Author Topic: Brother (possibly also some Bernina) embroidery machine memory cards  (Read 16244 times)

0 Members and 1 Guest are viewing this topic.

Offline AeroX2

  • Newbie
  • Posts: 9
  • Country: au
Re: Brother (possibly also some Bernina) embroidery machine memory cards
« Reply #50 on: March 22, 2022, 06:30:37 am »
So it took me quite a while but I managed to wire up the board and after a bunch of tinkering I got some actual readable output!

Code: [Select]
Copyright  by brother industries LTD.external 4M bit  ROMsewing pattern created by M.K & T.F  LCD font created by M.I            ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ“ÿÿÿÿÿÿÿÿÿÿÿÿ ÝG@ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿñÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿDRAGON3 Projectÿ1.0   versionÿÿÿ1999/08/04 dateÿbrother_sewing
Unfortunately a breadboard isn't the best interface and so there is quite a bit of noise on the lines, going to try a few things and see where I get.
 
The following users thanked this post: JuOOLs

Offline MarkMLlTopic starter

  • Frequent Contributor
  • **
  • Posts: 357
  • Country: gb
Re: Brother (possibly also some Bernina) embroidery machine memory cards
« Reply #51 on: March 22, 2022, 11:30:30 am »
Creditable progress. Any chance of a hex dump of at least the 512 bytes, so that if it's formatted as a floppy we can see the layout?

MarkMLl
 

Offline amyk

  • Super Contributor
  • ***
  • Posts: 8232
Re: Brother (possibly also some Bernina) embroidery machine memory cards
« Reply #52 on: March 23, 2022, 01:27:55 am »
Slow down the signals as much as you need to get a repeatable read. Parallel async ROM has no minimum frequency.
 

Offline AeroX2

  • Newbie
  • Posts: 9
  • Country: au
Re: Brother (possibly also some Bernina) embroidery machine memory cards
« Reply #53 on: March 23, 2022, 07:14:00 am »
Yep I initially tried slowing down the signal to the point where it was taking 50ms per read :/ so I left this overnight but even after leaving it overnight it still wasn't done, so I was wondering what was going on and realized now that Arduino uses 16bits for its int's and so was just overflowing my address counter :P

Not wanting to run it overnight, I lowered the read to 3ms and fiddled with the wires and it seemed to give a reliable result (at least the Brother text is readable) but hard to tell, I've attached the trimmed output of that run here.

I also ran it through binwalk to see if there was anything obvious but no luck maybe you guys will have better luck in identifying how this thing is laid out.
 

Offline MarkMLlTopic starter

  • Frequent Contributor
  • **
  • Posts: 357
  • Country: gb
Re: Brother (possibly also some Bernina) embroidery machine memory cards
« Reply #54 on: March 23, 2022, 07:56:15 am »
My initial thought was that if that is a text file it will probably have lost zero bytes etc. and that it might be better redone as hex.

However looking at it with xxd it does appear to have 0x00, 0xff etc. scattered liberally, and I notice content transitions on neat binary boundaries e.g.

Code: (none) [Select]
...
0002eff0: ffff ffff ffff ffff ffff ffff ffff ffff  ................
0002f000: 00f1 42e6 2143 284c f5f8 8343 f5bc 434e  ..B.!C(L...C..CN
...

which suggests that it is in fact undamaged.

Having said that, other than the obligatory copyright notice at the beginning there is nothing recognisable in there, in particular no #PES or #PEC strings which would be expected if we were looking at straight pattern files (see https://github.com/MarkMLl/pesdump etc.).

I suspect that what that actually is is literally a ROM extension with a binary header at 0x0080, in the same way that PCs (used to) have BIOS extensions. The fact that it has an explicit copyright for an LCD font would appear to reinforce this.

MarkMLl
« Last Edit: March 23, 2022, 01:22:07 pm by MarkMLl »
 

Offline amyk

  • Super Contributor
  • ***
  • Posts: 8232
Re: Brother (possibly also some Bernina) embroidery machine memory cards
« Reply #55 on: March 24, 2022, 01:17:36 am »
It does not look like machine instructions to me. The entropy is far too low. I'm not really familiar with embroidery pattern formats, but if it's anything like bitmap graphics, the texture of the data agrees.
 

