  INFO - FAQ - CC2-Forum - CCPro-Forum |
|
||
|
Hello TeK > The datasheet is not perfectly clear but it seems that without the security bytes it is still possible to read and write to RAM. From there it should be easy to get the job done (i.e. dump the flash) with the RUN command ($28). I didn't tried it yet with a GT16, but only with the QT4 and the QY4. If any wrong security byte have been transmitted, the controller is switched into a mode, in which the Flash works like an not implemented memory section. It seems the Flash is simply switched off. Maybe the difference make if the COP Control Register (COPCTL) on $ffff is first read or first written after reset. AFAIK the only way to find the values of the eight bytes is to guess them or to use brute force. The latter might take very long. > It would help if I could get the Monitor ROM of the chip for analysis. The contents of the MONITOR ROM isn't a secret. In the past I dumped and disassembled the two ROM areas of an empty GT16. > But apparently in Monitor Mode, command $49 allows to write one byte at a time (I guess that either the Monitor ROM or the Flash ROM take care of writing a full row). At least in the MON08 of the QT4 and QY4 this command can write only to RAM and to registers. This command corresponds to a "STA ,X". But various registers must be set to delete and write to Flash. And it's time critical. Alternatively one can use the routines in the first ROM (FLASH PROGRAMMING ROUTINES ROM, address $1b50 to $1e1f). Here's the ROM listing. The Reset Vector in Monitor Mode is at $fefe and $feff. And the SWI Vector is at $fefc and $fefd. (See Table 15-2 in manual.) After reset execution starts at $ff00. ; =========================================================================== ; = Project : ROM-Listing of MONITOR ROM of an empty 68HC908GT16 = ; = Mnemonic : AS05 for M6805 [1.40] from Frank A. Vorstenbosch = ; = made by : Dietmar Harlos ADPC = ; =========================================================================== fe20 : f7 sta ,x ; store accumulator at address in hx fe21 : f6 lda ,x ; load accu with value at address in hx fe22 : 000002 brset #0,$00,$fe27 ; branch to $fe27 if bit #0 at $00 is set fe25 : bc41 jmp $41 ; unconditional jump to address $41 fe27 : 83 swi ; software interrupt (addr. at $fffc:$fffd) fe28 : 1104 bclr #0,$04 ; clear bit #0 at memory address $04 fe2a : 8b pushh ; push h-register onto stack fe2b : 1100 bclr #0,$00 ; clear bit #0 at memory address $00 fe2d : ad52 bsr $fe81 ; branch to subroutine at address $fe81 fe2f : ad66 bsr $fe97 ; branch to subroutine at address $fe97 fe31 : 87 pusha ; push accu onto stack fe32 : 48 lsla ; shift left accumulator fe33 : 2a07 bpl $fe3c ; branch if plus (N bit is clear) fe35 : ad60 bsr $fe97 ; branch to subroutine at address $fe97 fe37 : 87 pusha ; push accu onto stack fe38 : 8a poph ; pop (pull) h-register from stack fe39 : ad5c bsr $fe97 ; branch to subroutine at address $fe97 fe3b : 97 tax ; transfer accumulator to x-register fe3c : 86 popa ; pop (pull) accu from stack fe3d : 84 tap ; transfer accu to processor status byte fe3e : 251c blo $fe5c ; branch if reg. is lower (C is set) fe40 : ad33 bsr $fe75 ; branch to subroutine at address $fe75 fe42 : 84 tap ; transfer accu to processor status byte fe43 : 280b bhcc $fe50 ; branch if half carry bit clear (H clear) fe45 : e601 lda $01,x ; load accu with value at addr. $01+hx fe47 : ad61 bsr $feaa ; branch to subroutine at address $feaa fe49 : af02 aix #$02 ; add signed value to index register (hx) fe4b : f6 lda ,x ; load accu with value at address in hx fe4c : ad5c bsr $feaa ; branch to subroutine at address $feaa fe4e : 20df bra $fe2f ; branch always to $fe2f fe50 : 27f9 beq $fe4b ; branch if equal (Z is set) fe52 : 2b19 bmi $fe6d ; branch if minus (N bit is set) fe54 : a828 eor #$28 ; XOR accumulator with value #$28 fe56 : 2702 beq $fe5a ; branch if equal (Z is set) fe58 : ad27 bsr $fe81 ; branch to subroutine at address $fe81 fe5a : 8a poph ; pop (pull) h-register from stack fe5b : 80 rti ; return from interrupt fe5c : 2907 bhcs $fe65 ; branch if half carry bit set (H is set) fe5e : ad37 bsr $fe97 ; branch to subroutine at address $fe97 fe60 : ad13 bsr $fe75 ; branch to subroutine at address $fe75 fe62 : f7 sta ,x ; store accumulator at address in hx fe63 : 20ca bra $fe2f ; branch always to $fe2f fe65 : ad30 bsr $fe97 ; branch to subroutine at address $fe97 fe67 : ad0c bsr $fe75 ; branch to subroutine at address $fe75 fe69 : af01 aix #$01 ; add signed value to index register (hx) fe6b : 20f5 bra $fe62 ; branch always to $fe62 fe6d : 95 tsx ; transfer stack pointer (sp+1) to hx fe6e : 8b pushh ; push h-register onto stack fe6f : 86 popa ; pop (pull) accu from stack fe70 : ad38 bsr $feaa ; branch to subroutine at address $feaa fe72 : 9f txa ; transfer x-register to accumulator fe73 : 20d7 bra $fe4c ; branch always to $fe4c fe75 : 87 pusha ; push accu onto stack fe76 : a60b lda #$0b ; load accumulator with value #$0b fe78 : ad54 bsr $fece ; branch to subroutine at address $fece fe7a : 2404 bhs $fe80 ; branch if reg. is higher or same (C clear) fe7c : 4bfa dbnza $fe78 ; decrement accu and branch if not zero fe7e : 86 popa ; pop (pull) accu from stack fe7f : 81 rts ; return from subroutine fe80 : 86 popa ; pop (pull) accu from stack fe81 : 0100fd brclr #0,$00,$fe81 ; branch to $fe81 if bit #0 at $00 is clear fe84 : aea9 ldx #$a9 ; load x-register with value #$a9 fe86 : 5bfe dbnzx $fe86 ; decrement x-reg. and branch if not zero fe88 : 1004 bset #0,$04 ; set bit #0 at memory address $04 fe8a : 2000 bra $fe8c ; branch always to $fe8c fe8c : 5bfa dbnzx $fe88 ; decrement x-reg. and branch if not zero fe8e : 1104 bclr #0,$04 ; clear bit #0 at memory address $04 fe90 : a702 ais #$02 ; add signed value to stack pointer (sp) fe92 : c6ffff lda $ffff ; load accumulator with value at $ffff fe95 : 2098 bra $fe2f ; branch always to $fe2f fe97 : 0000fd brset #0,$00,$fe97 ; branch to $fe97 if bit #0 at $00 is set fe9a : ad32 bsr $fece ; branch to subroutine at address $fece fe9c : 25f9 blo $fe97 ; branch if reg. is lower (C is set) fe9e : a680 lda #$80 ; load accumulator with value #$80 fea0 : ad2c bsr $fece ; branch to subroutine at address $fece fea2 : 46 rora ; rotate accumulator right through carry fea3 : 9d nop ; no operation (wait for one cycle) fea4 : 24fa bhs $fea0 ; branch if reg. is higher or same (C clear) fea6 : ad26 bsr $fece ; branch to subroutine at address $fece fea8 : 24d7 bhs $fe81 ; branch if reg. is higher or same (C clear) feaa : 89 pushx ; push x-register onto stack feab : 87 pusha ; push accu onto stack feac : a60a lda #$0a ; load accumulator with value #$0a feae : 0100fd brclr #0,$00,$feae ; branch to $feae if bit #0 at $00 is clear feb1 : aea9 ldx #$a9 ; load x-register with value #$a9 feb3 : 5bfe dbnzx $feb3 ; decrement x-reg. and branch if not zero feb5 : 99 sec ; set carry bit feb6 : 2009 bra $fec1 ; branch always to $fec1 feb8 : 9e db $9e ; replace ,x with ,sp in next instruction feb9 : 6601 ror $01,x ; rotate right through carry at $01+hx febb : 2404 bhs $fec1 ; branch if reg. is higher or same (C clear) febd : 1104 bclr #0,$04 ; clear bit #0 at memory address $04 febf : 2004 bra $fec5 ; branch