Author Topic: EEVblog #1144 - Padauk Programmer Reverse Engineering  (Read 74506 times)

0 Members and 2 Guests are viewing this topic.

Offline DocBen

  • Regular Contributor
  • *
  • Posts: 111
  • Country: de
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #275 on: December 28, 2018, 03:50:12 pm »
And if the current isnt to high the uln2003 could be replaced with the output pin of a microcontroller.
~20 mA.
 

Offline lucas.hartmann

  • Contributor
  • Posts: 16
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #276 on: December 28, 2018, 04:05:40 pm »
You could use low output to enable and Z to disable a zener, except you will have a voltage swing limit due to the clamping diodes on every GPIO.

If you use a 3.3V microcontroller and have a 3.0V zener for the outputs then it will max your voltage output at 3.3 + 0.7 + 3.0. You will not be able to get 12V from this circuit.

Enviado de meu SM-N910C usando o Tapatalk

 

Offline oPossum

  • Frequent Contributor
  • **
  • Posts: 847
  • Country: us
  • The other white meat
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #277 on: December 28, 2018, 04:17:33 pm »
TPIC6C595 is a nice upgrade from the old ULN2003. The DMOS outputs get close to ground (the darlingtons in the ULN only go down to about 1V) and it only requires only 3 GPIO from the microcontroller. The only thing I don't like about it is that it is a 5V part.

http://www.ti.com/lit/ds/symlink/tpic6c595.pdf

TPIC6B595 and TPIC6A595 have lower Rdson, so they can handle a bit more current.
« Last Edit: December 28, 2018, 04:19:40 pm by oPossum »
 

Offline DocBen

  • Regular Contributor
  • *
  • Posts: 111
  • Country: de
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #278 on: December 28, 2018, 04:21:26 pm »
You have to power the micro anyway.
So my thinking was to use 12v standard supply and then reduce the voltage to the appropriate level using the zeners.
As the uln2003 (or micro) switches to gnd that shouldnt be a problem.

I ordered some  ULN2003V12S16-13 a while back, was thinking of using those when they arrive.
They're 3.3V compatible.

Somewhat like this:
« Last Edit: December 28, 2018, 07:58:46 pm by DocBen »
 

Offline socram

  • Regular Contributor
  • *
  • Posts: 63
  • Country: es
    • Totodile!
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #279 on: December 28, 2018, 07:59:30 pm »
For generating VDD and VPP I'd just use any random linear regulator, with NMOS for switching the divider resistor, one for each pin.

I think it should be even possible to remove the NMOS altogether, using GPIO from the programming microcontroller and switching between high impedance and open collector, given how little current this draws.

I think it would be even possible to drive VDD straight from 3.3V or 5V (with another MOSFET for switching on and off), and thus have the regulator for switching between 5.6/8.2V only on the VPP pin.
« Last Edit: December 28, 2018, 08:02:08 pm by socram »
 

Offline DocBen

  • Regular Contributor
  • *
  • Posts: 111
  • Country: de
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #280 on: December 28, 2018, 08:10:17 pm »
For generating VDD and VPP I'd just use any random linear regulator, with NMOS for switching the divider resistor, one for each pin.

I dont know how fast the voltage transitions have to be.
From the pictures in Davids video they seem to be rather fast.
Voltage regulators typically have settling times that are rather long.
 

Offline socram

  • Regular Contributor
  • *
  • Posts: 63
  • Country: es
    • Totodile!
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #281 on: December 28, 2018, 08:26:05 pm »
For generating VDD and VPP I'd just use any random linear regulator, with NMOS for switching the divider resistor, one for each pin.

I dont know how fast the voltage transitions have to be.
From the pictures in Davids video they seem to be rather fast.
Voltage regulators typically have settling times that are rather long.
They're not that fast, you can actually see it settling on the Verify file that was uploaded with the analog Vpp.
 

Offline js_12345678_55AA

  • Regular Contributor
  • *
  • Posts: 193
  • Country: ht
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #282 on: December 28, 2018, 09:06:18 pm »
It would be nice to have the feature to set any voltage from 2.0V to 12.0V

2.0V - 5.0V are needed for calibration later (at least with 0.1V steps).

6.5, 8.5, 12.0 are needed for programing (OTP need higer voltages).

I was looking at something like PWM output and LM371T but the refernce schematic looks big (lots of components and an opamp).

JS

The voltage is not changed very often. The trace from Dave just showed that no capacitator was used to stabelize the vdd voltage...
« Last Edit: December 28, 2018, 09:08:23 pm by js_12345678_55AA »
Easy PDK programmer and more: https://free-pdk.github.io
 

Offline DocBen

  • Regular Contributor
  • *
  • Posts: 111
  • Country: de
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #283 on: December 28, 2018, 09:18:06 pm »
It would be nice to have the feature to set any voltage from 2.0V to 12.0V

Then maybe this would be something to look at:
http://openprog.altervista.org/OP_eng.html#Regulator
boost converter with feedback by using only a microcontroller

And for lower voltages you can just do pwm.
« Last Edit: December 28, 2018, 09:38:29 pm by DocBen »
 

Offline socram

  • Regular Contributor
  • *
  • Posts: 63
  • Country: es
    • Totodile!
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #284 on: December 28, 2018, 09:21:57 pm »
2.0V - 5.0V are needed for calibration later (at least with 0.1V steps).
How is that? What are those used for?
 

Offline js_12345678_55AA

  • Regular Contributor
  • *
  • Posts: 193
  • Country: ht
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #285 on: December 29, 2018, 12:03:50 am »
2.0V - 5.0V are needed for calibration later (at least with 0.1V steps).
How is that? What are those used for?
After writing the firmware, the IC can be calibrated. Due to manufacturing differences the internal clock might need some tuning (up or down) to produce the exact desired frequency of e.g. 16MHz. This also depends on the supply voltage (VDD). So if you plan to use the IC with 3.1V later you need to calibrate it using 3.1V for VDD. Calibration itself is a very simple process. You just let the IC run a loop with e.g. 5000000 cycles, The IC outputs a signal when it starts and when it finishs. The flasher captures the time it took and then can increase or decrease the clock a tiny tiny bit to calibrate it.

JS
Easy PDK programmer and more: https://free-pdk.github.io
 

Offline FrankBuss

  • Supporter
  • ****
  • Posts: 2304
  • Country: de
    • Frank Buss
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #286 on: December 29, 2018, 12:26:28 am »
I was looking at something like PWM output and LM371T but the refernce schematic looks big (lots of components and an opamp).

The basic circuit is simple, and at least in LTspice it works:



The 0-3 V is translated to 0-9 V. The 2SCR542P transistor is really nice: can switch up to 5 A, with a beefy TO-243 package and costs only 56 cent at Digikey.

To generate the 0-3 V control voltage, you could use a cheap DAC, like the MCP4901. Together with a reference voltage IC, like the LM4040, it should be pretty accurate without calibration.
So Long, and Thanks for All the Fish
Electronics, hiking, retro-computing, electronic music etc.: https://www.youtube.com/c/FrankBussProgrammer
 

Offline js_12345678_55AA

  • Regular Contributor
  • *
  • Posts: 193
  • Country: ht
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #287 on: December 29, 2018, 03:12:33 pm »
Many thanks for all your suggestions but it still looks complicated to me.

After searching around and considering my limited electronics skills I came up with this idea:

LM317 (adjustable ldo, approx USD 0.5)
MCP4141 (digital potentiometer, approx USD 0.7))
2 caps, 1 resistor

Would this work? For sure is easy to assemble  :).

JS
Easy PDK programmer and more: https://free-pdk.github.io
 

Offline FrankBuss

  • Supporter
  • ****
  • Posts: 2304
  • Country: de
    • Frank Buss
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #288 on: December 29, 2018, 03:53:00 pm »
The datasheet for the digital potentiometer says in the absolute maximum ratings table: "Voltage on all other pins (PxA, PxW, PxB..." = -0.3 V to Vdd + 0.3 V. Recommended max supply voltage for Vdd is 5.5 V. This means at the potentiometer pins you can use max 5.8 V, and probably it won't work at all for voltages > Vdd.

But my solution doesn't look too complicated. You can get all chips in DIP as well, and the LM4040 voltage reference in TO92-3 (looks like a transistor) for easier testing on a breadboard (the 3 V version of the reference would be the right choice, if the microcontroller and DAC runs with 3.3 V). For the OpAmp anything should do it, like a LM324, if you don't need to go to 0 V (it is not a rail-to-rail OpAmp). But might need some extra calibration. The ADA4522 has low offset voltage and low drift, which means it would be very accurate relatively to the voltage reference without calibration. I would just design a PCB for it and then use all SMD parts, it is actually easier to solder and would be a nice compact module.
So Long, and Thanks for All the Fish
Electronics, hiking, retro-computing, electronic music etc.: https://www.youtube.com/c/FrankBussProgrammer
 

Offline DocBen

  • Regular Contributor
  • *
  • Posts: 111
  • Country: de
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #289 on: December 29, 2018, 03:58:06 pm »
You could also do a variation of
http://www.circuitstoday.com/few-lm317-voltage-regulator-circuits
look for "Adjustable regulator with digitally selected output"

Replace the transistors with a ULN2003.
I think they cost USD 0.15 plus a few resistors.
 

