Ernie: Difference between revisions
Jump to navigation
Jump to search
| Line 24: | Line 24: | ||
<pre> | <pre> | ||
02 1b 10 ef 04 dc fd fd ff ff 03 44 37 39 46 30 31 30 39 20 20 f8 03 00 00 00 ff ff ff 0f 03 | 02 1b 10 ef 04 dc fd fd ff ff 03 44 37 39 46 30 31 30 39 20 20 f8 03 00 00 00 ff ff ff 0f 03 | ||
</pre> | </pre> | ||
| Line 32: | Line 31: | ||
<pre> | <pre> | ||
Extension Code : 10 | Vendor Code: NEC (0x10) | ||
Macro Extension Code: 0xEF | |||
Macro Function Code: 0x04 | |||
Device Extension Codes 1 and 2: 0xDC FD | |||
User Flash Rom Last Adress: ff ff 03 (0x40000) | |||
Device Name (10 bytes) 44 37 39 46 30 31 30 39 20 20 (D79F0109 ) | |||
Security Flag: 0xF8 | |||
Boot Block Number: 0x03 | |||
Start Block: 00 00 00 | |||
End Block : ff ff ff | |||
</pre> | </pre> | ||
Revision as of 17:14, 23 March 2020
Codename for Vita Syscon
Talking to ??? (RL78)
Connecting the tool Tool : E2 Lite, Tool Num : 5ES000599, Interface : 1 wire UART Emulator's supply power : OFF Emulator's firmware version：3.00.00.007 Connecting to the target device Query the device information. Device Name : R5F1ZCRK Devcie Code : 10 00 06 Firmware Version : V3.03 Code Flash 1 (Address : 0x00000000, Size : 384 K, Erase Size : 1 K) Data Flash 1 (Address : 0x000F1000, Size : 8 K, Erase Size : 1 K) Disconnecting the tool Operation completed.
Talking to Ernie (78K0R)
02 1b 10 ef 04 dc fd fd ff ff 03 44 37 39 46 30 31 30 39 20 20 f8 03 00 00 00 ff ff ff 0f 03
Device: D79F0109
Vendor Code: NEC (0x10) Macro Extension Code: 0xEF Macro Function Code: 0x04 Device Extension Codes 1 and 2: 0xDC FD User Flash Rom Last Adress: ff ff 03 (0x40000) Device Name (10 bytes) 44 37 39 46 30 31 30 39 20 20 (D79F0109 ) Security Flag: 0xF8 Boot Block Number: 0x03 Start Block: 00 00 00 End Block : ff ff ff
How to talk
| E1/E20/E2 Emulator, E2 Emulator Lite | Syscon | Notes |
|---|---|---|
| TOOL0 | TOOL0 | Pull up the signals of the TOOL0 pin at 1 kΩ and do not arrange these signal lines in parallel with or
across other high-speed signal lines. |
| RESET | RESET | When flash programming by the programming software is to be performed, the RESET# pin should be designed so that the reset signal on the user system does not conflict with the reset signal from the E1/E20/E2/E2 Lite. |
| GND | GND | The pins of the connector marked "GND" must be at the same ground level as the VSS pin of the MCU. |
| VDD | VDD | Connect the VDD of the connector to the VDD (power supply) of the user system. Use the emulator within the power supply voltage of 1.8 V to 5.5 V and within the operating voltage range of the MCU. |
| EVDD | EVDD |
Identifying VDD/EVDD
killing evdd kills Tool0 but not I2C, but vdd kills both
Some RL78 pics (testpoints, layout, blank vs not blank, options)
<imgur>IFmhPj3.png</imgur>
<imgur>nq4LID7.png</imgur>
<imgur>6ASfhB1.png</imgur>
<imgur>yAWXJnK.png</imgur>
<imgur>kKhSCdm.png</imgur>
Some 78K0R pics
- <imgur w=500>FEBXKkk.png</imgur>
- <imgur w=500>jZgJNwF.png</imgur>
Pinout
- VDD and GND known
- TOOL0, TOOL1, RESET, FLMD0 Unknown
- F9, F5, F6, J3, J10, G10, F10, H1, H4 possible
- F9, F10, G10, J10, most likely candidates respectively to TOOL0 TOOL1 RESET FLMD0
- F6 seems to be VDD, F5 seems to be GND, F9 TOOL0, G10 RESET
Debugger Points for Glitching
C11 VDD C10 EVDDX F5 ?? F9 TOOL0 F10 FLMD0 (On Old 78K0R pstv/psvita 1000 boards) G10 RESET L6 REGC