USB JTAG  

Go Back   USB JTAG > USBBDM (NT) > Product Support.

Reply
 
Thread Tools Display Modes
  #1  
Old 07-10-2012, 01:50 AM
Teddy Boom Teddy Boom is offline
Junior Member
 
Join Date: Jun 2012
Posts: 14
Default SPI flash ID question (DPC3010, DPC3825)

I've been attempting to dump the flash on a DPC3010 and a DPC3825. When I ID the chip I get output like this:

DPC3010
-flshdct 0
found Address= 00000000 25FL032A
found Address= 007f0000 25FL032A
found Address= 00fa0000 25FL032A

For the DPC3825, I forget the exact details, but it would have been along the lines of:
found Address= 00000000 25FL064A
found Address= 00fa0000 25FL064A

What does it mean to have two/three instances of "found address"? Are these dumps going to be good?



Edit: The DPC3010 uses an 8pin SPI flash. Here's the pinout:

pin1 Chip Select
pin2 Serial Data Out
pin3 Write Protection
pin4 Ground

pin5 Serial Data In
pin6 Clock
pin7 Hold
pin8 Vcc

Last edited by Teddy Boom; 07-10-2012 at 01:57 AM.
Reply With Quote
  #2  
Old 07-10-2012, 05:35 AM
CAPONE CAPONE is offline
Senior Member
 
Join Date: Dec 2008
Posts: 5,093
Default

Quote:
Originally Posted by Teddy Boom View Post
I've been attempting to dump the flash on a DPC3010 and a DPC3825. When I ID the chip I get output like this:

DPC3010
-flshdct 0
found Address= 00000000 25FL032A
found Address= 007f0000 25FL032A
found Address= 00fa0000 25FL032A

For the DPC3825, I forget the exact details, but it would have been along the lines of:
found Address= 00000000 25FL064A
found Address= 00fa0000 25FL064A

What does it mean to have two/three instances of "found address"? Are these dumps going to be good?



Edit: The DPC3010 uses an 8pin SPI flash. Here's the pinout:

pin1 Chip Select
pin2 Serial Data Out
pin3 Write Protection
pin4 Ground

pin5 Serial Data In
pin6 Clock
pin7 Hold
pin8 Vcc
I have Dumped the DPC3010, and the DPC3008. They are basically the Same, Only Difference is the ISP Pin Location. As for the 3 instances, Its reflective of Wrong XML. With the Proper XML you will have only one ID, Not 2 or 3. However if you Know how big chip is in MB you can still make full backup and program. BTW all 8 pin SPI Flashes have the Same Pinout so no Need to Point that Out. Pinout is the Same as SB5101U,SB5101N,Ambit256, All the Same...

As for the Dumps being Good, you will need to Check that your self. All 000's or FFFF's = NO GOOD.

25FL032A = May be a 4MB Flash
25FL064A = May be a 8MB Flash

Have you tryed setting target to TM802G?
__________________
"If you give a man a fish you feed him for a day. If you teach a man to fish you feed him for a lifetime."

Last edited by CAPONE; 07-10-2012 at 05:53 AM.
Reply With Quote
  #3  
Old 07-10-2012, 07:34 AM
usbbdm usbbdm is offline
Administrator
 
Join Date: Jul 2005
Posts: 8,885
Default

Quote:
Originally Posted by Teddy Boom View Post
I've been attempting to dump the flash on a DPC3010 and a DPC3825. When I ID the chip I get output like this:

DPC3010
-flshdct 0
found Address= 00000000 25FL032A
found Address= 007f0000 25FL032A
found Address= 00fa0000 25FL032A

For the DPC3825, I forget the exact details, but it would have been along the lines of:
found Address= 00000000 25FL064A
found Address= 00fa0000 25FL064A

What does it mean to have two/three instances of "found address"? Are these dumps going to be good?



Edit: The DPC3010 uses an 8pin SPI flash. Here's the pinout:

pin1 Chip Select
pin2 Serial Data Out
pin3 Write Protection
pin4 Ground

pin5 Serial Data In
pin6 Clock
pin7 Hold
pin8 Vcc
I think you have created your own xml and the definition of the memory is not right. That is why you get odd detection.
Reply With Quote
  #4  
Old 07-10-2012, 12:05 PM
CAPONE CAPONE is offline
Senior Member
 
Join Date: Dec 2008
Posts: 5,093
Default

Quote:
Originally Posted by usbbdm View Post
I think you have created your own xml and the definition of the memory is not right. That is why you get odd detection.
I get same thing trying different SPI targets like DPC3000,Ambit and SB6120 and the One I used if I remember correctlly Was the TM802G and created an XML based of of that XML.
__________________
"If you give a man a fish you feed him for a day. If you teach a man to fish you feed him for a lifetime."
Reply With Quote
  #5  
Old 07-10-2012, 01:44 PM
Teddy Boom Teddy Boom is offline
Junior Member
 
Join Date: Jun 2012
Posts: 14
Default

Quote:
Originally Posted by CAPONE View Post
I have Dumped the DPC3010, and the DPC3008. They are basically the Same, Only Difference is the ISP Pin Location. As for the 3 instances, Its reflective of Wrong XML. With the Proper XML you will have only one ID, Not 2 or 3. However if you Know how big chip is in MB you can still make full backup and program. BTW all 8 pin SPI Flashes have the Same Pinout so no Need to Point that Out. Pinout is the Same as SB5101U,SB5101N,Ambit256, All the Same...