Offline socram

  • Regular Contributor
  • *
  • Posts: 63
  • Country: es
    • Totodile!
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #290 on: December 29, 2018, 04:20:21 pm »
You could also do a variation of
http://www.circuitstoday.com/few-lm317-voltage-regulator-circuits
look for "Adjustable regulator with digitally selected output"

Replace the transistors with a ULN2003.
I think they cost USD 0.15 plus a few resistors.
That's exactly what I thought about in my previous post, but that won't work if you also need to calibrate it running from 3 to 5V. It may work if you don't really give a damn about calibrating and use it only for programming, or allow calibrating only at preset voltages (which to be honest, would be the case - aside from 3.3, 3.6 and 5V, who really needs any other voltages?)
 

Offline DocBen

  • Regular Contributor
  • *
  • Posts: 111
  • Country: de
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #291 on: December 29, 2018, 04:58:47 pm »
You could also do a variation of
http://www.circuitstoday.com/few-lm317-voltage-regulator-circuits
look for "Adjustable regulator with digitally selected output"

Replace the transistors with a ULN2003.
I think they cost USD 0.15 plus a few resistors.
That's exactly what I thought about in my previous post, but that won't work if you also need to calibrate it running from 3 to 5V. It may work if you don't really give a damn about calibrating and use it only for programming, or allow calibrating only at preset voltages (which to be honest, would be the case - aside from 3.3, 3.6 and 5V, who really needs any other voltages?)

No, no. You can choose the resistor values as you want and also switch them in parallel, kind of like a digital potentiometer (but they usually have the resistors in series).
1/R = 1/R1 + 1/R2 + ...
One would have to figure out the appropriate values though...
 

Offline socram

  • Regular Contributor
  • *
  • Posts: 63
  • Country: es
    • Totodile!
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #292 on: December 29, 2018, 05:13:50 pm »
Yeah, if you're doing that you'd better switch them in parallel, because the moment you leave none connected (ie when switching from one to the other) you're gonna pass the full voltage to the output  ;D

For regulating, you probably want to use the resistors as a rudimentary R2R ladder. For having 0.1V range from 2 to 5V you'll need ceil(log2((5-2)/0.1))=5 resistors, which aren't too many.

EDIT: I think this is slightly too overkill - we'll need probably 5 precision resistors with non-standard values, or five pots. I think just using a LM317 and a DAC as an offset for its ground should work better.
« Last Edit: December 29, 2018, 05:47:21 pm by socram »
 

Online imo

  • Super Contributor
  • ***
  • Posts: 2064
  • Country: 00
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #293 on: December 29, 2018, 07:46:11 pm »
You may consider a PWM DAC - below one gives you almost any Vout from 0-12V.
You may set the upper range by R2/R3, here

Vmax = 3.3V*(1+R2/R3), where 3.3V is MCUs log1

and the actual voltage by setting the PWM duty. The higher the PWM freq the faster settling with smaller R1C1.
Example only.
 

Offline DocBen

  • Regular Contributor
  • *
  • Posts: 111
  • Country: de
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #294 on: December 30, 2018, 08:31:43 am »
You may consider a PWM DAC - below one gives you almost any Vout from 0-12V.

Nice.

Going along those lines: (Voltage Regulator Control with DAC) -> Actually describes using PWM to control a voltage regulator
https://www.microchip.com/forums/FindPost/985974

If the output voltage is sampled with an ADC there's no need for an opamp (or precision ;) and transients would be handled by the voltage regulator.

I wonder if a fixed voltage regulator could be used by modifying the current/voltage on the GND lead. (I know that putting zeners there shift the output voltage)

EDIT: seems that you can easily:
https://electronicsforu.com/electronics-projects/hardware-diy/variable-power-supply-using-fixed-voltage-regulator-ic

Makes it very cheap SC1117-3.3V regulators cost less than USD 0.03

But cant go lower than the fixed voltage apparently :(
Also adjustable regulators of the same kind also cost less than USD 0.03 :)
« Last Edit: December 30, 2018, 08:51:26 am by DocBen »
 

Offline socram

  • Regular Contributor
  • *
  • Posts: 63
  • Country: es
    • Totodile!
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #295 on: December 30, 2018, 01:11:03 pm »
Just use a normal adjustable regulator, such as the LM317 (1.25V reference) or LM431 (2.5V reference). They're less than 0.10$ a piece in TO-92.

IMHO I think we're trying to overdesign this. Having just a set of common reference voltages for VDD should work for calibrating - after all, if you really want a somewhat stable clock (as it'll also drift from temperature changes), you'll use a regulated power supply at a standard voltage such as 3.3V or 5V.
« Last Edit: December 30, 2018, 01:13:40 pm by socram »
 

Offline socram

  • Regular Contributor
  • *
  • Posts: 63
  • Country: es
    • Totodile!
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #296 on: December 30, 2018, 06:31:54 pm »
Attached is the design I'd use for Vdd.

I'm using a HT7133 because it's a cheap linear regulator, it's available in TO92 for easy prototyping, and has a Vref of 3.3 which means you can buy many for using as 3.3V regulator with no resistors in other circuits.

The 200ohm resistor must be that value our lower, to ensure there are always 10mA of current being consumed -the minimum according to datasheet- any moment to ensure the regulator doesn't output a voltage higher than designed.

I'd try if the Padauk ICs can use 3.3V in place of 2.6V (used in non-RW operations and during command transmission) and 5V in place of 4.3V (used during flash reads), since that would make everything much easier. Otherwise m we would probably need to put a DAC for more accurate control, as I'm not sure adding more and more resistors scale.
 

Offline js_12345678_55AA

  • Regular Contributor
  • *
  • Posts: 193
  • Country: ht
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #297 on: December 30, 2018, 09:43:53 pm »
I did a new capture of VERIFY.

This time I lowered the voltage to detect a 1 down to 1.2V (was 1.5V).
I also found a way to capture the complete VERIFY command at 200MHz (the logic analyzer has a compression feature).
This messed up my trigger a bit (you see the scanning spikes before and after the command, which are used by writer to detect IC presence).
I hope now we can read the signal 100% ok without any tricks.

JS
Easy PDK programmer and more: https://free-pdk.github.io
 

Offline socram

  • Regular Contributor
  • *
  • Posts: 63
  • Country: es
    • Totodile!
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #298 on: December 31, 2018, 01:39:28 am »
I did a new capture of VERIFY.

This time I lowered the voltage to detect a 1 down to 1.2V (was 1.5V).
I also found a way to capture the complete VERIFY command at 200MHz (the logic analyzer has a compression feature).
This messed up my trigger a bit (you see the scanning spikes before and after the command, which are used by writer to detect IC presence).
I hope now we can read the signal 100% ok without any tricks.

JS

When sampling on rising edge now:
Code: [Select]
116050251: FLASH_READ_B
    No data (dummy read)

 121460163: FLASH_READ_B

    ADDR DATA ?
    -----------
    07EF 1FFE 0
    07F0 0025 0
    07F1 0025 1

 125171746: ??? (1010010110100101101001011010001100001010101000010)

 132819271: ??? (1010010110100101101001011010011001101010101000010)

 189653978: FLASH_WRITE_B

    ADDR -W1- -W2- -W3- -W4-
    ------------------------
    07F0 0026 3FFF 3FFF 3FFF


 194375712: FLASH_READ_B

    ADDR DATA ?
    -----------
    07F0 0026 0

 198033461: FLASH_WRITE_B

    ADDR -W1- -W2- -W3- -W4-
    ------------------------
    07F0 3FFF 0026 3FFF 3FFF


 202755194: FLASH_READ_B

    ADDR DATA ?
    -----------
    07F1 0002 1

 206415006: FLASH_READ_B

    ADDR DATA ?
    -----------
    07E0 1FFF 0
    07E1 1FFF 0
    07E2 1FFF 1
    07E3 1FFF 1
    07E4 1FFF 1
    07E5 1FFF 1
    07E6 1FFF 1
    07E7 1FFF 1
    07E8 1FFF 1
    07E9 1FFF 1
    07EA 1FFF 1
    07EB 1FFF 1
    07EC 1FFF 1
    07ED 0281 1
    07EE 027A 1
    07EF 1FFE 0
    07F0 0002 0
    07F1 0002 1
    07F2 1FFF 0
    07F3 1FFF 0
    07F4 1FFF 1
    07F5 1FFF 1
    07F6 1FFF 1
    07F7 1FFF 1
    07F8 1FFF 1
    07F9 1FFF 1
    07FA 1FFF 1
    07FB 1FFF 1
    07FC 1FFF 1
    07FD 1FFF 1
    07FE 1FFF 1
    07FF 1FFF 1

