Go Down

Topic: Trying to read a mystery memory (Read 543 times) previous topic - next topic

Retroplayer

Feb 28, 2013, 01:38 pm Last Edit: Feb 28, 2013, 04:46 pm by Retroplayer Reason: 1
I am looking to attempt to read and dump a mystery memory. By mystery, I mean that the parts are under blobs on a board (picture attached.) I have deducted a rough pinout:


    1  GND
    2  CHIP DETECT (connected to 3.3V on cart)
    3  CS0*
    4  CS1*
    5  CS2*
    6  CS3*
    7  CLK
    8  D0
    9  D1
    10 D2
    11 D3
    12 3.3V


There are two memories on the board. They are using CS2 and CS3. Clock and data lines are shared between them. The closest interface that I can come up with is a quad-SPI flash chip or possibly even a true SD card interface (hopefully not since the standards are closed for that.)

I plan to have it xray'd at work tomorrow, so perhaps I will find a chip identifier underneath the blobs, but I am wondering if anyone has any thoughts on how to start reading it in the meantime.

I did connect this up to a logic analyzer in the original circuit to watch the transactions and it appeared that the CS line was only pulsed HIGH for one cycle and a stream of nibbles came out of the data lines. The problem was that the stream was not a fixed width which made decoding it a bit confusing. There did seem to always be a consistent pattern to the first four nibble, so I am assuming that is an address.

The fact that the CS line was only strobed for one clock has me second guessing whether they are really considered "CS" lines. I would have expected it to be held in one state or another for the entire duration of one transaction.

Any thoughts? I can post some LA screen caps as well. But I will probably have had this xray'd by then.

PeterH


I did connect this up to a logic analyzer in the original circuit


If you have an opportunity to watch this working with a logic analyser then you should be able to figure out what it's supposed to do. Otherwise, I think you're facing a tough job.

You didn't mention the CLK line. Is that used at all?

If you have seen it working then presumably you have an idea what it is for. Does the stream of data that you saw it produce correspond to what it is intended to do?
I only provide help via the forum - please do not contact me for private consultancy.

Erdin

Could be ROM for a old game console.

Retroplayer

Well, I have a general idea what it is suppose to do, however with bidirectional lines, it is difficult to know who is generating what. However, I have been playing around with some sketches by simply feeding it a clock signal and watching what it does and interestingly, just the clock signal pops serial data out on D3. This leads me closer to thinking this is a quadSPI memory. By default they are configured for SPI mode and you have to set them for quadSPI.

So, I have my DO pin, I think. Working on figuring out which pin is the DI pin by sending the 9F command which is the command to tell an SPI chip to give up it's chip ID and spit out 3 bytes.

Getting there.

Retroplayer


Could be ROM for a old game console.


No, it is a cartridge for a TJ Bearytales animatronic bear. He has a story mode and a song mode. By watching the CS lines, I found that one "blob" was used for story mode and the other for song mode. There are two other pins which are not connected. They do toggle when the cartridge is removed though, which tells me the on-board flash is probably sharing those lines. On the board is a little module that looks very similar to the cartridge.

Retroplayer

Well, I've got it reading "something". I just don't seem to be in control of it. It is as if it is just auto-incrementing with the clock pulses. I guess I am just going to have to wait until I get the Xrays done. I am fairly convinced that it is a QUAD SPI chip. I tried several different READ_ID commands (though all memories should respond to the 9F JEDEC standard) and of course I get something, but reading it again gives a different number each time.

Giving up for now...

Go Up