March 2005 - e3-hacking

Reading the E2 and E3 ROM's through EXP
by Peter Washington 17 Mar '05

17 Mar '05

Hi folks, I have now got my RS232 Level Translator working and I have duplicated Matt's response from the E2, fast flashing LED's followed by about 13 ACK's then nothing for roughly 15 seconds than carry on booting normally. I'm now waiting for Ralph to finalise his latest and greatest version of exp.exe and I will run this on BOTH the E2 and E3, (different cables, because the E3 has a "proper" RS232 interface), and I will report results as soon as I have them. I am also in the fortunate position of being able to leave the system running for as long as it needs to read whatever we want from the E2 or E3, (only 1 at a time, I only have 1 host PC to use for this). Cheers Peter

1 0

Success!
by David Given 17 Mar '05

17 Mar '05

My line level converter works! Woohoo! (It turns out that it helps if you look at the *right* diagram on the datasheet, make sure that you correctly work out which wire of the cable is connected to which pin, and generally don't do a bunch of really embarassing stuff. On the plus side, it turns out that MAX232 chips are much more robust than I thought.) What's more, pblq has now turned into a reasonably generalised mechanism for communicating with PBL, complete with the ability to suck down data using one-byte checksum packets. Currently it's running at 9600 baud, which means it maxes out at 16 bytes per second --- that's a bit over an hour to download PBL, and six *days* for the main flash --- so I've only downloaded fragments. Here's a log; do the checksums match your boards? $ ./pblq Attempting handshake... Connected. PBL V3.1 build 1277 Maximum packet length is 8208 Checksum of 00000000+10000: 00A828D0 Checksum of 80010000+550000: 349F8B09 Downloadng: ################ $ objdump -D -b binary -m arm7tdmi output.img output.img: file format binary Disassembly of section .data: 0000000000000000 <.data>: 0: ea000054 b 0x158 4: ea000055 b 0x160 8: ea00005e b 0x188 c: ea000054 b 0x164 10: ea000054 b 0x168 14: 00000000 andeq r0, r0, r0 18: ea001eb2 b 0x7ae8 1c: ea001e86 b 0x7a3c 20: 00000000 andeq r0, r0, r0 24: 00007740 andeq r7, r0, r0, asr #14 ...etc... I'll get it doing a bit more, polish the interface a bit --- in order to change options, you have to recompile it, which isn't good --- and post it somewhere in a couple of days, if people think it would be useful... -- +- David Given --McQ-+ | dg(a)cowlark.com | "Home is where, when you have to go there, they | (dg(a)tao-group.com) | have to take you in." --- Cordelia Naismith +- www.cowlark.com --+

2 6

Initial version of pblq
by David Given 17 Mar '05

17 Mar '05

Here it is --- it's only 6kB, so I've attached it, and I'm only doing that because this is a low subscription list. Features: * Lots of complex handshaking code; on startup, if PBL is running, it'll connect to that, otherwise it'll wait for you to power cycle the device. * After handshaking, it changes the baud rate for faster transfers. * Command-line interface, easily scriptable. * 100 Bps download speed at 115200 baud! It currently only supports three commands; ping, checksum and read. write (0500) is next on my list; do we know how to change the NAND flash yet? Is that 0E00? BTW, there's a typo in the PBL spec --- the documentation for 0900 is specifying that the baud rate should be passed in big-endian; it's actually little-endian. How to build: ./configure make How to use on the E2: ./pblq read outputfile.img 0x80000000 0x10000 ...and on the E3 (untested): ./pblq -s 115200 read outputfile.img 0x80000000 0x10000 Let me know if it works, is useful, or is broken. (Tip: -v is helpful.) ... Right. I now have a copy of the PBL flash image. Looking at it with a hex editor, I notice immediately that my serial number seems to be in it at 0xFF20. Can anyone confirm this? This would imply that each version of PBL is unique. My MD5 is: 08f841b5a4c14052bcd94b25e1363120 pbl-flash.img (That's the version read out of flash, as above, not the version in RAM.) I also notice that trying to read the contents of the NAND flash at 0x80010000, using the byte-at-a-time checksum technique, makes PBL very unhappy. At one point I ended up with a file full of Qs; mostly PBL acts oddly which makes pblq die with protocol errors. Any suggestions? -- +- David Given --McQ-+ | dg(a)cowlark.com | "Two of my imaginary friends reproduced once ... | (dg(a)tao-group.com) | with negative results." --- Ben, from a.s.r +- www.cowlark.com --+