 210876950: FLASH_READ_B

    ADDR DATA ?
    -----------
    07E0 1FFF 0
    07E1 1FFF 0
    07E2 1FFF 1
    07E3 1FFF 1
    07E4 1FFF 1
    07E5 1FFF 1
    07E6 1FFF 1
    07E7 1FFF 1
    07E8 1FFF 1
    07E9 1FFF 1
    07EA 1FFF 1
    07EB 1FFF 1
    07EC 1FFF 1
    07ED 0281 1
    07EE 027A 1
    07EF 1FFE 0
    07F0 0026 0
    07F1 0026 1
    07F2 1FFF 0
    07F3 1FFF 0
    07F4 1FFF 1
    07F5 1FFF 1
    07F6 1FFF 1
    07F7 1FFF 1
    07F8 1FFF 1
    07F9 1FFF 1
    07FA 1FFF 1
    07FB 1FFF 1
    07FC 1FFF 1
    07FD 1FFF 1
    07FE 1FFF 1
    07FF 1FFF 1

 216360622: FLASH_READ_B

    ADDR DATA ?
    -----------
    0000 1FFF 0
    0001 1FFF 0
    0002 1FFF 1
    0003 1FFF 1
    0004 1FFF 1
    0005 1FFF 1
    0006 1FFF 1
    0007 1FFF 1
    0008 1FFF 1
    0009 1FFF 1
    000A 1FFF 1
    000B 1FFF 1
    000C 1FFF 1
    000D 1FFF 1
    000E 1FFF 1
    000F 1FFF 1
    0010 1FFF 1
    0011 1FFF 1
    0012 1FFF 1
    0013 1FFF 1
    0014 1FFF 1
    0015 1FFF 1
    0016 1FFF 1
    0017 1FFF 1
    0018 1FFF 1
    0019 1FFF 1
    001A 1FFF 1
    001B 1FFF 1
    001C 1FFF 1
    001D 1FFF 1
    001E 1FFF 1
    001F 1FFF 1
    0020 1FFF 1
    0021 1FFF 1
    0022 1FFF 1
    0023 1FFF 1
    0024 1FFF 1
    0025 1FFF 1
    0026 1FFF 1
    0027 1FFF 1
    0028 1FFF 1
    0029 1FFF 1
    002A 1FFF 1
    002B 1FFF 1
    002C 1FFF 1
    002D 1FFF 1
    002E 1FFF 1
    002F 1FFF 1
    0030 1FFF 1
    0031 1FFF 1
    0032 1FFF 1
    0033 1FFF 1
    0034 1FFF 1
    0035 1FFF 1
    0036 1FFF 1
    0037 1FFF 1
    0038 1FFF 1
    0039 1FFF 1
    003A 1FFF 1
    003B 1FFF 1
    003C 1FFF 1
    003D 1FFF 1
    003E 1FFF 1
    003F 1FFF 1
    0040 1FFF 1
    0041 1FFF 1
    0042 1FFF 1
    0043 1FFF 1
    0044 1FFF 1
    0045 1FFF 1
    0046 1FFF 1
    0047 1FFF 1
    0048 1FFF 1
    0049 1FFF 1
    004A 1FFF 1
    004B 1FFF 1
    004C 1FFF 1
    004D 1FFF 1
    004E 1FFF 1
    004F 1FFF 1
    0050 1FFF 1
    0051 1FFF 1
    0052 1FFF 1
    0053 1FFF 1
    0054 1FFF 1
    0055 1FFF 1
    0056 1FFF 1
    0057 1FFF 1
    0058 1FFF 1
    0059 1FFF 1
    005A 1FFF 1
    005B 1FFF 1
    005C 1FFF 1
    005D 1FFF 1
    005E 1FFF 1
    005F 1FFF 1
    0060 1FFF 1
    0061 1FFF 1
    0062 1FFF 1
    0063 1FFF 1
    0064 1FFF 1
    0065 1FFF 1
    0066 1FFF 1
    0067 1FFF 1
    0068 1FFF 1
    0069 1FFF 1
    006A 1FFF 1
    006B 1FFF 1
    006C 1FFF 1
    006D 1FFF 1
    006E 1FFF 1
    006F 1FFF 1
    0070 1FFF 1
    0071 1FFF 1
    0072 1FFF 1
    0073 1FFF 1
    0074 1FFF 1
    0075 1FFF 1
    0076 1FFF 1
    0077 1FFF 1
    0078 1FFF 1
    0079 1FFF 1
    007A 1FFF 1
    007B 1FFF 1
    007C 1FFF 1
    007D 1FFF 1
    007E 1FFF 1
    007F 1FFF 1
    0080 1FFF 1
    0081 1FFF 1
    0082 1FFF 1
    0083 1FFF 1
    0084 1FFF 1
    0085 1FFF 1
    0086 1FFF 1
    0087 1FFF 1
    0088 1FFF 1
    0089 1FFF 1
    008A 1FFF 1
    008B 1FFF 1
    008C 1FFF 1
    008D 1FFF 1
    008E 1FFF 1
    008F 1FFF 1
    0090 1FFF 1
    0091 1FFF 1
    0092 1FFF 1
    0093 1FFF 1
    0094 1FFF 1
    0095 1FFF 1
    0096 1FFF 1
    0097 1FFF 1
    0098 1FFF 1
    0099 1FFF 1
    009A 1FFF 1
    009B 1FFF 1
    009C 1FFF 1
    009D 1FFF 1
    009E 1FFF 1
    009F 1FFF 1
    00A0 1FFF 1
    00A1 1FFF 1
    00A2 1FFF 1
    00A3 1FFF 1
    00A4 1FFF 1
    00A5 1FFF 1
    00A6 1FFF 1
    00A7 1FFF 1
    00A8 1FFF 1
    00A9 1FFF 1
    00AA 1FFF 1
    00AB 1FFF 1
    00AC 1FFF 1
    00AD 1FFF 1
    00AE 1FFF 1
    00AF 1FFF 1
    00B0 1FFF 1
    00B1 1FFF 1
    00B2 1FFF 1
    00B3 1FFF 1
    00B4 1FFF 1
    00B5 1FFF 1
    00B6 1FFF 1
    00B7 1FFF 1
    00B8 1FFF 1
    00B9 1FFF 1
    00BA 1FFF 1
    00BB 1FFF 1
    00BC 1FFF 1
    00BD 1FFF 1
    00BE 1FFF 1
    00BF 1FFF 1
    00C0 1FFF 1
    00C1 1FFF 1
    00C2 1FFF 1
    00C3 1FFF 1
    00C4 1FFF 1
    00C5 1FFF 1
    00C6 1FFF 1
    00C7 1FFF 1
    00C8 1FFF 1
    00C9 1FFF 1
    00CA 1FFF 1
    00CB 1FFF 1
    00CC 1FFF 1
    00CD 1FFF 1
    00CE 1FFF 1
    00CF 1FFF 1
    00D0 1FFF 1
    00D1 1FFF 1
    00D2 1FFF 1
    00D3 1FFF 1
    00D4 1FFF 1
    00D5 1FFF 1
    00D6 1FFF 1
    00D7 1FFF 1
    00D8 1FFF 1
    00D9 1FFF 1
    00DA 1FFF 1
    00DB 1FFF 1
    00DC 1FFF 1
    00DD 1FFF 1
    00DE 1FFF 1
    00DF 1FFF 1
    00E0 1FFF 1
    00E1 1FFF 1
    00E2 1FFF 1
    00E3 1FFF 1
    00E4 1FFF 1
    00E5 1FFF 1
    00E6 1FFF 1
    00E7 1FFF 1
    00E8 1FFF 1
    00E9 1FFF 1
    00EA 1FFF 1
    00EB 1FFF 1
    00EC 1FFF 1
    00ED 1FFF 1
    00EE 1FFF 1
    00EF 1FFF 1
    00F0 1FFF 1
    00F1 1FFF 1
    00F2 1FFF 1
    00F3 1FFF 1
    00F4 1FFF 1
    00F5 1FFF 1
    00F6 1FFF 1
    00F7 1FFF 1
    00F8 1FFF 1
    00F9 1FFF 1
    00FA 1FFF 1
    00FB 1FFF 1
    00FC 1FFF 1
    00FD 1FFF 1
    00FE 1FFF 1
    00FF 1FFF 1
    0100 1FFF 1
    0101 1FFF 1
    0102 1FFF 1
    0103 1FFF 1
    0104 1FFF 1
    0105 1FFF 1
    0106 1FFF 1
    0107 1FFF 1
    0108 1FFF 1
    0109 1FFF 1
    010A 1FFF 1
    010B 1FFF 1
    010C 1FFF 1
    010D 1FFF 1
    010E 1FFF 1
    010F 1FFF 1
    0110 1FFF 1
    0111 1FFF 1
    0112 1FFF 1
    0113 1FFF 1
    0114 1FFF 1
    0115 1FFF 1
    0116 1FFF 1
    0117 1FFF 1
    0118 1FFF 1
    0119 1FFF 1
    011A 1FFF 1
    011B 1FFF 1
    011C 1FFF 1
    011D 1FFF 1
    011E 1FFF 1
    011F 1FFF 1
    0120 1FFF 1
    0121 1FFF 1
    0122 1FFF 1
    0123 1FFF 1
    0124 1FFF 1
    0125 1FFF 1
    0126 1FFF 1
    0127 1FFF 1
    0128 1FFF 1
    0129 1FFF 1
    012A 1FFF 1
    012B 1FFF 1
    012C 1FFF 1
    012D 1FFF 1
    012E 1FFF 1
    012F 1FFF 1
    0130 1FFF 1
    0131 1FFF 1
    0132 1FFF 1
    0133 1FFF 1
    0134 1FFF 1
    0135 1FFF 1
    0136 1FFF 1
    0137 1FFF 1
    0138 1FFF 1
    0139 1FFF 1
    013A 1FFF 1
    013B 1FFF 1
    013C 1FFF 1
    013D 1FFF 1
    013E 1FFF 1
    013F 1FFF 1
    0140 1FFF 1
    0141 1FFF 1
    0142 1FFF 1
    0143 1FFF 1
    0144 1FFF 1
    0145 1FFF 1
    0146 1FFF 1
    0147 1FFF 1
    0148 1FFF 1
    0149 1FFF 1
    014A 1FFF 1
    014B 1FFF 1
    014C 1FFF 1
    014D 1FFF 1
    014E 1FFF 1
    014F 1FFF 1
    0150 1FFF 1
    0151 1FFF 1
    0152 1FFF 1
    0153 1FFF 1
    0154 1FFF 1
    0155 1FFF 1
    0156 1FFF 1
    0157 1FFF 1
    0158 1FFF 1
    0159 1FFF 1
    015A 1FFF 1
    015B 1FFF 1
    015C 1FFF 1
    015D 1FFF 1
    015E 1FFF 1
    015F 1FFF 1
    0160 1FFF 1
    0161 1FFF 1
    0162 1FFF 1
    0163 1FFF 1
    0164 1FFF 1
    0165 1FFF 1
    0166 1FFF 1
    0167 1FFF 1
    0168 1FFF 1
    0169 1FFF 1
    016A 1FFF 1
    016B 1FFF 1
    016C 1FFF 1
    016D 1FFF 1
    016E 1FFF 1
    016F 1FFF 1
    0170 1FFF 1
    0171 1FFF 1
    0172 1FFF 1
    0173 1FFF 1
    0174 1FFF 1
    0175 1FFF 1
    0176 1FFF 1
    0177 1FFF 1
    0178 1FFF 1
    0179 1FFF 1
    017A 1FFF 1
    017B 1FFF 1
    017C 1FFF 1
    017D 1FFF 1
    017E 1FFF 1
    017F 1FFF 1
    [cut to keep message under 50k chars - they're all 1FFF anyway]
    07C0 1FFF 1
    07C1 1FFF 1
    07C2 1FFF 1
    07C3 1FFF 1
    07C4 1FFF 1
    07C5 1FFF 1
    07C6 1FFF 1
    07C7 1FFF 1
    07C8 1FFF 1
    07C9 1FFF 1
    07CA 1FFF 1
    07CB 1FFF 1
    07CC 1FFF 1
    07CD 1FFF 1
    07CE 1FFF 1
    07CF 1FFF 1
    07D0 1FFF 1
    07D1 1FFF 1
    07D2 1FFF 1
    07D3 1FFF 1
    07D4 1FFF 1
    07D5 1FFF 1
    07D6 1FFF 1
    07D7 1FFF 1
    07D8 1FFF 1
    07D9 1FFF 1
    07DA 1FFF 1
    07DB 1FFF 1
    07DC 1FFF 1
    07DD 1FFF 1
    07DE 1FFF 1
    07DF 1FFF 1

