Electronics > Repair
[Solved!]Looking for firmware dump for Tek THS3024.(How to repair firmware)
<< < (4/8) > >>
fzabkar:
What is the part number of the two flash chips?
squadchannel:

--- Quote from: fzabkar on June 08, 2024, 11:52:39 pm ---What is the part number of the two flash chips?

--- End quote ---

SST39VF6401B
squadchannel:
I found an interesting entry in the datasheet.
Perhaps a security ID is set? I'll check it out.

--- Quote ---Security ID
The SST39VF640xB devices offer a 256-bit Security ID space. The Secure ID space is divided into
two 128-bit segments: one factory-programmed segment and one user-programmed segment. The
first segment is programmed and locked at Microchip with a random 128-bit number. The user
segment is left unprogrammed for the customer to program as desired.
To program the user segment of the Security ID, the user must use the Security ID Word-Program
command. To detect end-of-write for the SEC ID, read the toggle bits. Do not use Data# Polling. Once
this is complete, the Sec ID should be locked using the User Sec ID Program Lock-Out. This disables
any future corruption of this space. Note that regardless of whether or not the Sec ID is locked, neither
Sec ID segment can be erased.
The Secure ID space can be queried by executing a 3-byte command sequence with Enter Sec ID
command (88H) at address 555H in the last byte sequence. To exit this mode, the Exit Sec ID
command should be executed. Refer to Table 6 for more details.

--- End quote ---
fzabkar:
To me, the corruption is bothersome because it appears to affect both flash ICs in the same way. That is, the even 16-bit words appear to be affected. It makes me wonder whether these chips have some inherent address decoder fault.

dead.bin


--- Code: ---Offset(h) 00   02   04   06   08   0A   0C   0E

0033D440  454E 4869 4500 0056 4E41 6576 0052 2048  ENHiE..VNAev.R H
0033D450  414D 6800 5245 4C65 4D45 6C20 454E 6768  AMh.RELeMEl ENgh
0033D460  4500 2D4C 4E41 656C 0044 6967 4554 562D  E.-LNAel.DigETV-
0033D470  4445 7665 5445 4869 454C 0056 4500 6576  DEveTEHiEL.VE.ev
0033D480  4C45 2048 0044 6800 4554 4C65 4445 6C20  LE H.Dh.ETLeDEl
0033D490  5445 7700 454C 4C65 4500 6C20 4C45 7700  TEw.ELLeE.l LEw.
0033D4A0  0044 4C65 4554 6C20 4445 7700 5445 4C65  .DLeETl DEw.TELe
0033D4B0  454C 6C20 4500 7700 4C45 4C65 0044 6C20  ELl E.w.LELe.Dl
0033D4C0  4554 7700 0000 4C65 0000 6C20 0000 7700  ETw...Le..l ..w.
0033D4D0  0000 4C65 0000 6C20 0000 7700 0000 4C65  ..Le..l ..w...Le
0033D4E0  0000 6C20 0000 7700 0000 4C65 0000 6C20  ..l ..w...Le..l
0033D4F0  0000 7700 0000 4C65 0000 6C20 0000 7700  ..w...Le..l ..w.
0033D500  0000 4C65 004C 6C20 656C 7700 4C65 4C65  ..Le.Ll elw.LeLe
0033D510  6C3A 6C20 6576 7700 3A00 4C65 7665 6C20  l:l evw.:.Level
0033D520  004C 7700 656C 7461 4C65 0044 6C3A 6120  .Lw.eltaLe.Dl:a
0033D530  6576 4461 3A00 2083 7665 6174 004C 8300  evDa:. ƒveat.Lƒ.
0033D540  656C 7461 4C65 0044 6C3A 6120 6576 4461  eltaLe.Dl:a evDa
0033D550  3A00 2083 7665 6174 004C 8300 656C 7461  :. ƒveat.Lƒ.elta
0033D560  5374 0044 7573 6120 5374 4461 7573 2083  St.Dusa StDaus ƒ
0033D570  5374 6174 7573 8300 5374 7461 7573 0052  Statusƒ.Sttaus.R
0033D580  5374 6500 7573 7365 5374 6973 7573 5269  Ste.usseStisusRi
--- End code ---

