open-tl866 icon indicating copy to clipboard operation
open-tl866 copied to clipboard

T48 project status

Open JohnDMcMaster opened this issue 2 years ago • 3 comments

Current state of project from what I can tell

  1. Firmware extraction: WCH bootloader, T48 bootloader, and T48 main firmware are dumped
  2. Firmware update via bootloader: we know a bit about how the protocol works, but nobody has implemented an updater yet
  3. Firmware update via ISP: I've attempted and failed, but 1) this is as heavily modified / untrusted board 2) I suspect there is something around the LED driver conflicting with the SWDIO line / BOOT must be driven in the right state. Maybe also BOOT0?
  4. We tried microprobing the flash die, but failed due to the chip not surviving decap. Maybe too thin of copper bond wires browning out the chip
  5. Nobody has demonstrated any basic T48 functionality such as blinking the LED
  6. Boards have been scanned / delayered somewhat, and progress is being made with pcbre and other tools to create a schematic

Some open questions / tasks:

  1. Proper schematic
  2. Create a stand alone updater (ie don't rely on their tools)
  3. Demonstrate some basic T48 functionality such as blinking an LED
  4. Demonstrate ISP flashing, if nothing else to recover my bricked boards that need new CPUs

JohnDMcMaster avatar Nov 24 '22 18:11 JohnDMcMaster

I demonstrated ISP flashing (chip was soldered backwards :P ). However I haven't been able to get the original T48 bootloader to load correctly. Maybe related to loading as .bin instead of .hex. Trying to prepare a .hex with the right base address (0x08000000 I believe).

In any case, with ISP now I should be able to try flashing an LED blink on the T48 using my own firmware

JohnDMcMaster avatar Nov 26 '22 22:11 JohnDMcMaster

We have an updater PoC here: https://github.com/JohnDMcMaster/libxgecu

JohnDMcMaster avatar Dec 21 '22 21:12 JohnDMcMaster