Author Topic: M37906F8CFP programmable?  (Read 7328 times)

0 Members and 1 Guest are viewing this topic.

Offline ercapocciaTopic starter

  • Regular Contributor
  • *
  • Posts: 79
  • Country: it
M37906F8CFP programmable?
« on: November 08, 2014, 10:10:41 am »
Hi there, i do service for a big brand of professional laundry equipment.
I have two motor control boards, that are basically an inverter plus some other security control related to the motor rpm. Those two board are exactly the same but the software in the CMOS CPU M37906F8CFP. I have pin (1-21-22),4,6,7,2,(23-39),41 connected to the 10pin plug J2. () means they are connected to the same pin in the plug.
Is there an easy way to copy the flash from a CPU to another?
Move the CPU is an option but i prefer don't go so far for now.


Thanks


Datasheet





 

Offline Yansi

  • Super Contributor
  • ***
  • Posts: 3893
  • Country: 00
  • STM32, STM8, AVR, 8051
Re: M37906F8CFP programmable?
« Reply #1 on: November 08, 2014, 03:50:01 pm »
No way to copy that, because the MCU you want to read the data from will be very likely locked for any debugging or code downloading. Laundry machine vendors are not so stupid, to leave their code open for public to download it from their product and copy that somewhere else.
 

Offline ercapocciaTopic starter

  • Regular Contributor
  • *
  • Posts: 79
  • Country: it
Re: M37906F8CFP programmable?
« Reply #2 on: November 08, 2014, 04:36:44 pm »
Thanks Yansi, you are right. I must admit i haven't considered that it could be locked. I'll try to desolder, swap the chip and see how it goes.
 

Offline amyk

  • Super Contributor
  • ***
  • Posts: 8240
Re: M37906F8CFP programmable?
« Reply #3 on: November 09, 2014, 03:17:10 am »
Actually the datasheet for this CPU mentions absolutely nothing about memory protection, so it could be possible. I didn't find specific information on the programming protocol but there is info out there on similar related MCU families.
 

Offline ercapocciaTopic starter

  • Regular Contributor
  • *
  • Posts: 79
  • Country: it
Re: M37906F8CFP programmable?
« Reply #4 on: November 09, 2014, 10:15:17 am »
Could you please give me an example from where i can start my research?

 

Offline Yansi

  • Super Contributor
  • ***
  • Posts: 3893
  • Country: 00
  • STM32, STM8, AVR, 8051
Re: M37906F8CFP programmable?
« Reply #5 on: November 09, 2014, 10:49:29 am »
Hehe, I've just search throughout the datasheet, and amyk's  right, there might be no protection. On the other hand, I've found on the web, that also MASK ROM microcontroller version of this exists (program code etched directly on the silicon), but I have no clue, how to identify the ROM version.
Also, in the datasheet, there is stated that Programming/Erase control by software command - And I think we are home now, because the program download can be disabled that way, from code running in the MCU.

Where to start research? Search for some better specsheet for this MCU to see, how does this software protection work.
And the second task - borrow somewhere a professional programing tool, that can program these suckers. I would be really waste of time, hacking that by using your own programmer design with another MCU. Maybe Segger programmer can do this sucker. You can try.
But do not waste too much time with that.  ;)
 

Offline mikerj

  • Super Contributor
  • ***
  • Posts: 3233
  • Country: gb
Re: M37906F8CFP programmable?
« Reply #6 on: November 09, 2014, 11:21:47 am »
Also, in the datasheet, there is stated that Programming/Erase control by software command - And I think we are home now, because the program download can be disabled that way, from code running in the MCU.

Pretty useless because the code has to start running to disable this feature, and you can normally attach a JTAG debugger whilst the device is in reset.
 

Offline Yansi

  • Super Contributor
  • ***
  • Posts: 3893
  • Country: 00
  • STM32, STM8, AVR, 8051
Re: M37906F8CFP programmable?
« Reply #7 on: November 09, 2014, 12:45:25 pm »
And the JTAG thingy you see where on this MCU?    ;D
 

Offline amyk

  • Super Contributor
  • ***
  • Posts: 8240
Re: M37906F8CFP programmable?
« Reply #8 on: November 09, 2014, 01:33:59 pm »
Quote
but I have no clue, how to identify the ROM version.
The ones with "M" instead of "F", e.g. "M8C" vs "F8C".