Offline MarkMLlTopic starter

  • Frequent Contributor
  • **
  • Posts: 357
  • Country: gb
Re: Brother (possibly also some Bernina) embroidery machine memory cards
« Reply #56 on: March 24, 2022, 08:05:36 am »
It does not look like machine instructions to me. The entropy is far too low. I'm not really familiar with embroidery pattern formats, but if it's anything like bitmap graphics, the texture of the data agrees.

Well of course there's stitch data in there... that's the whole idea. But that doesn't prevent it from being a ROM extension formatted according to some private SDK: it's definitely not one of the standard file types, and doesn't appear to be "filesystem-like".

MarkMLl
 

Offline AeroX2

  • Newbie
  • Posts: 9
  • Country: au
Re: Brother (possibly also some Bernina) embroidery machine memory cards
« Reply #57 on: March 24, 2022, 02:00:54 pm »
Still quite a ways off but I was digging around inside of PED-Basic and noticed some interesting strings, along with some functions that seemed to be appending those strings.

Going to dive a little deeper on the weekend, I'm hoping that maybe this software reads a PES file, converts it and then sends it to a EEPROM writer but lets find out.


 

Offline AeroX2

  • Newbie
  • Posts: 9
  • Country: au
Re: Brother (possibly also some Bernina) embroidery machine memory cards
« Reply #58 on: March 28, 2022, 02:14:32 pm »
So after taking a look into the software, it looks like the header of the PES file is stripped and the raw PES stitch data is embedded onto the EEPROM.

My previous putty.txt still has a bit of noise so I've reuploaded a newer version which should have less noise.
Using the offset of 0x2f327 for the stitch data I was able to read out this bear!

I've also found the function responsible for creating the rom data and I can probably just extract out this data and put it on a new EEPROM, however it would be nice to create my own program for doing that,
So still looking at how the data is arranged and how the offsets are calculated and hoping to create my own program!
 
The following users thanked this post: JuOOLs

Offline DavidAlfa

  • Super Contributor
  • ***
  • Posts: 5802
  • Country: es
Re: Brother (possibly also some Bernina) embroidery machine memory cards
« Reply #59 on: March 28, 2022, 03:02:44 pm »
3ms per read is a lot, you shouldn't need so much, also use a thicker wire for gnd.

As you're not using multiple addressing neither writing (for now) you can get rid of some bus signals:
CE     -> GND
WE    -> VCC
BYTE -> VCC
RST  ->10K to VCC, 100nF to GND (self-resets on power-on)
RY/BY can be ignored as you're not doing any write operations and the data set-up time is like 100ns.

10us delay should be enough, even in bad boards, unless there's a faulty/weak connection.
Example loop:
Code: [Select]
Write address
Wait 10uS
Set OE low
Wait 10us
Read data
Set OE high
Wait 10us

Last year I did the same to read a 29F800 using a STM32, dumping the contents into a usb drive.
To save IO pins I used four 74HC373 latches and enabled Byte mode, taking only 13 pins instead of almost 40.
The 4 latches were configured as:
- Data 0:7
- Addr 0:7
- Addr 8:15
- Addr 16:18, A-1, E, G, W

The signaling was a little more complex but worked well.

Few capacitors and proper grounding made it much easier than using breadboard, was able to greatly reduce the toggling delays to ~100ns, dumping the 512KB into the flash drive in ~25 seconds.

The code was as follows, you can ignore the latch handling, just read the comments.
Code: [Select]
// GPIO toggling delay
#define delay()   asm("nop\nnop\nnop\nnop\nnop\nnop\nnop\nnop\nnop")

// Configure Data port direction. 1= input, 0=output
void setDataDir(bool input){
  GPIOA->MODER = input ? (GPIOA->MODER & 0xFFFF0000) : (GPIOA->MODER & 0xFFFF0000) | 0x5555;
}

// Make a low-active pulse on the specified GPIO pin
void pulse(GPIO_TypeDef  *GPIOx, uint32_t pin){

    // Set pin low
  GPIOx->BSRR=pin;
  delay();

