Dumping firmware/software...and/or reflashing??

[bag06a]

So heres the quick deal (trying to go fast and to the point, laptop going to be dying soon ha). I have a paintball marker (tippmann x7 phenom) and it has some features of the electronic grip that I would like to redo. I know it is possible because I know of one person who is already reflashing (not making a new board or electronics to go inside the grip...but reprogamming it). I want to do it myself because 1. i dont want to pay lol and 2. I think it would be a fun project.

My question is this; How do I do a firmware dump on it so I can look at the code and modify it?? I'm sure that knowing the controller is one step. I am currently working on figuring it out. I THINK it may be an atmel ATtiny20. I see very small writing on the chip that says "atmel" and then some numbers that are very hard to distinguish. To me it looks like "atmel 0928" or something but cant really find anything with those exact numbers. something else that is written very time on it is "20SSO" (or so it looks like). Seems to me that it may be the package possibly but again I am not 10% sure. Also it has written on it (in bigger letters) "T20Ver2", however it is different writing than the others and dont know if it that writing comes directly from atmel or not.

My reasoning for believe that it's a ATtiny20 is that I refined search parameters to the pin count (14) and anything that had "SSO" anywhere in the package type.

Think you guys would be able to lead me in the right direction?

[Coding Badly]

The ATtiny20 only supports TPI (Tiny Programming Interface) programming.  Do you have a programmer that supports TPI?

I suggest posting a high quality photograph of the processor.

[bag06a]

I can try and take a picture of it later today, but I cant promise that you will be able to read any of the text on it. I had a hard enough time reading it with a magnifying glass haha (it was only a helping hands magnifying glass though). I'll keep you posted.

In regards to a TPI, no I do not have one. Probably could find a way to make one though hey? Not even 100% sure it is an ATtiny. Come to think of it, if I need a TPI, I remember seeing a video on youtube called "shrinkify your arduino projects" where they guy used an arduino uno (i think) to program a tiny.

[bag06a]

Ok I took some pictures of the chip. Sorry if they aren't good enough, they are the best I could get. That pesky T20Ver2 is for the most part in the way of the full model >.<  .

[Coding Badly]

That pesky T20Ver2 is for the most part in the way of the full model >.<  .

Have any whiteout?  Or finger nail polish?  You may be able to rub something into the lettering.  Or you may be able to carefully scrape off the T20Ver2.

Ok I took some pictures of the chip. Sorry if they aren't good enough, they are the best I could get.

The pictures are good enough.  The T20Ver2 definitely obscures the interesting bit.

I suspect that may not be an AVR processor.  I have dozens of AVR processors.  They are all imprinted with the Atmel logo... .  None of them have the word "Atmel" in a typical typeface like the chip in your picture.

[bag06a]

The T20VER2 might be etched onto the plastic, I cant remember. But for curiosity's sake (yours and mine) I will try (very carefully) some fingernail polish .

If it's not an AVR what might it be??

Could it still be an AVR of sorts and just not have the Atmel logo on it? Maybe as a mass purchasing agreement with Tippmann?

[Coding Badly]

If it's not an AVR what might it be??

Atmel makes at least two other microcontroller lines and has a long line of various memory chips.

Could it still be an AVR of sorts and just not have the Atmel logo on it?

Of course.

[mikedehaan]

In short...I'm in the same boat.  After purchasing the tippmann phenom x7 I was a little upset regarding the "safe" features of the firing modes.  Needless to say, I'm heading down the same path, and while this will likely end up more expensive than buy a new board (or potentially a new gun  ), I'm likely to gain useful knowledge about electronics and microprocessors along the way.  That knowledge is worth the journey.

But enough about me, on to the good stuff....

I decided to dust off my old oscilloscope and probe the pins as the trigger operates.  I figured I would at least be able to spot the power and ground pins and perhaps even the trigger pin.  Here's what I discovered in my tests:


If you hold the board with the reset button and LEDs facing you (solenoid on top), the top of the chip should be on the right (there's a little etched circle in the top left of the chip to inicate "top")

Top down (Left side)
1 - VCC Power (approx 9v)
2 - 0v (Digital in/out set to LOW?)
3 - 5v (Digital in/out set to HIGH?)
4 - 5v seems to reset the board when probed (firing is canceled and LED stays solid)
5 - 5v (Digital in/out set to HIGH?)
6 - solenoid trigger (fires the gun) (+5v when firing 0v otherwise)
7 - 5v (Digital input?)  - switches to 0v when the trigger is held (but not in pulses like #6)  Is this the magnetic trigger relay?

Bottom up (right side)
8 - 0v (Digital in/out set to LOW?)
9 - 0v (Digital in/out set to LOW?)
10 - 5v (Digital in/out set to HIGH?)
11 - Green status LED
12 - Red status LED
13 - 5v (Digital out set to HIGH?)
14 - ground

I can't say for certain that this is the ATtiny20, but I can say that if someone else is able to reprogram the chip without soldering and tippmann burned a T20 into the chip face, chances are we're dealing with an ATtiny20.

Can anyone with more expertise gather any more information from the pin data I've gathered?

[mikedehaan]

Also, to help with the original post:

I was also looking for a way to backup the original binary so that if all else failed I could just revert to factory settings.  I do not intend to modify the original code mostly because the best I'll be able to do is download a hex/binary dump of raw data...not source code.

In my quest, I found this link:

http://www.arduino.cc/cgi-bin/yabb2/YaBB.pl?num=1290093229

I couldn't find if it supported the ATtiny20, but since I don't have an in system programmer yet, I couldn't really try.  Could anyone recommend a good ISP for the ATtiny20?

I hope some of this helps.

[Coding Badly]

1 - VCC Power (approx 9v)
ATtiny20

Those two are mutually exclusive...

20. Electrical Characteristics
20.1 Absolute Maximum Ratings
Maximum Operating Voltage ............................................ 6.0V

[mikedehaan]

That makes more sense as to what I saw on the scope.  I don't have a multimeter handy to get actual voltage measurements, but I thought it was closer to the 10 than the 5. (I'm not dealing with a very accurate device).

I grounded the oscilloscope on the positive node of the 9v power supply and probed the VCC once again and the voltage difference was negative.  So for certain it's less than 9v (quite possibly 6v).

Once I dig up my multimeter, I'll find out what VCC is exactly.

[Coding Badly]

If VCC is 5 volts then...

Top down (Left side)
1 - VCC Power (approx 9v)
4 - 5v seems to reset the board when probed (firing is canceled and LED stays solid)

Bottom up (right side)
14 - ground

...are a strong indication that it is a 14 pin Atmel processor.

[mikedehaan]

Thanks!  That's good news.

Any advice on an in system programmer for the ATtiny20?

[Coding Badly]

The only help I can provide is negative.  If it is an ATtiny20 then the link in Reply #8 will not help.  As you can see from Google...

https://www.google.com/search?q=tpi+site%3Aarduino.cc&oq=tpi+site%3Aarduino.cc

...this forum is probably not the best place to ask the question.

[bag06a]

So I messages the guy on the forum that he regularly attends (figured it was a long shot but worth a try) and the only hints he gave were that he completely rewrote the software and that the model number of the cHip is printed on the chip :-/