 274899016: FLASH_WRITE_B

    ADDR -W1- -W2- -W3- -W4-
    ------------------------
    0000 0070 2F00 0182 3FED
    0004 018B 3FEE 019A 2F80
    0008 019B 2F1C 0183 3FFE
    000C 2AFF 3054 3FED 0B81
    0010 1F91 2F05 0B80 1AD0
    0014 3013 1F90 0063 3016
    0018 1180 3016 1D90 18D0
    001C 301B 2F01 1950 2FFF
    0020 0C01 018B 0B81 1AD0
    0024 3023 1B50 304F 2F04
    0028 0188 18D0 3029 2F02
    002C 0182 1304 1305 2F6E
    0030 0B82 2F00 0B83 0006
    0034 0B04 0007 0805 1584
    0038 1685 1004 1282 1083
    003C 1A40 3033 1F90 1AD0
    0040 303F 1584 1685 0590
    0044 18D0 3044 1950 303F
    0048 1D90 1AD0 3049 18D0
    004C 304B 1B50 302B 18D0
    0050 304F 1B50 3011 3053
    0054 018B 1ED1 1ED0 2F03
    0058 0BC1 2F8A 0BC0 2F56
    005C 0063 305C 11C0 305C
    0060 11C1 305C 1CD0 2F03
    0064 0BC1 2F8A 0BC0 2F56
    0068 0063 3068 11C0 3068
    006C 11C1 3068 3056 3FFF


 282886516: FLASH_WRITE_B

    ADDR -W1- -W2- -W3- -W4-
    ------------------------
    07EC 3FFF 0281 027A 1FFE
    07F0 0026 0026 3FFF 3FFF
    07F8 1850 3F54 3FFF 3FFF
    07FC 3FFF 3FFF 02FF 31FD


 290648067: FLASH_READ_B

    ADDR DATA ?
    -----------
    07E0 1FFF 0
    07E1 1FFF 0
    07E2 1FFF 1
    07E3 1FFF 1
    07E4 1FFF 1
    07E5 1FFF 1
    07E6 1FFF 1
    07E7 1FFF 1
    07E8 1FFF 1
    07E9 1FFF 1
    07EA 1FFF 1
    07EB 1FFF 1
    07EC 1FFF 1
    07ED 0281 1
    07EE 027A 1
    07EF 1FFE 0
    07F0 0026 0
    07F1 0026 1
    07F2 1FFF 0
    07F3 1FFF 0
    07F4 1FFF 1
    07F5 1FFF 1
    07F6 1FFF 1
    07F7 1FFF 1
    07F8 1850 1
    07F9 1F54 1
    07FA 1FFF 1
    07FB 1FFF 1
    07FC 1FFF 1
    07FD 1FFF 1
    07FE 02FF 1
    07FF 11FD 1

 296125972: FLASH_READ_B

    ADDR DATA ?
    -----------
    0000 0070 0
    0001 0F00 0
    0002 0182 0
    0003 1FED 0
    0004 018B 0
    0005 1FEE 1
    0006 019A 0
    0007 0F80 1
    0008 019B 0
    0009 0F1C 0
    000A 0183 0
    000B 1FFE 0
    000C 0AFF 0
    000D 1054 1
    000E 1FED 0
    000F 0B81 1
    0010 1F91 1
    0011 0F05 0
    0012 0B80 1
    0013 1AD0 0
    0014 1013 0
    0015 1F90 1
    0016 0063 1
    0017 1016 1
    0018 1180 0
    0019 1016 1
    001A 1D90 1
    001B 18D0 1
    001C 101B 1
    001D 0F01 1
    001E 1950 1
    001F 0FFF 0
    0020 0C01 1
    0021 018B 0
    0022 0B81 0
    0023 1AD0 0
    0024 1023 0
    0025 1B50 1
    0026 104F 1
    0027 0F04 1
    0028 0188 1
    0029 18D0 0
    002A 1029 0
    002B 0F02 1
    002C 0182 1
    002D 1304 0
    002E 1305 0
    002F 0F6E 1
    0030 0B82 1
    0031 0F00 0
    0032 0B83 0
    0033 0006 0
    0034 0B04 0
    0035 0007 0
    0036 0805 0
    0037 1584 0
    0038 1685 0
    0039 1004 1
    003A 1282 1
    003B 1083 1
    003C 1A40 1
    003D 1033 1
    003E 1F90 1
    003F 1AD0 1
    0040 103F 1
    0041 1584 1
    0042 1685 1
    0043 0590 1
    0044 18D0 1
    0045 1044 0
    0046 1950 1
    0047 103F 1
    0048 1D90 1
    0049 1AD0 1
    004A 1049 1
    004B 18D0 1
    004C 104B 1
    004D 1B50 1
    004E 102B 1
    004F 18D0 1
    0050 104F 1
    0051 1B50 1
    0052 1011 1
    0053 1053 1
    0054 018B 1
    0055 1ED1 1
    0056 1ED0 0
    0057 0F03 1
    0058 0BC1 1
    0059 0F8A 0
    005A 0BC0 0
    005B 0F56 0
    005C 0063 0
    005D 105C 0
    005E 11C0 0
    005F 105C 1
    0060 11C1 1
    0061 105C 1
    0062 1CD0 1
    0063 0F03 1
    0064 0BC1 1
    0065 0F8A 0
    0066 0BC0 0
    0067 0F56 0
    0068 0063 0
    0069 1068 0
    006A 11C0 0
    006B 1068 1
    006C 11C1 1
    006D 1068 1
    006E 1056 1
    006F 1FFF 1