    // Set pin high
  GPIOx->BSRR=pin<<16;
}

// Read Data from latch
uint8_t read(void){

    // Set Data port as input
  setDataDir(1);
  delay();

    // Enable Data latch Output
  OE_DATA_GPIO_Port->BSRR = OE_DATA_Pin<<16;

    // Pulse latch load
  pulse(LE_DATA_GPIO_Port, LE_DATA_Pin);

    // Read data
  uint8_t data = GPIOA->IDR & 0xFF;

    // Disable Data latch Output
  OE_DATA_GPIO_Port->BSRR = OE_DATA_Pin;
  delay();

    // Set Data port as output
  setDataDir(0);

  return data;
}

// Fill buffer, starts reading at the specified address with "size" number of 16-bit reads.
void fillBuffer(uint32_t address, uint8_t* buffer, uint32_t size){  // Size = number of 16-bit reads

  while(size--){

    // Load address with A-1=0 (lower byte)
    GPIOA->ODR = address & 0xFF;
    pulse(LE_ADR0_GPIO_Port, LE_ADR0_Pin);
    GPIOA->ODR = (address>>8) & 0xFF;
    pulse(LE_ADR1_GPIO_Port, LE_ADR1_Pin);
    GPIOA->ODR = ((address>>16) & 0xFF) | A_1_EN;
    pulse(LE_ADR2_GPIO_Port, LE_ADR2_Pin);

    // Enable CE
    GPIOA->ODR = ((address>>16) & 0xFF) | (A_1_EN & E_EN);
    pulse(LE_ADR2_GPIO_Port, LE_ADR2_Pin);

    // Enable G
    GPIOA->ODR = ((address>>16) & 0xFF) | (A_1_EN & E_EN & G_EN);
    pulse(LE_ADR2_GPIO_Port, LE_ADR2_Pin);

    // Read lower byte
    *buffer++=read();

    // Deselect G
    GPIOA->ODR = ((address>>16) & 0xFF) | (A_1_EN & E_EN);
    pulse(LE_ADR2_GPIO_Port, LE_ADR2_Pin);

    // Deselect E
    GPIOA->ODR = ((address>>16) & 0xFF) | (A_1_EN);
    pulse(LE_ADR2_GPIO_Port, LE_ADR2_Pin);

    // Disable A-1 (read higher byte)
    GPIOA->ODR = ((address>>16) & 0xFF) | CTRL_DIS;
    pulse(LE_ADR2_GPIO_Port, LE_ADR2_Pin);

    // Enable E
    GPIOA->ODR = ((address>>16) & 0xFF) | E_EN;
    pulse(LE_ADR2_GPIO_Port, LE_ADR2_Pin);

    // Enable G
    GPIOA->ODR = ((address>>16) & 0xFF) | (E_EN & G_EN);
    pulse(LE_ADR2_GPIO_Port, LE_ADR2_Pin);

    // Read higher byte
    *buffer++=read();

    // Deselect G
    GPIOA->ODR = ((address>>16) & 0xFF) | E_EN;
    pulse(LE_ADR2_GPIO_Port, LE_ADR2_Pin);

    // Deselect E
    GPIOA->ODR = ((address>>16) & 0xFF) | CTRL_DIS;
    pulse(LE_ADR2_GPIO_Port, LE_ADR2_Pin);

    address++;
    count-=2;
  }
}
« Last Edit: March 28, 2022, 03:58:24 pm by DavidAlfa »
Hantek DSO2x1x            Drive        FAQ          DON'T BUY HANTEK! (Aka HALF-MADE)
Stm32 Soldering FW      Forum      Github      Donate
 
The following users thanked this post: AeroX2

Offline MarkMLlTopic starter

  • Frequent Contributor
  • **
  • Posts: 357
  • Country: gb
Re: Brother (possibly also some Bernina) embroidery machine memory cards
« Reply #60 on: March 29, 2022, 09:05:12 am »
Using the offset of 0x2f327 for the stitch data I was able to read out this bear!

I suspect that the bear is in bitmap format to be presented on the LCD, rather than being stitch data which would be needle-movement commands.

MarkMLl
 

Offline JuOOLs

  • Newbie
  • Posts: 9
  • Country: gb
Re: Brother (possibly also some Bernina) embroidery machine memory cards
« Reply #61 on: April 02, 2022, 11:52:07 am »
Using the offset of 0x2f327 for the stitch data I was able to read out this bear!

I suspect that the bear is in bitmap format to be presented on the LCD, rather than being stitch data which would be needle-movement commands.

MarkMLl


Really nice work AeroX2 !!    the DLL code might elude to how the LCD preview image is stored, my guess it's some sort of colour format as the preview of the default designs on my PE-150 (similar to your PE-200) show an image of each of the indivdual colours and it looks like the outline colour (last colour used) is perhaps used as the main preview image.

How many colors are in that bear 4,  do you have a photo of how that bear preview looks on your machine?
« Last Edit: April 02, 2022, 11:54:23 am by JuOOLs »
 

Offline AeroX2

  • Newbie
  • Posts: 9
  • Country: au
Re: Brother (possibly also some Bernina) embroidery machine memory cards
« Reply #62 on: April 03, 2022, 02:14:02 pm »
Quote
I suspect that the bear is in bitmap format to be presented on the LCD, rather than being stitch data which would be needle-movement commands.
I don't quite think that is the case, considering the library I'm using should be interpreting the PES/PEC commands. At least that is how I'm reading it, also I think it would be more than a little weird to store a bitmap in this format.
The library I'm using is pyembroidery along with embroidepy, making a modification to the PecReader.py you can get it to read the file at the offset. (picture 1 attached)

Quote
Really nice work AeroX2 !!    the DLL code might elude to how the LCD preview image is stored, my guess it's some sort of colour format as the preview of the default designs on my PE-150 (similar to your PE-200) show an image of each of the indivdual colours and it looks like the outline colour (last colour used) is perhaps used as the main preview image.
Thanks, took me a while to get there and I'm really hoping this all pays off in the end.

Yep, there seems to be some additional processing being done to the image file for a preview...maybe? It is kindof hard to tell since there is a lot of small memcpy commands that seem to be doing different things under different conditions, but there are small sections that change with more files added and much larger sections that change with more files.

For those interested, CardIO.dll (offset: 0x6ac8), is the function that seems to create the final rom file which gets sent to the EEPROM writer.

Quote
How many colors are in that bear 4,  do you have a photo of how that bear preview looks on your machine?
Unfortunately not, that would have probably been the smart move to make but the bear should be the same one on the cover, (picture 2 attached)
There seems to be 4 color change commands, for a total of 5 threads, which seems to line up the the picture.


I've ordered some parts and planning on hooking the sewing machine up to a microcontroller, so I can get a much more complete picture and hopefully get it to sew something other than bears but those parts are going to take a while to arrive and then assemble so I'll have to see how that goes.
 

Offline SaberDT

  • Newbie
  • Posts: 2
  • Country: us
Re: Brother (possibly also some Bernina) embroidery machine memory cards
« Reply #63 on: July 29, 2022, 03:52:46 pm »
I recently obtained a Bernina Deco 650. Seems to be manufactured by Brother with the wonderfully obscure 40 pin port. I took some pictures of the internals. Will any of these be helpful?
 

Offline SaberDT

  • Newbie
  • Posts: 2
  • Country: us
Re: Brother (possibly also some Bernina) embroidery machine memory cards
« Reply #64 on: July 29, 2022, 03:53:46 pm »
Second Image due to post rules.
 

Offline MarkMLlTopic starter

  • Frequent Contributor
  • **
  • Posts: 357
  • Country: gb
Re: Brother (possibly also some Bernina) embroidery machine memory cards
« Reply #65 on: August 03, 2022, 11:23:07 am »
Thanks for the nice clear photos which are always useful, but I think that by now most of the physical stuff has been cracked.

I've still got to find time to look at the FPGA-based reader I've got here, which turns out to be "problematic" without the appropriate Windows-only drivers. I've been down a rabbit-hole of writing a specification language to decode a VCD file extracted from my HP logic analyser: it will now disassemble x86 states so I think that getting it to decode Flash memory (which might or might not have some sort of filesystem structure) should be no problem...