As for the Dumps being Good, you will need to Check that your self. All 000's or FFFF's = NO GOOD.

25FL032A = May be a 4MB Flash
25FL064A = May be a 8MB Flash

Have you tryed setting target to TM802G?
The DPC3825 I dumped as a DPC3000. The dump looks reasonable, of course it is 16MB, even though it must have been an 8MB flash chip... Would it still be possible to extract a firmware image from that? Like will it just be the first 8MB of data? Unfortunately I no longer have access to that modem.

I still have the DPC3010, so I will try dumping as a TM802G and see what happens, thanks for the tip.


Some general notes..
I'm pretty new to this, but I have a technical background. My goal is to extract firmwares so that I can upgrade modems to the firmware version required by local ISPs. In this region the ISP is not pushing upgrades properly, and there is a bunch of bureaucracy about having correct firmware versions.

Proper XML files for the following modems would be a huge help to me: DPC3825, SMCD3GN, DCM475 and DCM476. The DPC3010 is more just a hobby for now.. Reading the SMCD3GN as a DPC3000 works well enough for my purpose, but the DPC3825 has different file boundaries. I haven't gotten any DCM47Xs to play with yet.

Is there a tutorial for creating your own XMLs, or maybe there are some XMLs available that I haven't found yet?

Thanks for the help!!
Reply With Quote
  #6  
Old 07-10-2012, 03:54 PM
usbbdm usbbdm is offline
Administrator
 
Join Date: Jul 2005
Posts: 8,885
Default

To make SPI based modem it is very easy.
You need to make sure the total amount of the memory is the size of your flash.
You need to make sure you have the memory segment aligned.
eg. 1. 0->0xffff
2. 0x10000->0x3ffff

In here 0+ 0xffff + 1 = 0x10000 which is the start of next segment.
Your initial post has
found Address= 007f0000 25FL032A
Which the address of 0x7f0000 is from nowhere. That is the problem.

There are many many files under config directory and it is very easy to make one if you spend a little time to read several of them.
Reply With Quote
  #7  
Old 07-10-2012, 04:45 PM
CAPONE CAPONE is offline
Senior Member
 
Join Date: Dec 2008
Posts: 5,093
Default

Quote:
Originally Posted by Teddy Boom View Post
The DPC3825 I dumped as a DPC3000. The dump looks reasonable, of course it is 16MB, even though it must have been an 8MB flash chip... Would it still be possible to extract a firmware image from that? Like will it just be the first 8MB of data? Unfortunately I no longer have access to that modem.

I still have the DPC3010, so I will try dumping as a TM802G and see what happens, thanks for the tip.


Some general notes..
I'm pretty new to this, but I have a technical background. My goal is to extract firmwares so that I can upgrade modems to the firmware version required by local ISPs. In this region the ISP is not pushing upgrades properly, and there is a bunch of bureaucracy about having correct firmware versions.

Proper XML files for the following modems would be a huge help to me: DPC3825, SMCD3GN, DCM475 and DCM476. The DPC3010 is more just a hobby for now.. Reading the SMCD3GN as a DPC3000 works well enough for my purpose, but the DPC3825 has different file boundaries. I haven't gotten any DCM47Xs to play with yet.

Is there a tutorial for creating your own XMLs, or maybe there are some XMLs available that I haven't found yet?

Thanks for the help!!
You can do a compare to look for Proper placement of firmware. I did an XML for the TM802G and was able to Get a good read and Write and the Firmware Location is exactly the same as the DPC3000. Beside that You can enter Getram 0 800000 if you just want to read 8 MB or Getram 0 1000000 to read 16 MB or even up to 32 MB if you chose to. If you send USBBDM a Backup he may be able to tell you what size it it. Just becouse it Has a 16MB flash does not mean its Using Up the entire 16MB, It could just be Using Half that.
__________________
"If you give a man a fish you feed him for a day. If you teach a man to fish you feed him for a lifetime."

Last edited by CAPONE; 07-24-2012 at 08:32 PM.
Reply With Quote
  #8  
Old 07-10-2012, 04:48 PM
CAPONE CAPONE is offline
Senior Member
 
Join Date: Dec 2008
Posts: 5,093
Default

Quote:
Originally Posted by usbbdm View Post
To make SPI based modem it is very easy.
You need to make sure the total amount of the memory is the size of your flash.
You need to make sure you have the memory segment aligned.
eg. 1. 0->0xffff
2. 0x10000->0x3ffff

In here 0+ 0xffff + 1 = 0x10000 which is the start of next segment.
Your initial post has
found Address= 007f0000 25FL032A
Which the address of 0x7f0000 is from nowhere. That is the problem.