 304013520: FLASH_READ_B

    ADDR DATA ?
    -----------
    07E0 1FFF 0
    07E1 1FFF 0
    07E2 1FFF 1
    07E3 1FFF 1
    07E4 1FFF 1
    07E5 1FFF 1
    07E6 1FFF 1
    07E7 1FFF 1
    07E8 1FFF 1
    07E9 1FFF 1
    07EA 1FFF 1
    07EB 1FFF 1
    07EC 1FFF 1
    07ED 0281 1
    07EE 027A 1
    07EF 1FFE 0
    07F0 0002 0
    07F1 0002 1
    07F2 1FFF 0
    07F3 1FFF 0
    07F4 1FFF 1
    07F5 1FFF 1
    07F6 1FFF 1
    07F7 1FFF 1
    07F8 1850 1
    07F9 1F54 1
    07FA 1FFF 1
    07FB 1FFF 1
    07FC 1FFF 1
    07FD 1FFF 1
    07FE 027F 1
    07FF 11FD 1

 308485046: FLASH_READ_B

    ADDR DATA ?
    -----------
    0000 0070 0
    0001 0F00 0
    0002 0180 0
    0003 1FED 0
    0004 0183 0
    0005 1FEE 0
    0006 0198 0
    0007 0F80 0
    0008 0199 0
    0009 071C 0
    000A 0181 0
    000B 1FFE 0
    000C 02FF 0
    000D 1054 0
    000E 1FED 0
    000F 0981 1
    0010 1F91 1
    0011 0701 0
    0012 0380 0
    0013 1AD0 0
    0014 1013 0
    0015 1F90 1
    0016 0063 1
    0017 1012 1
    0018 1180 0
    0019 1006 0
    001A 1D90 1
    001B 1850 1
    001C 101B 1
    001D 0F00 1
    001E 1910 1
    001F 0FFF 0
    0020 0C00 1
    0021 008B 0
    0022 0B81 0
    0023 1AD0 0
    0024 1023 0
    0025 1950 1
    0026 104F 1
    0027 0F00 0
    0028 0180 1
    0029 18D0 0
    002A 1020 0
    002B 0F02 1
    002C 0080 1
    002D 1304 0
    002E 1301 0
    002F 0F6E 0
    0030 0B80 1
    0031 0F00 0
    0032 0B83 0
    0033 0006 0
    0034 0900 0
    0035 0003 0
    0036 0005 0
    0037 1584 0
    0038 1685 0
    0039 1000 0
    003A 1202 1
    003B 1081 1
    003C 1A40 1
    003D 1013 1
    003E 1F90 1
    003F 1AD0 1
    0040 103F 1
    0041 1584 1
    0042 1285 1
    0043 0590 1
    0044 1850 1
    0045 1004 0
    0046 1910 1
    0047 101F 1
    0048 1C90 1
    0049 1AD0 1
    004A 1000 1
    004B 18D0 1
    004C 1003 1
    004D 1B50 1
    004E 1023 1
    004F 1850 1
    0050 1007 1
    0051 1B50 1
    0052 1011 1
    0053 1013 1
    0054 0183 1
    0055 1ED1 1
    0056 1ED0 0
    0057 0F03 1
    0058 0BC0 1
    0059 0F8A 0
    005A 0BC0 0
    005B 0F56 0
    005C 0063 0
    005D 105C 0
    005E 10C0 0
    005F 101C 1
    0060 11C0 1
    0061 101C 1
    0062 1CD0 1
    0063 0F03 1
    0064 03C0 1
    0065 0F8A 0
    0066 0BC0 0
    0067 0F56 0
    0068 0063 0
    0069 1060 0
    006A 10C0 0
    006B 1028 1
    006C 10C1 1
    006D 1028 1
    006E 1056 1
    006F 1FFF 1

 315382652: FLASH_WRITE_B

    ADDR -W1- -W2- -W3- -W4-
    ------------------------
    0000 0070 2F00 0182 3FED
    0004 018B 3FEE 019A 2F80
    0008 019B 2F1C 0183 3FFE
    000C 2AFF 3054 3FED 0B81
    0010 1F91 2F05 0B80 1AD0
    0014 3013 1F90 0063 3016
    0018 1180 3016 1D90 18D0
    001C 301B 2F01 1950 2FFF
    0020 0C01 018B 0B81 1AD0
    0024 3023 1B50 304F 2F04
    0028 0188 18D0 3029 2F02
    002C 0182 1304 1305 2F6E
    0030 0B82 2F00 0B83 0006
    0034 0B04 0007 0805 1584
    0038 1685 1004 1282 1083
    003C 1A40 3033 1F90 1AD0
    0040 303F 1584 1685 0590
    0044 18D0 3044 1950 303F
    0048 1D90 1AD0 3049 18D0
    004C 304B 1B50 302B 18D0
    0050 304F 1B50 3011 3053
    0054 018B 1ED1 1ED0 2F03
    0058 0BC1 2F8A 0BC0 2F56
    005C 0063 305C 11C0 305C
    0060 11C1 305C 1CD0 2F03
    0064 0BC1 2F8A 0BC0 2F56
    0068 0063 3068 11C0 3068
    006C 11C1 3068 3056 3FFF


 326049413: 0000001101001010001110011010010100011100
 348308113: 0000001101001010001110011010010100011100
 373491264: FLASH_WRITE_B

    ADDR -W1- -W2- -W3- -W4-
    ------------------------
    07EC 3FFF 0281 027A 1FFE
    07F0 0026 0026 3FFF 3FFF
    07F8 1850 3F54 3FFF 3FFF
    07FC 3FFF 3FFF 0282 31FD


 378464965: FLASH_READ_B

    ADDR DATA ?
    -----------
    07E0 1FFF 0
    07E1 1FFF 0
    07E2 1FFF 1
    07E3 1FFF 1
    07E4 1FFF 1
    07E5 1FFF 1
    07E6 1FFF 1
    07E7 1FFF 1
    07E8 1FFF 1
    07E9 1FFF 1
    07EA 1FFF 1
    07EB 1FFF 1
    07EC 1FFF 1
    07ED 0281 1
    07EE 027A 1
    07EF 1FFE 0
    07F0 0026 0
    07F1 0026 1
    07F2 1FFF 0
    07F3 1FFF 0
    07F4 1FFF 1
    07F5 1FFF 1
    07F6 1FFF 1
    07F7 1FFF 1
    07F8 1850 1
    07F9 1F54 1
    07FA 1FFF 1
    07FB 1FFF 1
    07FC 1FFF 1
    07FD 1FFF 1
    07FE 0282 1
    07FF 11FD 1

 383944624: FLASH_READ_B

    ADDR DATA ?
    -----------
    07E0 1FFF 0
    07E1 1FFF 0
    07E2 1FFF 1
    07E3 1FFF 1
    07E4 1FFF 1
    07E5 1FFF 1
    07E6 1FFF 1
    07E7 1FFF 1
    07E8 1FFF 1
    07E9 1FFF 1
    07EA 1FFF 1
    07EB 1FFF 1
    07EC 1FFF 1
    07ED 0281 1
    07EE 027A 1
    07EF 1FFE 0
    07F0 0002 0
    07F1 0002 1
    07F2 1FFF 0
    07F3 1FFF 0
    07F4 1FFF 1
    07F5 1FFF 1
    07F6 1FFF 1
    07F7 1FFF 1
    07F8 1850 1
    07F9 1F54 1
    07FA 1FFF 1
    07FB 1FFF 1
    07FC 1FFF 1
    07FD 1FFF 1
    07FE 0202 1
    07FF 11FD 1

 388416397: FLASH_WRITE_B

    ADDR -W1- -W2- -W3- -W4-
    ------------------------
    07EC 3FFF 0281 027A 1FFE
    07F0 0026 0026 3FFF 3FFF
    07F8 1850 3F54 3FFF 3FFF
    07FC 3FFF 3FFF 0282 31FD




And when sampling on the falling edge:
Code: [Select]
116050423: FLASH_READ_A
    No data (dummy read)

 121460335: FLASH_READ_A

    ADDR DATA ?
    -----------
    07EF 1FFE 0
    07F0 0025 0
    07F1 0025 1

 125171918: ??? (1010010110100101101001011010001100011010101000010)

 132819443: ??? (1010010110100101101001011010011001111010101000010)

 189654150: FLASH_WRITE_A

    ADDR -W1- -W2- -W3- -W4-
    ------------------------
    07F0 0026 3FFF 3FFF 3FFF


 194375883: FLASH_READ_A

    ADDR DATA ?
    -----------
    07F0 0026 0

 198033633: FLASH_WRITE_A

    ADDR -W1- -W2- -W3- -W4-
    ------------------------
    07F0 3FFF 0026 3FFF 3FFF


 202755366: FLASH_READ_A

    ADDR DATA ?
    -----------
    07F1 0026 1

 206415178: FLASH_READ_A

    ADDR DATA ?
    -----------
    07E0 3FFF 0
    07E1 3FFF 0
    07E2 3FFF 1
    07E3 3FFF 1
    07E4 3FFF 1
    07E5 3FFF 1
    07E6 3FFF 1
    07E7 3FFF 1
    07E8 3FFF 1
    07E9 3FFF 1
    07EA 3FFF 1
    07EB 3FFF 1
    07EC 3FFF 1
    07ED 0281 1
    07EE 027A 1
    07EF 1FFE 0
    07F0 0026 0
    07F1 0026 1
    07F2 3FFF 0
    07F3 3FFF 0
    07F4 3FFF 1
    07F5 3FFF 1
    07F6 3FFF 1
    07F7 3FFF 1
    07F8 3FFF 1
    07F9 3FFF 1
    07FA 3FFF 1
    07FB 3FFF 1
    07FC 3FFF 1
    07FD 3FFF 1
    07FE 3FFF 1
    07FF 3FFF 1