MarkMLl
 

Offline AeroX2

  • Newbie
  • Posts: 9
  • Country: au
Re: Brother (possibly also some Bernina) embroidery machine memory cards
« Reply #66 on: September 04, 2022, 11:07:20 am »
Long time no see but finally got some time to play around with this again and got some fantastic results.

As you can see in the images below, the embroidery machine is finally accepting a custom embroidery design,
I'm not very good at making a custom design and I think my machine needs some tuning but nevertheless the design is recognizable.

I was correct in my idea that CardIO.dll is storing the card data and you can just extract this data from memory and burn it on a EEPROM, in this case I used SST39SF040-55-4I-WHE which after figuring out how to write to the thing worked perfectly.
 

Offline localghost

  • Newbie
  • Posts: 2
  • Country: za
Re: Brother (possibly also some Bernina) embroidery machine memory cards
« Reply #67 on: October 03, 2022, 07:26:09 pm »
Hihi, I got one of those " Ultimate Box" card programmers form my mom with a working Bernina Deco 650 machine and a 1MB card a long tie ago and captured the serial interaction between the card and the programing software.
This ultimate box is a Serial model so no PID/VID or usb transfer shenanigans,
I'll dig it out again ( we moved house ) and put up some pictures of the internals.. for now, I have a serial capture of the "Card read" action in the Ultimate Explorer software. ( I cannot remember what was on the card when I did the dump )
Baud : 57600

When I dig it out Ill upload a .PES ( V4 ) file to the card and dump the card again if anyone wants to figure out how the file is stored on the card, then supply both the .PES, read and Write dumps if anyone is interested
 

Offline localghost

  • Newbie
  • Posts: 2
  • Country: za
Re: Brother (possibly also some Bernina) embroidery machine memory cards
« Reply #68 on: October 03, 2022, 08:12:10 pm »
Finding the box of sewing stuff was quicker than I thought...
( I used an old design - will do an EEVBLOG thing at some pont and submit the machine files so Dave can make Caps or something... :)

The following is the output form the Vikant  UltimateExplorer application popup, the PES, write and Read Serial monitors are attached

upon opeing the port :
—[COM10]—————————————————————————————————————————

  Trying to open the port...  OK!
  Looking for the UltimateBox™...  Found!
    hardware [UltimateBox 1000]
    firmware [UltimateBox Rev 1000]

  Embroidery card has been detected!
  Identifying the card...  OK!

  The card has been recognized as:
  «Vikant UltimateCard™ Type I»
  [AMD Am29F080B][1024Kb]


Writing the attached PES file to the card:
UltimateExplorer v1.00k
__________________________________________________

The card has been recognized as:
«Vikant UltimateCard™ Type I»
[AMD Am29F080B][1024Kb]

In order to write new data to the card
all current card content has to be erased.

Erasing the card... OK

Writing 1024Kb... OK
Transferred 1024Kb

Time elapsed: 0 min and 36 sec.

—————————————————————————————————————————————————
Press [ESCAPE] button to continue...


Restarting the application and reading the card again :
——————————————————————————————————————————————————

The card has been recognized as:
«Vikant UltimateCard™ Type I»
[AMD Am29F080B][1024Kb]

Reading 1024Kb... OK
Transferred 1024Kb

Time elapsed: 6 min and 21 sec.

—————————————————————————————————————————————————
Press [ESCAPE] button to continue...


The Read happens in Blocks but Write seems to happen in one continuous stream.
That might be specific to this Card reader/Writer and version of the software




« Last Edit: October 03, 2022, 08:13:43 pm by localghost »
 

Offline MarkMLlTopic starter

  • Frequent Contributor
  • **
  • Posts: 357
  • Country: gb
Re: Brother (possibly also some Bernina) embroidery machine memory cards
« Reply #69 on: October 11, 2022, 05:21:41 pm »
Thanks for the contribution, I'll try to take a look at that at some point.

