Author Topic: Serial debug (console) approach...? (Read 33075 times)

para · « **on:** March 16, 2005, 08:48:32 pm »

Hi all,
has anyone yet opened his PB? There are two serial ports supposed to be existing on the PCB which are not connected externally. Usually these interfaces are used for debugging purposes. It'd be interesting to see if we could establish some telnet/rsh/ssh session or just a basic line-connection using 'em...

Para

A543 · « **Reply #1 on:** March 17, 2005, 08:44:13 pm »

There doesn't seem to be any place a port would be attached to the circuit board on mine, a Keg. I think they removed the serial port after the Red boxes.

judb · « **Reply #2 on:** March 18, 2005, 02:16:55 am »

the chip itself has the serial port built into it and we would need to pull the leads off the package to a port using some method. I dont know how hard to do a soilder job would be for that. They may have removed that set of traces on the PCB but it might be possible to hook directly to the CPU packaging or some of the pins on it to get the serial port.

AndyMan · « **Reply #3 on:** March 18, 2005, 02:30:40 pm »

If you're talking about the 8051... inherently, the 8051 is a "bit slinger"... you can drive any port pin directly or indirectly (there are at least 3 off 8 bit ports that can be bit twiddled real easy)

Obviously, there's also the "serial" output that would generally run into a 12V converter for true serial communications

sbingner · « **Reply #4 on:** March 18, 2005, 06:03:35 pm »

A pic of the PCB is at http://ns3.bingner.com/phatnoise/phatbox.jpg -- I also have a pic of the back http://ns3.bingner.com/phatnoise/phatbox-back.jpg ... do you see anywhere that it looks like a serial port could be soldered on?

Quote

the chip itself has the serial port built into it and we would need to pull the leads off the package to a port using some method. I dont know how hard to do a soilder job would be for that. They may have removed that set of traces on the PCB but it might be possible to hook directly to the CPU packaging or some of the pins on it to get the serial port.

para · « **Reply #5 on:** March 18, 2005, 06:19:45 pm »

What's the purpose of the 14-pin connector (JP4) and these two jumpers (JP1,JP2) found on the frontside?

sbingner · « **Reply #6 on:** March 18, 2005, 06:21:24 pm »

Oops, forst post I lied, I have no clue what either of those are doing... all I know is nothing was connected to them

judb · « **Reply #7 on:** March 18, 2005, 07:53:16 pm »

J6 looks interesting to me. from the looks of it theres 5 connectors and 2 holes for supports for some type of external interface.

judb · « **Reply #8 on:** March 18, 2005, 08:28:19 pm »

Wonder how hard these are to come by.. http://www.cirrus.com/en/pubs/devKit/EP7312dk-3.pdf

hmmm

sbingner · « **Reply #9 on:** March 18, 2005, 08:33:39 pm »

Quote

Wonder how hard these are to come by.. http://www.cirrus.com/en/pubs/devKit/EP7312dk-3.pdf

hmmm

http://www.newark.com/NewarkWebCommerce/newark/en_US/endecaSearch/partDetail.jsp?SKU=76C0109&N=4

Looks like about $1500

sbingner · « **Reply #10 on:** March 18, 2005, 08:56:48 pm »

Also, I've been wondering if it's possible that a portion of the communications to the head unit makes use of one of the two serial ports supported by the chipset? If so it should give us an idea of where to start to add a serial port. Or if somebody can get more info on a RedBox?

judb · « **Reply #11 on:** March 28, 2005, 01:43:42 am »

i think we can use the jtag interface (should be on the board in one of those jp connections) to extract the boot flash code.

A friend of mine whos been a mod freak on the xbox / ps2 and a DirectTivo hax0r (i mean the software changes to enable features) is coming by the house tomorrow to check it out. I sold him an older kenwood deck and I have some extra kegs I ordered online to toy with so we'll see what we can figure out.

judb · « **Reply #12 on:** March 28, 2005, 03:01:32 am »

http://www.cirrus.com/en/pubs/proDatasheet/EP7312-5.pdf

This has the pin out diagram for the 208 pin LQFP chip thats used on the phatbox hardware.

However.. this concerns me.. The Maverick Unique ID which is described on page 6 of the PDF. You can't cut n paste from the doc or I would here.

It says in a nut shell that each CPU has 32 bit specific ID and an 128 bit random ID etched into it by laser during the manufacturing process and that it can be used for SDMI (Secure Digital Music Initiative) to mark audio for the hardware only playback.

Now, if they are smart thats how they protect the audio and we'd be foobared from breaking that, HOWEVER we know the DMS works in diffrent boxes as its set up today, not coded for our specific CPU's Perhaps the non random number is some seed key they have programmed into these units that we need to know? maybe its not used at all by Phatnoise. Who knows.

Its something to think about though.

judb · « **Reply #13 on:** March 28, 2005, 03:06:48 am »

W78E516B-40

The winbond microcontroler on my pcb's datasheet:
http://www.datasheetarchive.com/datasheet/pdf/69/699566.html

AndyMan · « **Reply #14 on:** March 28, 2005, 03:33:19 am »

Judb,

just looked at the datasheet, dammit, can u read "protect code"... did Phatnoise go this far?

judb · « **Reply #15 on:** March 28, 2005, 04:05:42 am »

Lets hope not.

judb · « **Reply #16 on:** March 28, 2005, 04:29:01 am »

Okay.. so looking at the PDF about the winbond chip, thats where the head unit controls are operated, but we also think thats where the boot loader is right?

Looking at the doc i linked.. ports 2.6 and 2.7 are the reset leads to enable you to reprogram the winbond chip.

They head over to another chip, the XILINX XCR5032C chip. it looks like either I/O-A13 and I/O-A14 or GND and IO-B9 ... im having some difficulty determining pin 1 on the chip as some goop wont come off and i cant tell where the dot is exactly. Im leaning toward pins 13 and 14 which would be the A13 / 14 pins.

This is the Plastic VQFP on my hardware it seems.

Heres the datasheet for the XCR5032C:
http://www.nalanda.nitc.ac.in/industry/appnotes/xilinx/documents/partinfo/ds046.pdf

judb · « **Reply #17 on:** March 28, 2005, 04:38:38 am »

Next up we have the XILINK XC9572XL chip

datasheet: http://www.engin.brown.edu/courses/En163/xc9572XL.pdf

This chip seems to be tied to the IDE interface to the JP5 pins and to the interface connector to the head unit... but I need a magnifying glass to tell where each pin goes.

judb · « **Reply #18 on:** March 28, 2005, 05:03:21 am »

Well last for the night..
the ST Micro 2 MBit flash M29W200BB automotive grade flash.

Datasheet:
http://us.st.com/stonline/books/pdf/docs/6616.pdf

para · « **Reply #19 on:** March 28, 2005, 09:05:55 am »

Great findings! Keep up that work!

News:

Author Topic: Serial debug (console) approach...? (Read 33075 times)