Could you please give me an example from where i can start my research?
The MCU you have is part of the "7906 group"; here is the datasheet for the "7641 group" which contains the description/pinout of the parallel programming mode although the method of entering the mode is slightly different ("CNVss" pin is used, compared to MD0/MD1 for the 7906):

http://pdf.datasheetcatalog.com/datasheet/MitsubishiElectricCorporation/mXuutqw.pdf

Here is a document for the "7902 group" that suggests MD0=MD1=Vcc to enter parallel programming mode:

http://datasheet.eeworld.com.cn/pdf/MITSUBISHI/22641_M37902FCCHP.pdf
 

Offline ercapocciaTopic starter

  • Regular Contributor
  • *
  • Posts: 79
  • Country: it
Re: M37906F8CFP programmable?
« Reply #9 on: November 09, 2014, 06:40:13 pm »
Thank you guys for your very informative answer.
This is a new thing for me, i have a very basic electronics background. I'm a computer engineer and i started to study electronics a couple of month ago in my very limited free time.

I found a serial programming diagram in the Segger Flash 5 manual



i also found a Suisei parallel writing unit that can write and read to/from the 7900 Series Mitsubishi Electric
flash memory built-in MCU

EF7906F-42S User's Guide

More info about the controller

Complete Datatasheet
« Last Edit: November 09, 2014, 06:45:53 pm by ercapoccia »
 

Offline ercapocciaTopic starter

  • Regular Contributor
  • *
  • Posts: 79
  • Country: it
Re: M37906F8CFP programmable?
« Reply #10 on: November 09, 2014, 07:33:04 pm »
The pins on the pcb match the Segger flasher 5 connector, so probably this is the answer, i need a Seger Flasher 5, but it is pretty expensive and maybe the game isn't worth the candle.
 

Offline ercapocciaTopic starter

  • Regular Contributor
  • *
  • Posts: 79
  • Country: it
Re: M37906F8CFP programmable?
« Reply #11 on: November 10, 2014, 03:17:52 pm »
I read the Renesas datasheet and i can't find anything about password protection. Should i be able to read it with a proper serial reader, like the Segger Flash 5 PRO?
 

Offline Yansi

  • Super Contributor
  • ***
  • Posts: 3893
  • Country: 00
  • STM32, STM8, AVR, 8051
Re: M37906F8CFP programmable?
« Reply #12 on: November 10, 2014, 06:07:39 pm »
As I've said before, ask someone and borrow some beefy programmer which supports these MCUs.  But if you want buy one and if you would have usage for it, thats no problem then.

By the way, what is on that laundry machine board so interesting, you need to hack it?
 

Offline ercapocciaTopic starter

  • Regular Contributor
  • *
  • Posts: 79
  • Country: it
Re: M37906F8CFP programmable?
« Reply #13 on: November 10, 2014, 07:35:50 pm »
Thanks Yansi, i'll probably buy one and give it a try, i don't have anyone to ask for a programmer.

A motor control with this board costs from 800$ to 1500$ it depends on the output power. I have several board that i fixed but i can't use because the software on the mcu.  On the same board there are different software for different model. This way i'll be free to use any board on any model.   
 

Offline ercapocciaTopic starter

  • Regular Contributor
  • *
  • Posts: 79
  • Country: it
Re: M37906F8CFP programmable?
« Reply #14 on: November 15, 2014, 02:29:47 pm »
Got the Segger flash 5 Pro programmer and it works. Thanks for your help.
 

Offline Yansi

  • Super Contributor
  • ***
  • Posts: 3893
  • Country: 00
  • STM32, STM8, AVR, 8051
Re: M37906F8CFP programmable?
« Reply #15 on: November 15, 2014, 04:37:30 pm »
Wow, that MCU really has no readout protection? Silly laundry designers  >:D I would never expect unprotected code there.

And also congrats that it worked.
 

Offline ercapocciaTopic starter

  • Regular Contributor
  • *
  • Posts: 79
  • Country: it
Re: M37906F8CFP programmable?
« Reply #16 on: November 15, 2014, 04:59:00 pm »
It works also with the M30260F8AGP (M16/C26A) that is in the upgraded family version of the boards.  ;)
 

Offline amyk

  • Super Contributor
  • ***
  • Posts: 8240
Re: M37906F8CFP programmable?
« Reply #17 on: November 15, 2014, 05:24:24 pm »
Wow, that MCU really has no readout protection? Silly laundry designers  >:D I would never expect unprotected code there.

And also congrats that it worked.
It's a really old MCU family (now discontinued) and they probably didn't care for protection back then; also the ICSP protocol is not that well-documented so you could consider it "security through obscurity" - but even without the official programmer there's enough info floating around for someone determined enough to RE it.
 

Offline DemasPPC

  • Newbie
  • Posts: 1
  • Country: ru
Re: M37906F8CFP programmable?
« Reply #18 on: November 25, 2023, 11:49:58 am »
Hello everyone...can you share a dump for this controller? I would be very grateful, the EWD2300ZC device (the microcontroller burned out)
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf