RingEdge_NoKey_softmod
RingEdge_NoKey_softmod copied to clipboard
ArcadeHustle
Access eeprom on RE
Hey guys I tried to figure out how to read/write the sram and eeprom on the RE by looking at some binaries and wrote some test code.
While sram read and write works fine I found some peculiarity behaviour that I do not understand so far.. So accessing the eeprom works by using the intel lpc device and send commands with 32Bytes data to be read from /written to the eeprom. There is a region that holds the essential factory stuff (serial numbers etc) and system settings and there is another much bigger area that seems to be used for game specific stuff. Of course the factory data is there redundant to not lose the data when a power-cycle occurs when being written. Here is my current understanding of the eeprom's layout:
/* EEPROM memory layout: ---------------------- 0x0000 | | |Factory(0x100) | | | ---------------------- 0x0100 | | |0xFF (0x100) | | | ---------------------- 0x0200 | | |Factory-Backup(0x100)| | | ---------------------- 0x0300 | | |0xFF (0x700) | | | ---------------------- 0x1000 | | |Game-Data (?) | | | ---------------------- ??? | | |0xFF ? | | | ---------------------- 0x2000 */
So for testing I wrote random data at the eeprom and read it back for verification. What I observe is that 3-4 offsets withing the "Game-Data" the last byte of the 32 byte chunks are not the data I have written before. Rewriting the same value also did not fix this. Thus it does not seem to be a programming issue for it only happens at 3-4 of all 32byte chunks - I could imaging that either my eeprom has some bad cells in the game area OR maybe the last byte of each 32byte chunk is some kind of checksum or additional bytes like I know it from other eeproms for meta-data and basically these are "dont care byte" from the applications point of view.
So my question is if any of you have some knowledge about the eeprom layout or this specific issue? Is the eeprom on the Ringedge a discrete eeprom on the mainboard or the IO-board or is the eeprom within the intel southbridge?
Any input is appreciated :)