generated.bin


--- Code: ---Offset(h) 00   02   04   06   08   0A   0C   0E

0033D440  6C20 4869 6768 0056 2D4C 6576 656C 2048  l High.V-Level H
0033D450  6967 6800 562D 4C65 7665 6C20 4869 6768  igh.V-Level High
0033D460  0056 2D4C 6576 656C 2048 6967 6800 562D  .V-Level High.V-
0033D470  4C65 7665 6C20 4869 6768 0056 2D4C 6576  Level High.V-Lev
0033D480  656C 2048 6967 6800 562D 4C65 7665 6C20  el High.V-Level
0033D490  4C6F 7700 562D 4C65 7665 6C20 4C6F 7700  Low.V-Level Low.
0033D4A0  562D 4C65 7665 6C20 4C6F 7700 562D 4C65  V-Level Low.V-Le
0033D4B0  7665 6C20 4C6F 7700 562D 4C65 7665 6C20  vel Low.V-Level
0033D4C0  4C6F 7700 562D 4C65 7665 6C20 4C6F 7700  Low.V-Level Low.
0033D4D0  562D 4C65 7665 6C20 4C6F 7700 562D 4C65  V-Level Low.V-Le
0033D4E0  7665 6C20 4C6F 7700 562D 4C65 7665 6C20  vel Low.V-Level
0033D4F0  4C6F 7700 562D 4C65 7665 6C20 4C6F 7700  Low.V-Level Low.
0033D500  562D 4C65 7665 6C20 4C6F 7700 562D 4C65  V-Level Low.V-Le
0033D510  7665 6C20 4C6F 7700 562D 4C65 7665 6C20  vel Low.V-Level
0033D520  4C6F 7700 4461 7461 2083 0044 6174 6120  Low.Data ƒ.Data
0033D530  8300 4461 7461 2083 0044 6174 6120 8300  ƒ.Data ƒ.Data ƒ.
0033D540  4461 7461 2083 0044 6174 6120 8300 4461  Data ƒ.Data ƒ.Da
0033D550  7461 2083 0044 6174 6120 8300 4461 7461  ta ƒ.Data ƒ.Data
0033D560  2083 0044 6174 6120 8300 4461 7461 2083   ƒ.Data ƒ.Data ƒ
0033D570  0044 6174 6120 8300 4461 7461 2083 0052  .Data ƒ.Data ƒ.R
0033D580  6973 6500 5269 7365 0052 6973 6500 5269  ise.Rise.Rise.Ri
--- End code ---

Second IC in dead.bin


--- Code: ---Offset(h) 00   02   04   06   08   0A   0C   0E

0085B610  FFFF 01F0 FFFF 0290 FFFF 02D0 FFFF 0270
0085B620  FFFF 0250 FFFF 0110 FFFF 0230 FFFF 02B0
0085B630  FFFF 02B0 FFFF 05B0 FFFF 0510 FFFF 0670
0085B640  FFFF 0510 FFFF 0550 FFFF 0430 FFFF 0590
0085B650  FFFF 05D0 FFFF 04D0 FFFF 05F0 FFFF 03B0
0085B660  FFFF 04F0 FFFF 0510 FFFF 0470 FFFF 05F0
0085B670  FFFF 0410 FFFF 0710 FFFF 06D0 FFFF 0690
0085B680  BE6F 05F0 4242 0510 4146 0330 3032 01B0
0085B690  0055 03D0 0080 05F0 4E00 0550 9500 06D0
0085B6A0  20C1 06B0 B496 0530 20C1 0590 28D5 06F0
0085B6B0  D857 04B0 0053 03F0 5045 0490 3833 05B0
0085B6C0  4400 06B0 0084 06B0 4400 0550 0000 0530
0085B6D0  0000 06B0 00D5 0650 0967 0630 4000 05D0
0085B6E0  4001 0370 0100 05F0 0098 06D0 4000 05B0
0085B6F0  0101 05F0 0100 0350 0000 0570 1E00 0590
0085B700  0001 0690 00EA 05F0 0026 04B0 0103 0450
0085B710  0000 0370 FF10 0470 0016 04F0 0200 0590
0085B720  0000 0610 0000 0510 0005 0470 0909 05B0
0085B730  0901 05D0 00F8 04B0 FF08 0430 0012 0410
--- End code ---

https://www.mouser.com/datasheet/2/268/SST39VF6401B_SST39VF6402B_64_Mbit_x16_Multi_Purpos-709070.pdf (datasheet)

squadchannel:
If the 39VF6401 was corrupted, i think the verification gave me an error while I was rewriting it as well.
I'm thinking something went wrong during the firmware update rather than the 39VF6401 being faulty.

It is indeed the upperROM where the corruption is concentrated. It seems to be split 2 bytes at a time into upperROM/lowerROM.
I am attaching a dead.bin split into upper/lower.

Navigation
Message Index
Next page
Previous page
There was an error while thanking
Thanking...

Go to full version
Powered by SMFPacks Advanced Attachments Uploader Mod