e3-hacking

Download

e3-hacking@earth.li

December 2021

1 participants
2 discussions

Some things I have found on the Amstrad E3 while I was pressing different buttons.
by Nick Griffin 01 Oct '24

01 Oct '24

I found something the other day, if you press SETUP Button then 1 then 1 again, it looks like it comes up with driver info, Picture is here.. https://imgur.com/zjJc2oT And if you press SETUP Button then 1 then 0 it has numbers on the Setup Info screen Picture here.. https://imgur.com/VpJRCRt Anyone seen theses before..? Do not know what the numbers are on the Setup Info screen is..?? Spanner..

11 54

None
by None 29 Dec '21

29 Dec '21

when the bootloader enables the WDT it also sets the freeze bit in the WDT control register which prevents the register being changed, the only way to clear this is a reset. Possibly the bios could be patched to not set the freeze bit and the patched version programmed by jtag to give a box that can have the WDT disabled just after the CPU is halted, but i never got as far as looking to see if/how you would flash the bios by jtag, although it could probably be done. I also have no idea if the bootloader would check to see if the value in the WDT controller register had been tampered with. That and im not sure id want to dump 8 megs of flash with a wiggler, it would probably take a day or 2 lol, the wiggler is a very slow interface :) It might also be possible to dump the nand flash by allowing the emailer to reset then writing a macro to setup the memory controller to map the nand back into address space then read the first 512 (????) byte page (just read the same address 512 times) then write to the chip to change page and continue to read the next page, but until i came across the emailer i had never heard of page mode flash so the method of reading/writing/changing page completely boggled me, but it basically behaves like a smartmedia card. To read it in this manner would require some poking around the board to see how they are generating the signal for changing page rather that writing to flash I guessed that they are either sitting the chip on 2 chipselect lines (ie it would be mapped in 2 places) with one enabled for read/write and the other for reading/changing page, or it has only one chip select but with some of the address lines wired to the control signals so for example a write to a memory address at the chips lowest address would actually write to the chip while a write at the top of its mapped space would change the page, but this is just a random guess, i havent really looked into it. Oh and apologies for hijacking the E3 mailing list with E2 stuff but i hope some of it will be relevant, most arm boards seem to be built in a similar manner. en4rab > From: Ralph Corderoy <ralph(a)inputplus.co.uk> > Reply-To: e3-hacking(a)earth.li > > > Hi en4rab, > > > If the E3 behaves like the E2 did it will have its WDT enabled and > > locked so about 4 or 5 seconds after you halt the CPU the WDT will > > time out and reset the box > > Code to reset the watch-dog's timer writes 0x0000a5a5 to 0xffff8004. > > e3a0c9fe mov r12, #&3f8000 > e24cc501 sub r12, r12, #&400000 # r12 = 0xffff8000 = WDT. > e3a030a5 mov r3, #&a5 > e2833ca5 add r3, r3, #&a500 # r3 = 0xa5a5. > e58c3004 str r3, [r12, #4] # wdtcntr. > > Presumably, something similar could be done with JTAG to disable the > WDT > completely? > > Cheers, > > > Ralph. ===== -- | .-. en4rab(a)yahoo.com | / \ .-. | / \ / \ .-. .-. _ _ +--/-------\-----/-----\-----/---\---/---\---/-\-/-\/\/--- | / \ / \ / '-' '-' |/ '-' '-' -END OF TRANSMISSION- __________________________________ Do you Yahoo!? All your favorites on one personal page Try My Yahoo! http://my.yahoo.com

1 0