I need professionals HELP for sending RAW HEX command to MCU, Thanks.

[relax79]

Hi friends, sorry for my poor English.Please look at the attachments

          I need some explanation or someone to show me the right way or source about this. I open thread before for dumping firmware MN101EF31G (MN101E31G series) mcu but I became obsessed with sending commands now. Learning how to get "raw hex" (machine code or op code) command to be sent to mcu more important than dumping firmware. I am not lazy and I google it a lot of way but I can not find anything about this. I am use "Bus Pirate v3.6" with 2-Wire interface to this mcu. I only communicate to mcu DMOD (D-wire Programming mod) pin tied to low (gnd). Other ports not response, it's closed from register I assume.

I read from some text in the official programmers softwares folder and it says

CPUTYPE          : 101EF31G(Boot);
CPU CORE         : AM13E;
INT.ROM MAX      : 0x4000~0x4FFF;
RAM AREA         : 0X0~0X017FF;
INTERNAL REG     : 0X3E00~0X3FFF;
SUPPORT TGT      : DWIRE;
SUPPORT_ODB      : EX,SP,OTA;
ODB_FLASH_WADRS  : 0,0x400,2048;
ODB_OPEN_AFTER   : B0x3FC9,0x4B|B0x3FC8,0x02;     

Flash On-board Rewriting Enable Register (FBEWER: 0x03FC9) 0x4B=01001011: on-board rewriting enable
Flash Mode Register                     (FMDREG1: 0x03FC8) 0x02=00000010: Main area R/W

This register area 16-bit short addressing area and I must be change two register first but how? Command table says flash command but I can always read random bytes send to command. Base address 0x4000 + addr = 0x4aaa and 0x4555 am I right?

"0x4a 0xaa 0xaa 0x45 0x55 0x55 0x4a 0xaa 0xa0 0x3f 0xc9 0x4B" sometimes add to end"r:6"read 6 byte command and I get random bytes
 
I know this command not right but how can I find to saying mcu port "go to this address" and "write this data or read data"(like go to 0x4aaa write to aa)?

Also I can not understand because I am not know C or C++ language but "Dn=byte"  "Dm=bit" am I right? and how can I fit to 0x4b in it to Dm, it is only two bit.( sorry, I realize now  n=byte Dn and Dm=bit but problem same again about two bit)

Is in answer instruction manuals "machine code" part? and what is "programming bus cycle" and "instruction code cycle"?It need somekind of delay or something? MCU Brochure says"programming serial without any special tool" but how? Panasonic sell mcu but no answer to private customers request (only bussiness partners) I don't get command library or table and this is hypocrisy, sell anyone but no support it all customer. I know I ask a lot of question and that questions answers are complicated and hard to understand from noob like me but I obsessed to learn. I am add some attachments. Please you don't be mad at me. Thanks.

[picandmix]

Cannot help with your specific question, but have to ask why you are using such a little supported mcu ?

Can barely find anything on the web about that chip let alone any one stocking or using them.

There might be a forum member who as used that chip at work and might be able to offer an explanation.. ?

Machine code is interesting  to look at and help understand some of the chips very basic functions, but it is really an outdated method.

As you say you do not know C/C++ , then why not try the next nearest thing,  something like a Pic chip with Assembly code, just one step up from machine code and the Pics are readily available and supported.

[amyk]

^ He's probably repairing existing designs that use it.

As it appears they've not publicly documented the D-wire protocol you will need to do some reverse-engineering. I assume you've already downloaded the programmer software and played with it to read/write some MCUs? All you need then is a logic analyser...

[relax79]

Hi, thanks for replying
Yes I am try to repair existing board, this is my first post about this problem
"https://www.eevblog.com/forum/microcontrollers/mn101ef31gxw-dump-read-write-programming-help!!/msg586540/#msg586540"
I am good in electronic hardware repair but not good in using or programming embedded controller. I have a universal programmer for notebook and motherboard bios and Progskeet for ps3 Nand Nor chips. I worked for them so far programming. I download programmer software and also Debug Factory Builder (IDE) but both of the supporting manifacturers official programmer, not support uart or any strange device itself. I assume software not help me because they are send data to official programmer mcu s understanding way. They are says "without special tool" and I don't understand this part. Are that "MCU LSI User Manual" and "Instruction Manual" enough for programming? What am I missing? I realize later some binary numbers in the instruction manual then search answer for that but nothing find. For example
 
Mnemonic          Operation     Code Size(nibble)   Cycle    Machine Code
MOV Dn,Dm        Dn?Dm                    2                    1        1010 DnDm

If I write in c (can not know how)"1010 DnDm" and compile it then send in mcu(with official programmer, I have not because they are give me no info or support), it understand and work with this data. If I send same data to over serial port with "Bus Pirate" like

lats say dn=11 dm=10    1010=A      11 10=E  command=0xae 

mcu still understand or not? I mean what way correct 0x4aaa 0xaa sequence or instruction manuals machine code for changing or reading data in this mcu or any not well supported unknown mcu, what is byte read change language for serial communication commands, c or jedec standart flash command algo? What is machine code, is it for inner interactions or work both inner and outer (serial or any communication ) interactions, What type of command work for changeing to 0x3fc9 register to 0x4b.

only jedec

"0x4a 0xaa 0xaa 0x45 0x55 0x55 0x4a 0xaa 0xa0 0x3f 0xc9 0x4B"

or combination jedec and machine code

0x??=go to      machine code and sequence unknown type and bit, not figured out yet
0x!?=write to   machine code and sequence unknown type and bit, not figured out yet
also read machine code not figured out yet

0x?? 0x4a 0xaa 0x!? 0xaa 0x?? 0x45 0x55 0x!? 0x55 0x?? 0x4a 0xaa 0x!? 0xa0 0x?? 0x3f 0xc9 0x!? 0x4B

I ask that questions because I am confusing so much. This is not about only this mcu, I assume any mcu having in flash memory section and need for programming using jedec command. Maybe somebody try to "bus pirate" like me and figured out or aready know the solution.
I can not fully explain myself because of my bad English, I am so sorry about that.