Here it is --- it's only 6kB, so I've attached it, and I'm only doing that because this is a low subscription list.
Features:
* Lots of complex handshaking code; on startup, if PBL is running, it'll connect to that, otherwise it'll wait for you to power cycle the device. * After handshaking, it changes the baud rate for faster transfers. * Command-line interface, easily scriptable. * 100 Bps download speed at 115200 baud!
It currently only supports three commands; ping, checksum and read. write (0500) is next on my list; do we know how to change the NAND flash yet? Is that 0E00?
BTW, there's a typo in the PBL spec --- the documentation for 0900 is specifying that the baud rate should be passed in big-endian; it's actually little-endian.
How to build:
./configure make
How to use on the E2:
./pblq read outputfile.img 0x80000000 0x10000
...and on the E3 (untested):
./pblq -s 115200 read outputfile.img 0x80000000 0x10000
Let me know if it works, is useful, or is broken. (Tip: -v is helpful.)
...
Right. I now have a copy of the PBL flash image. Looking at it with a hex editor, I notice immediately that my serial number seems to be in it at 0xFF20. Can anyone confirm this? This would imply that each version of PBL is unique. My MD5 is:
08f841b5a4c14052bcd94b25e1363120 pbl-flash.img
(That's the version read out of flash, as above, not the version in RAM.)
I also notice that trying to read the contents of the NAND flash at 0x80010000, using the byte-at-a-time checksum technique, makes PBL very unhappy. At one point I ended up with a file full of Qs; mostly PBL acts oddly which makes pblq die with protocol errors. Any suggestions?