NishanthMenon changed the topic of #openocd to: this is the place to discuss all things OpenOCD | Logs: https://libera.irclog.whitequark.org/openocd/
gamiee has quit [Ping timeout: 246 seconds]
gamiee has joined #openocd
joconor has quit [Quit: ZNC 1.8.2 - https://znc.in]
joconor has joined #openocd
tsal has joined #openocd
tsal_ has quit [Ping timeout: 252 seconds]
Guest68 has joined #openocd
Guest68 has quit [Quit: Client closed]
akaWolf has quit [Ping timeout: 272 seconds]
akaWolf has joined #openocd
akaWolf has quit [Ping timeout: 255 seconds]
akaWolf has joined #openocd
akaWolf has quit [Ping timeout: 252 seconds]
akaWolf has joined #openocd
pengi3 has quit [Quit: The Lounge - https://thelounge.chat]
pengi3 has joined #openocd
akaWolf has quit [Ping timeout: 252 seconds]
akaWolf has joined #openocd
nerozero has joined #openocd
slobodan has joined #openocd
pengi37 has joined #openocd
pengi3 has quit [Ping timeout: 248 seconds]
pengi37 is now known as pengi3
ScottBakula has joined #openocd
<gamiee> ScottBakula: I recommend using Quassel instead of ZNC, much better experience (at least for me)
<ScottBakula> @PaulFertser, flash info 0 is not a valid command :)
<ScottBakula> i put my openocd in debug mode to see more things
<PaulFertser> ScottBakula: how so, you do not have flash defined by the board config?
<ScottBakula> i used /usr/share/openocd/scripts/target/bcm5352e.cfg and in my cmsis-dap.cfg i have this
<ScottBakula> adapter driver cmsis-dap \n transport select jtag \n gdb_port 3333
<ScottBakula> please be advised that bcm5352e.cfg is the last one
<ScottBakula> i tried with firmware-recovery.tcl before but same issue with this command, i am a newbie sorry :D
rkta has left #openocd [#openocd]
<ScottBakula> in bcm5352e.cfg nothing is mentionned about the flash and in firmware-recovery.tcl
<ScottBakula> same
<PaulFertser> ScottBakula: you said you had wrt54gl board, is this a different ne?
<PaulFertser> The SoC itself doesn't have that flash obviously.
<ScottBakula> @PaulFertser, i think to be more precised it's a wrt54g
<PaulFertser> ScottBakula: so you use the _board_ config
<PaulFertser> I think GL should be similar enough but not sure.
<PaulFertser> IDK how wide its connection to the flash, is it 16 bits or 8 bits?
<PaulFertser> No harm trying both.
<PaulFertser> (asus-rt-n16.cfg is an example)
<ScottBakula> yeah Paul : > flash info 0
<ScottBakula> Could not probe bank: no QRY
<ScottBakula> Try workaround w/0x555 instead of 0x55 to get QRY.
<ScottBakula> Flash Manufacturer/Device: 0xfc01 0xfc01
<ScottBakula> Could not probe bank: no QRY
<ScottBakula> auto_probe failed
<ScottBakula> the flash on the board has been identified as a MX29LV160C by myself :)
<ScottBakula> @PaulFertser, 16M-BIT [2Mx8/1Mx16] CMOS SINGLE VOLTAGE
slobodan has quit [Read error: Connection reset by peer]
slobodan has joined #openocd
<PaulFertser> ScottBakula: no QRY is bad, means something is wrong, no communication with the flash working.
<ScottBakula> :'(
<PaulFertser> ScottBakula: is it not working both in 16-bit and 8-bit modes?
<ScottBakula> idk how to change this @PaulFertser
vampirefrog has joined #openocd
<ScottBakula> i am moving to another approach, i wan to understand if they did something to block access to the flash, i am looking at the firmware
vampiref- has joined #openocd
vampiref- has quit [Quit: ZNC 1.8.2+deb2+deb11u1 - https://znc.in]
vampiref- has joined #openocd
vampirefrog has quit [Quit: Leaving]
pengi3 has quit [Ping timeout: 252 seconds]
pengi3 has joined #openocd
<PaulFertser> ScottBakula: asus-rt-n16.cfg is a tested example of using 8-bit bus.
<ScottBakula> @PaulFertser, sounds better : https://pastebin.com/jby0NLAc
<PaulFertser> ScottBakula: /now/ you can dump from it or flash it.