2 2

E2 PBL response
by Peter Washington 15 Mar '05

15 Mar '05

Hello folks, My name is Peter Washington, (alias Pugwash), and I've been helping Ralph Corderoy for some time now providing electronics expertise to back up his prowess on the software side. I started life as an electronic engineer speciallising in Micro's and then moved over the fence to software. I'm a bit of a newcomer, (complete virgin actually), to newsgroups and mailing list, so please bear with me. I've been following everything on this list avidly, and I'd like to congratulate Matt on the stirling work he's done in getting the E2 to talk to us and add my own congratulations to Ralph on his superb analysis of the E2 PBL. I actually own 2 E2's and an E3, one E2 is my main house phone and is registered with Amstrad, the other is in bits in my back bedroom on a "Breadboard", (a lump of wood big enough to hold the parts of the case that I need and the motherboard on some plastic pillars), hooked up to a PC running Linux. I should be receiving a batch of 5 MAX3232's today and I will be making up a voltage level shifter as soon as possible on some veroboard. I'm going to need to provide a second jack plug so that I can plug in to the E2 OR the E3 as I wish. If Ralph and Matt would like to supply me with a combined, modified exp.exe shortly, I will try the same tests on the E2 then the E3. I completely agree with Matt on 2 important matters :- 1. Trust the Maxim datasheets over any other source. (I think the Hardware Recyling circuit has used 0.1mF to 0.1 micro Farads, lack of the Greek mu) 2. Putting Vcc into the Gnd Pin of any chip will definitely damage it IF any other pin is connected to a voltage around about Vcc. The "Magic Blue Smoke" gets boiled off and it stops working ;-( I think that with the particular mix of people we now seem to have looking at this problem we should have it licked pretty quickly. On another subject entirely, (which should probably be handled further in some other forum), Ralph and I have been talking about home made Digital Storage Oscilloscopes recently, if either Matt or David would like to join forces with us maybe we could have a bash at actually making something. Cheers Peter

5 7

RE: [E3-hacking] E2 PBL response
by Peter Washington 15 Mar '05

15 Mar '05

hi Folks, Right, I've set my autowrap to 72. I hope it works. Matt, Ralph and I were talking about a Configurable Scope / DVM / Logic Analyser. Check out http://www.fpga4fun.com/, cool projects. The Wiki sounds like it might be the best approach to keeping Off Topic stuff to the right people, if I have the faintest understanding of what it is, Ralph perhaps we could have a chat about this. I would be more than happy to "scribble my thoughts" there, particularly since the project would involve lots of code running on a host computer to drive the beast. I have now received 5 MAX3232's so I will be building a Level Translator to put in my E2 serial lead, the E3 is already communicatiing nicely with the current lead, we just haven't been able to get it to talk to us properly, maybe I'll be able to as soon Ralph or Matt supply the latest version of exp.exe !!! Cheers Peter

1 0

PBL & running arbitrary code
by David Given 14 Mar '05

14 Mar '05

I recently found the Emailer Recycling page, and read the documentation there; it all looks highly intriguing, and I'm thinking of getting an E2 or E3, mainly as a toy. Amstrad have always been good at making hackable hardware --- I own a NC200, possibly the nicest Z80 laptop ever made, and have successfully run my own code on it. Still haven't managed to finish that CP/M port, though... Does anyone know if it's possible to use PBL to download and run arbitrary code on the device? Directive 05 would seem to allow data to be written to memory, but there doesn't seem to be any way of getting it to be executed. Does anyone know of such a thing? Would 05 allow you to overwrite PBL's stack (the dodgy way of doing this?) What about well-known PBL variables? And what does 07 do? (I suppose the easiest way of running your own code is to write it into the flash and then do a normal boot, but I'd rather not brick it immediately. Heaven forbid, the standard software might turn out to be useful.) -- David Given <dg(a)cowlark.com>

3 30

Line level conversion
by David Given 14 Mar '05

14 Mar '05

I'm now the proud owner of a MAX232CPE, and hopefully I should be able to breadboard up a line level converter tonight. Then we'll discover whether I've fried my UART by plugging it directly into an RS232 port. I can't seem to find, however, any consistency in the circuits I'm supposed to use. The datasheet's standard circuit uses 1µF capacitors; Maplin's circuit in the catalogue uses 22µF; the circuit here: http://www.seattlerobotics.org/encoder/aug97/cable.html ...uses 0.1µF. Hardware's not my strong point. Can anyone clarify? How critical are these sizes? -- +- David Given --McQ-+ | dg(a)cowlark.com | Quidquid latine dictum sit, altum viditur. | (dg(a)tao-group.com) | +- www.cowlark.com --+

3 3