Add additional reverse-engineering notes
This commit is contained in:
Grigori Goronzy
parent
eaeab65044
commit
d0597578de
57
doc/reverse-engineering/mcudb_flags.txt
Normal file
57
doc/reverse-engineering/mcudb_flags.txt
Normal file
@ -0,0 +1,57 @@
|
||||
STC15F103
|
||||
00064F50 63 C3 08 00 2C FC 47 00 9B F2 00 00 00 0C 00 00 c...,.G.........
|
||||
00064F60 00 08 00 00 00 00 00 00 00 20 00 00 07 03 00 00 ......... ......
|
||||
|
||||
STC15L103
|
||||
00065110 61 C3 08 00 90 FB 47 00 DB F2 00 00 00 0C 00 00 a.....G.........
|
||||
00065120 00 08 00 00 00 00 00 00 00 20 00 00 07 03 00 00 ......... ......
|
||||
|
||||
STC15F104E
|
||||
00065190 E3 02 08 00 AC B1 47 00 94 F2 00 00 00 10 00 00 ......G.........
|
||||
000651A0 00 04 00 00 00 00 00 00 00 20 00 00 07 00 00 00 ......... ......
|
||||
|
||||
STC15L104W
|
||||
X Y Z
|
||||
00065050 E1 C3 08 00 B8 B1 47 00 D4 F2 00 00 00 10 00 00 ......G.........
|
||||
00065060 00 04 00 00 00 00 00 00 00 20 00 00 07 03 00 00 ......... ......
|
||||
|
||||
STC15L104E
|
||||
000651B0 E1 02 08 00 94 B1 47 00 D4 F2 00 00 00 10 00 00 ......G.........
|
||||
000651C0 00 04 00 00 00 00 00 00 00 20 00 00 07 00 00 00 ......... ......
|
||||
|
||||
|
||||
byte X bit 1: F vs L? low => L part, high => F part
|
||||
byte Z: protocol/model generation number?
|
||||
|
||||
IAP15F2K61S2
|
||||
00063750 AF 0B 09 00 08 06 48 00 49 F4 00 00 00 F4 00 00 ......H.I.......
|
||||
00063760 00 00 00 00 00 00 00 00 00 00 01 00 07 00 00 00 ................
|
||||
|
||||
STC15F2K08S2
|
||||
00063650 A3 0B 09 00 78 06 48 00 01 F4 00 00 00 20 00 00 ....x.H...... ..
|
||||
00063660 00 D4 00 00 00 00 00 00 00 00 01 00 07 00 00 00 ................
|
||||
|
||||
STC15F2K32S2
|
||||
000636B0 A3 0B 09 00 48 06 48 00 04 F4 00 00 00 80 00 00 ....H.H.........
|
||||
000636C0 00 74 00 00 00 00 00 00 00 00 01 00 07 00 00 00 .t..............
|
||||
|
||||
STC15F2K60S2
|
||||
00063730 A3 0B 09 00 64 B2 47 00 08 F4 00 00 00 F0 00 00 ....d.G.........
|
||||
00063740 00 04 00 00 00 00 00 00 00 00 01 00 07 00 00 00 ................
|
||||
|
||||
IRC15F2K63S2
|
||||
00063770 BF 0C 09 00 F8 05 48 00 4A F4 00 00 00 FE 00 00 ......H.J.......
|
||||
00063780 00 00 00 00 00 00 00 00 00 00 01 00 07 00 00 00 ................
|
||||
|
||||
IRC15F1K63S
|
||||
00064470 BE 8C 09 00 20 00 48 00 20 F4 00 00 00 FE 00 00 .... .H. .......
|
||||
00064480 00 00 00 00 00 00 00 00 00 00 01 00 07 00 00 00 ................
|
||||
|
||||
IRC15W207S
|
||||
000648B0 B7 CC 0A 00 AC FE 47 00 56 F5 00 00 00 1E 00 00 ......G.V.......
|
||||
000648C0 00 00 00 00 00 00 00 00 00 20 00 00 07 00 00 00 ......... ......
|
||||
|
||||
STC15H4K56S4
|
||||
00063610 AF 8B 0E 00 98 06 48 00 07 F6 00 00 00 E0 00 00 ......H.........
|
||||
00063620 00 00 00 00 00 00 00 00 00 00 01 00 07 00 00 00 ................
