Dumping firmware/software...and/or reflashing??

So heres the quick deal (trying to go fast and to the point, laptop going to be dying soon ha). I have a paintball marker (tippmann x7 phenom) and it has some features of the electronic grip that I would like to redo. I know it is possible because I know of one person who is already reflashing (not making a new board or electronics to go inside the grip...but reprogamming it). I want to do it myself because 1. i dont want to pay lol and 2. I think it would be a fun project.

My question is this; How do I do a firmware dump on it so I can look at the code and modify it?? I'm sure that knowing the controller is one step. I am currently working on figuring it out. I THINK it may be an atmel ATtiny20. I see very small writing on the chip that says "atmel" and then some numbers that are very hard to distinguish. To me it looks like "atmel 0928" or something but cant really find anything with those exact numbers. something else that is written very time on it is "20SSO" (or so it looks like). Seems to me that it may be the package possibly but again I am not 10% sure. Also it has written on it (in bigger letters) "T20Ver2", however it is different writing than the others and dont know if it that writing comes directly from atmel or not.

My reasoning for believe that it's a ATtiny20 is that I refined search parameters to the pin count (14) and anything that had "SSO" anywhere in the package type.

Think you guys would be able to lead me in the right direction?

The ATtiny20 only supports TPI (Tiny Programming Interface) programming. Do you have a programmer that supports TPI?

I suggest posting a high quality photograph of the processor.

I can try and take a picture of it later today, but I cant promise that you will be able to read any of the text on it. I had a hard enough time reading it with a magnifying glass haha (it was only a helping hands magnifying glass though). I'll keep you posted.

In regards to a TPI, no I do not have one. Probably could find a way to make one though hey? Not even 100% sure it is an ATtiny. Come to think of it, if I need a TPI, I remember seeing a video on youtube called "shrinkify your arduino projects" where they guy used an arduino uno (i think) to program a tiny.

Ok I took some pictures of the chip. Sorry if they aren't good enough, they are the best I could get. That pesky T20Ver2 is for the most part in the way of the full model >.< .

bag06a:
That pesky T20Ver2 is for the most part in the way of the full model >.< .

Have any whiteout? Or finger nail polish? You may be able to rub something into the lettering. Or you may be able to carefully scrape off the T20Ver2.

Ok I took some pictures of the chip. Sorry if they aren't good enough, they are the best I could get.

The pictures are good enough. The T20Ver2 definitely obscures the interesting bit.

I suspect that may not be an AVR processor. I have dozens of AVR processors. They are all imprinted with the Atmel logo... . None of them have the word "Atmel" in a typical typeface like the chip in your picture.

The T20VER2 might be etched onto the plastic, I cant remember. But for curiosity's sake (yours and mine) I will try (very carefully) some fingernail polish :).

If it's not an AVR what might it be??

Could it still be an AVR of sorts and just not have the Atmel logo on it? Maybe as a mass purchasing agreement with Tippmann?

bag06a:
If it's not an AVR what might it be??

Atmel makes at least two other microcontroller lines and has a long line of various memory chips.

Could it still be an AVR of sorts and just not have the Atmel logo on it?

Of course.

In short...I'm in the same boat. After purchasing the tippmann phenom x7 I was a little upset regarding the "safe" features of the firing modes. Needless to say, I'm heading down the same path, and while this will likely end up more expensive than buy a new board (or potentially a new gun :astonished:), I'm likely to gain useful knowledge about electronics and microprocessors along the way. That knowledge is worth the journey.

But enough about me, on to the good stuff....

I decided to dust off my old oscilloscope and probe the pins as the trigger operates. I figured I would at least be able to spot the power and ground pins and perhaps even the trigger pin. Here's what I discovered in my tests:

If you hold the board with the reset button and LEDs facing you (solenoid on top), the top of the chip should be on the right (there's a little etched circle in the top left of the chip to inicate "top")

Top down (Left side)
1 - VCC Power (approx 9v)
2 - 0v (Digital in/out set to LOW?)
3 - 5v (Digital in/out set to HIGH?)
4 - 5v seems to reset the board when probed (firing is canceled and LED stays solid)
5 - 5v (Digital in/out set to HIGH?)
6 - solenoid trigger (fires the gun) (+5v when firing 0v otherwise)
7 - 5v (Digital input?) - switches to 0v when the trigger is held (but not in pulses like #6) Is this the magnetic trigger relay?

Bottom up (right side)
8 - 0v (Digital in/out set to LOW?)
9 - 0v (Digital in/out set to LOW?)
10 - 5v (Digital in/out set to HIGH?)
11 - Green status LED
12 - Red status LED
13 - 5v (Digital out set to HIGH?)
14 - ground

I can't say for certain that this is the ATtiny20, but I can say that if someone else is able to reprogram the chip without soldering and tippmann burned a T20 into the chip face, chances are we're dealing with an ATtiny20.

Can anyone with more expertise gather any more information from the pin data I've gathered?

Also, to help with the original post:

I was also looking for a way to backup the original binary so that if all else failed I could just revert to factory settings. I do not intend to modify the original code mostly because the best I'll be able to do is download a hex/binary dump of raw data...not source code.

In my quest, I found this link:

http://www.arduino.cc/cgi-bin/yabb2/YaBB.pl?num=1290093229

I couldn't find if it supported the ATtiny20, but since I don't have an in system programmer yet, I couldn't really try. Could anyone recommend a good ISP for the ATtiny20?

I hope some of this helps.

1 - VCC Power (approx 9v)
ATtiny20

Those two are mutually exclusive...

  1. Electrical Characteristics
    20.1 Absolute Maximum Ratings
    Maximum Operating Voltage ............................................ 6.0V

That makes more sense as to what I saw on the scope. I don't have a multimeter handy to get actual voltage measurements, but I thought it was closer to the 10 than the 5. (I'm not dealing with a very accurate device).

I grounded the oscilloscope on the positive node of the 9v power supply and probed the VCC once again and the voltage difference was negative. So for certain it's less than 9v (quite possibly 6v).

Once I dig up my multimeter, I'll find out what VCC is exactly.

If VCC is 5 volts then...

Top down (Left side)
1 - VCC Power (approx 9v)
4 - 5v seems to reset the board when probed (firing is canceled and LED stays solid)

Bottom up (right side)
14 - ground

...are a strong indication that it is a 14 pin Atmel processor.

Thanks! That's good news.

Any advice on an in system programmer for the ATtiny20?

The only help I can provide is negative. If it is an ATtiny20 then the link in Reply #8 will not help. As you can see from Google...

https://www.google.com/search?q=tpi+site%3Aarduino.cc&oq=tpi+site%3Aarduino.cc

...this forum is probably not the best place to ask the question.

So I messages the guy on the forum that he regularly attends (figured it was a long shot but worth a try) and the only hints he gave were that he completely rewrote the software and that the model number of the cHip is printed on the chip :-/

Try cleaning the top of the chip using a paper towel dipped in rubbing alcohol.

bag06a:
...the only hints he gave were that he completely rewrote the software...

I figured as much. I've started writing my own software for this as well. Right now it's a series of blinking LED's in the simulator :wink:

Also, I was able to confirm that VCC was 5v. (finally found my multimeter :D)

I figure that since I have the pinouts and a pretty good idea how the platform is supposed to operate (pull trigger => fire gun), I have a good chance in writing something that works. If you'd like to collaborate on this adventure please send me a private message and I'll give you my email address.

I think we've exhausted the Arduino nature of this topic, so this forum is probably not the best place to proceed.

mikedehaan:
I think we've exhausted the Arduino nature of this topic, so this forum is probably not the best place to proceed.

That is only possibly true if the processor is an ATtiny20. SPI programmable ATtiny processors (e.g. ATtiny84) are very popular in the Arduino world. They can be programmed easily using any Arduino compatible board. There is even a forum section dedicated to the pursuit... Microcontrollers.

Yea, I'd like to Collaborate on this adventure. It'd be great learning experience. I'll send you a pm when I get home so I don't have to do it on my phone.

Also, coding badly, data sheet for attiny20 says its ISP. Does that dramatically change things?

bag06a:
Also, coding badly, data sheet for attiny20

You've determined that it is an ATtiny20?

says its ISP. Does that dramatically change things?

ISP = In System Programming. It's a generic term meaning the processor can be programmed after being installed on a board. Atmel processors have several flavours of ISP: Serial (the most Arduino friendly), Parallel, debugWIRE, etcetera.

One of those ISP flavours is "TPI". As far as I can tell, the ATtiny20 only allows TPI programming. The other flavours are not supported. TPI programming has been rarely if ever discussed here.

The processor is essentially a stripped down ATmega328. The folks here have lots of experience with the 328 so I suspect you can get help here regarding low-level hardware questions. But probably not much help regarding uploading the new software via TPI.