There are many many files under config directory and it is very easy to make one if you spend a little time to read several of them.
That is a Side effect of the XML. I also had that problem with the First DPC3010 and DPC3008 That I Backed Up. I kept comparing by detecting with different SPI targets Untill I found one that Did not read as 3 different Flashes then I made an XML Based on that targets XML.
__________________
"If you give a man a fish you feed him for a day. If you teach a man to fish you feed him for a lifetime."
Reply With Quote
  #9  
Old 07-24-2012, 06:46 PM
teddyalmonds teddyalmonds is offline
Member
 
Join Date: Feb 2008
Posts: 48
Default

Yes reading is one thing but the issue is also being able to program back to it.
Reply With Quote
  #10  
Old 07-24-2012, 08:37 PM
CAPONE CAPONE is offline
Senior Member
 
Join Date: Dec 2008
Posts: 5,093
Default

Quote:
Originally Posted by teddyalmonds View Post
Yes reading is one thing but the issue is also being able to program back to it.
If you can get a Good READ, No Reason you could not Program. For the DCP3010 & DPC3008 I was able to read and Program with no Issuse. Only difference is I know the ISP Spot for both Models so I have no need to supply external power. I am sure if I had a DPC3825 I could fiond the ISP spot for it Also.
__________________
"If you give a man a fish you feed him for a day. If you teach a man to fish you feed him for a lifetime."
Reply With Quote
  #11  
Old 07-25-2012, 03:46 AM
teddyalmonds teddyalmonds is offline
Member
 
Join Date: Feb 2008
Posts: 48
Default

Quote:
Originally Posted by CAPONE View Post
If you can get a Good READ, No Reason you could not Program. For the DCP3010 & DPC3008 I was able to read and Program with no Issuse. Only difference is I know the ISP Spot for both Models so I have no need to supply external power. I am sure if I had a DPC3825 I could fiond the ISP spot for it Also.
I agree with you. With that being said, maybe when you get a moment you could post the isp points for both of those modems. I'm sure some users here would find them handy.
Reply With Quote
  #12  
Old 07-26-2012, 08:44 AM
usbbdm usbbdm is offline
Administrator
 
Join Date: Jul 2005
Posts: 8,885
Default

From the initial post, there should not be a problem as far s the connection. ISP pin or not. The issue is someone create his own wrong XML.
If you detect the flash as 00000000 25FL032A, that just means the flash is 4Mbyte. You should only have the memory from 0 to 0x3fffff. Anything beyond 0x400000 would cause another detection (duplicate and wrong). A simply XML would have one segment with start address of 0 and length of 0x400000.
Reply With Quote
  #13  
Old 07-26-2012, 09:11 AM
CAPONE CAPONE is offline
Senior Member
 
Join Date: Dec 2008
Posts: 5,093
Default

Quote:
Originally Posted by usbbdm View Post
From the initial post, there should not be a problem as far s the connection. ISP pin or not. The issue is someone create his own wrong XML.If you detect the flash as 00000000 25FL032A, that just means the flash is 4Mbyte. You should only have the memory from 0 to 0x3fffff. Anything beyond 0x400000 would cause another detection (duplicate and wrong). A simply XML would have one segment with start address of 0 and length of 0x400000.
Thats why I said on Post #8 (That is a Side effect of the XML.) However if it detects then Fixing the XML is not a difficult Task.......
__________________
"If you give a man a fish you feed him for a day. If you teach a man to fish you feed him for a lifetime."
Reply With Quote
  #14  
Old 07-29-2012, 03:14 PM
thaclient thaclient is offline
Junior Member
 
Join Date: Feb 2012
Posts: 20
Default

Quote:
Originally Posted by CAPONE View Post
Originally Posted by CAPONE
If you can get a Good READ, No Reason you could not Program. For the DCP3010 & DPC3008 I was able to read and Program with no Issuse. Only difference is I know the ISP Spot for both Models so I have no need to supply external power. I am sure if I had a DPC3825 I could fiond the ISP spot for it Also.

CAPONE , can you please tell me where the ISP point is man on the 3008? I have one and I would LOVE to dump it. Or can you give me a tip for finding it without blowing the modem.

Last edited by thaclient; 08-04-2012 at 02:36 PM.
Reply With Quote
  #15  
Old 08-14-2012, 12:24 PM
mr.sky mr.sky is offline
Senior Member
 
Join Date: Nov 2006
Posts: 303
Default

Quote:
Originally Posted by thaclient View Post
CAPONE , can you please tell me where the ISP point is man on the 3008? I have one and I would LOVE to dump it. Or can you give me a tip for finding it without blowing the modem.
I may be wrong, but look and see if yours has a U102?
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump


All times are GMT -7. The time now is 04:56 AM.


Powered by vBulletin® Version 3.7.3
Copyright ©2000 - 2018, Jelsoft Enterprises Ltd.