SPI flash ID question (DPC3010, DPC3825)

USB BDM software. Bug report.
Post Reply
Teddy Boom
Junior Member
Posts: 14
Joined: Tue Jun 05, 2012 7:39 pm

SPI flash ID question (DPC3010, DPC3825)

Post by Teddy Boom »

I've been attempting to dump the flash on a DPC3010 and a DPC3825. When I ID the chip I get output like this:

DPC3010
-flshdct 0
found Address= 00000000 25FL032A
found Address= 007f0000 25FL032A
found Address= 00fa0000 25FL032A

For the DPC3825, I forget the exact details, but it would have been along the lines of:
found Address= 00000000 25FL064A
found Address= 00fa0000 25FL064A

What does it mean to have two/three instances of "found address"? Are these dumps going to be good?



Edit: The DPC3010 uses an 8pin SPI flash. Here's the pinout:

pin1 Chip Select
pin2 Serial Data Out
pin3 Write Protection
pin4 Ground

pin5 Serial Data In
pin6 Clock
pin7 Hold
pin8 Vcc
CAPONE
Junior Member
Posts: 5011
Joined: Sat Dec 27, 2008 3:25 pm

Post by CAPONE »

Teddy Boom wrote:I've been attempting to dump the flash on a DPC3010 and a DPC3825. When I ID the chip I get output like this:

DPC3010
-flshdct 0
found Address= 00000000 25FL032A
found Address= 007f0000 25FL032A
found Address= 00fa0000 25FL032A

For the DPC3825, I forget the exact details, but it would have been along the lines of:
found Address= 00000000 25FL064A
found Address= 00fa0000 25FL064A

What does it mean to have two/three instances of "found address"? Are these dumps going to be good?



Edit: The DPC3010 uses an 8pin SPI flash. Here's the pinout:

pin1 Chip Select
pin2 Serial Data Out
pin3 Write Protection
pin4 Ground

pin5 Serial Data In
pin6 Clock
pin7 Hold
pin8 Vcc
I have Dumped the DPC3010, and the DPC3008. They are basically the Same, Only Difference is the ISP Pin Location. As for the 3 instances, Its reflective of Wrong XML. With the Proper XML you will have only one ID, Not 2 or 3. However if you Know how big chip is in MB you can still make full backup and program. BTW all 8 pin SPI Flashes have the Same Pinout so no Need to Point that Out. Pinout is the Same as SB5101U,SB5101N,Ambit256, All the Same...

As for the Dumps being Good, you will need to Check that your self. All 000's or FFFF's = NO GOOD.

25FL032A = May be a 4MB Flash
25FL064A = May be a 8MB Flash

Have you tryed setting target to TM802G?
"If you give a man a fish you feed him for a day. If you teach a man to fish you feed him for a lifetime."
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

Teddy Boom wrote:I've been attempting to dump the flash on a DPC3010 and a DPC3825. When I ID the chip I get output like this:

DPC3010
-flshdct 0
found Address= 00000000 25FL032A
found Address= 007f0000 25FL032A
found Address= 00fa0000 25FL032A

For the DPC3825, I forget the exact details, but it would have been along the lines of:
found Address= 00000000 25FL064A
found Address= 00fa0000 25FL064A

What does it mean to have two/three instances of "found address"? Are these dumps going to be good?



Edit: The DPC3010 uses an 8pin SPI flash. Here's the pinout:

pin1 Chip Select
pin2 Serial Data Out
pin3 Write Protection
pin4 Ground

pin5 Serial Data In
pin6 Clock
pin7 Hold
pin8 Vcc
I think you have created your own xml and the definition of the memory is not right. That is why you get odd detection.
CAPONE
Junior Member
Posts: 5011
Joined: Sat Dec 27, 2008 3:25 pm

Post by CAPONE »

usbbdm wrote:I think you have created your own xml and the definition of the memory is not right. That is why you get odd detection.
I get same thing trying different SPI targets like DPC3000,Ambit and SB6120 and the One I used if I remember correctlly Was the TM802G and created an XML based of of that XML.
"If you give a man a fish you feed him for a day. If you teach a man to fish you feed him for a lifetime."
Teddy Boom
Junior Member
Posts: 14
Joined: Tue Jun 05, 2012 7:39 pm

Post by Teddy Boom »

CAPONE wrote:I have Dumped the DPC3010, and the DPC3008. They are basically the Same, Only Difference is the ISP Pin Location. As for the 3 instances, Its reflective of Wrong XML. With the Proper XML you will have only one ID, Not 2 or 3. However if you Know how big chip is in MB you can still make full backup and program. BTW all 8 pin SPI Flashes have the Same Pinout so no Need to Point that Out. Pinout is the Same as SB5101U,SB5101N,Ambit256, All the Same...

