Remora - ethernet NVEM / EC300 / EC500 cnc board
25 Jan 2022 23:40 #233119
by scotta
Replied by scotta on topic Remora - ethernet NVEM / EC300 / EC500 cnc board
I'm trying to figure out what this IC is. I thought it might be an EEPROM but it is connected to GPIO pins that don't have a combined usage like I2C or SPI. Two pins do have pull down resistors though.
Any one have an idea what this could be? An I2C EEPROM would make sense but it would need to be bit banged in software.
Any one have an idea what this could be? An I2C EEPROM would make sense but it would need to be bit banged in software.
Attachments:
The following user(s) said Thank You: Pro_El
Please Log in or Create an account to join the conversation.
- tommylight
- Away
- Moderator
Less
More
- Posts: 18733
- Thank you received: 6299
26 Jan 2022 00:11 #233122
by tommylight
Replied by tommylight on topic Remora - ethernet NVEM / EC300 / EC500 cnc board
Might not be helpful, but have a look at it, it is a 32f103 and external 24C04 EEPROM, only two wires seem to got to micro.
lupyuen.github.io/articles/super-blue-pi...blue-pill-but-better
lupyuen.github.io/articles/super-blue-pi...blue-pill-but-better
Please Log in or Create an account to join the conversation.
26 Jan 2022 00:18 #233126
by scotta
Replied by scotta on topic Remora - ethernet NVEM / EC300 / EC500 cnc board
The location of the power and ground on the chip does not seem match up with any I2C EEPROM that I can find. Strange one...
Please Log in or Create an account to join the conversation.
- tommylight
- Away
- Moderator
Less
More
- Posts: 18733
- Thank you received: 6299
26 Jan 2022 00:23 - 26 Jan 2022 00:35 #233128
by tommylight
Replied by tommylight on topic Remora - ethernet NVEM / EC300 / EC500 cnc board
Can you figure out where the bottom two pins go?
Last edit: 26 Jan 2022 00:35 by tommylight.
Please Log in or Create an account to join the conversation.
26 Jan 2022 00:24 #233129
by scotta
Replied by scotta on topic Remora - ethernet NVEM / EC300 / EC500 cnc board
The pins that I have left unlabeled are not connected from what I can make out.
Please Log in or Create an account to join the conversation.
- ALittleOffTheRails
- Offline
- User is blocked
Less
More
- Posts: 247
- Thank you received: 65
26 Jan 2022 00:26 #233130
by ALittleOffTheRails
Replied by ALittleOffTheRails on topic Remora - ethernet NVEM / EC300 / EC500 cnc board
It could be just about anything, which is no help at all.
10K would make sense. I suppose all you can do is try.
Although the pin out seems a bit "cooky".
10K would make sense. I suppose all you can do is try.
Although the pin out seems a bit "cooky".
Please Log in or Create an account to join the conversation.
26 Jan 2022 19:57 #233218
by Pro_El
Replied by Pro_El on topic Remora - ethernet NVEM / EC300 / EC500 cnc board
I cannot help with confident answer with this information but i think is i2c EEPROM too from mikrocihp atmel st..., but i will have one controller with me in a week and see what can be these IC. I will make some test and maybe will have mark on my board... will see
Please Log in or Create an account to join the conversation.
26 Jan 2022 20:38 #233225
by scotta
I tried to re-flash the original firmware copy I took, but now I can't get a connection with Mach3 even though the PHY seems to be sending out requests. I did find a copy of the firmware on the web but it appears to be a very different size to the copy I thought I took. It would be great if your board is the same and we can get a good copy of the original bin / hex.
I'm not worried about it for using the board, as I will use Remora. But I did want to try and reverse engineer the protocol for the NVMPG that I got in the bundle...
Replied by scotta on topic Remora - ethernet NVEM / EC300 / EC500 cnc board
Hi, let's hope your board is the v3 version like mine. Other boards don't seem to have this chip populated.I cannot help with confident answer with this information but i think is i2c EEPROM too from mikrocihp atmel st..., but i will have one controller with me in a week and see what can be these IC. I will make some test and maybe will have mark on my board... will see
I tried to re-flash the original firmware copy I took, but now I can't get a connection with Mach3 even though the PHY seems to be sending out requests. I did find a copy of the firmware on the web but it appears to be a very different size to the copy I thought I took. It would be great if your board is the same and we can get a good copy of the original bin / hex.
