expected as I think others use a 28f400, instead of a 28f800. I can comfirm that something is happening, some registers like USP, RPC, etc, but it just can't detect the flash. I would appreciate any help folks can provide who have used this tool before. There is talk of a custom xml file, but I don't know how to start with it...yet. Here is what I know:
-When I read the FREEZE line goes high, which from what I have read indicates the device is in BDM mode.
-DSO, DSCLK, and DSI all toggle as they should.
Re: Reading eeprom from delco PCM, MC68336 based
Posted: Tue Apr 28, 2015 12:02 pm
by antus
I dont think you can write the flash over BDM as the implementation is custom, but you should be able to read it on a booted and running system by reading address range 0->512kb (not flash chip specific). If you do that then post up the bin.
Re: Reading eeprom from delco PCM, MC68336 based
Posted: Tue Apr 28, 2015 12:09 pm
by iblackford
Here goes nothing...I think I read more than is needed, but you can ignore the higher order addresses...
Re: Reading eeprom from delco PCM, MC68336 based
Posted: Tue Apr 28, 2015 12:16 pm
by VL400
Re: Reading eeprom from delco PCM, MC68336 based
Posted: Tue Apr 28, 2015 12:34 pm
by antus
Good link, VL!
iblackford, that looks like a good read, but the pcms mapping or architecture looks more different to the '0411 than i'd hoped. There is no boot vectors at the bottom of the address space to begin with and some of it looks like junk data, but it does look like your calibration and code is in there.
edit: I think the flash might start at 0x00016A6E, with a boot vector of 0x81000. Though Im not sure of the alignment. But that string of similar 32 bit numbers DO like an vector table.
Re: Reading eeprom from delco PCM, MC68336 based
Posted: Tue Apr 28, 2015 12:37 pm
by iblackford
Oh poop.
How to tell that my calibration data is there?
I'm looking through the 0411 XML right now, trying to figure it out. Can anyone enlighten me about the architecture of the 0411? 16bit data bus as well, or is it 8bit (from what I have read there is support an 8bit).
Ivan
Re: Reading eeprom from delco PCM, MC68336 based
Posted: Tue Apr 28, 2015 12:46 pm
by antus
This looks like code after the vector table. These repeated opcodes are easy to spot and are often used for timing loops.
Code: Select all
0x00017460 | 00 11 00 00 28 7C 00 FF FA 00 4E 71 4E 71 4E 71 | ....(|....NqNqNq
0x00017470 | 4E 71 4E 71 4E 71 4E 71 4E 71 4E 71 4E 71 4E 71 | NqNqNqNqNqNqNqNq
0x00017480 | 4E 71 4E 71 4E 71 4E 71 4E 71 19 47 00 27 19 46 | NqNqNqNqNq.G.'.F
some kind of ID here, may also be the passlock your looking for, or may just be a header and part number.
Code: Select all
0x0001A970 | 3F 5D 30 54 38 36 07 D1 16 18 03 03 A7 0D 31 33 | ?]0T86........13
0x0001A980 | 31 30 41 36 39 48 01 40 D1 60 FF FF FF 30 FF FF | 10A69H.@.`...0..
some kind of header. release 2.0 code booz? maybe.
Code: Select all
0x0001AA60 | 52 32 2E 30 62 6F 6F 7A FF FF FF FF FF FF 4D 46 | R2.0booz......MF
another R2.0 booz header (there are several more, too)
Code: Select all
0x00032460 | C6 87 52 32 2E 30 62 6F 6F 7A FF FF FF FF FF FF | ..R2.0booz......
0x00032470 | 4D 46 53 2A 00 3F FF FF FF FF FF FF 1F FF 00 01 | MFS*.?..........
This might or might not be calibration data. The runs of numbers look potentialy sequential, eg
AA AA AA AA 98 86 91 8D but its hard to say. This is just from a quick skim over.
Code: Select all
0x0001AC90 | B7 3D 01 00 AB 22 00 00 00 03 B7 3D 16 01 00 ED | .=...".....=....
0x0001ACA0 | CF 6D 00 00 07 08 07 17 00 00 00 00 00 00 00 00 | .m..............
0x0001ACB0 | 00 00 00 00 00 00 00 00 00 00 09 C3 62 62 89 89 | ............bb..
0x0001ACC0 | 8F 88 90 88 77 92 7F 8E 75 95 80 80 AA AA AA AA | ....w...u.......
0x0001ACD0 | AA AA AA AA 98 86 91 8D 90 90 00 00 10 D2 7E 89 | ..............~.
0x0001ACE0 | 01 08 FF FF FF C4 01 00 00 02 00 00 00 00 00 00 | ................
0x0001ACF0 | 01 18 00 03 B7 3D 01 00 AB 22 00 00 00 03 B7 3D | .....=...".....=
0x0001AD00 | 17 01 00 ED CF 6D 00 00 07 02 07 08 07 13 07 17 | .....m..........
0x0001AD10 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 09 2B | ...............+
0x0001AD20 | 62 62 89 89 8F 88 90 88 77 92 7F 8E 75 95 80 80 | bb......w...u...
0x0001AD30 | AA AA AA AA AA AA AA AA 98 86 91 8D 90 90 00 00 | ................
0x0001AD40 | 10 D2 7E 8B 01 0A FF FF FF C4 01 00 00 03 00 00 | ..~.............
0x0001AD50 | 00 00 00 00 00 21 00 03 B7 3D 01 00 AB 22 00 00 | .....!...=..."..
0x0001AD60 | 00 03 B7 3D 18 01 00 ED CF 6D 00 00 05 72 07 02 | ...=.....m...r..
0x0001AD70 | 07 08 07 13 07 17 00 00 00 00 00 00 00 00 00 00 | ................
0x0001AD80 | 00 00 09 AC 62 62 89 89 8F 88 90 88 77 92 7F 8E | ....bb......w...
0x0001AD90 | 75 95 80 80 AA AA AA AA AA AA AA AA 98 86 91 8D | u...............
I might pay to keep poking around in the address space and see what you can find. Maybe read up to 1mb.
Re: Reading eeprom from delco PCM, MC68336 based
Posted: Tue Apr 28, 2015 12:47 pm
by antus
'0411 processor is a 32 bit data bus, but only 24 bits are connected (high byte ignored, which causes some annoyance when cross referencing in IDA). The flash is mapped to 0x00000000.
Re: Reading eeprom from delco PCM, MC68336 based
Posted: Tue Apr 28, 2015 12:54 pm
by iblackford
Hmm...32bit databus but only 24 connected? Now I'm really confused..the EEPROM's have at most a 16bit databus I think, with an 8bit option if you hold the BYTE line low.
What external inputs does it use to know what the boot vector is? I know the ADDR0 pin is not connected to the EEPROM...I learned this in my ohming out...the ADDR1 and up are connected, and not swapped from what I could tell.
Ivan