Ernie: Difference between revisions
Jump to navigation
Jump to search
(→Pinout) |
|||
| (12 intermediate revisions by the same user not shown) | |||
| Line 1: | Line 1: | ||
Codename for Vita Syscon | Codename for Vita Syscon | ||
= Talking to | = Talking to ??? (RL78) = | ||
<pre> | <pre> | ||
| Line 18: | Line 18: | ||
Disconnecting the tool | Disconnecting the tool | ||
Operation completed. | Operation completed. | ||
</pre> | |||
= Talking to Ernie (78K0R) = | |||
<pre> | |||
02 1b 10 ef 04 dc fd fd ff ff 03 44 37 39 46 30 31 30 39 20 20 f8 03 00 00 00 ff ff ff 0f 03 | |||
</pre> | |||
<pre> | |||
Device: D79F0109 | |||
</pre> | |||
<pre> | |||
STX: 0x02 | |||
LEN: 0x1B | |||
Vendor Code: NEC (0x10) | |||
Macro Extension Code: 0xEF | |||
Macro Function Code: 0x04 | |||
Device Extension Codes 1 and 2: 0xDC FD | |||
User Flash Rom Last Adress: ff ff 03 (0x40000) | |||
Device Name (10 bytes) 44 37 39 46 30 31 30 39 20 20 (D79F0109 ) | |||
Security Flag: 0xF8 | |||
Boot Block Number: 0x03 | |||
Start Block: 00 00 | |||
End Block : 00 ff | |||
Reserved: FF FF | |||
Checksum: 0x0F | |||
ETX: 0x03 | |||
</pre> | </pre> | ||
| Line 46: | Line 74: | ||
= Some RL78 pics (testpoints, layout, blank vs not blank, options) = | = Some RL78 pics (testpoints, layout, blank vs not blank, options) = | ||
<imgur> | <imgur>IFmhPj3.png</imgur> | ||
<imgur>nq4LID7.png</imgur> | <imgur>nq4LID7.png</imgur> | ||
| Line 67: | Line 95: | ||
* F9, F5, F6, J3, J10, G10, F10, H1, H4 possible | * F9, F5, F6, J3, J10, G10, F10, H1, H4 possible | ||
* F9, F10, G10, J10, most likely candidates respectively to TOOL0 TOOL1 RESET FLMD0 | * F9, F10, G10, J10, most likely candidates respectively to TOOL0 TOOL1 RESET FLMD0 | ||
* F6 seems to be VDD, F5 seems to be GND, F9 TOOL0, G10 RESET | |||
= Debugger Points for Glitching = | = Debugger Points for Glitching = | ||
| Line 73: | Line 102: | ||
C11 VDD | C11 VDD | ||
C10 EVDDX | C10 EVDDX | ||
F5 | F5 ?? | ||
F9 TOOL0 | F9 TOOL0 | ||
F10 | F10 FLMD0 (On Old 78K0R pstv/psvita 1000 boards) | ||
G10 RESET | G10 RESET | ||
L6 REGC | L6 REGC | ||
</pre> | </pre> | ||
Revision as of 18:20, 23 March 2020
Codename for Vita Syscon
Talking to ??? (RL78)
Connecting the tool Tool : E2 Lite, Tool Num : 5ES000599, Interface : 1 wire UART Emulator's supply power : OFF Emulator's firmware version：3.00.00.007 Connecting to the target device Query the device information. Device Name : R5F1ZCRK Devcie Code : 10 00 06 Firmware Version : V3.03 Code Flash 1 (Address : 0x00000000, Size : 384 K, Erase Size : 1 K) Data Flash 1 (Address : 0x000F1000, Size : 8 K, Erase Size : 1 K) Disconnecting the tool Operation completed.
Talking to Ernie (78K0R)
02 1b 10 ef 04 dc fd fd ff ff 03 44 37 39 46 30 31 30 39 20 20 f8 03 00 00 00 ff ff ff 0f 03
Device: D79F0109
STX: 0x02 LEN: 0x1B Vendor Code: NEC (0x10) Macro Extension Code: 0xEF Macro Function Code: 0x04 Device Extension Codes 1 and 2: 0xDC FD User Flash Rom Last Adress: ff ff 03 (0x40000) Device Name (10 bytes) 44 37 39 46 30 31 30 39 20 20 (D79F0109 ) Security Flag: 0xF8 Boot Block Number: 0x03 Start Block: 00 00 End Block : 00 ff Reserved: FF FF Checksum: 0x0F ETX: 0x03
How to talk
| E1/E20/E2 Emulator, E2 Emulator Lite | Syscon | Notes |
|---|---|---|
| TOOL0 | TOOL0 | Pull up the signals of the TOOL0 pin at 1 kΩ and do not arrange these signal lines in parallel with or
across other high-speed signal lines. |
| RESET | RESET | When flash programming by the programming software is to be performed, the RESET# pin should be designed so that the reset signal on the user system does not conflict with the reset signal from the E1/E20/E2/E2 Lite. |
| GND | GND | The pins of the connector marked "GND" must be at the same ground level as the VSS pin of the MCU. |
| VDD | VDD | Connect the VDD of the connector to the VDD (power supply) of the user system. Use the emulator within the power supply voltage of 1.8 V to 5.5 V and within the operating voltage range of the MCU. |
| EVDD | EVDD |
Identifying VDD/EVDD
killing evdd kills Tool0 but not I2C, but vdd kills both
Some RL78 pics (testpoints, layout, blank vs not blank, options)
<imgur>IFmhPj3.png</imgur>
<imgur>nq4LID7.png</imgur>
<imgur>6ASfhB1.png</imgur>
<imgur>yAWXJnK.png</imgur>
<imgur>kKhSCdm.png</imgur>
Some 78K0R pics
- <imgur w=500>FEBXKkk.png</imgur>
- <imgur w=500>jZgJNwF.png</imgur>
Pinout
- VDD and GND known
- TOOL0, TOOL1, RESET, FLMD0 Unknown
- F9, F5, F6, J3, J10, G10, F10, H1, H4 possible
- F9, F10, G10, J10, most likely candidates respectively to TOOL0 TOOL1 RESET FLMD0
- F6 seems to be VDD, F5 seems to be GND, F9 TOOL0, G10 RESET
Debugger Points for Glitching
C11 VDD C10 EVDDX F5 ?? F9 TOOL0 F10 FLMD0 (On Old 78K0R pstv/psvita 1000 boards) G10 RESET L6 REGC