mnaberez

#!/usr/bin/env python3
"""
Read all PRG and SEQ files from a disk using cbmread.
Other file types (e.g. REL, USR) are ignored.

Usage: %s <device number>
"""

import shlex
import subprocess

mnaberez

NEC 78K0 Flash Vulnerability

Overview

The microcontroller that I studied was removed from a Volkswagen car radio manufactured by Delco (now Delphi). The chip had only Delco markings on the package. It was decapsulated and the markings "NEC D78F0831Y" were found on the die. I reverse engineered the device definition files for the NEC toolchain (RA78K0) and determined that the uPD78F0831Y is a subset of a documented chip, the uPD78F0833Y. The '833Y adds 3 more timers, extended I2C functionality, and adds registers that allow firmware running on the '833Y to reprogram the flash ("self-programming"). Otherwise, the '831Y and '833Y are the same.

The uPD78F0831Y uses the NEC 78K0 core. Note that NEC (now Renesas) produced a number of incompatible cores with similar names such as 78K0S and 78K

mnaberez

MKE06Z128VLD4

• MKE06Z128VLD4 Product Information
• Deep Dive on Kinetis E Series MCUs
• Kinetis Peripheral Module Quick Reference
• KE0x Fact Sheet
• KE06 Sub-Family Data Sheet
• KE06 Sub-Family Reference Manual

FRDM-KE06 Eval Board

mnaberez

Adapter to allow the M38869FFAHP microcontroller to be read as an M5M28F101 parallel flash memory.

Flash Name	Flash Pin	MCU Pin	MCU Name
A16	2	61	P31/PWM10
A15	3	39	P17
A12	4	42	P14
A7	5	47	P07
A6	6	48	P06
A5	7	49	P05

mnaberez

#!/usr/bin/env python

'''
Parse a log file containing "MEM:" lines from the KWP1281 tool
and write the data to a binary file.

Usage: %s file.log
'''
import os
import sys

mnaberez

;d80 read 2 ==0801==
    5 input"source unit";su
    6 input"destination unit";du
    7 input"image filename";f$
    8 if right$(f$,4)=".d80" then f$=left$(f$, len(f$)-4)
    9 fi$=f$+".d80":fe$=f$+".txt"
   10 bl$="":rem bad sector list
   30 open2,du,2,fi$+",p,w"
   35 open15,su,15
   40 open3,su,3,"#"

mnaberez

;d80 read ==0801==
    5 input"source unit";su
    6 input"destination unit";du
    7 input"image filename";f$
   30 open2,du,2,f$+",p,w"
   35 open15,su,15
   40 open3,su,3,"#"
   45 lt=77
   50 for t=1 to lt
   60 if t>=1 and t<=39 then ls=28

mnaberez

;d82 write ==0801==
    5 input"source unit";su
    6 input"destination unit";du
    7 input"image filename";f$
   30 open2,su,2,f$+",p,r"
   35 open15,du,15
   40 open3,du,3,"#"
   45 lt=154
   50 for t=1 to lt
   60 if t>=1 and t<=39 then ls=28

mnaberez

;d80 write ==0801==
    5 input"source unit";su
    6 input"destination unit";du
    7 input"image filename";f$
   30 open2,su,2,f$+",p,r"
   35 open15,du,15
   40 open3,du,3,"#"
   45 lt=77
   50 for t=1 to lt
   60 if t>=1 and t<=39 then ls=28

mnaberez

Blocktitle 0xE7 (dez. 231)
			
R6L = B
R7L = A

Byte 1	Meaning Value (a means byte2, b means byte3)	Caption
1	???	a*0.2*b	rpm
2	???	a*0.002*b	%
3	???	a*0.002*b	Deg
4	???	abs(b-127)*0.01*a	"ATDC if Value >127, else ""BTDC"""