always to $fec5 fec1 : 1004 bset #0,$04 ; set bit #0 at memory address $04 fec3 : 2000 bra $fec5 ; branch always to $fec5 fec5 : ae4f ldx #$4f ; load x-register with value #$4f fec7 : 5bfe dbnzx $fec7 ; decrement x-reg. and branch if not zero fec9 : 4bed dbnza $feb8 ; decrement accu and branch if not zero fecb : 86 popa ; pop (pull) accu from stack fecc : 88 popx ; pop (pull) x-register from stack fecd : 81 rts ; return from subroutine fece : 89 pushx ; push x-register onto stack fecf : 87 pusha ; push accu onto stack fed0 : a610 lda #$10 ; load accumulator with value #$10 fed2 : ae17 ldx #$17 ; load x-register with value #$17 fed4 : 010000 brclr #0,$00,$fed7 ; branch to $fed7 if bit #0 at $00 is clear fed7 : a200 sbc #$00 ; subtract with carry value #$00 from accu fed9 : 5bf9 dbnzx $fed4 ; decrement x-reg. and branch if not zero fedb : 49 rola ; rotate accumulator left through carry fedc : 86 popa ; pop (pull) accu from stack fedd : 88 popx ; pop (pull) x-register from stack fede : 81 rts ; return from subroutine fedf : ff ff ff ff ff ff ff ff -- ff ff ff ff ff ff ff ff feef : ff ff ff ff ff ff ff ff -- ff 9d 9d 9d 15 fe 28 ff ØØØ._( feff : 00 -- . ff00 : 2f0f bih $ff11 ; branch if external IRQ pin is high ff02 : 6e2037 mov #$20,$37 ; store value #$20 to address $37 ff05 : c6ff80 lda $ff80 ; load accumulator with value at $ff80 ff08 : 43 coma ; inverse accumulator (one's complement) ff09 : 2703 beq $ff0e ; branch if equal (Z is set) ff0b : 43 coma ; inverse accumulator (one's complement) ff0c : b738 sta $38 ; store accumulator at address $38 ff0e : 0536fd brclr #2,$36,$ff0e ; branch to $ff0e if bit #2 at $36 is clear ff11 : a7fa ais #$fa ; add signed value to stack pointer (sp) ff13 : 1100 bclr #0,$00 ; clear bit #0 at memory address $00 ff15 : 6eff40 mov #$ff,$40 ; store value #$ff to address $40 ff18 : 45fff6 ldhx #$fff6 ; load index register (hx) with value ff1b : 010002 brclr #0,$00,$ff20 ; branch to $ff20 if bit #0 at $00 is clear ff1e : 1f40 bclr #7,$40 ; clear bit #7 at memory address $40 ff20 : 51fe1a cbeqx #$fe,$ff3d ; compare x-reg with value & branch if equal ff23 : b600 lda $00 ; load accu with value at address $00 ff25 : 0e4003 brset #7,$40,$ff2b ; branch to $ff2b if bit #7 at $40 is set ff28 : cdfe97 jsr $fe97 ; jump to subroutine at address $fe97 ff2b : 9d nop ; no operation (wait for one cycle) ff2c : 71f2 cbeq ,x+,$ff20 ; cmp. accu with memory at hx, inc hx & beq ff2e : 51fe12 cbeqx #$fe,$ff43 ; compare x-reg with value & branch if equal ff31 : b600 lda $00 ; load accu with value at address $00 ff33 : 0e4003 brset #7,$40,$ff39 ; branch to $ff39 if bit #7 at $40 is set ff36 : cdfe97 jsr $fe97 ; jump to subroutine at address $fe97 ff39 : af01 aix #$01 ; add signed value to index register (hx) ff3b : 20f1 bra $ff2e ; branch always to $ff2e ff3d : aeff ldx #$ff ; load x-register with value #$ff ff3f : 9c rsp ; reset stack pointer (sp=$00ff) ff40 : ccfe20 jmp $fe20 ; unconditional jump to address $fe20 ff43 : 1d40 bclr #6,$40 ; clear bit #6 at memory address $40 ff45 : aeff ldx #$ff ; load x-register with value #$ff ff47 : 9c rsp ; reset stack pointer (sp=$00ff) ff48 : ccfe21 jmp $fe21 ; unconditional jump to address $fe21 ff4b : ff ff ff ff ff -- Let me know if you manage to patch the 2020. Greetings Dietmar Meine Homepage: http://ccintern.dharlos.de |
| Antwort schreiben |
Re: Voltcraft Charge Manager 2020 - Monitor Mode access (von TeK - 16.01.2006 0:20)Re: Voltcraft Charge Manager 2020 - Monitor Mode access (von Dietmar - 16.01.2006 20:36)Re: Voltcraft Charge Manager 2020 - Monitor Mode access (von TeK - 16.01.2006 21:59)