 210877122: FLASH_READ_A

    ADDR DATA ?
    -----------
    07E0 3FFF 0
    07E1 3FFF 0
    07E2 3FFF 1
    07E3 3FFF 1
    07E4 3FFF 1
    07E5 3FFF 1
    07E6 3FFF 1
    07E7 3FFF 1
    07E8 3FFF 1
    07E9 3FFF 1
    07EA 3FFF 1
    07EB 3FFF 1
    07EC 3FFF 1
    07ED 0281 1
    07EE 027A 1
    07EF 1FFE 0
    07F0 0026 0
    07F1 0026 1
    07F2 3FFF 0
    07F3 3FFF 0
    07F4 3FFF 1
    07F5 3FFF 1
    07F6 3FFF 1
    07F7 3FFF 1
    07F8 3FFF 1
    07F9 3FFF 1
    07FA 3FFF 1
    07FB 3FFF 1
    07FC 3FFF 1
    07FD 3FFF 1
    07FE 3FFF 1
    07FF 3FFF 1

 216360794: FLASH_READ_A

    ADDR DATA ?
    -----------
    0000 3FFF 0
    0001 3FFF 0
    0002 3FFF 1
    0003 3FFF 1
    0004 3FFF 1
    0005 3FFF 1
    0006 3FFF 1
    0007 3FFF 1
    0008 3FFF 1
    0009 3FFF 1
    000A 3FFF 1
    000B 3FFF 1
    000C 3FFF 1
    000D 3FFF 1
    000E 3FFF 1
    000F 3FFF 1
    0010 3FFF 1
    0011 3FFF 1
    0012 3FFF 1
    0013 3FFF 1
    0014 3FFF 1
    0015 3FFF 1
    0016 3FFF 1
    0017 3FFF 1
    0018 3FFF 1
    0019 3FFF 1
    001A 3FFF 1
    001B 3FFF 1
    001C 3FFF 1
    001D 3FFF 1
    001E 3FFF 1
    001F 3FFF 1
    0020 3FFF 1
    0021 3FFF 1
    0022 3FFF 1
    0023 3FFF 1
    0024 3FFF 1
    0025 3FFF 1
    0026 3FFF 1
    0027 3FFF 1
    0028 3FFF 1
    0029 3FFF 1
    002A 3FFF 1
    002B 3FFF 1
    002C 3FFF 1
    002D 3FFF 1
    002E 3FFF 1
    002F 3FFF 1
    0030 3FFF 1
    0031 3FFF 1
    0032 3FFF 1
    0033 3FFF 1
    0034 3FFF 1
    0035 3FFF 1
    0036 3FFF 1
    0037 3FFF 1
    0038 3FFF 1
    0039 3FFF 1
    003A 3FFF 1
    003B 3FFF 1
    003C 3FFF 1
    003D 3FFF 1
    003E 3FFF 1
    003F 3FFF 1
    0040 3FFF 1
    0041 3FFF 1
    0042 3FFF 1
    0043 3FFF 1
    0044 3FFF 1
    0045 3FFF 1
    0046 3FFF 1
    0047 3FFF 1
    0048 3FFF 1
    0049 3FFF 1
    004A 3FFF 1
    004B 3FFF 1
    004C 3FFF 1
    004D 3FFF 1
    004E 3FFF 1
    004F 3FFF 1
    0050 3FFF 1
    0051 3FFF 1
    0052 3FFF 1
    0053 3FFF 1
    0054 3FFF 1
    0055 3FFF 1
    0056 3FFF 1
    0057 3FFF 1
    0058 3FFF 1
    0059 3FFF 1
    005A 3FFF 1
    005B 3FFF 1
    005C 3FFF 1
    005D 3FFF 1
    005E 3FFF 1
    005F 3FFF 1
    0060 3FFF 1
    0061 3FFF 1
    0062 3FFF 1
    0063 3FFF 1
    0064 3FFF 1
    0065 3FFF 1
    0066 3FFF 1
    0067 3FFF 1
    0068 3FFF 1
    0069 3FFF 1
    006A 3FFF 1
    006B 3FFF 1
    006C 3FFF 1
    006D 3FFF 1
    006E 3FFF 1
    006F 3FFF 1
    0070 3FFF 1
    0071 3FFF 1
    0072 3FFF 1
    0073 3FFF 1
    0074 3FFF 1
    0075 3FFF 1
    0076 3FFF 1
    0077 3FFF 1
    0078 3FFF 1
    0079 3FFF 1
    007A 3FFF 1
    007B 3FFF 1
    007C 3FFF 1
    007D 3FFF 1
    007E 3FFF 1
    007F 3FFF 1
    0080 3FFF 1
    0081 3FFF 1
    0082 3FFF 1
    0083 3FFF 1
    0084 3FFF 1
    0085 3FFF 1
    0086 3FFF 1
    0087 3FFF 1
    0088 3FFF 1
    0089 3FFF 1
    008A 3FFF 1
    008B 3FFF 1
    008C 3FFF 1
    008D 3FFF 1
    008E 3FFF 1
    008F 3FFF 1
    0090 3FFF 1
    0091 3FFF 1
    0092 3FFF 1
    0093 3FFF 1
    0094 3FFF 1
    0095 3FFF 1
    0096 3FFF 1
    0097 3FFF 1
    0098 3FFF 1
    0099 3FFF 1
    009A 3FFF 1
    009B 3FFF 1
    009C 3FFF 1
    009D 3FFF 1
    009E 3FFF 1
    009F 3FFF 1
    00A0 3FFF 1
    00A1 3FFF 1
    00A2 3FFF 1
    00A3 3FFF 1
    00A4 3FFF 1
    00A5 3FFF 1
    00A6 3FFF 1
    00A7 3FFF 1
    00A8 3FFF 1
    00A9 3FFF 1
    00AA 3FFF 1
    00AB 3FFF 1
    00AC 3FFF 1
    00AD 3FFF 1
    00AE 3FFF 1
    00AF 3FFF 1
    00B0 3FFF 1
    00B1 3FFF 1
    00B2 3FFF 1
    00B3 3FFF 1
    00B4 3FFF 1
    00B5 3FFF 1
    00B6 3FFF 1
    00B7 3FFF 1
    00B8 3FFF 1
    00B9 3FFF 1
    00BA 3FFF 1
    00BB 3FFF 1
    00BC 3FFF 1
    00BD 3FFF 1
    00BE 3FFF 1
    00BF 3FFF 1
    00C0 3FFF 1
    00C1 3FFF 1
    00C2 3FFF 1
    00C3 3FFF 1
    00C4 3FFF 1
    00C5 3FFF 1
    00C6 3FFF 1
    00C7 3FFF 1
    00C8 3FFF 1
    00C9 3FFF 1
    00CA 3FFF 1
    00CB 3FFF 1
    00CC 3FFF 1
    00CD 3FFF 1
    00CE 3FFF 1
    00CF 3FFF 1
    00D0 3FFF 1
    00D1 3FFF 1
    00D2 3FFF 1
    00D3 3FFF 1
    00D4 3FFF 1
    00D5 3FFF 1
    00D6 3FFF 1
    00D7 3FFF 1
    00D8 3FFF 1
    00D9 3FFF 1
    00DA 3FFF 1
    00DB 3FFF 1
    00DC 3FFF 1
    00DD 3FFF 1
    00DE 3FFF 1
    00DF 3FFF 1
    00E0 3FFF 1
    00E1 3FFF 1
    00E2 3FFF 1
    00E3 3FFF 1
    00E4 3FFF 1
    00E5 3FFF 1
    00E6 3FFF 1
    00E7 3FFF 1
    00E8 3FFF 1
    00E9 3FFF 1
    00EA 3FFF 1
    00EB 3FFF 1
    00EC 3FFF 1
    00ED 3FFF 1
    00EE 3FFF 1
    00EF 3FFF 1
    00F0 3FFF 1
    00F1 3FFF 1
    00F2 3FFF 1
    00F3 3FFF 1
    00F4 3FFF 1
    00F5 3FFF 1
    00F6 3FFF 1
    00F7 3FFF 1
    00F8 3FFF 1
    00F9 3FFF 1
    00FA 3FFF 1
    00FB 3FFF 1
    00FC 3FFF 1
    00FD 3FFF 1
    00FE 3FFF 1
    00FF 3FFF 1
    0100 3FFF 1
    0101 3FFF 1
    0102 3FFF 1
    0103 3FFF 1
    0104 3FFF 1
    0105 3FFF 1
    0106 3FFF 1
    0107 3FFF 1
    0108 3FFF 1
    0109 3FFF 1
    010A 3FFF 1
    010B 3FFF 1
    010C 3FFF 1
    010D 3FFF 1
    010E 3FFF 1
    010F 3FFF 1
    0110 3FFF 1
    0111 3FFF 1
    0112 3FFF 1
    0113 3FFF 1
    0114 3FFF 1
    0115 3FFF 1
    0116 3FFF 1
    0117 3FFF 1
    0118 3FFF 1
    0119 3FFF 1
    011A 3FFF 1
    011B 3FFF 1
    011C 3FFF 1
    011D 3FFF 1
    011E 3FFF 1
    011F 3FFF 1
    0120 3FFF 1
    0121 3FFF 1
    0122 3FFF 1
    0123 3FFF 1
    0124 3FFF 1
    0125 3FFF 1
    0126 3FFF 1
    0127 3FFF 1
    0128 3FFF 1
    0129 3FFF 1
    012A 3FFF 1
    012B 3FFF 1
    012C 3FFF 1
    012D 3FFF 1
    012E 3FFF 1
    012F 3FFF 1
    0130 3FFF 1
    0131 3FFF 1
    0132 3FFF 1
    0133 3FFF 1
    0134 3FFF 1
    0135 3FFF 1
    0136 3FFF 1
    0137 3FFF 1
    0138 3FFF 1
    0139 3FFF 1
    013A 3FFF 1
    013B 3FFF 1
    013C 3FFF 1
    013D 3FFF 1
    013E 3FFF 1
    013F 3FFF 1
    0140 3FFF 1
    0141 3FFF 1
    0142 3FFF 1
    0143 3FFF 1
    0144 3FFF 1
    0145 3FFF 1
    0146 3FFF 1
    0147 3FFF 1
    0148 3FFF 1
    0149 3FFF 1
    014A 3FFF 1
    014B 3FFF 1
    014C 3FFF 1
    014D 3FFF 1
    014E 3FFF 1
    014F 3FFF 1
    0150 3FFF 1
    0151 3FFF 1
    0152 3FFF 1
    0153 3FFF 1
    0154 3FFF 1
    0155 3FFF 1
    0156 3FFF 1
    0157 3FFF 1
    0158 3FFF 1
    0159 3FFF 1
    015A 3FFF 1
    015B 3FFF 1
    015C 3FFF 1
    015D 3FFF 1
    015E 3FFF 1
    015F 3FFF 1
    0160 3FFF 1
    0161 3FFF 1
    0162 3FFF 1
    0163 3FFF 1
    0164 3FFF 1
    0165 3FFF 1
    0166 3FFF 1
    0167 3FFF 1
    0168 3FFF 1
    0169 3FFF 1
    016A 3FFF 1
    016B 3FFF 1
    016C 3FFF 1
    016D 3FFF 1
    016E 3FFF 1
    016F 3FFF 1
    0170 3FFF 1
    0171 3FFF 1
    0172 3FFF 1
    0173 3FFF 1
    0174 3FFF 1
    0175 3FFF 1
    0176 3FFF 1
    0177 3FFF 1
    0178 3FFF 1
    0179 3FFF 1
    017A 3FFF 1
    017B 3FFF 1
    017C 3FFF 1
    017D 3FFF 1
    017E 3FFF 1
    017F 3FFF 1
    [cut to keep under 50k chars - all is 3FFF]
    07C0 3FFF 1
    07C1 3FFF 1
    07C2 3FFF 1
    07C3 3FFF 1
    07C4 3FFF 1
    07C5 3FFF 1
    07C6 3FFF 1
    07C7 3FFF 1
    07C8 3FFF 1
    07C9 3FFF 1
    07CA 3FFF 1
    07CB 3FFF 1
    07CC 3FFF 1
    07CD 3FFF 1
    07CE 3FFF 1
    07CF 3FFF 1
    07D0 3FFF 1
    07D1 3FFF 1
    07D2 3FFF 1
    07D3 3FFF 1
    07D4 3FFF 1
    07D5 3FFF 1
    07D6 3FFF 1
    07D7 3FFF 1
    07D8 3FFF 1
    07D9 3FFF 1
    07DA 3FFF 1
    07DB 3FFF 1
    07DC 3FFF 1
    07DD 3FFF 1
    07DE 3FFF 1
    07DF 3FFF 1