|
||||
|
||||
108
doc/reverse-engineering/stc15w4.txt
Normal file
108
doc/reverse-engineering/stc15w4.txt
Normal file
@ -0,0 +1,108 @@
|
||||
fresh chip, RC frequency untuned, caught with stcgal
|
||||
|
||||
2015-12-10 23:39:46.886233: PC
|
||||
7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F
|
||||
7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F
|
||||
7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F
|
||||
7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F
|
||||
7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F
|
||||
7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F
|
||||
7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F
|
||||
7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F
|
||||
7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F
|
||||
7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F
|
||||
7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F
|
||||
7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F
|
||||
7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F
|
||||
7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F
|
||||
7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F
|
||||
7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F
|
||||
7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F
|
||||
2015-12-10 23:39:50.989044: MCU
|
||||
46 B9 68 00 34 50 8D FF 73 96 F5 7B 9F FF FF FF
|
||||
FF FF 25 EF 00 00 73 54 00 F5 28 04 06 70 96 02
|
||||
15 19 1C 1E 23 00 EC E0 04 D7 F8 73 BF FF FF 15
|
||||
09 25 60 16 92 16
|
||||
2015-12-10 23:39:51.231028: PC
|
||||
46 B9 6A 00 07 82 00 F3 16
|
||||
|
||||
Checking target MCU ...
|
||||
MCU type: STC15W4K56S4
|
||||
F/W version: 7.3.4T
|
||||
|
||||
Current H/W Option:
|
||||
. Current system clock source is internal IRC oscillator
|
||||
. IRC is unadjusted
|
||||
. Oscillator gain is HIGH
|
||||
. Wakeup Timer frequency: 36.351KHz
|
||||
. Do not detect the level of P3.2 and P3.3 next download
|
||||
. Power-on reset, use the extra power-on delay
|
||||
. RESET pin behaves as I/O pin
|
||||
. Interrupt while detect a Low-Voltage
|
||||
. Thresh voltage level of the built-in LVD : 2.78 V
|
||||
. Permit EEPROM operation under Low-Voltag
|
||||
. CPU-Core supply level : 3.38 V
|
||||
. Hardware do not enable Watch-Dog-Timer
|
||||
. Watch-Dog-Timer pre-scalar : 64
|
||||
. Watch-Dog-Timer stop count in idle mode
|
||||
. Program can modify the Watch-Dog-Timer scalar
|
||||
. Erase user EEPROM area at next download
|
||||
. Do not control 485 at next download
|
||||
. Do not check user password next download
|
||||
. TXD is independent IO
|
||||
. TXD pin as quasi-bidirectional mode after reset
|
||||
. P2.0 output HIGH level after reset
|
||||
|
||||
. MCU type: STC15W4K56S4
|
||||
F/W version: 7.3.4T
|
||||
|
||||
Complete !
|
||||
|
||||
Waiting for MCU, please cycle power: done
|
||||
Target model:
|
||||
Name: STC15W4K56S4
|
||||
Magic: F528
|
||||
Code flash: 56.0 KB
|
||||
EEPROM flash: 3.0 KB
|
||||
Target frequency: 0.000 MHz
|
||||
Target BSL version: 7.3.4T
|
||||
Target wakeup frequency: 36.351 KHz
|
||||
Target options:
|
||||
reset_pin_enabled=False
|
||||
clock_source=internal
|
||||
clock_gain=high
|
||||
watchdog_por_enabled=False
|
||||
watchdog_stop_idle=True
|
||||
watchdog_prescale=64
|
||||
low_voltage_reset=False
|
||||
low_voltage_threshold=3
|
||||
eeprom_lvd_inhibit=False
|
||||
eeprom_erase_enabled=True
|
||||
bsl_pindetect_enabled=False
|
||||
por_reset_delay=long
|
||||
rstout_por_state=high
|
||||
uart2_passthrough=False
|
||||
uart2_pin_mode=normal
|
||||
Disconnected!