I ended up by getting into a rabbit hole working out how to capture a dump from my old HP logic analyser, and convert it into something useful. I got to the point of being able to convert its HPIB data to a VCD file, and then to postprocess that... so while I can now disassemble 8088/V20 opcodes I'm no further forward with the card reader :-)

MarkMLl
 

Offline flez1966

  • Newbie
  • Posts: 2
  • Country: gb
Re: Brother (possibly also some Bernina) embroidery machine memory cards
« Reply #70 on: October 19, 2022, 08:46:45 pm »
Wow I cant believe I have found a thread on these old odd cards, I have the PE software on floppy, and I'm sure a serial connected card reader and a card, from when i bought a machine in 2013 that only worked a month before getting a mechanical issue that I would fix when i have the time.....
I dont what I can do to help or how much help I can be, or if any help is needed, but i'm here 'if'.

Lez
 

Offline MarkMLlTopic starter

  • Frequent Contributor
  • **
  • Posts: 357
  • Country: gb
Re: Brother (possibly also some Bernina) embroidery machine memory cards
« Reply #71 on: November 02, 2022, 11:23:27 am »
It's certainly a valuable focal point for techies interested in this facet of CNC equipment :-)

Funnily enough, I was just discussing the "questionable" performance of the InkStitch software with somebody yesterday. I notice that there have been a couple of releases since I last tried it, I really do need to have another shot and possibly dust off my attempt at improving things.

MarkMLl
« Last Edit: November 02, 2022, 11:27:54 am by MarkMLl »
 

Offline GerryG

  • Newbie
  • Posts: 1
  • Country: gb
Re: Brother (possibly also some Bernina) embroidery machine memory cards
« Reply #72 on: November 16, 2022, 09:26:02 pm »
Hi all.
So I nominally lucked out by getting this machine on the cheap, and I'm having a bear of a time interfacing with the memory card. Unfortunately, I'm nowhere near as electronically-minded as you guys: I'm a CNC programmer, but more mechanically oriented, so this is all a bit beyond me in places.
To make things singularly more irritating, I bought a card reader for this thing, which was one of the Simplicity SmartBox units. Of course, my PC doesn't recognise the USB device (that'd be far too useful). It presents a PID and VID and all that jazz, but I can't find a driver for it (unless I shell out £50 for some CD-ROM from the US, because copying the abandonware to the internet is too much like communism, I guess).
I see that you guys have had some success with getting an arduino to talk to the card directly - has anyone managed to figure a way to use an Arduino as a proper reader/writer for it? If it's workable, I have precisely zero compunctions about ripping the reader I've got apart for the laughably obsolescent AMP socket that everyone was scratching their heads about for a bit to do a semi-proper job of things.

However, before I do tear it apart, I figure you guys might be interested in the contents.
It's marked up as "Great Notions Rev A 04/24/2002, Small Blackbox_AVR_USB3"
The only chips of interest on there that I can see are a Xilinx XC95144XL TQL44BMN0225 F1222764A 10C, an ATMEL AT43USB320A 0227 55618E RH1B2934 and an ATMEL AT49F1025 55JC 0107

Bear in mind that when it comes to bare metal electronics, I'm a simpleton (and that's being charitable)

I'm comfortable enough getting into the guts of most things, but with this, I need a fair bit of guidance
 

Offline AeroX2

  • Newbie
  • Posts: 9
  • Country: au
Re: Brother (possibly also some Bernina) embroidery machine memory cards
« Reply #73 on: November 29, 2022, 03:38:33 pm »
Thought I would chime in and say that I've uploaded the PCB, image dumper and image writer to Github, which I'm sure someone can improve on.
(Pretty sure my clock lines for the flash chip are too close to my other lines and so I had to write at a pretty slow speed :-//)
https://github.com/AeroX2/brother-cart-emulator

The final result is that I got this working, although I give no warranties since I only really tested this once with the Kirby embroidery but I'm pretty confident it should work with other PES files.
 

Offline JuOOLs

  • Newbie
  • Posts: 9
  • Country: gb
Re: Brother (possibly also some Bernina) embroidery machine memory cards
« Reply #74 on: December 31, 2022, 05:39:20 pm »
Really nice work AeroX2!! I managed to create an image.bin from a .pes design from your script!  :-+
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf