EEVblog #1144 - Padauk Programmer Reverse Engineering

[lucas.hartmann]

You can hook if a few analog comparators to diffetentiate between the required voltage levels. Something like a flash ADC structure, but with far less bits.

A single CA339 + 4 trimpots would give you five voltage levels, and take 4 bits on the logic analyzer.

Enviado de meu SM-N910C usando o Tapatalk

[js_12345678_55AA]

You can hook if a few analog comparators to diffetentiate between the required voltage levels. Something like a flash ADC structure, but with far less bits.

A single CA339 + 4 trimpots would give you five voltage levels, and take 4 bits on the logic analyzer.

Enviado de meu SM-N910C usando o Tapatalk

Hi,

Thanks for the idea, looks like ZeroPlus is doing the same in their commercial offering: https://www.thedebugstore.com/dso-lap-c-zeroplus.html

Fortunately the different voltages applied are not so complicated. Just VPP (PA.5) and VDD are set to different level when each programing step starts. A simple measurement with a scope is no problem. Since we can count the trigger pulses in logic analyzer (VPP low / high transitions) it is easy to setup the scope to ignore X trigger and we arrive at the desired programing step to measure / monitor the voltage.


JS


EDIT: Since I like the idea of using some bits of the logic analyzer to capture analog voltage so much, I will use a cheap STM32F072 board to do exactly this... 2 parallel ADC channels, output 2x8 bit, should only take an hour to implement :-)

[spth]

EDIT: Since I like the idea of using some bits of the logic analyzer to capture analog voltage so much, I will use a cheap STM32F072 board to do exactly this... 2 parallel ADC channels, output 2x8 bit, should only take an hour to implement :-)

A Padauk or Puolop would provide the ADC channels cheaper.

Philipp

[js_12345678_55AA]

A Padauk or Puolop would provide the ADC channels cheaper.

Philipp

This would be an excellent choice in the future. I also did not see the 100% identical "Puolop" brand before 

Right now I do not have the PFS173 with ADC und use the STM32F072 I have at hand (also not very expensive).


Capture analog values for logic analyzer using STM32F072:

Hardware:
I use STM32F072 on this little board (USD 2.80): https://item.taobao.com/item.htm?id=539758673887
(schematics: http://www.vcc-gnd.com/jikeliangpinstm32f072c8t6xuexibanziliao )

Mini ST-Link/V2 compatible device for uploading / debugging (USD 1.40): https://item.taobao.com/item.htm?id=560869168693

Software:

1. Use CubeMX software from ST and load the file "A2LASTM32.ioc"
    The project is configured to use 2 ADC channels in 8bit mode on PA0 and PA1 and use the complete GPIOB as 16 bit output (PB0-PB15).
    ADC is configured for continuous scan using DMA to write into a circular double buffer
    DMA will trigger interrupts + callbacks whenever first or second part of double buffer is complete

2. and click "Generate Code"
   (you can change code generator to your preferred IDE)

2. Open the generated code with your preferred IDE

3. Add the following code in the specified sections in "main.c" of the generated code:

    DMA callbacks combine the 2 ADC values into a 16 bit value and set GPIOB output (USER CODE 0, see below)

    ADC is calibrated and started in main (USER CODE 2, see below)

Code: [Select]

...

/* USER CODE BEGIN 0 */

//double buffer(2) * 32 bit  //  32 bit = (2 * 16 bit) // each adc value always takes 16 bit
static uint32_t adcDMABuffer[2];

//first part of double buffer complete
void HAL_ADC_ConvHalfCpltCallback(ADC_HandleTypeDef* AdcHandle) {
  //combine and output 2 adc values (8bit : 8bit) on GPIOB
  GPIOB->ODR = (adcDMABuffer[0] | (adcDMABuffer[0]>>8)) & 0xFFFF;
}

//second part of double buffer complete
void HAL_ADC_ConvCpltCallback(ADC_HandleTypeDef* AdcHandle) {
  //combine and output 2 adc values (8bit : 8bit) on GPIOB
  GPIOB->ODR = (adcDMABuffer[1] | (adcDMABuffer[1]>>8)) & 0xFFFF;
}

/* USER CODE END 0 */


...


/* USER CODE BEGIN 2 */

HAL_ADCEx_Calibration_Start(&hadc);
HAL_ADC_Start_DMA(&hadc, (uint32_t*)adcDMABuffer, 2*2 );

/* USER CODE END 2 */

...
4. Compile it

5. Upload it using ST-Link/V2 (your IDE supports this for sure)



Was a nice experience. I just used the CubeMX configurator with the mouse and typed 7 lines of code (excluding comments).

JS

[js_12345678_55AA]

Hi,

I was trying to find out some info about the "BGTR" register which is defined in PFS154.INC and used by init code of PFS154 when I came across this:

"SONiX 8-Bit Micro-Controller"

I think I just found the initial IC designer which seem to have created the CPU core in 2004 or earlier (several years before PADAUK adapted it):

==> http://www.sonix.com.tw/list-en-1006

They also have flash versions:

==> http://www.sonix.com.tw/list-en-1001

More external files:

http://www.alldatasheet.com/view.jsp?Searchword=SN8P2722
http://pdf1.alldatasheet.com/datasheet-pdf/view/110082/SONIX/SN8P2501A.html
...


The PADAUK IC versions seem to have small changes but we can learn a LOT from SONIX datasheets:

e.g.: P1.1/RST/VPP ... VPP: OTP 12.3V power input pin in programming mode

==> And a section mentioning "BandGap" near IHRC and ILRC (just like in PFS154.INC file)

So
IHRCR = Internal High speed R/C Register
ILRCR = Internal Low speed R/C Register
BGTR might be Band Gap Tuning Register


JS

[spth]

Hi,

I was trying to find out some info about the "BGTR" register which is defined in PFS154.INC and used by init code of PFS154 when I came across this:

"SONiX 8-Bit Micro-Controller"

I think I just found the initial IC designer which seem to have created the CPU core in 2004 or earlier (several years before PADAUK adapted it):
[…]

That looks somewhat similar to, but still different from the Padauk devices. In particular, Padauk (and Puolop) have a stack in RAM. SONiX has a tiny fixed-size stack in separate memory (similar to low-end PIC devices). That makes Padauk / Puolop a better target for a C compiler.

Philipp

[spth]

[…] I also did not see the 100% identical "Puolop" brand before 

Most of the range looks identical, down to the dates in the datasheet changelogs. But Padauk has some flash and 8-core devices, while Puolop hasn't. And there seem to be some Puolop 1-core OTP devices that do not have a Padauk equivalent.

Philipp

[js_12345678_55AA]

Hi,

I was trying to find out some info about the "BGTR" register which is defined in PFS154.INC and used by init code of PFS154 when I came across this:

"SONiX 8-Bit Micro-Controller"

I think I just found the initial IC designer which seem to have created the CPU core in 2004 or earlier (several years before PADAUK adapted it):
[…]

That looks somewhat similar to, but still different from the Padauk devices. In particular, Padauk (and Puolop) have a stack in RAM. SONiX has a tiny fixed-size stack in separate memory (similar to low-end PIC devices). That makes Padauk / Puolop a better target for a C compiler.

Philipp

Only somewhat similar? They share almost the same instruction set as the 16 bit PADAUK devices. There is a disassembler on github: https://github.com/vpelletier/dissn8  ... have a look yourself.

So I wonder why PADAUK binary PDK file is encrypted... want to hide the fact that main """inspiration""" came from SN8 core?

JS

[js_12345678_55AA]

Also found this site...

==> BE CAREFUL, NOT SURE IF THE TOOL IS LEGIT <==

http://www.mcusky.com/uasm/product_u51.asp


But they list PADAUK CPU and have a asm listing with valid 16 bit opcode bytes. (Looks like somebody in China was faster than us).

Somebody has setup handy to try (virtual machine, network restricted, ...)?


JS

[FrankBuss]

I added some eyes to a metal owl with a PMS150C:



When the LED is dimmed, it needs about 300 uA, and when on about 2 mA. So the CR2032 batttery I used should last maybe at least a week.

The project file is attached. The PMS150C has no OTP ldtabl instruction, so I used a concept known from PICs: a lookup table with lots of "ret x" instructions, then calculating the address into this table, pushing it on stack and with a "ret" I jump into the table, returning the value I want. Needs some cycles, but not much space. Is there a better method? Getting the syntax right for the array etc. was not easy with the suboptimal documentation.

Interestingly with the ICE (in circuit emulator) it doesn't work, only when flashing the real chip. The ICE needs the switch-case part of the program. But I already contacted Padauk and they are looking into it.

[js_12345678_55AA]

Hi,

I think what you should use is the "PCADD" instructions. Your table lookup could look like this:

Code: [Select]

void LookUp_A(void)
{
    ADD A,1
    PCADD A
    RET 0x0F
    RET 0x1F
    RET 0x7F
    RET 0x00
}

...

    A = i;
    LookUp_A();
    tm2b = A;
...

One other important thing: PWM is NOT turned OFF when you write 0x00 to "tm2b".
The formula for duty cycle is: Duty of Output = [( K + 1 ) ÷ 256] × 100%  (you see the +1, oscilloscope also shows a small spike all the time)
So in order to save power you should turn off PWM instead.


JS

UPDATE:

I modified your program a bit to disable PWM output when there is "0" in the table. This should save some power.

Code: [Select]

void LookUp_A(void)
{
    //caller needs to make sure A is in range of 0-3
    ADD A,1
    PCADD A
    RET 0x0F
    RET 0x1F
    RET 0x7F
    RET 0x00
}

void FPPA0(void):stack=4
{
  .ADJUST_IC  SYSCLK=IHRC/32, IHRC=16MHz, VDD=3V, Bandgap=Off

  $ TM2S = 8BIT, /1, /1;             // 8-bit PWM, pre-scalar = 1, scalar = 1 (tm2s = 0b0_00_00000)

  while (1) {
    BYTE i = 0;
    while (1)
    {
      A = i;
      LookUp_A();
      if( 0==A )
        $ TM2C = STOP;
      else
      {
        TM2B = A;
        $ TM2C = SYSCLK, PA3, PWM;   // setup timer2 as pwm out: system clock (512kHz), output=PA3, PWM mode (tm2c = 0b0001_10_1_0)
      }
      i++;
      if (i == 4) break;
      .delay 40000;
    }
    .delay 1000000;
  }
}

To really save power the DELAYs should be done using a TIMER and STOPEXE mode. Then for sure your battery will last 3 months instead of 1 week.

UPDATE2:

I did several modifications to get a much better power efficiency:
- use ILRC/16 instead of IHRC
- disable IHRC
- use STOPEXE during the long 2 second sleep

Code: [Select]

void LookUp_A(void)                                  //caller needs to make sure A is in range of 0-3
{
  ADD A,1
  PCADD A
  RET 0x0F
  RET 0x1F
  RET 0x7F
  RET 0x00
}

void DeepSleep_2s(void)
{
  WORD sleep = 0;
  STT16 sleep

  INTRQ.T16 = 0;

  $ T16M = ILRC, /64, BIT11;                         //T16 clock source = ILRC (typ. 62 kHz on PMC150), / 64 => approx 1 kHz timer, 11BIT = 2048 => approx 2 seconds

  while( !INTRQ.T16 )                                //STOPEXE could be interrupted by multiple sources, we wait for T16 overflow here
    STOPEXE;

  $ T16M = STOP;
}

void FPPA0(void) : stack=2
{
  .ADJUST_IC  SYSCLK=ILRC (IHRC/16), IHRC=16MHz, VDD=3V, Bandgap=Off

#if _SYS (AT_ICE)
  $ CLKMD = ILRC/4, En_ILRC;                         // ICE does not support ILRC/16, so we use /4 instead
#else
  $ CLKMD = ILRC/16, En_ILRC;                        // use ILRC/16 as system clock (3.875kHz), turn off IHRC to save more power
#endif

  $ TM2S = 8BIT, /1, /1;                             // 8-bit PWM, pre-scalar = 1, scalar = 1 (tm2s = 0b0_00_00000)

  while (1)
  {
    BYTE i = 0;
    while (1)
    {
      A = i;
      LookUp_A();
      if( 0==A )
        $ TM2C = STOP;
      else
      {
        TM2B = A;
        $ TM2C = ILRC, PA3, PWM;             // setup timer2 as pwm out: clock ilrc (62kHz), output=PA3, PWM mode
      }
      i++;
      if (i == 4) break;
      .delay 300;
#if _SYS (AT_ICE)
      .delay 900;                                    // wait extra time since ICE clock is faster
#endif
    }
    DeepSleep_2s();
  }
}


[lucas.hartmann]

You really need ADD A, 1?

Not sure about padauk, but other microcontroller always have PC pointing to the next instruction, so PCADD zero behaves like NOP.

Enviado de meu SM-N910C usando o Tapatalk

[js_12345678_55AA]

You really need ADD A, 1?

Not sure about padauk, but other microcontroller always have PC pointing to the next instruction, so PCADD zero behaves like NOP.

Enviado de meu SM-N910C usando o Tapatalk

Yes really need the +1 for PCADD. Otherwise my program was jumping into nowhere, crashing (I think it adds 256 in the case of A=0, will need to investigate)

JS

[FrankBuss]

Thanks, good ideas. It is no problem for my program, but the pcadd wouldn't work with larger tables. But I could test for different 256 byte ranges, there is not much ROM anyway. PWM 0 with the short spike actually looks quite nice for the owl eyes in the dark, you can still see it slightly glowing.

[FrankBuss]

I think the programmer is a bit rudimentary with all these jumpers, or maybe I'm doing something wrong? I managed to program the PMS150C parts with SOT-23-6 package, but it was a bit complicated.

I got an SOT-23-6 to DIP 14 adapter from Padauk, see attached images top.jpg and bottom.jpg. The pinout is odd:

signal -	SOT-23-6 pin -	DIP 14 pin
PA4	1	9
GND	2	11
PA6	3	6
PA5	4	7
VDD	5	4
PA3	6	8

When I tried to program it, it didn't work, because when I create a project for the PMS150C, the package in the PDK file is S08. In the program writer user manual on page 21 it looks like you can configure for each pin individually the signal function, like PA6 or VDD. But this didn't work.

So I did the procedure defined in chapter 5 for creating a "connecting board". On page 16 in the user manual you can see the pinout of JP7. The user manual is not very clear, but looks like each pin of JP7 is connected to the ZIF socket on top, except for 4 pins of the socket: The 8 bottom pins are connected to the socket, then there are 4 unconnected pins on the socket, and then the top 28 pins of JP7 are connected again to the socket.

I defined my own "connecting board", as defined  in chapter 5 with JP7. The way you do this is to connect the 8 lower pins to your specific pinout. I did this, connecting the signals PA3, PA4, PA5, PA6, VDD, and GND from the bottom 8 pins to my DIP 14 layout on the top side with jumper wires. You can see this in the image jp7.jpg. PA7 and PA0 doesn't need to be connected, which means a minimal programmer might need at most 6 pins, but maybe less. Then I added the pin definitions in the PRE file in the IDE, as explained on page 19 of the writer user manual:

Code: [Select]

.writer package 14, 4, 32, 8, 9, 7, 6, 32, 11, 0x0000, 0x0000, 0

I had some problems with the open/short tests, but using 0x0000 for mask1 and mask2 worked without problems, which disables all tests on all pins.

After looking again at the adapter layout, the pinout looks exactly like the pinout of the PFS154-S14 chip. Maybe this would have saved me some time with the jumper wires, because I would have needed to define just the right writer package instruction, and could then use one of the pre-defined jumpers for S14 packages. Anyone who did this for the SOT-23-6 parts?

Why I think the programmer is rudimentary: It looks like the with the jumpers JP1 to JP7, the fixed 8 programmer signals are routed to the ZIF socket pins and you have to manually short the pins on the jumpers. For some jumpers like JP2, you get this jumper block, which connects all pins in parallel and the routing is done by the PCB layout, but depending on the package, you have to set individual jumpers, like with JP5. If you have the right connector board, or if your pinout is one of the pre-defined pinouts to use the existing jumpers, it is no problem for production. Just plugin the right jumper, and you can program your chips. But would be much better if it could be configured all in software, without the need to manually change jumpers.

There are already a bunch of 4051 analog multiplexers on the programmer board, but I guess they are used only for the open/short test and maybe chip identification, not to route the programming signals. Probably this would be a problem anyway, if it needs higher power, like when routing VDD and GND. But shouldn't break the bank to add two individual transistors for each pin for switching VDD and GND if necessary, at least up to SOP16. But there are some low resistance multiplexers ICs available as well, which would reduce this to like 4 ICs instead of 32 transistors. Just as an idea, if someone is planning to build an easy to use, universal Padauk chip programmer.

[socram]

Hi,

I finally got the time to use a logic analyzer (ZeroPlus Logic Cube LAP-C322000) to capture the writing of a program on a PFS154.
...

Hello. I have downloaded the PDK and decrypted it, and got the following:

Code: [Select]

00000000: 70 00 00 2f 82 01 ed 3f 8b 01 ee 3f 9a 01 80 2f  p../...?...?.../
00000010: 9b 01 1c 2f 83 01 fe 3f ff 2a 54 30 ed 3f 81 0b  .../...?.*T0.?..
00000020: 91 1f 05 2f 80 0b d0 1a 13 30 90 1f 63 00 16 30  .../.....0..c..0
00000030: 80 11 16 30 90 1d d0 18 1b 30 01 2f 50 19 ff 2f  ...0.....0./P../
00000040: 01 0c 8b 01 81 0b d0 1a 23 30 50 1b 4f 30 04 2f  ........#0P.O0./
00000050: 88 01 d0 18 29 30 02 2f 82 01 04 13 05 13 6e 2f  ....)0./......n/
00000060: 82 0b 00 2f 83 0b 06 00 04 0b 07 00 05 08 84 15  .../............
00000070: 85 16 04 10 82 12 83 10 40 1a 33 30 90 1f d0 1a  ........@.30....
00000080: 3f 30 84 15 85 16 90 05 d0 18 44 30 50 19 3f 30  ?0........D0P.?0
00000090: 90 1d d0 1a 49 30 d0 18 4b 30 50 1b 2b 30 d0 18  ....I0..K0P.+0..
000000a0: 4f 30 50 1b 11 30 53 30 8b 01 d1 1e d0 1e 03 2f  O0P..0S0......./
000000b0: c1 0b 8a 2f c0 0b 56 2f 63 00 5c 30 c0 11 5c 30  .../..V/c.\0..\0
000000c0: c1 11 5c 30 d0 1c 03 2f c1 0b 8a 2f c0 0b 56 2f  ..\0.../.../..V/
000000d0: 63 00 68 30 c0 11 68 30 c1 11 68 30 56 30 ff 3f  c.h0..h0..h0V0.?
000000e0: ff 3f ff 3f ff 3f ff 3f ff 3f ff 3f ff 3f ff 3f  .?.?.?.?.?.?.?.?
000000f0: ff 3f ff 3f ff 3f ff 3f ff 3f ff 3f ff 3f ff 3f  .?.?.?.?.?.?.?.?

I have also downloaded the text file and written a quick and dirty Python script (attached) for parsing PA6_ICPDA and PA3_ICPCK as SPI data and clock, respectively.

The output is:

Code: [Select]

      1009: 1010010110100101101001011010011000001010101000010
     55103: 1010010110100101101001011010011000011010101000010
     65685: 001111110111101111111111110000111111100000000000000001100011111110001000000000000111
     92201: 1010010110100101101001011010001100011010101000010
    112855: 0
    122857: 00
    132871: 0
    158597: 1010010110100101101001011010011001111010101000010
    737022: 1010010110100101101001011010011100001010101000010
    757693: 000000000001001111111111111111111111111111111111111111110011111110000000000000
    784240: 1010010110100101101001011010011000001010101000010
    820818: 1010010110100101101001011010011100001010101000010
    841488: 111111111111110000000000010011111111111111111111111111110011111110000000000000
    868054: 1010010110100101101001011010011000001010101000010
    904632: 1010010110100101101001011010011000001010101000010
    949230: 1010010110100101101001011010011000001010101000010
    969891: 00111111000001111111111111100011111100001011111111111110001111110001001111111111111100111111000110111111111111110011111100100111111111111111001111110010101111111111111100111111001100111111111111110011111100111011111111111111001111110100011111111111111100111111010010111111111111110011111101010011111111111111001111110101111111111111111100111111011001111111111111110011111101101000010100000011001111110111000001001111010100111111011110111111111111000011111110000000000000001000001111111000100000000000100100111111100101111111111111100011111110011111111111111110001111111010011111111111111100111111101011111111111111110011111110110111111111111111001111111011111111111111111100111111110000111111111111110011111111001111111111111111001111111101001111111111111100111111110111111111111111110011111111100011111111111111001111111110111111111111111100111111111100111111111111110011111111111111111111111111
   1004046: 1010010110100101101001011010011000011010101000010
   1589373: 1010010110100101101001011010011100011010101000010
   1620117: 000000011100001011110000000000000110000010111111111011010000000000000000000000000001100010111111111110111000000110011010101111100000000000000000100000000000000001100110111011110001110000000110000011111111111111100000000001000000000000101010111111111100000101010011111111101101001011100000010000000001100000000000011111100100011011110000010100101110000000011010110100000000000010000000000000110000000100110111111001000000000001100011110000000101100000000010100000000000010001100000001100000001011001110110010000011000110100000000000011000000000000110000000110111011110000000101100101010000101111111111110000000011100000000000001100000000010000011000101100101110000001011010110100000000000100000000000000110000001000110110110101000011000001001111101111000001000000000100100000000000000001100010000110001101000011000000101001101111000000100000000101000000000000000001100000100100110000010001001100000101101111011011100000000101100000000000001011100000101011110000000000101110000011000000000001100000000110000000000000001011000001000000000000011100100000000101010101100001000000000110100000000000010110100001010100000000010001001010000010010000100000110000000111000000000000011010010000001100000011001101111110010000011010110100000000000111100000000000110000001111110101011000010001011010000101000101100100000000001000000000000000011000110100001100000100010001100101010000110000001111110000001000100000000000011101100100000110101101000011000001001001011000110100000000001001000000000000110000010010110110110101000011000000101011011000110100000000001001100000000000110000010011110110110101000011000000010001110000010100110000001010000000000000000001100010110111101101000101111011010000101111000000110000001010100000000000001011110000011011111000101000101111000000101111010101100000001011000000000000000000011000111100000101110001000111000000110000010111000000001011100000000000010001110000011100000101110001110011010000101111000000110000001100000000000000001011110000011011111000101000101111000000101111010101100000001100100000000000000000011000111100000110100001000111000000110000011010000000001101000000000000010001110000011100000110100011000001010110111111111111110000001101100000000000
   1669266: 1010010110100101101001011010011100001010101000010
   1689953: 111111111111110000101000000100001001111010011111111111100011111101100000000000000000000001000000000000010011111111111111111111111111110011111110000000000000011000010100001111110101010011111111111111111111111111110011111111000000000000111111111111111111111111111100001011111111110001111111010011111111100000000000
   1746862: 1010010110100101101001011010011000001010101000010
   1767523: 00111111000001111111111111100011111100001111111111111110001111110001011111111111111100111111000111111111111111110011111100100111111111111111001111110010101111111111111100111111001101111111111111110011111100111011111111111111001111110100011111111111111100111111010010111111111111110011111101010111111111111111001111110101101111111111111100111111011001111111111111110011111101101000010100000011001111110111000001001111010100111111011110111111111111000011111110000000000000001000001111111000100000000000100100111111100101111111111111100011111110011111111111111110001111111010011111111111111100111111101011111111111111110011111110110111111111111111001111111011111111111111111100111111110000110000101000010011111111001111111010101001001111111101011111111111111100111111110111111111111111110011111111100011111111111111001111111110111111111111111100111111111100000101111111110011111111111110001111111011
   1801641: 1010010110100101101001011010011000011010101000010
   1832399: 0000000000000000000011100000000000000000110111100000000000000000000100000011000001000000000000011111111111011010000000000010000000110001011000000000001011111111110111010000000000110000001100110100000000000011110111110000000100000000010000000011001101100000000001001101111000111000000000000101000000110000011000000000010110111111111111000000000001100101010111111110000000000110101000001010100100000000011101111111110110100000000001111001011100000011000000001000001111110010001100000000100010011110000010100000000010010001011100000001000000001001101101011010000000000000101001100000001001100000000010101011111100100001000000001011000000001100011100000000101111100000001011010000000011000010001100000000000000001100101000000010110100000000110100111011001000010000000011011011000110100001000000001110001000000011011100000000111011011110000000110000000011110011001010100001000000001111110111111111111000000001000000011000000000110000000100001000001100010110000000010001000101110000001000000001000110110101101000000000000100100010000001000110000000010010101101101010000100000001001101100000100111110000000100111101111000001001000000010100000000110001000100000001010010110001101000000000000101010010000001010010000000010101110111100000010100000001011000000011000001010000000101101010011000001000000000010111001001100000101000000001011111011110110111010000000110000001011100000101000000011000110111100000000000000001100100010111000001100000000110011000000000001100000000011010000101100000100000000001101010000000000011100000000110110001000000001010000000011011101010110000100000000001110000101101000010100000000111001010000000001001000000011101001001010000010100000001110110100001000001110000000111100011010010000001000000011110111000000110011100000001111100111111001000010000000111111011010110100001000000100000011000000111111100000010000010101011000010010000001000010010110100001011000000100001100010110010000100000010001000110001101000010000001000101010000010001000000000100011001100101010000100000010001110100000011111110000001001000011101100100001000000100100101101011010000100000010010100100000100100110000001001011011000110100001000000100110011000001001011100000010011010110110101000010000001001110010000001010111000000100111101100011010000100000010100001100000100111110000001010001011011010100001000000101001001000000010001100000010100110100000101001110000001010100000001100010111000000101010101111011010001100000010101100111101101000000000001010111101111000000111000000101100000101111000001100000010110011011111000101000000001011010001011110000000000000101101110111101010110000000010111000000000110001100000001011101110000010111000000000101111001000111000000000000010111111100000101110010000001100000010001110000011000000110000111000001011100100000011000100111001101000010000001100011101111000000111000000110010000101111000001100000011001011011111000101000000001100110001011110000000000000110011110111101010110000000011010000000000110001100000001101001110000011010000000000110101001000111000000000000011010111100000110100010000001101100010001110000011000000110110111000001101000100000011011101100000101011010000001101111111111111111111
   1890615: 1010010110100101101001011010011000011010101000010
   1935310: 1010010110100101101001011010011000001010101000010
   2004366: 1010010110100101101001011010011100011010101000010
   2035112: 000000011100001011110000000000000110000010111111111011010000000000000000000000000001100010111111111110111000000110011010101111100000000000000000100000000000000001100110111011110001110000000110000011111111111111100000000001000000000000101010111111111100000101010011111111101101001011100000010000000001100000000000011111100100011011110000010100101110000000011010110100000000000010000000000000110000000100110111111001000000000001100011110000000101100000000010100000000000010001100000001100000001011001110110010000011000110100000000000011000000000000110000000110111011110000000101100101010000101111111111110000000011100000000000001100000000010000011000101100101110000001011010110100000000000100000000000000110000001000110110110101000011000001001111101111000001000000000100100000000000000001100010000110001101000011000000101001101111000000100000000101000000000000000001100000100100110000010001001100000101101111011011100000000101100000000000001011100000101011110000000000101110000011000000000001100000000110000000000000001011000001000000000000011100100000000101010101100001000000000110100000000000010110100001010100000000010001001010000010010000100000110000000111000000000000011010010000001100000011001101111110010000011010110100000000000111100000000000110000001111110101011000010001011010000101000101100100000000001000000000000000011000110100001100000100010001100101010000110000001111110000001000100000000000011101100100000110101101000011000001001001011000110100000000001001000000000000110000010010110110110101000011000000101011011000110100000000001001100000000000110000010011110110110101000011000000010001110000010100110000001010000000000000000001100010110111101101000101111011010000101111000000110000001010100000000000001011110000011011111000101000101111000000101111010101100000001011000000000000000000011000111100000101110001000111000000110000010111000000001011100000000000010001110000011100000101110001110011010000101111000000110000001100000000000000001011110000011011111000101000101111000000101111010101100000001100100000000000000000011000111100000110100001000111000000110000011010000000001101000000000000010001110000011100000110100011000001010110111111111111110000001101100000000000
   2110976: 0
   2223667: 00
   2230308: 00
   2237010: 0
   2277626: 1101001010001110
   2301113: 0
   2304898: 11010010100011100
   2333060: 0
   2445751: 00
   2452389: 00
   2459091: 0
   2489632: 1101001010001110
   2523220: 0
   2527007: 11010010100011100
   2584511: 1010010110100101101001011010011100001010101000010
   2605196: 111111111111110000101000000100001001111010011111111111100011111101100000000000000000000001000000000000010011111111111111111111111111110011111110000000000000011000010100001111110101010011111111111111111111111111110011111111000000000000111111111111111111111111111100001010000010110001111111010011111111100000000000
   2634228: 1010010110100101101001011010011000001010101000010
   2664969: 00111111000001111111111111100011111100001011111111111110001111110001001111111111111100111111000110111111111111110011111100100111111111111111001111110010101111111111111100111111001100111111111111110011111100111011111111111111001111110100011111111111111100111111010010111111111111110011111101010011111111111111001111110101101111111111111100111111011001111111111111110011111101101000010100000011001111110111000001001111010100111111011110111111111111000011111110000000000000001000001111111000100000000000100100111111100101111111111111100011111110011011111111111110001111111010011111111111111100111111101011111111111111110011111110110111111111111111001111111011111111111111111100111111110000110000101000010011111111001111111010101001001111111101011111111111111100111111110111111111111111110011111111100011111111111111001111111110111111111111111100111111111100000101000001010011111111111110001111111011
   2699086: 1010010110100101101001011010011000001010101000010
   2743782: 1010010110100101101001011010011100001010101000010
   2774546: 111111111111110000101000000100001001111010011111111111100011111101100000000000000000000001000000000000010011111111111111111111111111110011111110000000000000011000010100001111110101010011111111111111111111111111110011111111000000000000111111111111111111111111111100001010000010110001111111010011111111100000000000


The transmission at 1620117 (which matches 1:1 that at 2035112) with 22 bit frames between 4-word blocks:

Code: [Select]

Exec.bin: 00000001110000 10111100000000 00000110000010 11111111101101                        00000110001011 11111111101110 00000110011010 10111110000000                        00000110011011 10111100011100 00000110000011 11111111111110                        10101011111111 11000001010100 11111111101101 00101110000001                        01111110010001 10111100000101 00101110000000 01101011010000                        11000000010011 01111110010000 00000001100011 11000000010110                        01000110000000 11000000010110 01110110010000 01100011010000                        11000000011011 10111100000001 01100101010000 10111111111111                        00110000000001 00000110001011 00101110000001 01101011010000                        11000000100011 01101101010000 11000001001111 10111100000100                        00000110001000 01100011010000 11000000101001 10111100000010                        00000110000010 01001100000100 01001100000101 10111101101110                        00101110000010 10111100000000 00101110000011 00000000000110                        00101100000100 00000000000111 00100000000101 01010110000100                        01011010000101 01000000000100 01001010000010 01000010000011                        01101001000000 11000000110011 01111110010000 01101011010000                        11000000111111 01010110000100 01011010000101 00010110010000                        01100011010000 11000001000100 01100101010000 11000000111111                        01110110010000 01101011010000 11000001001001 01100011010000                        11000001001011 01101101010000 11000000101011 01100011010000                        11000001001111 01101101010000 11000000010001 11000001010011                        00000110001011 01111011010001 01111011010000 10111100000011                        00101111000001 10111110001010 00101111000000 10111101010110                        00000001100011 11000001011100 01000111000000 11000001011100                        01000111000001 11000001011100 01110011010000 10111100000011                        00101111000001 10111110001010 00101111000000 10111101010110                        00000001100011 11000001101000 01000111000000 11000001101000                        01000111000001 11000001101000 11000001010110 11111111111111                       
 1620117: 00000001110000 10111100000000 00000110000010 11111111101101 0000000000000000000000 00000110001011 11111111101110 00000110011010 10111110000000 0000000000100000000000 00000110011011 10111100011100 00000110000011 11111111111110 0000000001000000000000 10101011111111 11000001010100 11111111101101 00101110000001 0000000001100000000000 01111110010001 10111100000101 00101110000000 01101011010000 0000000010000000000000 11000000010011 01111110010000 00000001100011 11000000010110 0000000010100000000000 01000110000000 11000000010110 01110110010000 01100011010000 0000000011000000000000 11000000011011 10111100000001 01100101010000 10111111111111 0000000011100000000000 00110000000001 00000110001011 00101110000001 01101011010000 0000000100000000000000 11000000100011 01101101010000 11000001001111 10111100000100 0000000100100000000000 00000110001000 01100011010000 11000000101001 10111100000010 0000000101000000000000 00000110000010 01001100000100 01001100000101 10111101101110 0000000101100000000000 00101110000010 10111100000000 00101110000011 00000000000110 0000000110000000000000 00101100000100 00000000000111 00100000000101 01010110000100 0000000110100000000000 01011010000101 01000000000100 01001010000010 01000010000011 0000000111000000000000 01101001000000 11000000110011 01111110010000 01101011010000 0000000111100000000000 11000000111111 01010110000100 01011010000101 00010110010000 0000001000000000000000 01100011010000 11000001000100 01100101010000 11000000111111 0000001000100000000000 01110110010000 01101011010000 11000001001001 01100011010000 0000001001000000000000 11000001001011 01101101010000 11000000101011 01100011010000 0000001001100000000000 11000001001111 01101101010000 11000000010001 11000001010011 0000001010000000000000 00000110001011 01111011010001 01111011010000 10111100000011 0000001010100000000000 00101111000001 10111110001010 00101111000000 10111101010110 0000001011000000000000 00000001100011 11000001011100 01000111000000 11000001011100 0000001011100000000000 01000111000001 11000001011100 01110011010000 10111100000011 0000001100000000000000 00101111000001 10111110001010 00101111000000 10111101010110 0000001100100000000000 00000001100011 11000001101000 01000111000000 11000001101000 0000001101000000000000 01000111000001 11000001101000 11000001010110 11111111111111 0000001101100000000000
It looks like it's loading 4 words, then sending the address to where it must be flashed to.

[js_12345678_55AA]

Hello @socram,

this is fantastic work :-)

Meanwhile I added two 8 bit channel which capture analog voltages as well.

I measured and normalized the analog conversion so the decimal decoded 8 bit value is voltage in 100mv step (e.g. 30 = 3.0V , 65 = 6.5V , ... )

I also found out that you can download and use the logic analyzer software without a real hardware in "DEMO-Mode"
Download: LAP-C V3.14.06 2018-11-19 : http://bd.zeroplus.com.tw/www/lac_s31406_all.zip
==> Select "LAP-C32000" as demo device.

Now I can share the captures directly (much smaller size) and you still can export them to text ("File->Export->Waveform...").


I also did some more captures (I just pressed all buttons in Writer GUI which started an operation):

- PADAUK-P-003-PFS154_SimpleBlink_NoPinCheck_Bus_AVDD_Program (erase,write,calibrate)

- PADAUK-P-003-PFS154_SimpleBlink_NoPinCheck_Bus_AVDD_Verify

- PADAUK-P-003-PFS154_SimpleBlink_NoPinCheck_Bus_AVDD_BlankCheck (was not blank, was programmed properly with SimpleBlink PDK before)

- PADAUK-P-003-PFS154_SimpleBlink_NoPinCheck_Bus_AVDD_ReadSearch

NOTE:
Since the analog channel used a bit of the analyzer memory some captures are in chunks (pages). So when you see _P1, _P2, ... means they need to be stitched together (not sure where exactly need to stitch, maybe the 1% pre trigger is applied to the following pages as well and some values might be doubled)

JS

[socram]

I have improved a bit the Python script and now the logs are much clear. Instead of expecting a fixed time between transmissions, it uses the VDD signal to detect power cycling:

Code: [Select]

      1009       : 1010010110100101101001011010011000001010101000010
     55103   READ: 1010010110100101101001011010011000011010101000010 001111110111101111111111110000111111100000000000000001100011111110001000000000000111
     92201       : 1010010110100101101001011010001100011010101000010 0000
    158597       : 1010010110100101101001011010011001111010101000010
    737022       : 1010010110100101101001011010011100001010101000010 000000000001001111111111111111111111111111111111111111110011111110000000000000
    784240       : 1010010110100101101001011010011000001010101000010
    820818       : 1010010110100101101001011010011100001010101000010 111111111111110000000000010011111111111111111111111111110011111110000000000000
    868054       : 1010010110100101101001011010011000001010101000010
    904632       : 1010010110100101101001011010011000001010101000010
    949230       : 1010010110100101101001011010011000001010101000010 00111111000001111111111111100011111100001011111111111110001111110001001111111111111100111111000110111111111111110011111100100111111111111111001111110010101111111111111100111111001100111111111111110011111100111011111111111111001111110100011111111111111100111111010010111111111111110011111101010011111111111111001111110101111111111111111100111111011001111111111111110011111101101000010100000011001111110111000001001111010100111111011110111111111111000011111110000000000000001000001111111000100000000000100100111111100101111111111111100011111110011111111111111110001111111010011111111111111100111111101011111111111111110011111110110111111111111111001111111011111111111111111100111111110000111111111111110011111111001111111111111111001111111101001111111111111100111111110111111111111111110011111111100011111111111111001111111110111111111111111100111111111100111111111111110011111111111111111111111111
   1004046   READ: 1010010110100101101001011010011000011010101000010
   1589373  WRITE: 1010010110100101101001011010011100011010101000010 000000011100001011110000000000000110000010111111111011010000000000000000000000000001100010111111111110111000000110011010101111100000000000000000100000000000000001100110111011110001110000000110000011111111111111100000000001000000000000101010111111111100000101010011111111101101001011100000010000000001100000000000011111100100011011110000010100101110000000011010110100000000000010000000000000110000000100110111111001000000000001100011110000000101100000000010100000000000010001100000001100000001011001110110010000011000110100000000000011000000000000110000000110111011110000000101100101010000101111111111110000000011100000000000001100000000010000011000101100101110000001011010110100000000000100000000000000110000001000110110110101000011000001001111101111000001000000000100100000000000000001100010000110001101000011000000101001101111000000100000000101000000000000000001100000100100110000010001001100000101101111011011100000000101100000000000001011100000101011110000000000101110000011000000000001100000000110000000000000001011000001000000000000011100100000000101010101100001000000000110100000000000010110100001010100000000010001001010000010010000100000110000000111000000000000011010010000001100000011001101111110010000011010110100000000000111100000000000110000001111110101011000010001011010000101000101100100000000001000000000000000011000110100001100000100010001100101010000110000001111110000001000100000000000011101100100000110101101000011000001001001011000110100000000001001000000000000110000010010110110110101000011000000101011011000110100000000001001100000000000110000010011110110110101000011000000010001110000010100110000001010000000000000000001100010110111101101000101111011010000101111000000110000001010100000000000001011110000011011111000101000101111000000101111010101100000001011000000000000000000011000111100000101110001000111000000110000010111000000001011100000000000010001110000011100000101110001110011010000101111000000110000001100000000000000001011110000011011111000101000101111000000101111010101100000001100100000000000000000011000111100000110100001000111000000110000011010000000001101000000000000010001110000011100000110100011000001010110111111111111110000001101100000000000
   1669266       : 1010010110100101101001011010011100001010101000010 111111111111110000101000000100001001111010011111111111100011111101100000000000000000000001000000000000010011111111111111111111111111110011111110000000000000011000010100001111110101010011111111111111111111111111110011111111000000000000111111111111111111111111111100001011111111110001111111010011111111100000000000
   1746862       : 1010010110100101101001011010011000001010101000010 00111111000001111111111111100011111100001111111111111110001111110001011111111111111100111111000111111111111111110011111100100111111111111111001111110010101111111111111100111111001101111111111111110011111100111011111111111111001111110100011111111111111100111111010010111111111111110011111101010111111111111111001111110101101111111111111100111111011001111111111111110011111101101000010100000011001111110111000001001111010100111111011110111111111111000011111110000000000000001000001111111000100000000000100100111111100101111111111111100011111110011111111111111110001111111010011111111111111100111111101011111111111111110011111110110111111111111111001111111011111111111111111100111111110000110000101000010011111111001111111010101001001111111101011111111111111100111111110111111111111111110011111111100011111111111111001111111110111111111111111100111111111100000101111111110011111111111110001111111011
   1801641   READ: 1010010110100101101001011010011000011010101000010 0000000000000000000011100000000000000000110111100000000000000000000100000011000001000000000000011111111111011010000000000010000000110001011000000000001011111111110111010000000000110000001100110100000000000011110111110000000100000000010000000011001101100000000001001101111000111000000000000101000000110000011000000000010110111111111111000000000001100101010111111110000000000110101000001010100100000000011101111111110110100000000001111001011100000011000000001000001111110010001100000000100010011110000010100000000010010001011100000001000000001001101101011010000000000000101001100000001001100000000010101011111100100001000000001011000000001100011100000000101111100000001011010000000011000010001100000000000000001100101000000010110100000000110100111011001000010000000011011011000110100001000000001110001000000011011100000000111011011110000000110000000011110011001010100001000000001111110111111111111000000001000000011000000000110000000100001000001100010110000000010001000101110000001000000001000110110101101000000000000100100010000001000110000000010010101101101010000100000001001101100000100111110000000100111101111000001001000000010100000000110001000100000001010010110001101000000000000101010010000001010010000000010101110111100000010100000001011000000011000001010000000101101010011000001000000000010111001001100000101000000001011111011110110111010000000110000001011100000101000000011000110111100000000000000001100100010111000001100000000110011000000000001100000000011010000101100000100000000001101010000000000011100000000110110001000000001010000000011011101010110000100000000001110000101101000010100000000111001010000000001001000000011101001001010000010100000001110110100001000001110000000111100011010010000001000000011110111000000110011100000001111100111111001000010000000111111011010110100001000000100000011000000111111100000010000010101011000010010000001000010010110100001011000000100001100010110010000100000010001000110001101000010000001000101010000010001000000000100011001100101010000100000010001110100000011111110000001001000011101100100001000000100100101101011010000100000010010100100000100100110000001001011011000110100001000000100110011000001001011100000010011010110110101000010000001001110010000001010111000000100111101100011010000100000010100001100000100111110000001010001011011010100001000000101001001000000010001100000010100110100000101001110000001010100000001100010111000000101010101111011010001100000010101100111101101000000000001010111101111000000111000000101100000101111000001100000010110011011111000101000000001011010001011110000000000000101101110111101010110000000010111000000000110001100000001011101110000010111000000000101111001000111000000000000010111111100000101110010000001100000010001110000011000000110000111000001011100100000011000100111001101000010000001100011101111000000111000000110010000101111000001100000011001011011111000101000000001100110001011110000000000000110011110111101010110000000011010000000000110001100000001101001110000011010000000000110101001000111000000000000011010111100000110100010000001101100010001110000011000000110110111000001101000100000011011101100000101011010000001101111111111111111111
   1890615   READ: 1010010110100101101001011010011000011010101000010
   1935310       : 1010010110100101101001011010011000001010101000010
   2004366  WRITE: 1010010110100101101001011010011100011010101000010 000000011100001011110000000000000110000010111111111011010000000000000000000000000001100010111111111110111000000110011010101111100000000000000000100000000000000001100110111011110001110000000110000011111111111111100000000001000000000000101010111111111100000101010011111111101101001011100000010000000001100000000000011111100100011011110000010100101110000000011010110100000000000010000000000000110000000100110111111001000000000001100011110000000101100000000010100000000000010001100000001100000001011001110110010000011000110100000000000011000000000000110000000110111011110000000101100101010000101111111111110000000011100000000000001100000000010000011000101100101110000001011010110100000000000100000000000000110000001000110110110101000011000001001111101111000001000000000100100000000000000001100010000110001101000011000000101001101111000000100000000101000000000000000001100000100100110000010001001100000101101111011011100000000101100000000000001011100000101011110000000000101110000011000000000001100000000110000000000000001011000001000000000000011100100000000101010101100001000000000110100000000000010110100001010100000000010001001010000010010000100000110000000111000000000000011010010000001100000011001101111110010000011010110100000000000111100000000000110000001111110101011000010001011010000101000101100100000000001000000000000000011000110100001100000100010001100101010000110000001111110000001000100000000000011101100100000110101101000011000001001001011000110100000000001001000000000000110000010010110110110101000011000000101011011000110100000000001001100000000000110000010011110110110101000011000000010001110000010100110000001010000000000000000001100010110111101101000101111011010000101111000000110000001010100000000000001011110000011011111000101000101111000000101111010101100000001011000000000000000000011000111100000101110001000111000000110000010111000000001011100000000000010001110000011100000101110001110011010000101111000000110000001100000000000000001011110000011011111000101000101111000000101111010101100000001100100000000000000000011000111100000110100001000111000000110000011010000000001101000000000000010001110000011100000110100011000001010110111111111111110000001101100000000000
   2110976       : 0000001101001010001110011010010100011100
   2333060       : 0000001101001010001110011010010100011100
   2584511       : 1010010110100101101001011010011100001010101000010 111111111111110000101000000100001001111010011111111111100011111101100000000000000000000001000000000000010011111111111111111111111111110011111110000000000000011000010100001111110101010011111111111111111111111111110011111111000000000000111111111111111111111111111100001010000010110001111111010011111111100000000000
   2634228       : 1010010110100101101001011010011000001010101000010 00111111000001111111111111100011111100001011111111111110001111110001001111111111111100111111000110111111111111110011111100100111111111111111001111110010101111111111111100111111001100111111111111110011111100111011111111111111001111110100011111111111111100111111010010111111111111110011111101010011111111111111001111110101101111111111111100111111011001111111111111110011111101101000010100000011001111110111000001001111010100111111011110111111111111000011111110000000000000001000001111111000100000000000100100111111100101111111111111100011111110011011111111111110001111111010011111111111111100111111101011111111111111110011111110110111111111111111001111111011111111111111111100111111110000110000101000010011111111001111111010101001001111111101011111111111111100111111110111111111111111110011111111100011111111111111001111111110111111111111111100111111111100000101000001010011111111111110001111111011
   2699086       : 1010010110100101101001011010011000001010101000010
   2743782       : 1010010110100101101001011010011100001010101000010 111111111111110000101000000100001001111010011111111111100011111101100000000000000000000001000000000000010011111111111111111111111111110011111110000000000000011000010100001111110101010011111111111111111111111111110011111111000000000000111111111111111111111111111100001010000010110001111111010011111111100000000000

1589373 is now the program sequence (which also appears at 2004366 - they are still 1:1 identical, not sure why is it downloading the code twice).

I am downloading the software to export to TXT and run them through the script to find simmilarities, but it's still downloading (and will probably take a few hours - is this 2001?)

I wonder what's with 2110976 and 2333060, as they are not following the format of the rest - maybe it's something running on the microcontroller?

EDIT: It looks like 1801641 could be either read or verify:

Code: [Select]

COMMAND:
1010010110100101101001011010011000011010101000010

ADDRESS       DATA           ?
0000000000000 00000001110000 0
0000000000001 10111100000000 0
0000000000010 00000110000010 0
0000000000011 11111111101101 0
0000000000100 00000110001011 0
0000000000101 11111111101110 1
0000000000110 00000110011010 0
0000000000111 10111110000000 1
0000000001000 00000110011011 0
0000000001001 10111100011100 0
0000000001010 00000110000011 0
0000000001011 01111111111110 0
0000000001100 10101011111111 0
0000000001101 01000001010100 1
0000000001110 11111111101101 0
0000000001111 00101110000001 1
0000000010000 01111110010001 1
0000000010001 00111100000101 0
0000000010010 00101110000000 1
0000000010011 01101011010000 0
0000000010100 11000000010011 0
0000000010101 01111110010000 1
0000000010110 00000001100011 1
0000000010111 11000000010110 1
0000000011000 01000110000000 0
0000000011001 01000000010110 1
0000000011010 01110110010000 1
0000000011011 01100011010000 1
0000000011100 01000000011011 1
0000000011101 10111100000001 1
0000000011110 01100101010000 1
0000000011111 10111111111111 0
0000000100000 00110000000001 1
0000000100001 00000110001011 0
0000000100010 00101110000001 0
0000000100011 01101011010000 0
0000000100100 01000000100011 0
0000000100101 01101101010000 1
0000000100110 11000001001111 1
0000000100111 10111100000100 1
0000000101000 00000110001000 1
0000000101001 01100011010000 0
0000000101010 01000000101001 0
0000000101011 10111100000010 1
0000000101100 00000110000010 1
0000000101101 01001100000100 0
0000000101110 01001100000101 0
0000000101111 10111101101110 1
0000000110000 00101110000010 1
0000000110001 10111100000000 0
0000000110010 00101110000011 0
0000000110011 00000000000110 0
0000000110100 00101100000100 0
0000000110101 00000000000111 0
0000000110110 00100000000101 0
0000000110111 01010110000100 0
0000000111000 01011010000101 0
0000000111001 01000000000100 1
0000000111010 01001010000010 1
0000000111011 01000010000011 1
0000000111100 01101001000000 1
0000000111101 11000000110011 1
0000000111110 01111110010000 1
0000000111111 01101011010000 1
0000001000000 11000000111111 1
0000001000001 01010110000100 1
0000001000010 01011010000101 1
0000001000011 00010110010000 1
0000001000100 01100011010000 1
0000001000101 01000001000100 0
0000001000110 01100101010000 1
0000001000111 01000000111111 1
0000001001000 01110110010000 1
0000001001001 01101011010000 1
0000001001010 01000001001001 1
0000001001011 01100011010000 1
0000001001100 11000001001011 1
0000001001101 01101101010000 1
0000001001110 01000000101011 1
0000001001111 01100011010000 1
0000001010000 11000001001111 1
0000001010001 01101101010000 1
0000001010010 01000000010001 1
0000001010011 01000001010011 1
0000001010100 00000110001011 1
0000001010101 01111011010001 1
0000001010110 01111011010000 0
0000001010111 10111100000011 1
0000001011000 00101111000001 1
0000001011001 10111110001010 0
0000001011010 00101111000000 0
0000001011011 10111101010110 0
0000001011100 00000001100011 0
0000001011101 11000001011100 0
0000001011110 01000111000000 0
0000001011111 11000001011100 1
0000001100000 01000111000001 1
0000001100001 11000001011100 1
0000001100010 01110011010000 1
0000001100011 10111100000011 1
0000001100100 00101111000001 1
0000001100101 10111110001010 0
0000001100110 00101111000000 0
0000001100111 10111101010110 0
0000001101000 00000001100011 0
0000001101001 11000001101000 0
0000001101010 01000111000000 0
0000001101011 11000001101000 1
0000001101100 01000111000001 1
0000001101101 11000001101000 1
0000001101110 11000001010110 1
0000001101111 11111111111111 1

I am not sure what the last bit could be, but the "data" is 1:1 the binary code that had just been programmed previously in the flash.

EDIT2: If that is indeed READ, then 55103 would be also reading 1FFE 0003 0003 from address 0x7EF

Code: [Select]

COMMAND:
1010010110100101101001011010011000011010101000010

ADDRESS       DATA           ?
0011111101111 01111111111110 0
0011111110000 00000000000011 0
0011111110001 00000000000011 1

[js_12345678_55AA]

I wonder what's with 2110976 and 2333060, as they are not following the format of the rest - maybe it's something running on the microcontroller?

This is calibration discussed earlier in this thread with full disassembly.

I am not sure what the last bit could be, but the "data" is 1:1 the binary code that had just been programmed previously in the flash.

In case of READ/VERIFY/... the direction of CLK and DAT need to change:
begin (sending command): WRITER output: CLK/DAT, IC = input
after command (receive data): WRITER disables output of CLK/DAT and switches to input, IC = output

During this transition it looks like a "CLK" is generated which is in fact ignored by both sides (both sides are switching input/output of CLK/DAT). Saw this during writing.

If there is no switch of modes in the read command it also might be a PARITY bit?

JS

[socram]

I am not sure. I had also thought of the parity bit, but it doesn't seem to make sense (for example, because it stays as 1 when one bit in the address or data is flipped). I had also tried sampling on the falling edge but again, it didn't make any sense.

Other files:

PADAUK-P-003-PFS154_SimpleBlink_NoPinCheck_Bus_AVDD_BlankCheck.txt

Code: [Select]

      1207: FLASH_READ_1
            No data (dummy read)

     27385: FLASH_READ_2
            No data (dummy read)

     72043: FLASH_READ_2

            ADDR DATA ?
            -----------
            07E0 3FFF 0
            07E1 3FFF 0
            07E2 3FFF 1
            07E3 1FFF 1
            07E4 3FFF 1
            07E5 1FFF 1
            07E6 1FFF 1
            07E7 1FFF 1
            07E8 3FFF 1
            07E9 1FFF 1
            07EA 1FFF 1
            07EB 1FFF 1
            07EC 3FFF 1
            07ED 0281 1
            07EE 027A 1
            07EF 1FFE 0
            07F0 0025 0
            07F1 0025 1
            07F2 3FFF 0
            07F3 1FFF 0
            07F4 3FFF 1
            07F5 1FFF 1
            07F6 3FFF 1
            07F7 1FFF 1
            07F8 1850 1
            07F9 3F54 1
            07FA 3FFF 1
            07FB 3FFF 1
            07FC 1FFF 1
            07FD 3FFF 1
            07FE 0282 1
            07FF 31FD 1

    126900: FLASH_READ_2
            No data (dummy read)



PADAUK-P-003-PFS154_SimpleBlink_NoPinCheck_Bus_AVDD_Program_P1.txt

Code: [Select]

      1209: FLASH_READ_B
            No data (dummy read)

     55304: FLASH_READ_B

            ADDR DATA ?
            -----------
            07EF 1FFE 0
            07F0 0021 0
            07F1 0021 1

    102483: ??? (1010010110100101101001011010001100001010101000010)

    178976: ??? (1010010110100101101001011010011001111010101000010)

    747185: FLASH_WRITE

            ADDR -W1- -W2- -W3- -W4-
            ------------------------
            07F0 0022 3FFF 3FFF 3FFF


    794400: FLASH_READ_A
            No data (dummy read)

    830958: ??? (1010010110100101101001011010011100001010101000010)

    878196: FLASH_READ_B
            No data (dummy read)

    914794: FLASH_READ_A
            No data (dummy read)

    959391: FLASH_READ_B

            ADDR DATA ?
            -----------
            07E0 3FFF 0
            07E1 3FFF 0
            07E2 3FFF 1
            07E3 3FFF 1
            07E4 3FFF 1
            07E5 3FFF 1
            07E6 3FFF 1
            07E7 3FFF 1
            07E8 3FFF 1
            07E9 3FFF 1
            07EA 3FFF 1
            07EB 3FFF 1
            07EC 3FFF 1
            07ED 0281 1
            07EE 027A 1
            07EF 1FFE 0
            07F0 0022 0
            07F1 0022 1
            07F2 3FFF 0
            07F3 1FFF 0
            07F4 3FFF 1
            07F5 1FFF 1
            07F6 1FFF 1
            07F7 1FFF 1
            07F8 3FFF 1
            07F9 1FFF 1
            07FA 1FFF 1
            07FB 1FFF 1
            07FC 3FFF 1
            07FD 1FFF 1
            07FE 3FFF 1
            07FF 3FFF 1

   1014210: FLASH_READ_B
            No data (dummy read)


PADAUK-P-003-PFS154_SimpleBlink_NoPinCheck_Bus_AVDD_Verify

Code: [Select]

      1209: FLASH_READ_B
            No data (dummy read)

     27386: FLASH_READ_B
            No data (dummy read)

     72043: FLASH_READ_A

            ADDR DATA ?
            -----------
            07E0 1FFF 0
            07E1 1FFF 0
            07E2 3FFF 1
            07E3 3FFF 1
            07E4 3FFF 1
            07E5 3FFF 1
            07E6 1FFF 1
            07E7 3FFF 1
            07E8 1FFF 1
            07E9 3FFF 1
            07EA 1FFF 1
            07EB 3FFF 1
            07EC 1FFF 1
            07ED 0281 1
            07EE 027A 1
            07EF 1FFE 0
            07F0 001F 0
            07F1 001F 1
            07F2 3FFF 0
            07F3 3FFF 0
            07F4 3FFF 1
            07F5 3FFF 1
            07F6 3FFF 1
            07F7 3FFF 1
            07F8 1850 1
            07F9 3F54 1
            07FA 3FFF 1
            07FB 3FFF 1
            07FC 3FFF 1
            07FD 3FFF 1
            07FE 0282 1
            07FF 31FD 1

    136979: FLASH_READ_A
            No data (dummy read)

    695006: FLASH_READ_B

            ADDR DATA ?
            -----------
            07E0 3FFF 0
            07E1 1FFF 0
            07E2 1FFF 1
            07E3 1FFF 1
            07E4 3FFF 1
            07E5 1FFF 1
            07E6 1FFF 1
            07E7 1FFF 1
            07E8 3FFF 1
            07E9 1FFF 1
            07EA 1FFF 1
            07EB 1FFF 1
            07EC 3FFF 1
            07ED 0281 1
            07EE 027A 1
            07EF 1FFE 0
            07F0 001F 0
            07F1 001F 1
            07F2 3FFF 0
            07F3 1FFF 0
            07F4 3FFF 1
            07F5 1FFF 1
            07F6 3FFF 1
            07F7 3FFF 1
            07F8 1850 1
            07F9 3F54 1
            07FA 3FFF 1
            07FB 3FFF 1
            07FC 1FFF 1
            07FD 3FFF 1
            07FE 0282 1
            07FF 31FD 1

    749723: FLASH_READ_B

            ADDR DATA ?
            -----------
            07E0 3FFF 0
            07E1 1FFF 0
            07E2 1FFF 1
            07E3 1FFF 1
            07E4 3FFF 1
            07E5 1FFF 1
            07E6 3FFF 1
            07E7 3FFF 1
            07E8 3FFF 1
            07E9 3FFF 1
            07EA 3FFF 1
            07EB 3FFF 1
            07EC 3FFF 1
            07ED 0281 1
            07EE 027A 1
            07EF 1FFE 0
            07F0 001F 0
            07F1 001F 1
            07F2 3FFF 0
            07F3 3FFF 0
            07F4 1FFF 1
            07F5 3FFF 1
            07F6 1FFF 1
            07F7 3FFF 1
            07F8 1850 1
            07F9 3F54 1
            07FA 3FFF 1
            07FB 3FFF 1
            07FC 1FFF 1
            07FD 3FFF 1
            07FE 0282 1
            07FF 31FD 1

    804580: FLASH_READ_A

            ADDR DATA ?
            -----------
            0000 0070 0
            0001 2F00 0
            0002 0182 0
            0003 3FED 0
            0004 018B 0
            0005 3FEE 1
            0006 019A 0
            0007 2F80 1
            0008 019B 0
            0009 2F1C 0
            000A 0183 0
            000B 3FFE 0
            000C 0AFF 0
            000D 3054 1
            000E 1FED 0
            000F 0B81 1
            0010 1F91 1
            0011 2F05 0
            0012 0B80 1
            0013 1AD0 0
            0014 3013 0
            0015 1F90 1
            0016 0063 1
            0017 3016 1
            0018 1180 0
            0019 3016 1
            001A 1D90 1
            001B 18D0 1
            001C 301B 1
            001D 2F01 1
            001E 1950 1
            001F 2FFF 0
            0020 0C01 1
            0021 018B 0
            0022 0B81 0
            0023 1AD0 0
            0024 3023 0
            0025 1B50 1
            0026 304F 1
            0027 2F04 1
            0028 0188 1
            0029 18D0 0
            002A 3029 0
            002B 0F02 1
            002C 0182 1
            002D 1304 0
            002E 1305 0
            002F 0F6E 1
            0030 0B82 1
            0031 0F00 0
            0032 0B83 0
            0033 0006 0
            0034 0B04 0
            0035 0007 0
            0036 0805 0
            0037 1584 0
            0038 1685 0
            0039 1004 1
            003A 1282 1
            003B 1083 1
            003C 1A40 1
            003D 3033 1
            003E 1F90 1
            003F 1AD0 1
            0040 303F 1
            0041 1584 1
            0042 1685 1
            0043 0590 1
            0044 18D0 1
            0045 3044 0
            0046 1950 1
            0047 303F 1
            0048 1D90 1
            0049 1AD0 1
            004A 3049 1
            004B 18D0 1
            004C 104B 1
            004D 1B50 1
            004E 302B 1
            004F 18D0 1
            0050 104F 1
            0051 1B50 1
            0052 3011 1
            0053 3053 1
            0054 018B 1
            0055 1ED1 1
            0056 1ED0 0
            0057 2F03 1
            0058 0BC1 1
            0059 2F8A 0
            005A 0BC0 0
            005B 2F56 0
            005C 0063 0
            005D 305C 0
            005E 11C0 0
            005F 305C 1
            0060 11C1 1
            0061 305C 1
            0062 1CD0 1
            0063 2F03 1
            0064 0BC1 1
            0065 2F8A 0
            0066 0BC0 0
            0067 2F56 0
            0068 0063 0
            0069 1068 0
            006A 11C0 0
            006B 3068 1
            006C 11C1 1
            006D 3068 1
            006E 1056 1
            006F 1FFF 1
            0070 3FFF 1
            0071 1FFF 1
            0072 3FFF 1
            0073 1FFF 1
            0074 3FFF 1
            0075 1FFF 1
            0076 3FFF 1
            0077 1FFF 1
            0078 3FFF 1
            0079 1FFF 1
            007A 3FFF 1
            007B 1FFF 1
            007C 3FFF 1
            007D 1FFF 1
            007E 3FFF 1
            007F 3FFF 1
            0080 1FFF 1
            0081 3FFF 1
            0082 1FFF 1
            0083 3FFF 1
            0084 1FFF 1
            0085 3FFF 1
            0086 1FFF 1
            0087 3FFF 1
            0088 1FFF 1
            0089 3FFF 1
            008A 3FFF 1
            008B 3FFF 1
            008C 1FFF 1
            008D 3FFF 1
            008E 3FFF 1
            008F 3FFF 1
            0090 1FFF 1
            0091 3FFF 1
            0092 3FFF 1
            0093 3FFF 1
            0094 1FFF 1
            0095 3FFF 1
            0096 3FFF 1
            0097 3FFF 1
            0098 3FFF 1
            0099 3FFF 1
            009A 3FFF 1
            009B 3FFF 1
            009C 3FFF 1
            009D 3FFF 1
            009E 3FFF 1
            009F 3FFF 1
            00A0 3FFF 1
            00A1 3FFF 1
            00A2 3FFF 1
            00A3 3FFF 1
            00A4 3FFF 1
            00A5 3FFF 1
            00A6 3FFF 1
            00A7 3FFF 1
            00A8 3FFF 1
            00A9 3FFF 1
            00AA 3FFF 1
            00AB 3FFF 1
            00AC 3FFF 1
            00AD 3FFF 1
            00AE 3FFF 1
            00AF 1FFF 1
            00B0 3FFF 1
            00B1 1FFF 1
            00B2 1FFF 1
            00B3 1FFF 1
            00B4 3FFF 1
            00B5 1FFF 1
            00B6 1FFF 1
            00B7 1FFF 1
            00B8 3FFF 1
            00B9 1FFF 1
            00BA 1FFF 1
            00BB 1FFF 1
            00BC 3FFF 1
            00BD 1FFF 1
            00BE 1FFF 1
            00BF 3FFF 1
            00C0 1FFF 1
            00C1 1FFF 1
            00C2 1FFF 1
            00C3 3FFF 1
            00C4 1FFF 1
            00C5 3FFF 1
            00C6 1FFF 1
            00C7 3FFF 1
            00C8 1FFF 1
            00C9 3FFF 1
            00CA 3FFF 1
            00CB 3FFF 1
            00CC 1FFF 1
            00CD 3FFF 1
            00CE 3FFF 1
            00CF 3FFF 1
            00D0 1FFF 1
            00D1 3FFF 1
            00D2 3FFF 1
            00D3 3FFF 1
            00D4 1FFF 1
            00D5 3FFF 1
            00D6 3FFF 1
            00D7 3FFF 1
            00D8 1FFF 1
            00D9 3FFF 1
            00DA 3FFF 1
            00DB 3FFF 1
            00DC 3FFF 1
            00DD 3FFF 1
            00DE 3FFF 1
            00DF 3FFF 1
            00E0 3FFF 1
            00E1 3FFF 1
            00E2 3FFF 1
            00E3 3FFF 1
            00E4 3FFF 1
            00E5 3FFF 1
            00E6 3FFF 1
            00E7 3FFF 1
            00E8 3FFF 1
            00E9 3FFF 1
            00EA 3FFF 1
            00EB 3FFF 1
            00EC 3FFF 1
            00ED 3FFF 1
            00EE 3FFF 1
            00EF 3FFF 1
            00F0 3FFF 1
            00F1 1FFF 1
            00F2 1FFF 1
            00F3 1FFF 1
            00F4 3FFF 1
            00F5 1FFF 1
            00F6 1FFF 1
            00F7 1FFF 1
            00F8 3FFF 1
            00F9 1FFF 1
            00FA 1FFF 1
            00FB 1FFF 1
            00FC 3FFF 1
            00FD 1FFF 1
            00FE 1FFF 1
            00FF 1FFF 1
            0100 1FFF 1
            0101 1FFF 1
            0102 1FFF 1
            0103 1FFF 1
            0104 1FFF 1
            0105 3FFF 1
            0106 1FFF 1
            0107 3FFF 1
            0108 3FFF 1
            0109 3FFF 1
            010A 3FFF 1
            010B 3FFF 1
            010C 1FFF 1
            010D 3FFF 1
            010E 3FFF 1
            010F 3FFF 1
            0110 1FFF 1
            0111 3FFF 1
            0112 3FFF 1
            0113 3FFF 1
            0114 1FFF 1
            0115 3FFF 1
            0116 3FFF 1
            0117 3FFF 1
            0118 1FFF 1
            0119 3FFF 1
            011A 3FFF 1
            011B 3FFF 1
            011C 3FFF 1
            011D 3FFF 1
            011E 3FFF 1
            011F 3FFF 1
            0120 3FFF 1
            0121 3FFF 1
            0122 3FFF 1
            0123 3FFF 1
            0124 3FFF 1
            0125 3FFF 1
            0126 3FFF 1
            0127 3FFF 1
            0128 3FFF 1
            0129 3FFF 1
            012A 3FFF 1
            012B 3FFF 1
            012C 3FFF 1
            012D 3FFF 1
            012E 3FFF 1
            012F 3FFF 1
            0130 3FFF 1
            0131 3FFF 1
            0132 3FFF 1
            0133 3FFF 1
            0134 3FFF 1
            0135 1FFF 1
            0136 1FFF 1
            0137 1FFF 1
            0138 3FFF 1
            0139 1FFF 1
            013A 1FFF 1
            013B 1FFF 1
            013C 3FFF 1
            013D 1FFF 1
            013E 1FFF 1
            013F 1FFF 1
            0140 3FFF 1
            0141 1FFF 1
            0142 1FFF 1
            0143 1FFF 1
            0144 1FFF 1
            0145 1FFF 1
            0146 1FFF 1
            0147 1FFF 1
            0148 3FFF 1
            0149 3FFF 1
            014A 3FFF 1
            014B 3FFF 1
            014C 3FFF 1
            014D 3FFF 1
            014E 3FFF 1
            014F 3FFF 1
            0150 1FFF 1
            0151 3FFF 1
            0152 3FFF 1
            0153 3FFF 1
            0154 1FFF 1
            0155 3FFF 1
            0156 3FFF 1
            0157 3FFF 1
            0158 1FFF 1
            0159 3FFF 1
            015A 3FFF 1
            015B 3FFF 1
            015C 1FFF 1
            015D 3FFF 1
            015E 3FFF 1
            015F 3FFF 1
            0160 3FFF 1
            0161 3FFF 1
            0162 3FFF 1
            0163 3FFF 1
            0164 3FFF 1
            0165 3FFF 1
            0166 3FFF 1
            0167 3FFF 1
            0168 3FFF 1
            0169 3FFF 1
            016A 3FFF 1
            016B 3FFF 1
            016C 3FFF 1
            016D 3FFF 1
            016E 3FFF 1
            016F 3FFF 1
            0170 3FFF 1
            0171 3FFF 1
            0172 3FFF 1
            0173 3FFF 1
            0174 3FFF 1
            0175 3FFF 1
            0176 3FFF 1
            0177 1FFF 1
            0178 3FFF 1
            0179 1FFF 1
            017A 1FFF 1
            017B 1FFF 1
            017C 3FFF 1
            017D 1FFF 1
            017E 1FFF 1
            017F 1FFF 1
            0180 3FFF 1
            0181 1FFF 1
            0182 3FFF 1
            0183 1FFF 1
            0184 3FFF 1
            0185 1FFF 1
            0186 1FFF 1
            0187 1FFF 1
            0188 3FFF 1
            0189 3FFF 1
            018A 3FFF 1
            018B 3FFF 1
            018C 3FFF 1
            018D 3FFF 1
            018E 3FFF 1
            018F 3FFF 1
            0190 1FFF 1
            0191 3FFF 1
            0192 3FFF 1
            0193 3FFF 1
            0194 1FFF 1
            0195 3FFF 1
            0196 3FFF 1
            0197 3FFF 1
            0198 1FFF 1
            0199 3FFF 1
            019A 3FFF 1
            019B 3FFF 1
            019C 1FFF 1
            019D 3FFF 1
            019E 3FFF 1
            019F 3FFF 1
            01A0 1FFF 1
            01A1 3FFF 1
            01A2 3FFF 1
            01A3 3FFF 1
            01A4 3FFF 1
            01A5 3FFF 1
            01A6 3FFF 1
            01A7 3FFF 1
            01A8 3FFF 1
            01A9 3FFF 1
            01AA 3FFF 1
            01AB 3FFF 1
            01AC 3FFF 1
            01AD 3FFF 1
            01AE 3FFF 1
            01AF 3FFF 1
            01B0 3FFF 1
            01B1 3FFF 1
            01B2 3FFF 1
            01B3 3FFF 1
            01B4 3FFF 1
            01B5 3FFF 1
            01B6 3FFF 1
            01B7 3FFF 1
            01B8 3FFF 1
            01B9 1FFF 1
            01BA 1FFF 1
            01BB 1FFF 1
            01BC 3FFF 1
            01BD 1FFF 1
            01BE 1FFF 1
            01BF 1FFF 1
            01C0 3FFF 1
            01C1 1FFF 1
            01C2 3FFF 1
            01C3 1FFF 1
            01C4 3FFF 1
            01C5 1FFF 1
            01C6 3FFF 1
            01C7 1FFF 1
            01C8 3FFF 1
            01C9 1FFF 1
            01CA 3FFF 1
            01CB 3FFF 1
            01CC 3FFF 1
            01CD 3FFF 1
            01CE 3FFF 1
            01CF 3FFF 1
            01D0 3FFF 1
            01D1 3FFF 1
            01D2 3FFF 1
            01D3 3FFF 1
            01D4 1FFF 1
            01D5 3FFF 1
            01D6 3FFF 1
            01D7 3FFF 1
            01D8 1FFF 1
            01D9 3FFF 1
            01DA 3FFF 1
            01DB 3FFF 1
            01DC 1FFF 1
            01DD 3FFF 1
            01DE 3FFF 1
            01DF 3FFF 1
            01E0 1FFF 1
            01E1 3FFF 1
            01E2 3FFF 1
            01E3 3FFF 1
            01E4 3FFF 1
            01E5 3FFF 1
            01E6 3FFF 1
            01E7 3FFF 1
            01E8 3FFF 1
            01E9 3FFF 1
            01EA 3FFF 1
            01EB 3FFF 1
            01EC 3FFF 1
            01ED 3FFF 1
            01EE 3FFF 1
            01EF 3FFF 1
            01F0 3FFF 1
            01F1 3FFF 1
            01F2 3FFF 1
            01F3 3FFF 1
            01F4 3FFF 1
            01F5 3FFF 1
            01F6 3FFF 1
            01F7 3FFF 1
            01F8 3FFF 1
            01F9 3FFF 1
            01FA 3FFF 1
            01FB 3FFF 1
            01FC 3FFF 1
            01FD 1FFF 1
            01FE 1FFF 1
            01FF 1FFF 1
            0200 3FFF 1
            0201 1FFF 1
            0202 3FFF 1
            0203 1FFF 1
            0204 3FFF 1
            0205 1FFF 1
            0206 3FFF 1
            0207 1FFF 1
            0208 3FFF 1
            0209 1FFF 1
            020A 1FFF 1
            020B 1FFF 1
            020C 3FFF 1
            020D 3FFF 1
            020E 3FFF 1
            020F 3FFF 1
            0210 3FFF 1
            0211 3FFF 1
            0212 3FFF 1
            0213 3FFF 1
            0214 3FFF 1
            0215 3FFF 1
            0216 3FFF 1
            0217 3FFF 1
            0218 1FFF 1
            0219 3FFF 1
            021A 3FFF 1
            021B 3FFF 1
            021C 1FFF 1
            021D 3FFF 1
            021E 3FFF 1
            021F 3FFF 1
            0220 1FFF 1
            0221 3FFF 1
            0222 3FFF 1
            0223 3FFF 1
            0224 1FFF 1
            0225 3FFF 1
            0226 3FFF 1
            0227 3FFF 1
            0228 3FFF 1
            0229 3FFF 1
            022A 3FFF 1
            022B 3FFF 1
            022C 3FFF 1
            022D 3FFF 1
            022E 3FFF 1
            022F 3FFF 1
            0230 3FFF 1
            0231 3FFF 1
            0232 3FFF 1
            0233 3FFF 1
            0234 3FFF 1
            0235 3FFF 1
            0236 3FFF 1
            0237 3FFF 1
            0238 3FFF 1
            0239 3FFF 1
            023A 3FFF 1
            023B 3FFF 1
            023C 3FFF 1
            023D 3FFF 1
            023E 3FFF 1
            023F 1FFF 1
            0240 3FFF 1
            0241 3FFF 1
            0242 3FFF 1
            0243 1FFF 1
            0244 3FFF 1
            0245 1FFF 1
            0246 3FFF 1
            0247 1FFF 1
            0248 3FFF 1
            0249 1FFF 1
            024A 1FFF 1
            024B 1FFF 1
            024C 3FFF 1
            024D 1FFF 1
            024E 1FFF 1
            024F 1FFF 1
            0250 3FFF 1
            0251 3FFF 1
            0252 3FFF 1
            0253 3FFF 1
            0254 3FFF 1
            0255 3FFF 1
            0256 3FFF 1
            0257 3FFF 1
            0258 1FFF 1
            0259 3FFF 1
            025A 3FFF 1
            025B 3FFF 1
            025C 1FFF 1
            025D 3FFF 1
            025E 3FFF 1
            025F 3FFF 1
            0260 1FFF 1
            0261 3FFF 1
            0262 3FFF 1
            0263 3FFF 1
            0264 1FFF 1
            0265 3FFF 1
            0266 3FFF 1
            0267 3FFF 1
            0268 1FFF 1
            0269 3FFF 1
            026A 3FFF 1
            026B 3FFF 1
            026C 3FFF 1
            026D 3FFF 1
            026E 3FFF 1
            026F 3FFF 1
            0270 3FFF 1
            0271 3FFF 1
            0272 3FFF 1
            0273 3FFF 1
            0274 3FFF 1
            0275 3FFF 1
            0276 3FFF 1
            0277 3FFF 1
            0278 3FFF 1
            0279 3FFF 1
            027A 3FFF 1
            027B 3FFF 1
            027C 3FFF 1
            027D 3FFF 1
            027E 3FFF 1
            027F 3FFF 1
            0280 3FFF 1
            0281 3FFF 1
            0282 3FFF 1
            0283 3FFF 1
            0284 3FFF 1
            0285 1FFF 1
            0286 3FFF 1
            0287 1FFF 1
            0288 3FFF 1
            0289 1FFF 1
            028A 1FFF 1
            028B 1FFF 1
            028C 3FFF 1
            028D 1FFF 1
            028E 1FFF 1
            028F 1FFF 1
            0290 3FFF 1
            0291 1FFF 1
            0292 1FFF 1
            0293 3FFF 1
            0294 3FFF 1
            0295 3FFF 1
            0296 3FFF 1
            0297 3FFF 1
            0298 3FFF 1
            0299 3FFF 1
            029A 3FFF 1
            029B 3FFF 1
            029C 1FFF 1
            029D 3FFF 1
            029E 3FFF 1
            029F 3FFF 1
            02A0 1FFF 1
            02A1 3FFF 1
            02A2 3FFF 1
            02A3 3FFF 1
            02A4 1FFF 1
            02A5 3FFF 1
            02A6 3FFF 1
            02A7 3FFF 1
            02A8 1FFF 1
            02A9 3FFF 1
            02AA 3FFF 1
            02AB 3FFF 1
            02AC 3FFF 1
            02AD 3FFF 1
            02AE 3FFF 1
            02AF 3FFF 1
            02B0 3FFF 1
            02B1 3FFF 1
            02B2 3FFF 1
            02B3 3FFF 1
            02B4 3FFF 1
            02B5 3FFF 1
            02B6 3FFF 1
            02B7 3FFF 1
            02B8 3FFF 1
            02B9 3FFF 1
            02BA 3FFF 1
            02BB 3FFF 1
            02BC 3FFF 1
            02BD 3FFF 1
            02BE 3FFF 1
            02BF 3FFF 1
            02C0 3FFF 1
            02C1 3FFF 1
            02C2 3FFF 1
            02C3 3FFF 1
            02C4 3FFF 1
            02C5 3FFF 1
            02C6 3FFF 1
            02C7 1FFF 1
            02C8 3FFF 1
            02C9 1FFF 1
            02CA 1FFF 1
            02CB 1FFF 1
            02CC 3FFF 1
            02CD 1FFF 1
            02CE 1FFF 1
            02CF 1FFF 1
            02D0 3FFF 1
            02D1 1FFF 1
            02D2 1FFF 1
            02D3 1FFF 1
            02D4 3FFF 1
            02D5 3FFF 1
            02D6 3FFF 1
            02D7 3FFF 1
            02D8 3FFF 1
            02D9 3FFF 1
            02DA 3FFF 1
            02DB 3FFF 1
            02DC 3FFF 1
            02DD 3FFF 1
            02DE 3FFF 1
            02DF 3FFF 1
            02E0 1FFF 1
            02E1 3FFF 1
            02E2 3FFF 1
            02E3 3FFF 1
            02E4 1FFF 1
            02E5 3FFF 1
            02E6 3FFF 1
            02E7 3FFF 1
            02E8 1FFF 1
            02E9 3FFF 1
            02EA 3FFF 1
            02EB 3FFF 1
            02EC 1FFF 1
            02ED 3FFF 1
            02EE 3FFF 1
            02EF 3FFF 1
            02F0 3FFF 1
            02F1 3FFF 1
            02F2 3FFF 1
            02F3 3FFF 1
            02F4 3FFF 1
            02F5 3FFF 1
            02F6 3FFF 1
            02F7 3FFF 1
            02F8 3FFF 1
            02F9 3FFF 1
            02FA 3FFF 1
            02FB 3FFF 1
            02FC 3FFF 1
            02FD 3FFF 1
            02FE 3FFF 1
            02FF 3FFF 1
            0300 3FFF 1
            0301 3FFF 1
            0302 3FFF 1
            0303 3FFF 1
            0304 3FFF 1
            0305 3FFF 1
            0306 3FFF 1
            0307 3FFF 1
            0308 3FFF 1
            0309 1FFF 1
            030A 1FFF 1
            030B 1FFF 1
            030C 3FFF 1
            030D 1FFF 1
            030E 1FFF 1
            030F 1FFF 1
            0310 3FFF 1
            0311 1FFF 1
            0312 1FFF 1
            0313 1FFF 1
            0314 3FFF 1
            0315 1FFF 1
            0316 1FFF 1
            0317 1FFF 1
            0318 3FFF 1
            0319 3FFF 1
            031A 3FFF 1
            031B 3FFF 1
            031C 3FFF 1
            031D 3FFF 1
            031E 3FFF 1
            031F 3FFF 1
            0320 1FFF 1
            0321 3FFF 1
            0322 3FFF 1
            0323 3FFF 1
            0324 1FFF 1
            0325 3FFF 1
            0326 3FFF 1
            0327 3FFF 1
            0328 1FFF 1
            0329 3FFF 1
            032A 3FFF 1
            032B 3FFF 1
            032C 1FFF 1
            032D 3FFF 1
            032E 3FFF 1
            032F 3FFF 1
            0330 1FFF 1
            0331 3FFF 1
            0332 3FFF 1
            0333 3FFF 1
            0334 3FFF 1
            0335 3FFF 1
            0336 3FFF 1


EDIT: Improved dumps with automatic decoding script.

So far:

• 1010010110100101101001011010011100011010101000010: FLASH write
• 1010010110100101101001011010011000011010101000010: FLASH read A
• 1010010110100101101001011010011000001010101000010: FLASH read B

I have no idea what's the difference between the two flash reads, but they at least use exactly the same output format, and they both seem to be used interchangeably.

[socram]

There seems to be two Flash read commands and two Flash write commands - why? I have absolutely no idea.

• 1010010110100101101001011010011100011010101000010: FLASH write A
• 1010010110100101101001011010011100001010101000010: FLASH write B
• 1010010110100101101001011010011000011010101000010: FLASH read A
• 1010010110100101101001011010011000001010101000010: FLASH read B

Parsing again the first shared .txt file, one gets now:

PADAUK-P-003-PFS154_SimpleBlink_NoPinCheck.txt

Code: [Select]

      1009: FLASH_READ_B
            No data (dummy read)

     55103: FLASH_READ_A

            ADDR DATA ?
            -----------
            07EF 1FFE 0
            07F0 0003 0
            07F1 0003 1

     92201: ??? (1010010110100101101001011010001100011010101000010)

    158597: ??? (1010010110100101101001011010011001111010101000010)

    737022: FLASH_WRITE_B

            ADDR -W1- -W2- -W3- -W4-
            ------------------------
            07F0 0004 3FFF 3FFF 3FFF


    784240: FLASH_READ_B
            No data (dummy read)

    820818: FLASH_WRITE_B

            ADDR -W1- -W2- -W3- -W4-
            ------------------------
            07F0 3FFF 0004 3FFF 3FFF


    868054: FLASH_READ_B
            No data (dummy read)

    904632: FLASH_READ_B
            No data (dummy read)

    949230: FLASH_READ_B

            ADDR DATA ?
            -----------
            07E0 3FFF 0
            07E1 1FFF 0
            07E2 1FFF 1
            07E3 1FFF 1
            07E4 3FFF 1
            07E5 1FFF 1
            07E6 1FFF 1
            07E7 1FFF 1
            07E8 3FFF 1
            07E9 1FFF 1
            07EA 1FFF 1
            07EB 3FFF 1
            07EC 3FFF 1
            07ED 0281 1
            07EE 027A 1
            07EF 1FFE 0
            07F0 0004 0
            07F1 0004 1
            07F2 3FFF 0
            07F3 3FFF 0
            07F4 3FFF 1
            07F5 3FFF 1
            07F6 3FFF 1
            07F7 3FFF 1
            07F8 1FFF 1
            07F9 3FFF 1
            07FA 1FFF 1
            07FB 3FFF 1
            07FC 1FFF 1
            07FD 3FFF 1
            07FE 1FFF 1
            07FF 3FFF 1

   1004046: FLASH_READ_A
            No data (dummy read)

   1589373: FLASH_WRITE_A

            ADDR -W1- -W2- -W3- -W4-
            ------------------------
            0000 0070 2F00 0182 3FED
            0004 018B 3FEE 019A 2F80
            0008 019B 2F1C 0183 3FFE
            000C 2AFF 3054 3FED 0B81
            0010 1F91 2F05 0B80 1AD0
            0014 3013 1F90 0063 3016
            0018 1180 3016 1D90 18D0
            001C 301B 2F01 1950 2FFF
            0020 0C01 018B 0B81 1AD0
            0024 3023 1B50 304F 2F04
            0028 0188 18D0 3029 2F02
            002C 0182 1304 1305 2F6E
            0030 0B82 2F00 0B83 0006
            0034 0B04 0007 0805 1584
            0038 1685 1004 1282 1083
            003C 1A40 3033 1F90 1AD0
            0040 303F 1584 1685 0590
            0044 18D0 3044 1950 303F
            0048 1D90 1AD0 3049 18D0
            004C 304B 1B50 302B 18D0
            0050 304F 1B50 3011 3053
            0054 018B 1ED1 1ED0 2F03
            0058 0BC1 2F8A 0BC0 2F56
            005C 0063 305C 11C0 305C
            0060 11C1 305C 1CD0 2F03
            0064 0BC1 2F8A 0BC0 2F56
            0068 0063 3068 11C0 3068
            006C 11C1 3068 3056 3FFF


   1669266: FLASH_WRITE_B

            ADDR -W1- -W2- -W3- -W4-
            ------------------------
            07EC 3FFF 0281 027A 1FFE
            07F0 0004 0004 3FFF 3FFF
            07F8 1850 3F54 3FFF 3FFF
            07FC 3FFF 3FFF 02FF 31FD


   1746862: FLASH_READ_B

            ADDR DATA ?
            -----------
            07E0 3FFF 0
            07E1 3FFF 0
            07E2 3FFF 1
            07E3 3FFF 1
            07E4 3FFF 1
            07E5 1FFF 1
            07E6 3FFF 1
            07E7 1FFF 1
            07E8 3FFF 1
            07E9 1FFF 1
            07EA 3FFF 1
            07EB 1FFF 1
            07EC 3FFF 1
            07ED 0281 1
            07EE 027A 1
            07EF 1FFE 0
            07F0 0004 0
            07F1 0004 1
            07F2 3FFF 0
            07F3 3FFF 0
            07F4 3FFF 1
            07F5 3FFF 1
            07F6 3FFF 1
            07F7 3FFF 1
            07F8 1850 1
            07F9 3F54 1
            07FA 3FFF 1
            07FB 3FFF 1
            07FC 1FFF 1
            07FD 3FFF 1
            07FE 02FF 1
            07FF 31FD 1

   1801641: FLASH_READ_A

            ADDR DATA ?
            -----------
            0000 0070 0
            0001 2F00 0
            0002 0182 0
            0003 3FED 0
            0004 018B 0
            0005 3FEE 1
            0006 019A 0
            0007 2F80 1
            0008 019B 0
            0009 2F1C 0
            000A 0183 0
            000B 1FFE 0
            000C 2AFF 0
            000D 1054 1
            000E 3FED 0
            000F 0B81 1
            0010 1F91 1
            0011 0F05 0
            0012 0B80 1
            0013 1AD0 0
            0014 3013 0
            0015 1F90 1
            0016 0063 1
            0017 3016 1
            0018 1180 0
            0019 1016 1
            001A 1D90 1
            001B 18D0 1
            001C 101B 1
            001D 2F01 1
            001E 1950 1
            001F 2FFF 0
            0020 0C01 1
            0021 018B 0
            0022 0B81 0
            0023 1AD0 0
            0024 1023 0
            0025 1B50 1
            0026 304F 1
            0027 2F04 1
            0028 0188 1
            0029 18D0 0
            002A 1029 0
            002B 2F02 1
            002C 0182 1
            002D 1304 0
            002E 1305 0
            002F 2F6E 1
            0030 0B82 1
            0031 2F00 0
            0032 0B83 0
            0033 0006 0
            0034 0B04 0
            0035 0007 0
            0036 0805 0
            0037 1584 0
            0038 1685 0
            0039 1004 1
            003A 1282 1
            003B 1083 1
            003C 1A40 1
            003D 3033 1
            003E 1F90 1
            003F 1AD0 1
            0040 303F 1
            0041 1584 1
            0042 1685 1
            0043 0590 1
            0044 18D0 1
            0045 1044 0
            0046 1950 1
            0047 103F 1
            0048 1D90 1
            0049 1AD0 1
            004A 1049 1
            004B 18D0 1
            004C 304B 1
            004D 1B50 1
            004E 102B 1
            004F 18D0 1
            0050 304F 1
            0051 1B50 1
            0052 1011 1
            0053 1053 1
            0054 018B 1
            0055 1ED1 1
            0056 1ED0 0
            0057 2F03 1
            0058 0BC1 1
            0059 2F8A 0
            005A 0BC0 0
            005B 2F56 0
            005C 0063 0
            005D 305C 0
            005E 11C0 0
            005F 305C 1
            0060 11C1 1
            0061 305C 1
            0062 1CD0 1
            0063 2F03 1
            0064 0BC1 1
            0065 2F8A 0
            0066 0BC0 0
            0067 2F56 0
            0068 0063 0
            0069 3068 0
            006A 11C0 0
            006B 3068 1
            006C 11C1 1
            006D 3068 1
            006E 3056 1
            006F 3FFF 1

   1890615: FLASH_READ_A
            No data (dummy read)

   1935310: FLASH_READ_B
            No data (dummy read)

   2004366: FLASH_WRITE_A

            ADDR -W1- -W2- -W3- -W4-
            ------------------------
            0000 0070 2F00 0182 3FED
            0004 018B 3FEE 019A 2F80
            0008 019B 2F1C 0183 3FFE
            000C 2AFF 3054 3FED 0B81
            0010 1F91 2F05 0B80 1AD0
            0014 3013 1F90 0063 3016
            0018 1180 3016 1D90 18D0
            001C 301B 2F01 1950 2FFF
            0020 0C01 018B 0B81 1AD0
            0024 3023 1B50 304F 2F04
            0028 0188 18D0 3029 2F02
            002C 0182 1304 1305 2F6E
            0030 0B82 2F00 0B83 0006
            0034 0B04 0007 0805 1584
            0038 1685 1004 1282 1083
            003C 1A40 3033 1F90 1AD0
            0040 303F 1584 1685 0590
            0044 18D0 3044 1950 303F
            0048 1D90 1AD0 3049 18D0
            004C 304B 1B50 302B 18D0
            0050 304F 1B50 3011 3053
            0054 018B 1ED1 1ED0 2F03
            0058 0BC1 2F8A 0BC0 2F56
            005C 0063 305C 11C0 305C
            0060 11C1 305C 1CD0 2F03
            0064 0BC1 2F8A 0BC0 2F56
            0068 0063 3068 11C0 3068
            006C 11C1 3068 3056 3FFF


   2110976: 0000001101001010001110011010010100011100
   2333060: 0000001101001010001110011010010100011100
   2584511: FLASH_WRITE_B

            ADDR -W1- -W2- -W3- -W4-
            ------------------------
            07EC 3FFF 0281 027A 1FFE
            07F0 0004 0004 3FFF 3FFF
            07F8 1850 3F54 3FFF 3FFF
            07FC 3FFF 3FFF 0282 31FD


   2634228: FLASH_READ_B

            ADDR DATA ?
            -----------
            07E0 3FFF 0
            07E1 1FFF 0
            07E2 1FFF 1
            07E3 1FFF 1
            07E4 3FFF 1
            07E5 1FFF 1
            07E6 1FFF 1
            07E7 1FFF 1
            07E8 3FFF 1
            07E9 1FFF 1
            07EA 1FFF 1
            07EB 1FFF 1
            07EC 3FFF 1
            07ED 0281 1
            07EE 027A 1
            07EF 1FFE 0
            07F0 0004 0
            07F1 0004 1
            07F2 3FFF 0
            07F3 1FFF 0
            07F4 3FFF 1
            07F5 3FFF 1
            07F6 3FFF 1
            07F7 3FFF 1
            07F8 1850 1
            07F9 3F54 1
            07FA 3FFF 1
            07FB 3FFF 1
            07FC 1FFF 1
            07FD 3FFF 1
            07FE 0282 1
            07FF 31FD 1

   2699086: FLASH_READ_B
            No data (dummy read)

   2743782: FLASH_WRITE_B

            ADDR -W1- -W2- -W3- -W4-
            ------------------------
            07EC 3FFF 0281 027A 1FFE
            07F0 0004 0004 3FFF 3FFF
            07F8 1850 3F54 3FFF 3FFF
            07FC 3FFF 3FFF 0282 31FD




[js_12345678_55AA]

There seems to be two Flash read commands and two Flash write commands - why? I have absolutely no idea.

    1010010110100101101001011010011100011010101000010: FLASH write A
    1010010110100101101001011010011100001010101000010: FLASH write B
    1010010110100101101001011010011000011010101000010: FLASH read A
    1010010110100101101001011010011000001010101000010: FLASH read B

This are the same commands I mentioned several posts ago.

    101001011010010110100101101001110001101010100001 (0): A5A5A5A *71* AA1   
    101001011010010110100101101001110000101010100001 (0): A5A5A5A *70* AA1
    101001011010010110100101101001100001101010100001 (0): A5A5A5A *61* AA1
    101001011010010110100101101001100000101010100001 (0): A5A5A5A *60* AA1

last bit (0) is clock when switching bus direction or delay before write?

==> https://www.eevblog.com/forum/blog/eevblog-1144-padauk-programmer-reverse-engineering/msg2052700/#msg2052700

I also wrote about the ERASE command 31 and maybe a CHECK command 66  (your 2 unknown commands).


The new captures contain the analog voltages of VDD and VPP. I wonder if different voltages are applied when the same commands are executed...?

JS

[socram]

First there is:

Code: [Select]

     55103: FLASH_READ_A

            ADDR DATA ?
            -----------
            07EF 1FFE 0
            07F0 0003 0
            07F1 0003 1
After that, the two mysterious commands are sent.

Code: [Select]

     92201: 1010010110100101101001011010001100011010101000010 0000
    158597: 1010010110100101101001011010011001111010101000010
Then, it does two writes:

Code: [Select]

    737022: FLASH_WRITE_B

            ADDR -W1- -W2- -W3- -W4-
            ------------------------
            07F0 0004 3FFF 3FFF 3FFF

    820818: FLASH_WRITE_B

            ADDR -W1- -W2- -W3- -W4-
            ------------------------
            07F0 3FFF 0004 3FFF 3FFF
It finally does one read to verify it. As we can see, the two writes have been AND'ed, so it means FLASH_WRITE_B doesn't implicitely clear the FLASH and it had to be one of the mysterious that had been run before:

Code: [Select]

    949230: FLASH_READ_B

            ADDR DATA ?
            -----------
            07E0 3FFF 0
            07E1 1FFF 0
            07E2 1FFF 1
            07E3 1FFF 1
            07E4 3FFF 1
            07E5 1FFF 1
            07E6 1FFF 1
            07E7 1FFF 1
            07E8 3FFF 1
            07E9 1FFF 1
            07EA 1FFF 1
            07EB 3FFF 1
            07EC 3FFF 1
            07ED 0281 1
            07EE 027A 1
            07EF 1FFE 0
            07F0 0004 0
            07F1 0004 1
            07F2 3FFF 0
            07F3 3FFF 0
            07F4 3FFF 1
            07F5 3FFF 1
            07F6 3FFF 1
            07F7 3FFF 1
            07F8 1FFF 1
            07F9 3FFF 1
            07FA 1FFF 1
            07FB 3FFF 1
            07FC 1FFF 1
            07FD 3FFF 1
            07FE 1FFF 1
            07FF 3FFF 1
Either 0x60 or 0x31 have erased thus the last page (at least) of the memory, but I still don't see which would. Sending 0000 to erase last/all pages don't make much sense - I doubt there's only one page of flash and 0 means thus all.

0x60 being "clear everything" would make more sense (and thus would explain the long delay after executing that command while the device is being cleared), but I don't understand what 0x31 would do then.

EDIT: Also have a look at 0x7ED, still contains data after issuing those commands.

EDIT2: I don't know how to use the ZEROPLUS tool, so I don't really know how to see the VPP voltages.

[js_12345678_55AA]

EDIT2: I don't know how to use the ZEROPLUS tool, so I don't really know how to see the VPP voltages.

I grouped the 2 channels into a bus each (VDD_AN and PA5_ICVPP_AN, bottom of Zero Plus) which decodes to decimal values (right click on the hex values and select "Numeric Base->Decimal").

In case you want to do it manually:
C0...C7 = 8 bit of analog value VDD_AN (in 100mV, ==> 30 decimal = 3.0V, 45 decimal = 4.5V, ...)
D0...D7 = 8 bit of analog value PA5_ICVPP_AN


example line from text export:


         PA0_UNUSED   | Bus1           *VDD*SCLK*DATA PA4  PA5 PA7  GND   | VDD_AN              *C0...*C7  | PA5_ICVPP_AN  *D0...*D7   

91330            0    | Data=0X1F             1   0   0   0   1   0   0   | 0X2B                  11010100 | 0X38           00011100


VDD_AN = 11010100 = 0x2B = 43 ==> 4.3V
PA5_ICVPP_AN = 00011100 = 0x38 = 56 ==> 5.6V

 

JS

[js_12345678_55AA]

Then, it does two writes:

Code: [Select]

    737022: FLASH_WRITE_B

            ADDR -W1- -W2- -W3- -W4-
            ------------------------
            07F0 0004 3FFF 3FFF 3FFF

    820818: FLASH_WRITE_B

            ADDR -W1- -W2- -W3- -W4-
            ------------------------
            07F0 3FFF 0004 3FFF 3FFF

This looks pretty normal. To understand this you must know how a OTP / flash write is usually working.

Blank IC / After Erase => all memory cells are holding a '1' bit value
Programing = change some of the '1' bits to '0' bits. You only can change '1' to '0' not the other way around. If you want to write something new you must erase the chip first (is possible) which makes *ALL* memory cells to a '1'.

So
- writing '11111111' somewhere does in reality: NOTHING (all stays same, you can do this as many times as you want)
- writing '0' somewhere changes this bit to '0'. If you later write a '1' it will do NOTHING (the 0 will stay).


==> Since the IC seems to require to write 4 WORDS at once a simple solution just to write 1 WORD or even only some bits from it is to write the unused WORDS with all '1'.
- writing "ABCD 3FFF 3FFF 3FFF" only will change the first word
- writing "3FFF EFGH 3FFF 3FFF" only will change the second word

==> It looks like WRITER just wants to write 2 WORDS in 2 single operations.

JS