Help identifying unknown chip: ATMLH808 64C 1 P7H3561E

[Napalm]

So first a little background info. I've decided to hack my home cordless Panasonic DECT phone's ring tone. A friend also has a similar model phone by Panasonic and has decided to also try and hack his. The main DECT baseband chip is a SC144 mine is a SC14430 and his a SC14480. My phone stores its settings like phonebook in a separate 8pin SOIC I2C EEPROM by Microchip 24AA32AI-SN. So I've connected by Bus Pirate up and dumped my 4 KByte EEPROM and I have my phonebook and lots of other settings and unknown values. Excellent, so now we can commence hacking.

My friend on the other hand has a slightly different model and his settings are stored in some unknown chip. I can't find a datasheet or any other info about it. I for the moment can assume its a I2C EEPROM or Flash memory of at least the same size.

I think the initial letters ATML is short for Atmel. But I can't find similar part numbers on their site. I have attached a picture of his device. Any help in identifying what it is or even finding a datasheet would be appreciated.

[oPossum]

May be a 24C64 or similar (24AA64 etc...)

[Napalm]

Perhaps, but I'm still not convinced. I looked at the 24C64 data sheet it lists the pinout as follows: 1: A0, 2: A1, 3:A2, 4:GND, 5:SDA, 6:SCL, 7:WP, 8:VCC.

From the image I see C172 is the decoupling cap so we can assume pin 8 is indeed VCC. Pins 1 to 4 seem tyo be connected together so we can assume thats GND and the A0,A1,A2 pins are 0 the standard configuration. We could also go one step futher and assume R42,R41,R40 are the pull-ups for pins 5,6 and 7. So everything sounds good, but why do we have a pull-up on pin 7 which would be WP, this is normally tied to VCC or GND.. and even if the main processor was using that for write protection.. why the pull-up? perhaps so its write protected and then the processor pulls to GND when it chooses to write to the device? I suppose that's feasible.

I'll have my friend test it out and see if we can read the EEPROM. I'll post a response with details.
Thanks.

[patb]

Page 15 (Part Marking Scheme section) - http://www.atmel.com/dyn/resources/prod_documents/doc5298.pdf

I had the same problem yesterday with ATMLU022 64C.

[Napalm]

Thanks patb! Now thats exact confirmation. I now feel confident at hooking this up and not making it go bang
Cheers

[Napalm]

I've got a related question or two. The larger DECT baseband processor labelled SC14430.. I can't find a data sheet for that either. After some research I have found that the original manufacturer is Sitel, which I believe was bought out by National Semiconductor. I found similar parts to this that come under National Semiconductor SC14404/SC14408. See: http://www.dialog-semiconductor.com/product_selector/chip.html and http://www.dialog-semiconductor.com/single-chip-dect-cat-iq-solution
Still can't find the data sheet's, I wonder If I could call them and ask for access to the customer portal (act as a prospective buyer).

Now I've examined the board and the silk screen has the word JTAG next to a test point. But that's the only test point. Not the usual TRST,TDI,TMS,TCLK,TDO pins. Is there even a single wire JTAG interface?? I know of microWire which was invented by National Semiconductor and it was the precursor to SPI. So I assume it could be a fixed rate SPI connection, something like you hold it low while you power up the chip and it gets into a programming mode.

I've attached pictures. Anyone any ideas?

[alm]

There is SWD, which is a two pin version of JTAG used in some low pincount ARM MCUs. Don't think National uses it, but there are likely other proprietary extensions to JTAG out there.

[IanB]

Off topic, but it's hugely annoying that cordless phones are so primitive and lacking in features compared to even the most basic cellphone. Where is the SD card slot? Where is the USB interface for phone book synchronization and backup? Where is the wi-fi interface? Arggghh....

[Napalm]

@IanB: Exactly why they need to be hacked