Does anyone recognize this display SPI protocol?

[NiHaoMike]

I'm trying to reverse engineer the display module in an Onkyo TX-NR509 so I can take over control using a Raspberry Pi Pico. (The end goal is to turn that unit into a "smart" audio box with an Atomic Pi inside handling audio playback and various automation applicable to a home audio/video system.) The module itself is marked "16-BT-165GINK", not that helpful. I have attached a Pulseview capture of the SPI lines.

I'm under the assumption that the controller is going to be one of the off the shelf ones and not a custom ASIC. I'm hoping someone would recognize that what family of controller it is, maybe even the exact one used.

[coromonadalix]

normally you can / could search for inscriptions on the display ?

in the service manual  we clearly see the 4 lines going into the display,  and yes it's an intelligent display,  it is used in others models ... 

Could be custom made too ??

And the problem will be to sniff out the data and figure it out, and many infos / characters will be displayed ....

in your file  i don't see where you define your CLK, RST  D0, CS lines  ??

[NiHaoMike]

D0 is /Reset, D1 is /CS, D2 is CLK, D3 is MOSI.

The module is custom but I would be very surprised if the chip itself is as well. Doesn't make sense to design a custom chip when there's off the shelf chips for those sorts of display modules.

[DavidAlfa]

The service manual mentions M66005 (M66005-0001AHP ?), which is a VFD controller:


Found the datasheet but in japanese only.
Tried to translate it using Google but it only did it partially, as not all of it is encoded as text, some parts are plain images.

Then tried Google Lens, does a decent job (See attached screenshots).

[NiHaoMike]

A step closer but that is definitely not the exact chip since the commands do not appear to match up. The display is also 2 row while that chip is single row.

Therefore, I think the chip used is most likely a 2 row variant in that family.

[DavidAlfa]

This is the decoded output after correctly settings the  clock polarity and edges.
Yo me it makes some sense, at least what I've found so far.
Each row is a single transfer, made while CS=low.

07 F0  // digit count = 16, all segments off
27 04
05 87 07
03 C0 C0 C0 C0 C0 C0 C0 C0 C0 C0 C0 C0 C0 C0 C0 C0
62 AA 54 AB 5C AA 54 AA 54 AA 54
17
27 06
42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
04 20 04 04 04 04 04 04 04 04 04 04 04 04 04 04 40
00 A0 04 04 04 04 04 04 04 04 04 04 06 04 04 04 C0
04 20 04 4C AC 04 04 04 04 04 A6 B6 AE 36 F6 6A 40
00 A0 04 04 04 04 04 04 04 08 08 0C 08 08 06 04 C0
42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0E 0C 00 18 1C
04 20 04 04 06 04 22 6A 22 F4 22 43 06 04 04 04 40
00 A0 04 04 04 06 04 04 04 04 04 04 04 06 04 04 C0
42 28 30 08 00 60 00 00 00 00 00 00 20 00 00 00 0E 0C 00 18 1C
00 A0 04 F6 A6 4E A6 2E CA 04 16 C2 06 36 36 82 C0
42 28 30 08 00 60 00 00 00 00 00 00 30 00 00 00 00 00 00 00 00
04 20 04 CC AC 04 04 04 04 04 A6 B6 AF 36 F6 6A 40
00 A0 04 04 04 04 04 04 04 08 08 08 0C 08 04 06 C0
04 20 04 9C 2C 04 04 04 04 04 A6 B6 AE 37 F6 6A 40
00 A0 04 04 04 04 04 04 04 88 08 08 0C 08 04 04 C0
04 20 04 2C 2C 04 04 04 04 04 E6 B6 AE 36 F6 6A 40
00 A0 04 04 04 04 04 04 04 06 08 08 08 08 04 04 C0
04 20 04 CC 2C 04 04 04 04 04 A6 B6 AE 36 F6 6A 40
00 A0 04 04 04 04 04 04 04 04 88 08 08 08 04 04 C0
04 20 04 4E 2C 04 04 04 04 04 A6 B6 BE 36 F6 6A 60
04 20 06 8C 2C 04 04 04 04 04 A6 B6 AE 37 F6 6A 40
42 28 30 08 00 60 00 00 00 00 00 00 20 00 00 00 00 0C 10 04 0C
04 20 04 04 04 04 22 6A 22 F4 22 42 04 04 04 04 40
00 A0 04 F6 A6 4E A6 2E CA 06 16 C2 04 37 36 82 C0
42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
04 20 04 04 04 04 04 06 04 04 04 04 04 04 04 04 40
00 A0 04 04 04 04 04 04 04 04 04 04 04 04 04 04 C0
57

[DavidAlfa]

Found the Onkyo TX-SR706 actually uses 2x discrete M66005 drivers, and the display is very similar:



But yeah, the commands just don't match.

[DavidAlfa]

Had a moment to look at it.

Downloaded the firmware here:
https://www.intl.onkyo.com/support/firmware/tx-nr509.html

Decrypted it using this:
http://divideoverflow.com/2014/04/decrypting-onkyo-firmware-files/

Analized the output files: There's a kernel, a squashfs filesystem and then two suspicious files containing lot of menu strings:
- of2.ONKAVR0007_00NA00EA00NA.NA103
- of3.ONKAVR0007_00NA00EA00NA.NA108

Knowing the controller UPD70F3746GJ (datasheet] has 1MB of flash, perhabs one of them is a flash update.
- The display is connected to CSIB5 (SPI5 for normal people).
- CSB5 base address is FFFFFD50
- Chip Enable is connected to P68, so address FFFFF40D (PORT6H), bit 0

Open of3.ONKAVR0007_00NA00EA00NA.NA108 in ghidra, uncheck "Show only recommended Language", choose V850 processor.

First find where the SPI is configured:

- FFFFFD50 (CB5CTL0) = 0xF1
- FFFFFD51 (CB5CTL1) = 5
- FFFFFD52 (CB5CTL2) = 0

Comparing these values with the datasheet: Master, clock/64, the clock mode matches the waveform...
And wait! LSB first! This will mean we need to search reversed bytes in the code!

So this:

Code: [Select]

07 F0
27 04
05 87 07
03 C0 C0 C0 C0 C0 C0 C0 C0 C0 C0 C0 C0 C0 C0 C0 C0

Becomes this in code:

Code: [Select]

E0 0F
E4 20
A0 E1 E0
C0 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03

Let's find those values...kind of! But slightly different:


It's sending this. Maybe I looked in the wrong place of the code, but looks extremely similar and has same pattern.

Code: [Select]

E0 0F
E4 F0
A0 F0 F0
C0 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03

Which would be seen like this by the analyzer:

Code: [Select]

07 F0
27 0F
05 0F 0F
03 C0 C0 C0 C0 C0 C0 C0 C0 C0 C0 C0 C0 C0 C0 C0 C0

Compared again againt what you got, it's like it picked up some noise:

Code: [Select]

07 F0
27 04
05 87 07
03 C0 C0 C0 C0 C0 C0 C0 C0 C0 C0 C0 C0 C0 C0 C0 C0

So maybe your capture data is wrong?
Also, perhabs the controller also expects LSB first, so these would be the actual commands?


Now let's find where somewhere where CE is toggled.
Looks like it's this part, but didn't inspect any longer:


Well, that's all, now it's time for you to dive into the binaries!
Extracted firmware here: https://anonfiles.com/9fEb47D8yf/onkyo_zip

[NiHaoMike]

I kind of figured something was up with the bit order when the symbols seem to be scattered about instead of being in a logical sequence.

For others who have the same display to interface to, these Bus Pirate commands will get you started:

Code: [Select]

[ % 0x07 0xF0 % ]
[ % 0x27 0x04 % ]
[ % 0x05 0x07 0x07 % ]
[ % 0x03 0xC0 0xC0 0xC0 0xC0 0xC0 0xC0 0xC0 0xC0 0xC0 0xC0 0xC0 0xC0 0xC0 0xC0 0xC0 0xC0 % ]
[ % 0x62 0xAA 0x54 0xAB 0x5C 0xAA 0x54 0xAA 0x54 0xAA 0x54 % ]
[ % 0x17 % ]
[ % 0x27 0x04 % ]
[ % 0x42 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 % ]
[ % 0x04 0x20 0x04 0x04 0x04 0x04 0x04 0x04 0x04 0x04 0x04 0x04 0x04 0x04 0x04 0x04 0x40 % ]
[ % 0x00 0x20 0x59 0x99 0x04 0x84 0xf6 0x86 0x85 0x1a 0x04 0xf6 0x3e 0x3e 0xa6 0x12 0x40 % ]

I know from other observations that 0x27 sets the brightness.
0x42 appears to be custom characters.
0x04 is the top row.
0x00 is the bottom row.

This is the list of symbols, I know at least some of the "blanks" can be programmed.

Code: [Select]