I'm not worried about it for using the board, as I will use Remora. But I did want to try and reverse engineer the protocol for the NVMPG that I got in the bundle...
Please Log in or Create an account to join the conversation.
29 Jan 2022 22:55 - 29 Jan 2022 23:00 #233498
by scotta
Replied by scotta on topic Remora - ethernet NVEM / EC300 / EC500 cnc board
A little more progress on the NVEM board over a long weekend. I still cannot get the original firmware to talk with Mach3 again. I was hoping to be able to sniff the serial connection to the MPG to try and figure out the serial payload protocol. The only other way to do this would be to decompile the firmware.
Opening up the MPG to find that it too has an STM32 chip. The MCU is a STM32F103RCT6 with a 25Mhz crystal (which is strange). The TFT display module is an XYL2221 module using a parallel ILI9225 driver.
This was my first attempt at trying to reverse engineer from a binary so a bit of a learning curve on how to use the Ghidra software.
After finding what looked like the main() function there were only two other function calls in the main loop. The first being a call to what looks like the TFT update function and the other doing something with the interrupt controller. Looks like timer interrupts are used to poll of data and read button presses etc.
In the TFT_update function there are references to array positions that contain data for the display values. Enough info to start mapping out the payload structure.
There is a header of two bytes. This was found by looking for a UART receive function. These two header bytes are used to sync the data and then to transfer a further 51 following bytes into a data array. This same function also sends a reply if a second header structure is received. No data is updated so this must be used for checking that the MPG is connected.
The button press codes were straight forward to capture using Realterm.
I built a protocol simulator in Excel to test it out. I can update the display as needed!
Next step is to write a LinuxCNC component that can encode the 51 byte payload and a Remora module to go into the NVEM board to send the data to the MPG.
Baudrate = 115200 8N1
[protocol simulator is attached to save others from the work]
Opening up the MPG to find that it too has an STM32 chip. The MCU is a STM32F103RCT6 with a 25Mhz crystal (which is strange). The TFT display module is an XYL2221 module using a parallel ILI9225 driver.
This was my first attempt at trying to reverse engineer from a binary so a bit of a learning curve on how to use the Ghidra software.
After finding what looked like the main() function there were only two other function calls in the main loop. The first being a call to what looks like the TFT update function and the other doing something with the interrupt controller. Looks like timer interrupts are used to poll of data and read button presses etc.
In the TFT_update function there are references to array positions that contain data for the display values. Enough info to start mapping out the payload structure.
There is a header of two bytes. This was found by looking for a UART receive function. These two header bytes are used to sync the data and then to transfer a further 51 following bytes into a data array. This same function also sends a reply if a second header structure is received. No data is updated so this must be used for checking that the MPG is connected.
The button press codes were straight forward to capture using Realterm.
I built a protocol simulator in Excel to test it out. I can update the display as needed!
Next step is to write a LinuxCNC component that can encode the 51 byte payload and a Remora module to go into the NVEM board to send the data to the MPG.
Baudrate = 115200 8N1
[protocol simulator is attached to save others from the work]
Last edit: 29 Jan 2022 23:00 by scotta.
Please Log in or Create an account to join the conversation.
- ALittleOffTheRails
- Offline
- User is blocked
Less
More
- Posts: 247
- Thank you received: 65
30 Jan 2022 02:13 #233511
by ALittleOffTheRails
Replied by ALittleOffTheRails on topic Remora - ethernet NVEM / EC300 / EC500 cnc board
My hat off to you, you've really been putting in the hard yards.
Being a serial protocol would there be the chance of using the Pendant without the NVEM module via a USB to serial dongle directly attached to a computer.
Being a serial protocol would there be the chance of using the Pendant without the NVEM module via a USB to serial dongle directly attached to a computer.
Please Log in or Create an account to join the conversation.
Time to create page: 0.365 seconds