Dumping 93LC66B (3wire mode)

ian · December 18, 2024, 3:09pm

So we know the Bus Pirate is working
93LC66B DO should be HiZ and do nothing to the bus when it is not actively sending data or erase/write status. If it “fails” you should get all 0xff when reading because of the pull-up
Something is holding DO low even though the chip hasn’t been enabled

If you are sure of the connections, then is this chip in a board where something else is pulling the output to 0?

AreYouLoco · December 18, 2024, 3:10pm

Yup I am trying in-circuit. Maybe thats why

ian · December 18, 2024, 3:13pm

That can be tricky. You’ll need to determine what else is on that SPI bus and how to disable it. It could be a big pull-down, but that would be unusual and defeat the point of the ACK bit this chip gives.

Is the board running, or are you trying to power the chip from the Bus Pirate?

Are you certain of the voltage supply if you are powering from the BP?

Is there some kind of security to avoid reading out the EEPROM?

AreYouLoco · December 18, 2024, 3:14pm

I tried voltage 3V3 and 5V. Board is not powered. Using VCC from BusPirate. The board is 6V tolerant so it should be fine to use either 3.3 or 5V. I will try with the hooks provided with BusPirate now. Cuz I don’t trust this Pomona clip even its original.

ian · December 18, 2024, 3:18pm

You should probably measure the board’s voltage while running and then match that.

It’s also possible the Bus Pirate is powering the rest of the board and other chips are booting as well. Possibly partially as the Bus Pirate might not be able to handle the load.

How much current is being used?

This is from a UPC? Are you certain the board is 6V tolerant, and not just the max rated power supply? The chip is only rated to 5.5volts, so it would be out of spec at 6volts.

AreYouLoco · December 18, 2024, 3:49pm

I made measures and it seems like its SOIC not rotated SOIC. VCC on the right side and NC and VSS is tied to GND and ORG is NC. At 3V3 from BP5 the current is around 50-60mA floating a bit. So if it would power stuff around I would expect it to be more.

AreYouLoco · December 18, 2024, 3:59pm

Now tried ‘definition of insanity style’ And just repeated the read command and I randomly get some data:

Last 3 runs. Long text warning

3WIRE> >-[^^_^ 0x00 r:512]

Set data: 1
CS Enabled
Tick clock: 1
Tick clock: 1
Set data: 0
Tick clock: 1
TX: 0x00 
RX: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x6D 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x34 0x00 0x00 0x00 0x00 0x00 0x00 0x02 
    0x90 0x00 0x00 0x00 0x00 0x00 0x00 0x18 
    0x30 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0xB0 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x0B 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x12 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x50 0xD2 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0xA0 0x00 0x00 0x00 0x00 0x00 0x00 
    0x28 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0xB2 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x2C 0x1A 0x80 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    
CS Disabled

Logic analyzer: 33490 samples captured
3WIRE> >-[^^_^ 0x00 r:512]

Set data: 1
CS Enabled
Tick clock: 1
Tick clock: 1
Set data: 0
Tick clock: 1
TX: 0x00 
RX: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x24 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0xA4 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x1A 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x50 0xD0 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x68 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0xA0 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x24 0x00 0x00 0x00 0x00 0x00 
    0x00 0x02 0x0D 0x20 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x05 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x50 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x1A 0x40 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x87 0x20 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    
CS Disabled

Logic analyzer: 33487 samples captured
3WIRE> >-[^^_^ 0x00 r:512]

Set data: 1
CS Enabled
Tick clock: 1
Tick clock: 1
Set data: 0
Tick clock: 1
TX: 0x00 
RX: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x1A 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0xA0 0x00 0x00 0x00 0x00 0x00 0x00 
    0x06 0x80 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x21 0xE4 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x0D 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0xB0 0x00 0x00 0x00 0x00 0x00 0x00 
    0x01 0x60 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x05 0x09 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0xB4 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x1A 0x00 0x00 
    0x00 0x00 0x00 0x00 0x04 0x80 0x00 0x00 
    0x00 0x00 0x00 0x00 0x02 0x1A 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
    
CS Disabled

Logic analyzer: 33502 samples captured

With each run I get some random bits with data. So there is progress I guess. Bad cabling?

ian · December 18, 2024, 4:30pm

Current seems fine.

