I'm looking for a disassembler for a 24C02 memory chip - Page 1
Forum section: electronics / beginners

author: Lachin012
author_rank: Regular Contributor
timestamp: March 16, 2023, 10:07:34 pm
content: Hello! please tell me who can meet the disassembler for memory chips 24С02.

author: wraper
author_rank: Unknown
timestamp: March 16, 2023, 10:14:08 pm
content: What are you going to disassemble? EEPROM normally does not store any code. Not to say disassembler is for CPU architecture, not memory type where code is stored.

author: Lachin012
author_rank: Regular Contributor
timestamp: March 16, 2023, 10:38:36 pm
content: Quote from: wraper on March 16, 2023, 10:14:08 pmThere is a code from 24C02 I would like to see the contents, there is a certain problem in this code.

author: HwAoRrDk
author_rank: Super Contributor
timestamp: March 16, 2023, 10:53:43 pm
content: Are yousurethe EEPROM contains code? I doubt it. For two reasons:1. A 24C02 is only 2 kbits, 256 bytes. That's a very small amount of code.2. It has an I2C interface. Microcontrollers or microprocessors do not typically access their program memory that way.More likely to be a configuration/settings EEPROM.

author: wraper
author_rank: Unknown
timestamp: March 16, 2023, 10:55:04 pm
content: Again, your question is pointless and there is 99,99% chance there is no code to disassemble, only data. To view it use some hex editor like HxD.

author: CaptDon
author_rank: Super Contributor
timestamp: March 17, 2023, 01:48:08 pm
content: Is that chip used with a small FPGA? A disassembler?? Well, we would need to know what it is connected to? What system does this serial EEPROM store data for? That would determine what code we could disassemble to. I suspect all of these questions are beyond your skill level since you didn't give us that information to start with. What are you hacking would be the next question. Probably the only problem with the code is you don't own the intellectual property or source code to it.

author: nigelwright7557
author_rank: Frequent Contributor
timestamp: March 17, 2023, 02:58:15 pm
content: You used to be able to buy clip on units that could read and write the EEPROM.

author: Lachin012
author_rank: Regular Contributor
timestamp: March 17, 2023, 04:23:34 pm
content: Yes, you are probably right, it was necessary to explain everything in order, there is a control unit, this unit has a ST72F325 microcontroller, since this microcontroller does not have its own EEPROM, they installed an external 24C02 memory chip, the exchange is via I2C, and so the settings of the unit itself are stored in 24C02, and if either the checksum or something else is damaged, the block displays an error (-P-) that the contents of the EEPROM are damaged, and if you write normal content, then everything starts working after that, the fact is that I would like to look at what exactly is damaged and what is written in EEPROM to figure out which cells are damaged.Thank you for your understanding, maybe I did not express my thoughts correctly, but I tried to describe my problem.I am attaching the contents of the EEPROM and not a lot of photos about the error, I’ll write right away that I recorded the contents of 24C02 from a similar block, the block works but not correctly, I wrote it down purely to check to make sure the block will work after writing 24C02.

author: wraper
author_rank: Unknown
timestamp: March 17, 2023, 04:53:18 pm
content: If it's actually a design flaw and not some HW failure that causes corruption, looking which exact data gets corrupted will not give you anything unless you are firmware developer and have MCU firmware source code.Without altering MCU firmware, basically the only thing you can do is replacing the EEPROM, maybe with some another compatible type and see if it improves situation. Or maybe you could do some hack with power rails or MCU reset if corruption happens during power on or off. Did you actually replace the EEPROM? They do fail with data retention problem.

author: Lachin012
author_rank: Regular Contributor
timestamp: March 17, 2023, 05:09:23 pm
content: Yes, I changed the EEPROM to a new one, the result is the same, if, say, we take an EEPROM from a similar model and write it to 24C02, then the error goes away, but the block itself does not work correctly, the contents of the MCU ST72F325 itself are also there, but there is no sense, since this large code and disassembling it is a big problem.There is no hardware problem everything is checked carefully. All power supply is ok.

author: HwAoRrDk
author_rank: Super Contributor
timestamp: March 17, 2023, 06:08:31 pm
content: So you want to disassemble the microcontroller code to see what the purpose and structure of the information stored in the EEPROM is?Might be tricky - the ST7 architecture is quite old and uncommon. Perhaps you might have some luck using theNakendisassembler for STM8. I believe the STM8 instruction set is a superset of the ST7, so you might get sensible results. IDA Pro also apparently specifically supports ST7, but that is an expensive commercial product.You are right that if you have tens of kilobytes of code to reverse-engineer, it will indeed be a "big problem". I once reverse engineered only 2 kB of STM8 disassembled code and that took several days. A suggestion would be to try and isolate code which deals with the I2C peripheral, which you should be able to find by looking for instructions that access the I2C peripheral register addresses.

author: wraper
author_rank: Unknown
timestamp: March 17, 2023, 06:15:48 pm
content: Did you try just a blank EEPROM? Many devices simply write default data if EEPROM is blank.

author: Lachin012
author_rank: Regular Contributor
timestamp: March 17, 2023, 07:34:10 pm
content: Quote from: wraper on March 17, 2023, 06:15:48 pmYes, I tried to put an empty EEPROM, all the same result.

author: Lachin012
author_rank: Regular Contributor
timestamp: March 17, 2023, 07:34:59 pm
content: Quote from: HwAoRrDk on March 17, 2023, 06:08:31 pmThank you for the link, I'll try to work.

author: wraper
author_rank: Unknown
timestamp: March 17, 2023, 07:42:22 pm
content: Quote from: Lachin012 on March 17, 2023, 05:09:23 pmYou could try a trick. Try cooking EEPROM contents from 2 dumps you have. Try replacing half of original dump with data from another device. If it does not help, replace another half. If it helps, try replacing smaller portions of original data until you get working EEPROM data or find what exactly causes the error.

author: Manul
author_rank: Super Contributor
timestamp: March 17, 2023, 08:00:59 pm
content: Was the device ever working correctly? If yes, then the obvious question is what changed?If the EEPROM itself is good and we assume the firmware to be by design static, then it could be power problems (mind you, the issue might occur only at startup like ramp time, transients, dips), clock problems, insufficient I2C bus drive (weak, marginal pullups?), rotting firmware bits, empty RTC battery (don't laugh, I've seen a device which was giving EEPROM error, because it was checking stored time against current time or something) or maybe some external input is causing the MCU to misbehave and corrupt the data.In any case methodical comparing is the easiest way.Edit: Is the device Electrolux ERF2000 fridge? Really, check the power supply - number one issue in consumer products.

author: CaptDon
author_rank: Super Contributor
timestamp: March 17, 2023, 08:30:21 pm
content: Thank-you for the follow up. This is the information we needed to offer assistance. Sadly, I am not familiar with that particular platform. When you specified such a small serial eeprom I thought it was connected to an older smaller FPGA. Best wishes to solve the problem!

author: Lachin012
author_rank: Regular Contributor
timestamp: March 17, 2023, 08:46:46 pm
content: Quote from: Manul on March 17, 2023, 08:00:59 pmYes, that is what he is. Electrolux ERF2000.Everything is fine with the power supply, there are no failures, the ripple before that everything worked, but the problem is precisely the error of its eeprom, when I recorded from a similar model its eeprom unit completely came to life, but there is a mismatch of programs, but there was no error.

author: Manul
author_rank: Super Contributor
timestamp: March 17, 2023, 08:59:55 pm
content: Quote from: Lachin012 on March 17, 2023, 08:46:46 pmOh, ok, sorry, somehow I understood that data corruption happens again and again. So it was just one time corruption and now you can't get it working. Got it.Can you post a working EEPROM dump form another model?

author: darkspr1te
author_rank: Frequent Contributor
timestamp: March 17, 2023, 09:31:09 pm
content: I remember seeing a eeprom service procedure for solving which suffered static issues.Quotethen later it states,Quoteso the eeprom back will also have to come from similar part number too .there is a function to show eeprom codes, your could "scan the i2c but of the other board it matches too and see if you can also scan the new eeprom to see what addresses are used, i've use this method to fix Electrolux control panels. in that case the kepty the addreses the same across boards and data , that was the key. be careful with high voltage and using pc's/scope to read the ic2 in the device,darkspr1te

author: Lachin012
author_rank: Regular Contributor
timestamp: March 17, 2023, 09:35:21 pm
content: Quote from: Manul on March 17, 2023, 08:59:55 pmHere is from another model.

author: Lachin012
author_rank: Regular Contributor
timestamp: March 17, 2023, 09:38:22 pm
content: Quote from: darkspr1te on March 17, 2023, 09:31:09 pmThe fact is that this procedure does not help. But I will try again.

author: amyk
author_rank: Super Contributor
timestamp: March 17, 2023, 10:24:35 pm
content: What functions does this fridge have? If it's not much more than a thermostat and possibly defrost timer, you might have better luck fitting a generic thermostat in its place.

author: darkspr1te
author_rank: Frequent Contributor
timestamp: March 17, 2023, 10:25:29 pm
content: I've looked at the posted bin file plus the new bin file and here's what i've foundbytes 0x0 too 0x64 is duplicated , bytes 0x65 too 0xc9The device serial/model number maybe ? is at 0xD0 too 0xD5file 240c_compr file it's BF0A2Uand24c02.zip it's BF0A1JI also noted that it just so happen on 240c_compr it has a letter p at 0xFE, could be related to stored long term errorwhen you compare those two sections in a hex viewer (i used HxD for this)you will see some similar data too. the item highlighted the in the included picture is the possible serial model number in hexthe next group of numbers look similar too with some small changes, maybe software versionsand of course there is that last changes byte that is 0xFEthats just what I've noted in a quick look.maybe change the serial number in a copy of the other device file to match the damaged device and then write that data to 0xD0-0xD5, then write the new file with new patched device number to the system.I have done it here if your willing to write to the device.darksrp1te

author: Lachin012
author_rank: Regular Contributor
timestamp: March 17, 2023, 11:52:54 pm
content: Quote from: darkspr1te on March 17, 2023, 10:25:29 pmThank you for doing a very good analysis.Most likely this is not a model at addresses 0xD0-0xD5, but a firmware version.Suppose we have an error P at address 0xFE and the value 70 is written there, what should we write instead of 70 to fix the error P and is it necessary to calculate the checksum after the correction?added a photo of the main unit and a photo of the indication

author: radiolistener
author_rank: Super Contributor
timestamp: March 18, 2023, 12:57:09 pm
content: this chip contains just configuration settings and calibration if any. So, there is no code in that chip. If you have code from MCU, you can reverse it, you can find part of code which works with eeprom by opcode which access it's bus. But reverse is a hard process and take a lot of time, I'm sure it will be more cheaper to buy a new device than spending time on reverse engineering of such thing.On the other hand you can try to contact manufacturer by email, may be they can help to survive your device with providing eeprom dump or details for eeprom content and checksum calculation.

author: darkspr1te
author_rank: Frequent Contributor
timestamp: April 06, 2023, 10:58:08 am
content: I would start by writing 0x00 there are testing that, ignoring any possible crc issue first.Also test the file i patched and see if it changes anything.

author: m k
author_rank: Super Contributor
timestamp: April 07, 2023, 05:44:16 pm
content: Maybe missing FF in DE next.