[SOLVED] Looking for a NXP XA-G30 Dissasembler

[sixtimesseven]

I have a chroma 16502 which needs calibration, unfortunatly the cal. menu is pasword locked 

I got the firmware of the eeprom, see attached zip for the bin file.

However, the microcontroller is a NXP PXAG30KBA which they describe as XA-G30 family.
I could not find much regarding this old, obsolete chip but I was wondering if sombody has a disassembler for it?

[GromBeestje]

From a quick glance at the datasheet, it looks like its architecture is an extended version of the 8051. Therefore I would try to see what a 8051 decompiler makes of it. I suggest to load the file into radare2, select 8051 architecture and see what happens.

[amyk]

It's not an 8051. The claims of 8051 compatibiilty are like saying that the 8086 is compatible with the 8080/8085.

https://www.ceibo.com/eng/datasheets/Philips-XA-User-Guide.pdf

The password is probably stored in EEPROM. Do you want to actually reverse the algorithm, or find which byte(s) to patch in the ROM to bypass it?

Either way, if you don't find something, let me know and I can write a disassembler. The above doc has all the necessary information.

[sixtimesseven]

It's not an 8051. The claims of 8051 compatibiilty are like saying that the 8086 is compatible with the 8080/8085.

https://www.ceibo.com/eng/datasheets/Philips-XA-User-Guide.pdf

The password is probably stored in EEPROM. Do you want to actually reverse the algorithm, or find which byte(s) to patch in the ROM to bypass it?

Either way, if you don't find something, let me know and I can write a disassembler. The above doc has all the necessary information.

Nice thank you!

I'm not so much interested in the firmware, just knowing which bytes to flip would be plenty.

However, I had another idea. I noticed that there is no max number of passwords. And the max input frequency for the keys is pretty high (>40Hz). There are 9 different keys with a five position pasword makes 5^9= 1953125 combinations which should take about 3 days to brute force

[sixtimesseven]

Sooo ... Turns out Chroma cannot implement a halfway decent password 

I wired up an arduino to trigger each switch, but before going trough with the 5^9 combinations I figured I test the simpler 5^4 or 5^5 combinations in case they used F1-F4 or the navigation keys exclusivly.
Turns out they have... Password is pretty trivial, should have gotten it by trying obvious ones hand:

It is: [ArrowUp, ArrowDown, ArrowLeft, ArrowRight, Trigger]