As for the Dumps being Good, you will need to Check that your self. All 000's or FFFF's = NO GOOD.

25FL032A = May be a 4MB Flash
25FL064A = May be a 8MB Flash

Have you tryed setting target to TM802G?
The DPC3825 I dumped as a DPC3000. The dump looks reasonable, of course it is 16MB, even though it must have been an 8MB flash chip... Would it still be possible to extract a firmware image from that? Like will it just be the first 8MB of data? Unfortunately I no longer have access to that modem.

I still have the DPC3010, so I will try dumping as a TM802G and see what happens, thanks for the tip.


Some general notes..
I'm pretty new to this, but I have a technical background. My goal is to extract firmwares so that I can upgrade modems to the firmware version required by local ISPs. In this region the ISP is not pushing upgrades properly, and there is a bunch of bureaucracy about having correct firmware versions.

Proper XML files for the following modems would be a huge help to me: DPC3825, SMCD3GN, DCM475 and DCM476. The DPC3010 is more just a hobby for now.. Reading the SMCD3GN as a DPC3000 works well enough for my purpose, but the DPC3825 has different file boundaries. I haven't gotten any DCM47Xs to play with yet.

Is there a tutorial for creating your own XMLs, or maybe there are some XMLs available that I haven't found yet?

Thanks for the help!!
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

To make SPI based modem it is very easy.
You need to make sure the total amount of the memory is the size of your flash.
You need to make sure you have the memory segment aligned.
eg. 1. 0->0xffff
2. 0x10000->0x3ffff

In here 0+ 0xffff + 1 = 0x10000 which is the start of next segment.
Your initial post has
found Address= 007f0000 25FL032A
Which the address of 0x7f0000 is from nowhere. That is the problem.

There are many many files under config directory and it is very easy to make one if you spend a little time to read several of them.
CAPONE
Junior Member
Posts: 5011
Joined: Sat Dec 27, 2008 3:25 pm

Post by CAPONE »

Teddy Boom wrote:The DPC3825 I dumped as a DPC3000. The dump looks reasonable, of course it is 16MB, even though it must have been an 8MB flash chip... Would it still be possible to extract a firmware image from that? Like will it just be the first 8MB of data? Unfortunately I no longer have access to that modem.

I still have the DPC3010, so I will try dumping as a TM802G and see what happens, thanks for the tip.


Some general notes..
I'm pretty new to this, but I have a technical background. My goal is to extract firmwares so that I can upgrade modems to the firmware version required by local ISPs. In this region the ISP is not pushing upgrades properly, and there is a bunch of bureaucracy about having correct firmware versions.

Proper XML files for the following modems would be a huge help to me: DPC3825, SMCD3GN, DCM475 and DCM476. The DPC3010 is more just a hobby for now.. Reading the SMCD3GN as a DPC3000 works well enough for my purpose, but the DPC3825 has different file boundaries. I haven't gotten any DCM47Xs to play with yet.

Is there a tutorial for creating your own XMLs, or maybe there are some XMLs available that I haven't found yet?

Thanks for the help!!
You can do a compare to look for Proper placement of firmware. I did an XML for the TM802G and was able to Get a good read and Write and the Firmware Location is exactly the same as the DPC3000. Beside that You can enter Getram 0 800000 if you just want to read 8 MB or Getram 0 1000000 to read 16 MB or even up to 32 MB if you chose to. If you send USBBDM a Backup he may be able to tell you what size it it. Just becouse it Has a 16MB flash does not mean its Using Up the entire 16MB, It could just be Using Half that.
"If you give a man a fish you feed him for a day. If you teach a man to fish you feed him for a lifetime."
CAPONE
Junior Member
Posts: 5011
Joined: Sat Dec 27, 2008 3:25 pm

Post by CAPONE »

usbbdm wrote:To make SPI based modem it is very easy.
You need to make sure the total amount of the memory is the size of your flash.
You need to make sure you have the memory segment aligned.
eg. 1. 0->0xffff
2. 0x10000->0x3ffff

In here 0+ 0xffff + 1 = 0x10000 which is the start of next segment.
Your initial post has
found Address= 007f0000 25FL032A
Which the address of 0x7f0000 is from nowhere. That is the problem.

There are many many files under config directory and it is very easy to make one if you spend a little time to read several of them.
That is a Side effect of the XML. I also had that problem with the First DPC3010 and DPC3008 That I Backed Up. I kept comparing by detecting with different SPI targets Untill I found one that Did not read as 3 different Flashes then I made an XML Based on that targets XML.
"If you give a man a fish you feed him for a day. If you teach a man to fish you feed him for a lifetime."
teddyalmonds
Junior Member
Posts: 47
Joined: Wed Feb 20, 2008 1:27 pm

Post by teddyalmonds »

Yes reading is one thing but the issue is also being able to program back to it.
CAPONE
Junior Member
Posts: 5011
Joined: Sat Dec 27, 2008 3:25 pm

Post by CAPONE »

teddyalmonds wrote:Yes reading is one thing but the issue is also being able to program back to it.
If you can get a Good READ, No Reason you could not Program. For the DCP3010 & DPC3008 I was able to read and Program with no Issuse. Only difference is I know the ISP Spot for both Models so I have no need to supply external power. I am sure if I had a DPC3825 I could fiond the ISP spot for it Also.
"If you give a man a fish you feed him for a day. If you teach a man to fish you feed him for a lifetime."
teddyalmonds
Junior Member
Posts: 47
Joined: Wed Feb 20, 2008 1:27 pm

Post by teddyalmonds »

CAPONE wrote:If you can get a Good READ, No Reason you could not Program. For the DCP3010 & DPC3008 I was able to read and Program with no Issuse. Only difference is I know the ISP Spot for both Models so I have no need to supply external power. I am sure if I had a DPC3825 I could fiond the ISP spot for it Also.
I agree with you. With that being said, maybe when you get a moment you could post the isp points for both of those modems. I'm sure some users here would find them handy.
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

From the initial post, there should not be a problem as far s the connection. ISP pin or not. The issue is someone create his own wrong XML.
If you detect the flash as 00000000 25FL032A, that just means the flash is 4Mbyte. You should only have the memory from 0 to 0x3fffff. Anything beyond 0x400000 would cause another detection (duplicate and wrong). A simply XML would have one segment with start address of 0 and length of 0x400000.
CAPONE
Junior Member
Posts: 5011
Joined: Sat Dec 27, 2008 3:25 pm

Post by CAPONE »

usbbdm wrote:From the initial post, there should not be a problem as far s the connection. ISP pin or not. The issue is someone create his own wrong XML.If you detect the flash as 00000000 25FL032A, that just means the flash is 4Mbyte. You should only have the memory from 0 to 0x3fffff. Anything beyond 0x400000 would cause another detection (duplicate and wrong). A simply XML would have one segment with start address of 0 and length of 0x400000.
Thats why I said on Post #8 (That is a Side effect of the XML.) However if it detects then Fixing the XML is not a difficult Task.......
"If you give a man a fish you feed him for a day. If you teach a man to fish you feed him for a lifetime."
thaclient
Junior Member
Posts: 20
Joined: Fri Feb 03, 2012 4:43 pm

Post by thaclient »

CAPONE wrote:Originally Posted by CAPONE
If you can get a Good READ, No Reason you could not Program. For the DCP3010 & DPC3008 I was able to read and Program with no Issuse. Only difference is I know the ISP Spot for both Models so I have no need to supply external power. I am sure if I had a DPC3825 I could fiond the ISP spot for it Also.

CAPONE , can you please tell me where the ISP point is man on the 3008? I have one and I would LOVE to dump it. Or can you give me a tip for finding it without blowing the modem.
mr.sky
Junior Member
Posts: 289
Joined: Fri Nov 10, 2006 3:30 pm

Post by mr.sky »

thaclient wrote:CAPONE , can you please tell me where the ISP point is man on the 3008? I have one and I would LOVE to dump it. Or can you give me a tip for finding it without blowing the modem.
I may be wrong, but look and see if yours has a U102?
Post Reply

Who is online

Users browsing this forum: No registered users and 5 guests