The firmware is not protected... I could not resist ... 
......
...
"I also monitored the traffic between the CPU and the 24LC64 eeprom and dumped the eeprom. Interesting as my UTG932E turned now to be a UTG962E. 
"
The 496 first bytes of the eeprom are used to store the current configuration. The model definition is store at the end of the eeprom (see print screen). I did not find the serial number in it.
So, I actually buggered up the first few bytes in my EEPROM but fortunately like fremen67 said, they are settings for the device - I put the module into Chinese amongst other things
. I did however, manage to avoid buying an EEPROM programmer since this 24LC64 is read/written using i2c.
I got my trusty arduino uno out and started playing!
First, I soldered two wires onto the IC on pins 5&6 (SDA and SCL respectively) and then used wire jumpers onto the uno (5V not 3.3v). The UTG has pullup resistors already in it. Then I proceeded to corrupt my settings!
I didn't think, I coded like I always have done before using the standard Wire library, and only addressing ONE byte. I realised my mistake and made a working program to access the full EEPROM. A0 was tied high on the PCB, so the address is 0x51.
Then I bit the bullet and wrote the EEPROM...... and then I smiled!
Thanks to fremen67 for doing the initial discovery. I too could see the processor clear as day when I rotated it in the light (no acetone needed), but the ICs under the signal generator PCB in the back of the unit (under the shielding), were well and truly lasered off. I can't comment what's in here other than a few relays and opamps.
#include <Wire.h>
#define ADDR_Ax 0b001 //A2, A1, A0
#define ADDR (0b1010 << 3) + ADDR_Ax
void setup() {
Serial.begin(115200);
Wire.begin();
}
#define line_length 16
#define rows 32
void loop() {
//Serial.print((char)readEEPROM(0x1F0B));
//writeEEPROM(0x1F0B, 0x36); //make 60MHz
//writeEEPROM(0x1F0B, 0x33); //make 30MHz
//Serial.print((char)readEEPROM(0x1F0B));
dump(0x1EA0);
while(1);
}
void dump(int base_addr){
for (long i=0;i<(rows*line_length);i+=line_length){
Serial.print(i+base_addr, HEX);
Serial.print(":\t");
for (long j=0;j<line_length;j++){
Serial.print(readEEPROM(j+base_addr+i),HEX);
Serial.print(" ");
}
Serial.print("\t");
for (long j=0;j<line_length;j++){
Serial.print((char)readEEPROM(j+base_addr+i));
Serial.print(" ");
}
Serial.println();
}
}
void writeEEPROM( int eeaddress, uint8_t data )
{
Wire.beginTransmission(ADDR);
Wire.write((eeaddress >> 8)); // MSB
Wire.write((eeaddress & 0xFF)); // LSB
Wire.write(data);
Wire.endTransmission();
delay(5);
}
byte readEEPROM( unsigned int eeaddress )
{
byte rdata = 0xFF;
Wire.beginTransmission(ADDR);
Wire.write((eeaddress >> 8)); // MSB
Wire.write((eeaddress & 0xFF)); // LSB
Wire.endTransmission();
Wire.requestFrom(ADDR, 1);
if (Wire.available())
{
rdata = Wire.read();
}
return rdata;
}
Dan
Home
Help
Search
Login
Register