 274899188: FLASH_WRITE_A

    ADDR -W1- -W2- -W3- -W4-
    ------------------------
    0000 0070 2F00 0182 3FED
    0004 018B 3FEE 019A 2F80
    0008 019B 2F1C 0183 3FFE
    000C 2AFF 3054 3FED 0B81
    0010 1F91 2F05 0B80 1AD0
    0014 3013 1F90 0063 3016
    0018 1180 3016 1D90 18D0
    001C 301B 2F01 1950 2FFF
    0020 0C01 018B 0B81 1AD0
    0024 3023 1B50 304F 2F04
    0028 0188 18D0 3029 2F02
    002C 0182 1304 1305 2F6E
    0030 0B82 2F00 0B83 0006
    0034 0B04 0007 0805 1584
    0038 1685 1004 1282 1083
    003C 1A40 3033 1F90 1AD0
    0040 303F 1584 1685 0590
    0044 18D0 3044 1950 303F
    0048 1D90 1AD0 3049 18D0
    004C 304B 1B50 302B 18D0
    0050 304F 1B50 3011 3053
    0054 018B 1ED1 1ED0 2F03
    0058 0BC1 2F8A 0BC0 2F56
    005C 0063 305C 11C0 305C
    0060 11C1 305C 1CD0 2F03
    0064 0BC1 2F8A 0BC0 2F56
    0068 0063 3068 11C0 3068
    006C 11C1 3068 3056 3FFF


 282886688: FLASH_WRITE_A

    ADDR -W1- -W2- -W3- -W4-
    ------------------------
    07EC 3FFF 0281 027A 1FFE
    07F0 0026 0026 3FFF 3FFF
    07F8 1850 3F54 3FFF 3FFF
    07FC 3FFF 3FFF 02FF 31FD


 290648239: FLASH_READ_A

    ADDR DATA ?
    -----------
    07E0 3FFF 0
    07E1 3FFF 0
    07E2 3FFF 1
    07E3 3FFF 1
    07E4 3FFF 1
    07E5 3FFF 1
    07E6 3FFF 1
    07E7 3FFF 1
    07E8 3FFF 1
    07E9 3FFF 1
    07EA 3FFF 1
    07EB 3FFF 1
    07EC 3FFF 1
    07ED 0281 1
    07EE 027A 1
    07EF 1FFE 0
    07F0 0026 0
    07F1 0026 1
    07F2 3FFF 0
    07F3 3FFF 0
    07F4 3FFF 1
    07F5 3FFF 1
    07F6 3FFF 1
    07F7 3FFF 1
    07F8 1850 1
    07F9 3F54 1
    07FA 3FFF 1
    07FB 3FFF 1
    07FC 3FFF 1
    07FD 3FFF 1
    07FE 02FF 1
    07FF 31FD 1

 296126144: FLASH_READ_A

    ADDR DATA ?
    -----------
    0000 0070 0
    0001 2F00 0
    0002 0182 0
    0003 3FED 0
    0004 018B 0
    0005 3FEE 1
    0006 019A 0
    0007 2F80 1
    0008 019B 0
    0009 2F1C 0
    000A 0183 0
    000B 3FFE 0
    000C 2AFF 0
    000D 3054 1
    000E 3FED 0
    000F 0B81 1
    0010 1F91 1
    0011 2F05 0
    0012 0B80 1
    0013 1AD0 0
    0014 3013 0
    0015 1F90 1
    0016 0063 1
    0017 3016 1
    0018 1180 0
    0019 3016 1
    001A 1D90 1
    001B 18D0 1
    001C 301B 1
    001D 2F01 1
    001E 1950 1
    001F 2FFF 0
    0020 0C01 1
    0021 018B 0
    0022 0B81 0
    0023 1AD0 0
    0024 3023 0
    0025 1B50 1
    0026 304F 1
    0027 2F04 1
    0028 0188 1
    0029 18D0 0
    002A 3029 0
    002B 2F02 1
    002C 0182 1
    002D 1304 0
    002E 1305 0
    002F 2F6E 1
    0030 0B82 1
    0031 2F00 0
    0032 0B83 0
    0033 0006 0
    0034 0B04 0
    0035 0007 0
    0036 0805 0
    0037 1584 0
    0038 1685 0
    0039 1004 1
    003A 1282 1
    003B 1083 1
    003C 1A40 1
    003D 3033 1
    003E 1F90 1
    003F 1AD0 1
    0040 303F 1
    0041 1584 1
    0042 1685 1
    0043 0590 1
    0044 18D0 1
    0045 3044 0
    0046 1950 1
    0047 303F 1
    0048 1D90 1
    0049 1AD0 1
    004A 3049 1
    004B 18D0 1
    004C 304B 1
    004D 1B50 1
    004E 302B 1
    004F 18D0 1
    0050 304F 1
    0051 1B50 1
    0052 3011 1
    0053 3053 1
    0054 018B 1
    0055 1ED1 1
    0056 1ED0 0
    0057 2F03 1
    0058 0BC1 1
    0059 2F8A 0
    005A 0BC0 0
    005B 2F56 0
    005C 0063 0
    005D 305C 0
    005E 11C0 0
    005F 305C 1
    0060 11C1 1
    0061 305C 1
    0062 1CD0 1
    0063 2F03 1
    0064 0BC1 1
    0065 2F8A 0
    0066 0BC0 0
    0067 2F56 0
    0068 0063 0
    0069 3068 0
    006A 11C0 0
    006B 3068 1
    006C 11C1 1
    006D 3068 1
    006E 3056 1
    006F 3FFF 1

 304013692: FLASH_READ_A

    ADDR DATA ?
    -----------
    07E0 3FFF 0
    07E1 3FFF 0
    07E2 3FFF 1
    07E3 3FFF 1
    07E4 3FFF 1
    07E5 3FFF 1
    07E6 3FFF 1
    07E7 3FFF 1
    07E8 3FFF 1
    07E9 3FFF 1
    07EA 3FFF 1
    07EB 3FFF 1
    07EC 3FFF 1
    07ED 0281 1
    07EE 027A 1
    07EF 1FFE 0
    07F0 0026 0
    07F1 0026 1
    07F2 3FFF 0
    07F3 3FFF 0
    07F4 3FFF 1
    07F5 3FFF 1
    07F6 3FFF 1
    07F7 3FFF 1
    07F8 1850 1
    07F9 3F54 1
    07FA 3FFF 1
    07FB 3FFF 1
    07FC 3FFF 1
    07FD 3FFF 1
    07FE 02FF 1
    07FF 31FD 1

 308485218: FLASH_READ_A

    ADDR DATA ?
    -----------
    0000 0070 0
    0001 2F00 0
    0002 0182 0
    0003 3FED 0
    0004 018B 0
    0005 3FEE 0
    0006 019A 0
    0007 2F80 0
    0008 019B 0
    0009 2F1C 0
    000A 0183 0
    000B 3FFE 0
    000C 2AFF 0
    000D 3054 0
    000E 3FED 0
    000F 0B81 1
    0010 1F91 1
    0011 2F05 0
    0012 0B80 0
    0013 1AD0 0
    0014 3013 0
    0015 1F90 1
    0016 0063 1
    0017 3016 1
    0018 1180 0
    0019 3016 0
    001A 1D90 1
    001B 18D0 1
    001C 301B 1
    001D 2F01 1
    001E 1950 1
    001F 2FFF 0
    0020 0C01 1
    0021 018B 0
    0022 0B81 0
    0023 1AD0 0
    0024 3023 0
    0025 1B50 1
    0026 304F 1
    0027 2F04 0
    0028 0188 1
    0029 18D0 0
    002A 3029 0
    002B 2F02 1
    002C 0182 1
    002D 1304 0
    002E 1305 0
    002F 2F6E 0
    0030 0B82 1
    0031 2F00 0
    0032 0B83 0
    0033 0006 0
    0034 0B04 0
    0035 0007 0
    0036 0805 0
    0037 1584 0
    0038 1685 0
    0039 1004 0
    003A 1282 1
    003B 1083 1
    003C 1A40 1
    003D 3033 1
    003E 1F90 1
    003F 1AD0 1
    0040 303F 1
    0041 1584 1
    0042 1685 1
    0043 0590 1
    0044 18D0 1
    0045 3044 0
    0046 1950 1
    0047 303F 1
    0048 1D90 1
    0049 1AD0 1
    004A 3049 1
    004B 18D0 1
    004C 304B 1
    004D 1B50 1
    004E 302B 1
    004F 18D0 1
    0050 304F 1
    0051 1B50 1
    0052 3011 1
    0053 3053 1
    0054 018B 1
    0055 1ED1 1
    0056 1ED0 0
    0057 2F03 1
    0058 0BC1 1
    0059 2F8A 0
    005A 0BC0 0
    005B 2F56 0
    005C 0063 0
    005D 305C 0
    005E 11C0 0
    005F 305C 1
    0060 11C1 1
    0061 305C 1
    0062 1CD0 1
    0063 2F03 1
    0064 0BC1 1
    0065 2F8A 0
    0066 0BC0 0
    0067 2F56 0
    0068 0063 0
    0069 3068 0
    006A 11C0 0
    006B 3068 1
    006C 11C1 1
    006D 3068 1
    006E 3056 1
    006F 3FFF 1

 315382824: FLASH_WRITE_A

    ADDR -W1- -W2- -W3- -W4-
    ------------------------
    0000 0070 2F00 0182 3FED
    0004 018B 3FEE 019A 2F80
    0008 019B 2F1C 0183 3FFE
    000C 2AFF 3054 3FED 0B81
    0010 1F91 2F05 0B80 1AD0
    0014 3013 1F90 0063 3016
    0018 1180 3016 1D90 18D0
    001C 301B 2F01 1950 2FFF
    0020 0C01 018B 0B81 1AD0
    0024 3023 1B50 304F 2F04
    0028 0188 18D0 3029 2F02
    002C 0182 1304 1305 2F6E
    0030 0B82 2F00 0B83 0006
    0034 0B04 0007 0805 1584
    0038 1685 1004 1282 1083
    003C 1A40 3033 1F90 1AD0
    0040 303F 1584 1685 0590
    0044 18D0 3044 1950 303F
    0048 1D90 1AD0 3049 18D0
    004C 304B 1B50 302B 18D0
    0050 304F 1B50 3011 3053
    0054 018B 1ED1 1ED0 2F03
    0058 0BC1 2F8A 0BC0 2F56
    005C 0063 305C 11C0 305C
    0060 11C1 305C 1CD0 2F03
    0064 0BC1 2F8A 0BC0 2F56
    0068 0063 3068 11C0 3068
    006C 11C1 3068 3056 3FFF


 337347740: 0000001010010100011101010100101000111010
 359606267: 0000001010010100011101010100101000111010
 373491436: FLASH_WRITE_A

    ADDR -W1- -W2- -W3- -W4-
    ------------------------
    07EC 3FFF 0281 027A 1FFE
    07F0 0026 0026 3FFF 3FFF
    07F8 1850 3F54 3FFF 3FFF
    07FC 3FFF 3FFF 0282 31FD


 378465137: FLASH_READ_A

    ADDR DATA ?
    -----------
    07E0 3FFF 0
    07E1 3FFF 0
    07E2 3FFF 1
    07E3 3FFF 1
    07E4 3FFF 1
    07E5 3FFF 1
    07E6 3FFF 1
    07E7 3FFF 1
    07E8 3FFF 1
    07E9 3FFF 1
    07EA 3FFF 1
    07EB 3FFF 1
    07EC 3FFF 1
    07ED 0281 1
    07EE 027A 1
    07EF 1FFE 0
    07F0 0026 0
    07F1 0026 1
    07F2 3FFF 0
    07F3 3FFF 0
    07F4 3FFF 1
    07F5 3FFF 1
    07F6 3FFF 1
    07F7 3FFF 1
    07F8 1850 1
    07F9 3F54 1
    07FA 3FFF 1
    07FB 3FFF 1
    07FC 3FFF 1
    07FD 3FFF 1
    07FE 0282 1
    07FF 31FD 1

 383944796: FLASH_READ_A

    ADDR DATA ?
    -----------
    07E0 3FFF 0
    07E1 3FFF 0
    07E2 3FFF 1
    07E3 3FFF 1
    07E4 3FFF 1
    07E5 3FFF 1
    07E6 3FFF 1
    07E7 3FFF 1
    07E8 3FFF 1
    07E9 3FFF 1
    07EA 3FFF 1
    07EB 3FFF 1
    07EC 3FFF 1
    07ED 0281 1
    07EE 027A 1
    07EF 1FFE 0
    07F0 0026 0
    07F1 0026 1
    07F2 3FFF 0
    07F3 3FFF 0
    07F4 3FFF 1
    07F5 3FFF 1
    07F6 3FFF 1
    07F7 3FFF 1
    07F8 1850 1
    07F9 3F54 1
    07FA 3FFF 1
    07FB 3FFF 1
    07FC 3FFF 1
    07FD 3FFF 1
    07FE 0282 1
    07FF 31FD 1

 388416569: FLASH_WRITE_A

    ADDR -W1- -W2- -W3- -W4-
    ------------------------
    07EC 3FFF 0281 027A 1FFE
    07F0 0026 0026 3FFF 3FFF
    07F8 1850 3F54 3FFF 3FFF
    07FC 3FFF 3FFF 0282 31FD




We can now be sure that:
  • There's only a FLASH_{WRITE,READ} command - the reason I was getting two is because the bits weren't being properly samples
  • Data must be sampled on the falling edge, otherwise we miss the first bit judging by the read flash (1FFF in rising vs 3FFF in falling)

EDIT: There's a repo I've made for the tiny Python scripts I'm using, since uploading them manually here is annoying: https://github.com/socram8888/pdkscope
« Last Edit: December 31, 2018, 02:29:06 am by socram »
 

Offline DocBen

  • Regular Contributor
  • *
  • Posts: 111
  • Country: de
Re: EEVblog #1144 - Padauk Programmer Reverse Engineering
« Reply #299 on: December 31, 2018, 07:15:51 am »
Thanks for the new capture.

One odd thing I noticed is that the clock duty cycle changes during the data transmissions (and commands) maybe thats indicative of a handover to the micro being programmed: active output -> pull-up on the programmer side and pulldown on the micro side.

Then the trailing AA1 could be an acknowledge by the micro during commands
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf