Newbie needs help connecting a Bus Pirate to router UART

[Hogwild]

Hi everyone:

Extreme newbie here. I have very little understanding of electronics, but much more computer experience.

I'd like to connect my Bus Pirate v3.6a to a no-name router I've got here. There are four pins that appear to be a UART interface. The pins measure as follows using my DMM:

0V, 5.01V, 1.8V, GND


Now, as a beginner, I probably should've got something simpler, but I already bought the Bus Pirate for its flexibility. The BP documentation lists pinouts of 3.3V and 5V on the Bus Pirate. However, as I understand it, the voltage is contniuously variable. Obviously, I don't want to fry the router, so I thought I'd start by connecting to the router @ 1.8V. How does one do that on the BP? Do you use the 3.3V pin and then adjust it in software?

And which pins and I connecting to which? Gnd is obvious, but what about the other two? The voltages don't seem to fluctuate on either, so how do I know which one is Tx and which one is Rx?

[tunk]

Is this any help?
https://openwrt.org/docs/techref/hardware/port.serial.cables
https://openwrt.org/docs/techref/hardware/port.serial

[Hogwild]

Mm...that's more confusing, really. Lots of theory and info. but more intended for people with experience.

[ledtester]

Some ideas:

1. Trace where the potential TX/RX pins go back to the main processor chip and look up their function in the processor's datasheet.

2. It is likely the device emits serial traffic when it powers up. You can probe a potential TX pin with a scope or logic analyzer when it boots to see if there is an identifiable signal.

3. Same as in #2 but try to identify the device's TX pin by connecting only the RX pin of your Bus Pirate to it. You'll have to guess at the baud rate.

4. This is more advanced, but the TX pin should be low impedance and the RX pin high impedance. By connecting a high resistance voltage divider to the pin you should be able to get an idea of the pin's impedance by seeing how connecting the pin to the divider affects the divider's voltage.

[Hogwild]

Some ideas:

1. Trace where the potential TX/RX pins go back to the main processor chip and look up their function in the processor's datasheet.

2. It is likely the device emits serial traffic when it powers up. You can probe a potential TX pin with a scope or logic analyzer when it boots to see if there is an identifiable signal.

3. Same as in #2 but try to identify the device's TX pin by connecting only the RX pin of your Bus Pirate to it. You'll have to guess at the baud rate.



4. This is more advanced, but the TX pin should be low impedance and the RX pin high impedance. By connecting a high resistance voltage divider to the pin you should be able to get an idea of the pin's impedance by seeing how connecting the pin to the divider affects the divider's voltage.

1. The router's guts are mostly encased in cans. As far as I can tell, those cans appear to be soldered to the board and it would be a huge amount of work to remove them. Or am I just interpreting it wrong. Companies do solder cans to their boards sometimes, don't they?

2. I don't have a logic analyzer. But I do have a scope. I'd REALLY rather not have to unpack the scope (it's deep in a pile of other stuff in a jampacked cupboard) and try hooking it up (which I'd probably do wrong). I tend to get confused sometimes and connect things wrong, and not a in a good way, hence my reluctance to connect the scope. Maybe if other things don't work.

3. This seems more doable for me. I'm still not clear, however, which pin is Rx on Bus Pirate and which would be Tx on the router. Can you help with that?

Ah, is this it?
https://learn.sparkfun.com/tutorials/bus-pirate-v36a-hookup-guide

Should I be using the pins labelled MOSI and MISO on the Bus Pirate?
Master (data) out, Slave in (TX for UART)
Master (data) in, Slave out (RX for UART)

If so, does that mean MOSI is Tx on the Bus Pirate (and goes to Rx on the UART on the router,) and MISO is RX on the Bus Pirate? I ask because I read that some companies like to label pinouts with what they should connect to, not what they do (you know, just for fun).


And all this time I thought Miso was a kind of soup.

[ledtester]

Ah, is this it?
https://learn.sparkfun.com/tutorials/bus-pirate-v36a-hookup-guide

Should I be using the pins labelled MOSI and MISO on the Bus Pirate?
Master (data) out, Slave in (TX for UART)
Master (data) in, Slave out (RX for UART)

That looks right.

MISO is an input line for the Bus Pirate so it should be safe to connect it to either the router's RX or TX pin.

If so, does that mean MOSI is Tx on the Bus Pirate (and goes to Rx on the UART on the router,) and MISO is RX on the Bus Pirate? I ask because I read that some companies like to label pinouts with what they should connect to, not what they do (you know, just for fun).

MOSI MISO stands for Master In/Slave Out so it is unambiguously an input for the master and an output for the slave.

Likewise, MISO MOSI stands for Master Out/Slave In.

The Bus Pirate is the Master in this configuration.

[Hogwild]

Okay, I think I've got it.

Now, I bought the probe-type breakout cable, and I didn't consider that there's no pins where these traces are, just pads with no holes. I really don't want to have solder anything to the pads. Is there a quick/easy way to use the probes to connect to the pads without soldering anything?

[ledtester]

A picture would be very helpful.

Also, what's the make/model of your router? It should have an FCC ID and we can find out a lot from that.

[Hogwild]

To be honest, I've been quiet about that for reasons I won't get into.

[Hogwild]

Ah, is this it?
https://learn.sparkfun.com/tutorials/bus-pirate-v36a-hookup-guide

Should I be using the pins labelled MOSI and MISO on the Bus Pirate?
Master (data) out, Slave in (TX for UART)
Master (data) in, Slave out (RX for UART)

That looks right.

MISO is an input line for the Bus Pirate so it should be safe to connect it to either the router's RX or TX pin.

If so, does that mean MOSI is Tx on the Bus Pirate (and goes to Rx on the UART on the router,) and MISO is RX on the Bus Pirate? I ask because I read that some companies like to label pinouts with what they should connect to, not what they do (you know, just for fun).

MOSI stands for Master In/Slave Out so it is unambiguously an input for the master and an output for the slave.

Likewise, MISO stands for Master Out/Slave In.

The Bus Pirate is the Master in this configuration.

Mmm..don't you have that backwards? MOSI would be Master Out Slave in and MISO would be Master In Slave Out. I think you have it backwards.

[ledtester]

Mmm..don't you have that backwards? MOSI would be Master Out Slave in and MISO would be Master In Slave Out. I think you have it backwards.

Yeah, you're right.

[Hogwild]

Hmm...I can't figure out any obvious way of attaching the probes to the PCB pads. How do people usually go about soldering on headers (straight)?

[ledtester]

Here's a custom jig... probably 3d printed:



From:

How We Hacked a TP-Link Router and Took Home $55,000 in Pwn2Own
https://youtu.be/zjafMP7EgEA

[Hogwild]

Yes, I saw that. It's very impressive, but it looks like it would be pretty price/complicated to make.

[Hogwild]

I'm still not getting any text output on my screen when connecting what (we think) are the correct pins.

Pads on this board measure as follows (from Left to Right).

0V,  5.01V,   1.799-1.800V,  Cont with GND

I took these measurements using what looked like a large ground plane as ground. I don't have access to the MCU or anything like that. As I said, most of the components are covered with cans.

Anyone have any suggestions what I should try next?

Oh, and...thanks for all your help so far!