Are the numbers you’re seeing consistent with the logic analyzer output?

It’s very challenging to read a chip in circuit. You need to identify the master chip and figure out how to hold it in reset. That you’re seeing all 0x00 instead of 0xff shows that there is definitely something else active on the bus.

Which Bus Pirate are you using?

AreYouLoco · December 18, 2024, 4:31pm

BP5 rev10. I am going to review Pulseview output now

Master chip would be the MCU I guess which I believe is bricked as of now.

ian · December 18, 2024, 4:47pm

So on the BP5 we can only see the signals the Bus Pirate is generating, we can’t see what is actually happening on the bus. BP6 has an extra buffer to address this situation.

It is completely possible that the bus is active and we just don’t see the contention.

The fastest thing you can do is use PulseView in normal mode, set a trigger on CS pin, and see if there is any activity that trigger the capture.

You could also use a decent scope to watch the pins one by one.

Something is holding the pull-up resistor to ground, until that issue is addressed you won’t be able to read the chip. It is possible that bricked MCU is bricked in a way that DO is stuck at ground. It could be a million things, especially on a board that isn’t working properly.

ian · December 18, 2024, 4:49pm

If the chip is large-ish, the fastest solution is usually to pull the chip off and put it in a socket, and solder it back later.

AreYouLoco · December 18, 2024, 4:51pm

Figured it out. According to the guide I was following to unbrick it before. There is SWIO/JTAG connector with RST pin. I just grounded it. And now the current is steady ~17mA and I get consistent dumps.

https://www.tarball.ca/posts/unbricking-an-apc-smt3000-ups-after-a-failed-firmware-update/smt3000i.jpg(image larger than 200 KB)

So it was CPU not MCU after all.

ian · December 18, 2024, 4:54pm

Congratulations! The first step of in circuit programming is generally finding that reset, otherwise you get bus contention.

AreYouLoco · December 18, 2024, 4:58pm

First bit is zero tho. Was it over-written? Or is it a coincidence. Anyway happy with the result. And also 3-Wire mode seems to work fine after some fiddling. Here is the begining of my EEPROM:

@alive8330 so you try it next?

ian · December 18, 2024, 5:15pm

Highly doubt it. You would need to unlock the latch first, then successfully run the erase command. Plus the chip wasn’t reading so I doubt it would work. Also, the logic graph doesn’t show it responding to anything.

Likley it’s a 4 byte version number or some kind of header.

AreYouLoco · December 18, 2024, 5:30pm

Ok following up is there some way to save it as binary on the buspirate storage for further bisecting? Or do I have to copy-paste that into some hex editor. Also should check ASCII output to check if its meaningfull if not then MSB/LSB change I guess.

ian · December 18, 2024, 5:40pm

Dumping is a common use case and I’ve had an idea how to deal with it.

How about this: a global command:

You set up the read manually
The command uses the current mode read function to read x bytes and save them to a file

Most every memory has some kind of sequential read command (except maybe 1 wire). But the way to set up the read is different. So you get it to the right state, and the command dumps X bytes to a .Bin file.

AreYouLoco · December 18, 2024, 5:43pm

Or maybe simplier something like output redirection globally like Unix pipes "| > " but unfortunately those characters are already used for some stuff

ian · December 18, 2024, 5:49pm

Yes, absolutely. I’ve thought about that, but it would be pretty ugly to implement inside the syntax compiler as it currently works. It would also not benefit from having a help menu explaining how it works.

A dump command I can push tomorrow morning. Modifications to syntax compiler would take a few days of messing around.

AreYouLoco · December 18, 2024, 5:53pm

Well you know the code. So I mostly trust you on that