0x00 blank
0x01 ball on pedestal
0x02 @ (open)
0x03 A with \ above
0x04 blank
0x05 ||
0x06 high \
0x07 a with \ above
0x08 low ||
0x09 refresh
0x0A P
0x0B D with - through
0x0C 0
0x0D high clover
0x0E p
0x0F a with x above
0x10 up arrow
0x11 mouse cursor
0x12 H
0x13 E with \ above
0x14 (
0x15 high ..
0x16 h
0x17 e with \ above
0x18 down right arrow
0x19 thumbs down
0x1A X
0x1B O with / through
0x1C 8
0x1D ,
0x1E x
0x1F o with / through
0x20 blank
0x21 left down waves
0x22 D
0x23 A with .. above
0x24 $
0x25 chain link
0x26 d
0x27 a with .. above
0x28 II
0x29 key
0x2A T
0x2B O with ^ above
0x2C 4
0x2D high /
0x2E t
0x2F o with ^ above
0x30 [ up
0x31 search
0x32 L
0x33 I with \ above
0x34 large ,
0x35 sideways L
0x36 l
0x37 i with \ above
0x38 >>
0x39 star
0x3A \
0x3B U with .. above
0x3C <
0x3D 1/4
0x3E |
0x3F u with .. above
0x40 blank
0x41 musical note
0x42 B
0x43 A with o above
0x44 high ||
0x45 cent
0x46 b
0x47 a with ^ above
0x48 square D
0x49 square !
0x4A R
0x4B O with \ above
0x4C 2
0x4D small 2
0x4E r
0x4F o with \ above
0x50 left arrow
0x51 office
0x52 J
0x53 E with ^ above
0x54 *
0x55 a with _ below
0x56 j
0x57 e with ^ above
0x58 right triangle
0x59 filled heart
0x5A Z
0x5B U with / above
0x5C large :
0x5D o with _ below
0x5E z
0x5F u with / above
0x60 hash cursor
0x61 half filled theta
0x62 F
0x63 joined AE
0x64 &
0x65 split |
0x66 f
0x67 joined ae
0x68 left triangle
0x69 lock
0x6A V
0x6B O with .. above
0x6C 6
0x6D paragraph
0x6E v
0x6F o with .. above
0x70 hollow up arrow
0x71 iPod
0x72 N
0x73 tree
0x74 .
0x75 @
0x76 n
0x77 I with ^ above
0x78 portal
0x79 butterfly
0x7A ^
0x7B joined |O
0x7C >
0x7D 3/4
0x7E high ~
0x7F joined |o
0x80 blank
0x81 CD
0x82 A
0x83 A with / above
0x84 !
0x85 high i
0x86 a
0x87 a with / above
0x88 small |
0x89 ()
0x8A Q
0x8B N with ~ above
0x8C 1
0x8D +-
0x8E q
0x8F n with ~ above
0x90 down arrow
0x91 on
0x92 I
0x93 E with / above
0x94 )
0x95 tunnel
0x96 i
0x97 e with / above
0x98 left up arrow
0x99 heart
0x9A Y
0x9B U with \ above
0x9C 9
0x9D small 1
0x9E y
0x9F u with \ above
0xA0 blank
0xA1 folder
0xA2 E
0xA3 A with o above
0xA4 %
0xA5 Yen
0xA6 e
0xA7 a with o above
0xA8 Ohm
0xA9 ID
0xAA U
0xAB O with ~ above
0xAC 5
0xAD micro
0xAE u
0xAF o with ~ above
0xB0 OK
0xB1 light bulb
0xB2 M
0xB3 I with / above
0xB4 -
0xB5 ~
0xB6 m
0xB7 i with / above
0xB8 <<
0xB9 Tr
0xBA ]
0xBB Y with / above
0xBC =
0xBD 1/2
0xBE }
0xBF y with / above
0xC0 blank
0xC1 2 musical notes
0xC2 C
0xC3 A with ~ above
0xC4 #
0xC5 pound
0xC6 c
0xC7 a with ~ above
0xC8 square reverse D
0xC9 square ?
0xCA S
0xCB O with / above
0xCC 3
0xCD small 3
0xCE s
0xCF o with / above
0xD0 right arrow
0xD1 square i
0xD2 K
0xD3 E with .. above
0xD4 +
0xD5 <<
0xD6 k
0xD7 e with .. above
0xD8 small ||
0xD9 0
0xDA [
0xDB U with ^ above
0xDC ;
0xDD >>
0xDE {
0xDF u with ^ above
0xE0 mesh
0xE1 audio file
0xE2 G
0xE3 C with . below
0xE4 '
0xE5 section
0xE6 g
0xE7 c with . below
0xE8 up down triangles
0xE9 thumbs up
0xEA W
0xEB multiply
0xEC 7
0xED middle .
0xEE w
0xEF divide
0xF0 left arrow (large)
0xF1 factory
0xF2 O
0xF3 I with .. above
0xF4 /
0xF5 high -
0xF6 o
0xF7 i with .. above
0xF8 left right arrow
0xF9 clock
0xFA _
0xFB beta
0xFC ?
0xFD inverted ?
0xFE filled square
0xFF y with .. above

[NiHaoMike]

After correcting for bit order, it basically implements ISO-8859-1 with additional symbols in the undefined locations.

[wfdudley]

This chip is used in Onkyo receivers and other Japanese goods.
Refer to this thread https://www.eevblog.com/forum/projects/does-anyone-recognize-this-display-spi-protocol/
Original datasheet is here: https://www.renesas.com/ja/document/dst/933676
A lot of fiddling with Google Translate (once for documents, once for images), yields the attached.