USB firmware & DSPcode
Reverse-engineering of usb firmware
ReverseFirmware
DSPcode : in s-record format, Technically, a header / description could be added to BNM files : format s-record motorola see
http://home.socal.rr.com/awi/srecords.htm
http://eagle-usb.org/download/bnm-format.txt [fr] some explanations
http://eagle-usb.org/download/RTBLD_44e2ea17.BNM (1 MB) files for latest DSPcode
http://baud123.free.fr/eagle-usb/eagle-usb-2.3/eagle-usb-2.3.2.tar.bz2 (900 kB) driver with firmware, given as hexadecimal values...
http://castet.matthieu.free.fr/eagle/release/ueagle-data-src-1.0.tar.gz (1,2 MB) original formats for USB firmware + DSPcode
http://castet.matthieu.free.fr/eagle/release/ueagle-data-1.0.tar.gz (800 kB) format used by ueagle-atm driver
http://doolittle.icarus.com/~larry/fwinventory/2.6.17.html [en] drivers that contain firmware, list of those using request_firmware or that use the obsolete mod_firmware_load
Conversion tools
Intel HeX Format convert s-format
http://www.ibiblio.org/pub/Linux/apps/circuits/srecord-1.15.README [en] convertisseur de différents formats dont s-record vers intel
http://www.xs4all.nl/~sbolt/e-spider_prog.html [en] programming a spider
http://www.blueearthresearch.com/databkit.htm [en] conversions, ASCII Hex file to an Intel Hex format file
http://home.hetnet.nl/~newlife-software/Binex/binex.htm [en] conversion tool (for win :-( )
http://www.analog.com/UploadedFiles/Associated_Docs/5095058928297198217link_07A_fmt.pdf [en] Visual DSP++ 3.5 doc hexutil tool
http://list.dprg.org/archive/1997-October/002506.html [en] reassuring message about difficulty to use ASM
https://www.semicon.panasonic.co.jp/cgi-bin/micom/manual/download/get_log.cgi?email=general&url=https://www.semicon.panasonic.co.jp/micom/manual/pdf/13110-120e.pdf (1 MB) [en] cross compiler
http://www.eetools.com/download/cm-manual.pdf (2 MB) [en] some tools and interesting definitions : see below
http://srecord.sourceforge.net/
� Binary Format
Binary format does not specify the address or checksum of the file. The file contains
the actual binary data. An example of this format is a DOS executable file with an
.EXE or .COM extension. Binary format is generated for programmable memory
devices. It is recommended to save your EPROM data as binary format in order to
load the file as a standard file format later.
� Intel HEX Format
Intel HEX format files are text files that include the file information in hexadecimal.
1 : A record mark
2-3 Byte Record length in 2 digit HEX, Max 20 (64 in
ASCII)
4-7 Address 4 digit HEX Field. Most significant byte first
8-9 Byte 2 digit field record type :
01 End of file
02 Extended address
10 - N Data Data field in HEX digits
N+1 - N+2 Check-Sum Two digit HEX Check-Sum character computed
by two’s complementing the sum of previous
bytes except the ‘:’
INTEL HEX FILE EXAMPLE
:110000000444154414D414E2053332053455249414C73
:00000001FF
The extended address record specifies the index address where data will be loaded
into. The Extended Address will continue to offset data record address until a new
Extended Address record is specified.
: 02 0000 02 4A29 02
Check Sum
Index address
Record type
Address
Record Langth
The Address field is blank because this record is not data.
The record length is ‘02’ for index address (2 Bytes).
NOTE : If the address for the data record is ‘2B56’, the actual address
will be 4A290 + 2B56 or 4CDE6(HEX).
� Motorola S HEX Format
The Motorola S format file is an ASCII-HEX file.
Position (Byte) Character Remarks
1 S Letter S indicates start of record
2 0, 1, 2, 3, or 9 A single character indicates the type of record.
9: End-of-file
3: 32-bit address data record
2: 24-bit address data record
1: 16-bit address data record
0: Header
3-4 Byte Byte COUNT in HEX (multiply by two
for number of characters). This count
includes the address, data, and
CheckSum field.
5-X Bytes Memory Address for the current record.
X will be:
8 : 16-bit addressing for files less than 64K.
10: 24-bit addressing for files greater than 64K.
12: 32-bit addressing for files greater than 64K in length.
X+1 - N Bytes HEX Data (two per byte)
N+1 - N+2 Check-Sum Two digit HEX Check-Sum character
calculated by one’s complement
of DATA, ADDRESS and COUNT.
Motorola File Example
S1140000444154414D414E2053332053455249414C6F
S9030000FC
� TEKTRONIX HEX Format
The Tektronix HEX format contains ASCII records, expressing bytes ASCII pairs.
Position Character Remarks
1 / Slash character for start of line
2-5 2Bytes Address. MSB first load
6-7 Byte Number of data bytes (not checksums)
8-9 Byte Check-Sum of ADDRESS and COUNT
by character in HEX (not by byte)
10 - N Data Data bytes as ASCII pairs
N+1 - N+2 Byte Check-Sum of Data by character (not as bytes)
Tek Hex Example
/00001102444154414D414E2053332053455249414C8F
/01000001
� ASCII HEX format
This selection generates an ASCII coded HEX format for either 4-bit or 8-bit PROMs.
Each record contains a four-digit HEX address (16-bit) followed by 16 data elements.
A 16-bit checksum is at the end of the file.
When this format is selected, the device base address must be specified. This address
represents the lowest address in the device. The file created contains an entry for each
location in this device. ASCII HEX format can be created for programmable memory
devices only.
chipset of eagle-usb for Fast 800 ADSL USB modem
voir
http://eagle-usb.org/images/ pour une photo de l'intérieur du modem
on a le code DSP et le firmware usb qui sert au chargement du code DSP (sans doute effacé ensuite)
et les DEUX sont en 8051 ?
[
MatthieuCastet] Non le firmware usb n'est pas effacé ensuite, c'est lui qui est chargé de faire le pont entre l'interface usb qui communique avec le pc et le dsp/chip adsl (surement via un lien utopia).
rien de gagné
le DSP est surement un code spécifique je parie
[
MatthieuCastet] oui, mais en regardant sur les version de demo de visualDSP d'analog, il serait peut etre possible de trouver quelques chose...
ya combien de puces dans ces foutus modems ?
c'est ainsi sur tout les modems que je connais
y'a au moins 3 puces
- l'AFE = Analog Front End, c'est juste une interface reliée à la ligne ADSL
- y'a le DSP, c'est lui qui mijote des FFT à fond la patate
- et y'a le coté USB, en général un 8051 tout con (mais pour l'alcatel, c'est une puce à eux)[MatthieuCastet] Pas sur le 8051 pour l'usb doit etre integrer dans le eagle. C'est pour cela qu'analog propose plusieurs versions : PCI, USB, utopia, ...
http://www.8052.com/links.phtml sites pour le 8051 (et autres)
tools
usb stuff
atm stuff