<ScottBakula> ok i am reading the firmware, let see if it's better
<ScottBakula> does the dump_image is writing to the file in streaming mode or wait to read all the content before writing ?
<PaulFertser> ScottBakula: should be streaming
<PaulFertser> ScottBakula: note you specified the size incorrectly but that shouldn't matter much.
<ScottBakula> argh still empty :(
<ScottBakula> i must confirm my hardware is working properly with another board
slobodan_ has joined #openocd
slobodan has quit [Ping timeout: 248 seconds]
<PaulFertser> ScottBakula: you can use "mdw" to check individual words.
<PaulFertser> ScottBakula: also try different addresses, e.g. 0xbc000000 vs. 0x1c000000
<PaulFertser> ScottBakula: does this board boot from this flash?
<PaulFertser> ScottBakula: it's certainly communicating with the flash in some reasonable way now since you read C2 C2 id bytes.
<PaulFertser> So probably just mapped to different address in your hardware, also there're cached vs. uncached regions on mips.
<PaulFertser> ScottBakula: yes, I know on wrt54gl that I was using it was mapped to 0x1c000000 , not bc, so I'd expect same for your wrt54g target.
<ScottBakula> ok
<ScottBakula> ohohoh
<ScottBakula> i made a test and i have something now @PaulFertser !!!
<ScottBakula> dump_image test.bin 0xbc000000 4096
<PaulFertser> ScottBakula: why was previous dump_image not working?
<ScottBakula> i think yes, in the partition table we don't have the good adresses
<ScottBakula> everywhere on internet it's referenced here, for example: https://sergioprado.blog/2020-02-20-extracting-firmware-from-devices-using-jtag/ which is my starting point article
<ScottBakula> jtag> readmem 0x1fc00000 0x400000 flash.bin <-- FALSE !!!
<ScottBakula> if i well understood, now i need to find the starting address on this flash, maybe i will bruteforce it
<PaulFertser> ScottBakula: you said you have flash of just 2 MiB so no wonder it's false for your case.
<PaulFertser> ScottBakula: dump all the 2 MiB, then use binwalk.
nerozero has quit [Ping timeout: 244 seconds]
slobodan_ has quit [Read error: Connection reset by peer]
slobodan_ has joined #openocd
slobodan_ has quit [Read error: Connection reset by peer]
slobodan_ has joined #openocd
slobodan_ has quit [Ping timeout: 248 seconds]
<ScottBakula> thanks @PaulFertser for your precious help !)
slobodan_ has joined #openocd
<PaulFertser> ScottBakula: got it all working now? Glad to help! What are you trying to RE, btw, what's the final goal with this antique board?
<PaulFertser> ScottBakula: also, can you confirm downgrading OpenOCD is necessary?
<ScottBakula> i used openocd version 0.12.0 for this
<PaulFertser> OK, so no regressions there, good to know.
<ScottBakula> "What are you trying to RE" : i know this is very old, but it was a starting point for me to experiment with jtag. I never used it before, i had to have a setup, i saw jtagulator was discontinued, and also i saw segger j-link is soo expensive
<ScottBakula> i bought a bus pirate 6 recently, but for the moment no jtag support, it still in dev
<PaulFertser> jtagulator you need only when pinout is unknown.
<PaulFertser> j-link edu can be bought for NC purposes for relatively cheapp.
<PaulFertser> My go-to device currently is TUMPA (non-light), it's FT2232H based. It has its silly gotchas but it seems to be the cheapest FT2232H board with fast buffer. Plus you get RS-232.
<ScottBakula> oh nice i take a look at it, for jtagulator i think i need something equivalent for iot hacking/reing because most of the time you don't know the jtag pins
<PaulFertser> There're newer much better projects.
<PaulFertser> https://www.crowdsupply.com/1bitsquared/glasgow should be capable
<PaulFertser> ScottBakula: bluetag looks promising, thanks for sharing
<ScottBakula> omg i bought the bus pirate to quickly i guess, for 145$ the glasgow looks much more powerful
<PaulFertser> You didn't ask here :)
tsal has quit [Quit: ZNC 1.8.2+deb3.1 - https://znc.in]
<ScottBakula> Oh boy! i didn't know you 2 months ago, if only I could travel in time 🤔
slobodan_ has quit [Read error: Connection reset by peer]
tsal has joined #openocd
joconor has quit [Quit: ZNC 1.8.2 - https://znc.in]