Necromancer's notes

Some time ago, I got myself a bunch of those chips. They were dirt chip, they come from china, they have a 8051 architecture and… They are totally missing a way to get programmed in linux.
You can use sdcc, but you are still made to use their binary sh*t to upload the firmware.  And they were retarded enoght no to open up the protocol.
So, time to hack…

I quickly borrowed an ft2232h mini module from a friend, since I didn’t take the time to etch mine, and wrote a little piece of crap to sniff the traffic.
Basically, I use 2 ports of ft2232 module and connect their RX lines to to RX&&TX lines of the micro. They are like a man’in’ the middle that sniffs all the traffic back to my linux machine.
I also use a windows laptop, that uses a standard usbrs232 dongle and stock software to upload the firmware.
You can grab a copy of my uart sniffer here: Some time ago, I got myself a bunch of those chips. They were dirt chip, they come from china, they have a 8051 architecture and… They are totally missing a way to get programmed in linux.
You can use sdcc, but you are still made to use their binary sh*t to upload the firmware.
So, time to hack…
I quickly borrowed an ft2232h mini module from a friend, since I didn’t take the time to etch mine, and wrote a little piece of crap to sniff the traffic.
Basically, I use 2 ports of ft2232 module and connect their RX lines to to RX&&TX lines of the micro. They are like a man’in’ the middle that sniffs all the traffic back to my linux machine.

I also use a windows laptop, that uses a standard usb<–>rs232 dongle and stock software to upload the firmware.
You can grab a copy of my uart sniffer here: https://github.com/nekromant/usniffer
So, what can be told about the ISP stuff?

1. It uses EVEN parity.

2. It operates at 2 different speeds. A lower one, at which it reads/writes the controller’s settings and a different at which it writes the flash. They can be the same, they can differ

3. Some of microcontroller info can be salvaged from the stock ISP software using plain strings. Since the guys put NO licence at all, nobody told us it’s illegal to reverse engineer that.

Okay. Reverse engineering is kinda pain: it’s written in visual (sic!) basic! And the output assembly code is messy.

Now, the stuff that you have all been waiting for: a live transaction log of flashing some code into the microcontroller. Have a look at 0x7f! These are the sync bytes. The programmer sends them until the target responds. target adjusts baud rate using these.
Afterwards go initialisation and parameter query, parameter update and flashing the stuff.

[4.530501 ] programmer: 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f 0x7f
[5.995480 ] mcu: 0x46 0xb9 0x68 0x0 0x72 0x41 0x52 0x28 0x52 0x68 0x9c 0x41 0xdc 0xa 0x84 0x29 0x82 0x53 0x88 0x94 0x41 0xdc 0xa 0x84 0x99 0x4a 0xd 0x50 0x5a 0xdc 0x8c 0xff 0xfd 0xbb 0xff 0xfd 0xfd 0xfd 0xfd 0xfd 0xfd 0xfd 0xfd 0xfd 0xfd 0xfd 0xfd 0x1 0x4 0x8 0x20 0x40 0x0 0xbc 0xe9 0xd1 0x1 0xe2 0x17 0xe 0xb8 0x43 0x9c 0x16
[6.359488 ] programmer: 0x46 0xb9 0x6a 0x0 0x1a 0x50 0x1d 0x3 0xc8 0xa3 0xe0 0xb4 0x70 0x2 0x46 0x16
[6.428478 ] mcu: 0x46 0xb9 0x68 0x0 0xe 0x8f 0x0 0xfc 0x16
[6.564365 ] programmer: 0x46 0xb9 0x6a 0x1 0x6a 0xec 0x1c 0x68 0xdc 0xbf 0xfe 0x2d 0xd 0x4 0x23 0x16
[6.896367 ] mcu: 0x46 0xb9 0x68 0x0 0x1c 0x8f 0x40 0x70 0xbf 0xfe 0x2d 0xd 0x4 0x4 0x26 0x16
[7.111364 ] programmer: 0x46 0xb9 0x6a 0x1 0x62 0xc8 0x14 0x68 0xdc 0xbf 0xff 0xb5 0x1a 0xe8 0xca 0xf1
[7.439365 ] mcu: 0x46 0xb9 0x68 0x0 0x1a 0x84 0x1 0x83 0xfb 0xf7 0xb5 0x34 0x68 0xa0 0x39 0xf1
[7.549363 ] programmer: 0x46 0xb9 0x6a 0x0 0x18 0x84 0xff 0x1 0x2 0xe 0x20 0xc0 0xc0 0x0 0x0 0x1 0x4 0x10 0x60 0x80 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0xe0 0x7f 0x7e 0x7d 0xf1 0xdb 0xd2 0xcb 0xc3 0xba 0xb2 0xab 0xa3 0x9a 0x93 0x8a 0x82 0x7b 0x72 0x6b 0x63 0x5a 0x53 0x4a 0x42 0x3b 0x33 0x2a 0x22 0x1b 0x12 0xb 0x3 0xfa 0xc9 0xad 0x8d 0x69 0x4d 0x29 0x9 0xed 0x35 0xa5 0x95 0xaa 0x53 0x52 0x51 0x50 0x3d 0x73 0xa9 0x12 0xda 0x49 0x69 0xd2 0x48 0x47 0x19 0x2b 0x8d 0xb2 0x68 0x21 0x41 0x1 0xfb 0xe4 0xd6 0xc6 0xb4 0xa6 0x94 0x84 0x76 0x66 0x54 0x44 0x36 0x24 0x16 0x6 0xf4 0x99 0x51 0x11 0xd9 0x45 0x65 0xca 0x28 0x27 0x99 0x2b 0x46 0xd1 0x72 0x44 0x88 0x20 0x1f 0x1e 0x1d 0x71 0xdb 0x48 0x2c 0xc 0xe8 0x21 0xb1 0xc5 0xa 0x13 0x12 0x45 0x82 0xec 0x90 0xd8 0x64 0xcd 0xf1
[9.673243 ] mcu: 0x46 0xb9 0x68 0x0 0x1c 0x0 0x0 0xd 0x4 0x28 0x2e 0x40 0xd8 0x89 0x2 0x44 0x59 0xff
[9.785238 ] programmer: 0x46 0xb9 0x6a 0x0 0x1a 0x1 0x4 0x18 0x20 0x80 0x0 0x0 0x80 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0xf7 0x16
[10.462234 ] mcu: 0x46 0xb9 0x68 0x0 0x10 0x0 0x0 0x0 0xe0 0x59 0xfe
[10.534237 ] programmer: 0x46 0xb9 0x6a 0x1 0x6a 0xa 0x20 0x40 0x0 0x0 0x0 0x0 0x0 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x1 0x2 0x77 0x59 0xff
[11.211234 ] mcu: 0x46 0xb9 0x68 0x0 0x10 0x0 0x0 0x0 0xe0 0x59 0xfe
[11.284236 ] programmer: 0x46 0xb9 0x6a 0x0 0x1a 0x1 0x4 0x18 0xa0 0xc0 0x0 0x0 0x80 0x0 0x0 0x1 0x4 0x10 0x60 0x80 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x2 0x78 0x59 0xff
[11.961119 ] mcu: 0x46 0xb9 0x68 0x0 0x10 0x0 0x0 0x1 0x4 0xb3 0xfc
[12.034120 ] programmer: 0x46 0xb9 0x6a 0x1 0x6a 0xa 0x20 0x40 0x0 0x1 0x80 0x0 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x60 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x60 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x60 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x60 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x60 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x60 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x60 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x60 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x60 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x60 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x60 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x60 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x60 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x60 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x60 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x60 0x80 0x0 0x1 0xf8 0x16
[12.711109 ] mcu: 0x46 0xb9 0x68 0x0 0x10 0x0 0x0 0x1 0x4 0xb3 0xfc
[12.785113 ] programmer: 0x46 0xb9 0x6a 0x0 0x1a 0x1 0x4 0x18 0x20 0x60 0x0 0x0 0x80 0x0 0x0 0x1 0x4 0x10 0x60 0x80 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x2 0x79 0x16
[13.462111 ] mcu: 0x46 0xb9 0x68 0x0 0x10 0x0 0x0 0x1 0x4 0xb3 0xfc
[13.534113 ] programmer: 0x46 0xb9 0x6a 0x1 0x6a 0xa 0x20 0x40 0x0 0x2 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x1 0xf9 0x59 0xff
[14.210987 ] mcu: 0x46 0xb9 0x68 0x0 0x10 0x0 0x0 0x1 0x4 0xb3 0xfc
[14.283987 ] programmer: 0x46 0xb9 0x6a 0x1 0x6a 0xa 0x20 0xc0 0x0 0x3 0x0 0x0 0x1 0x7 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x14 0x98 0xb3 0xfc
[14.960985 ] mcu: 0x46 0xb9 0x68 0x0 0x10 0x0 0x0 0x1 0x4 0xb3 0xfc
[15.033986 ] programmer: 0x46 0xb9 0x6a 0x1 0x6a 0xa 0x20 0x40 0x0 0x3 0x1 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x1 0x4 0x10 0x60 0x80 0x0 0x0 0x0 0x1 0x4 0x10 0x60 0x80 0x0 0x0 0x0 0x1 0x4 0x10 0x60 0x80 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x1 0xfa 0x16
[15.710985 ] mcu: 0x46 0xb9 0x68 0x0 0x10 0x0 0x0 0x1 0x4 0xb3 0xfc
[15.784988 ] programmer: 0x46 0xb9 0x6a 0x1 0x6a 0x2c 0xd3 0x30 0x80 0x1b 0x1 0xd1 0xc1 0x13 0xec 0xc9 0xf1
[15.924987 ] mcu: 0x46 0xb9 0x68 0x0 0xe 0x8d 0x1 0xe2 0x59 0xfe
[17.060867 ] programmer: 0xfe 0xfe 0xfe 0xfe 0x46 0xb9 0x6a 0x1 0x3a 0x4c 0x28 0xc0 0x5e 0x8b

My test file was 256 bytes of 0x01 in hex.
We can see it is put in packets, each acked by the mcu:
[15.033986 ] programmer: 0x46 0xb9 0x6a 0x1 0x6a 0xa 0x20 0x40 0x0 0x3 0x1 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x1 0x4 0x10 0x60 0x80 0x0 0x0 0x0 0x1 0x4 0x10 0x60 0x80 0x0 0x0 0x0 0x1 0x4 0x10 0x60 0x80 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x0 0x0 0x0 0x0 0x1 0x4 0x10 0x20 0x80 0x1 0xfa 0x16
[15.710985 ] mcu: 0x46 0xb9 0x68 0x0 0x10 0x0 0x0 0x1 0x4 0xb3 0xfc
A lot of junkish data in packets tell us that either these are some checksums or the data sent is encrypted. Either way this is a good exercise for the brain. More to come soon!