|
||||
|
||||
|
||||
cpu core supply level
|
||||
|
||||
2.68v
|
||||
46 B9 68 00 34 50 8D FF 73 96 F7 BC 9F 00 5B 7A C0 FD 27 ED 00 00 73 54 00 F5 28 04 06 70 96 02 15 19 1C 1E 23 00 EC E0 04 D7 EA 92 FF FF FF 15 09 25 60 14 BD 16
|
||||
|
||||
3.33v
|
||||
46 B9 68 00 34 50 8D FF 73 96 F7 BC 9F 00 5B 92 30 FD 25 EA 00 FC 73 54 00 F5 28 04 06 70 96 02 15 19 1C 1E 23 00 EC E0 04 D7 F7 92 FF FF FF 15 09 25 60 15 49 16
|
||||
|
||||
3.63v
|
||||
46 B9 68 00 34 50 8D FF 73 96 F7 BC 9F 00 5B 7A C0 FD 25 EF 00 00 73 54 00 F5 28 04 06 70 96 02 15 19 1C 1E 23 00 EC E0 04 D7 FD 92 FF FF FF 15 09 25 60 14 D0 16
|
||||
|
||||
3.73v
|
||||
46 B9 68 00 34 50 8D FF 73 96 F7 BC 9F 00 5B 92 30 FD 25 EA 00 00 73 54 00 F5 28 04 06 70 96 02 15 19 1C 1E 23 00 EC E0 04 D7 FF 92 FF FF FF 15 09 25 60 14 55 16
|
||||
^^
|
||||
core voltage
|
||||
voltage: ff -> 3.73v
|
||||
fd -> 3.63v
|
||||
f7 -> 3.33v
|
||||
ea -> 2.68v
|
||||
|
||||
32
doc/reverse-engineering/stc8-new.txt
Normal file
32
doc/reverse-engineering/stc8-new.txt
Normal file
@ -0,0 +1,32 @@
|
||||
Cycling power: done
|
||||
Waiting for MCU: <- Packet data: 46 B9 68 00 30 50 FF FF FF FF 8F 00 04 FF FF 8B FD FF 27 3E F5 73 73 55 00 F6 41 0A 88 86 6F 8F 08 20 20 20 01 00 00 20 05 3C 18 05 22 32 FF 12 18 16
|
||||
-> Packet data: 46 B9 6A 00 07 FF 01 70 16
|
||||
done
|
||||
Target model:
|
||||
Name: STC8F2K08S2
|
||||
Magic: F641
|
||||
Code flash: 8.0 KB
|
||||
EEPROM flash: 56.0 KB
|
||||
Target frequency: 0.000 MHz
|
||||
Target BSL version: 7.3.10U
|
||||
Target wakeup frequency: 34.950 KHz
|
||||
Target ref. voltage: 1340 mV
|
||||
Target mfg. date: 2018-05-22
|
||||
Target options:
|
||||
reset_pin_enabled=False
|
||||
clock_gain=high
|
||||
watchdog_por_enabled=False
|
||||
watchdog_stop_idle=True
|
||||
watchdog_prescale=64
|
||||
low_voltage_reset=False
|
||||
low_voltage_threshold=2
|
||||
eeprom_erase_enabled=True
|
||||
bsl_pindetect_enabled=False
|
||||
por_reset_delay=long
|
||||
rstout_por_state=high
|
||||
uart1_remap=False
|
||||
uart2_passthrough=False
|
||||
uart2_pin_mode=normal
|
||||
epwm_open_drain=False
|
||||
program_eeprom_split=29440
|
||||
Disconnected!
|
||||
35
doc/reverse-engineering/untrimmed.txt
Normal file
35
doc/reverse-engineering/untrimmed.txt
Normal file
@ -0,0 +1,35 @@
|
||||
Cycling power: done
|
||||
Waiting for MCU: done
|
||||
Protocol detected: stc8
|
||||
Target model:
|
||||
Name: STC8F2K08S2
|
||||
Magic: F641
|
||||
Code flash: 8.0 KB
|
||||
EEPROM flash: 56.0 KB
|
||||
Target frequency: 0.000 MHz
|
||||
Target BSL version: 7.3.10U
|
||||
Target wakeup frequency: 34.950 KHz
|
||||
Target ref. voltage: 1340 mV
|
||||
Target mfg. date: 2018-05-22
|
||||
Target options:
|
||||
reset_pin_enabled=False
|
||||
clock_gain=high
|
||||
watchdog_por_enabled=False
|
||||
watchdog_stop_idle=True
|
||||
watchdog_prescale=64
|
||||
low_voltage_reset=False
|
||||
low_voltage_threshold=2
|
||||
eeprom_erase_enabled=True
|
||||
bsl_pindetect_enabled=False
|
||||
por_reset_delay=long
|
||||
rstout_por_state=high
|
||||
uart1_remap=False
|
||||
uart2_passthrough=False
|
||||
uart2_pin_mode=normal
|
||||
epwm_open_drain=False
|
||||
program_eeprom_split=29440
|
||||
Loading flash: 80 bytes (Intel HEX)
|
||||
<- Packet data: 46 B9 68 00 30 50 FF FF FF FF 8F 00 04 FF FF 8B FD FF 27 38 F5 73 73 55 00 F6 41 0A 88 86 6F 8F 08 20 20 20 01 00 00 20 05 3C 18 05 22 32 FF 12 12 16
|
||||
Protocol error: uncalibrated, please provide a trim value
|
||||
-> Packet data: 46 B9 6A 00 07 FF 01 70 16
|
||||
Disconnected!
|
||||
Loading…
Reference in New Issue
Block a user