Cheaply read program from a PIC18 - Page 1
Forum section: electronics / general

author: MLXXXp
author_rank: Frequent Contributor
timestamp: December 15, 2019, 05:36:37 pm
content: Since I haven't got any responses tomy post reqesting information on communicating with a power supplyI bought, my next thought is to read the program from the PIC, then try to disassemble it to see if I can get any clues about the protocol.I have no intention of doing any further PIC development, so I don't want to spend much money or effort on this. Is the following plan likely to work?I foundPICPgm, which claims to support the PIC18F14K50 that I need to read. I have an old PC running Windows XP. I've already installed PICPgm on it and, when run, it at least brings up the GUI without any problems or errors.The PC has a parallel port, so I plan to build theTLVP - Trivial LVP programmer. I just need a 74HCT573, which I can get locally for less that $1. I have everything else.One issue is that theProgramming Specificationindicates that a bidirectional level converter is required if the main power is 5V. I have aMOSFET based level converterwith an on board 3.3V regulator for the low side. Will that work, inserted as shown in the spec?Once I've read the program, I hope to be able to use this:Disassembler for Microchip's PIC 18 familyDoes anyone see any problems or have any comments?

author: Ian.M
author_rank: Super Contributor
timestamp: December 15, 2019, 06:26:39 pm
content: You've just opened a massive can of worms and, if you cant find the firmware source anywhere online, are about to jump down the PIC development rabbit hole.The 74HCT573 is just being used as a buffer. Any non-inverting quad gate or hex buffer in the 74HCT family could be substituted. You'd need pullups on the outputs if it was open drain, which would also let you handle the level conversion by pulling up PGC and PGD to 3.3V instead of 5V.Most PICs in commercial products and non open-source hobby kits are code protected. That means you can read the CONFIG bits, but the program and data memories read back as all zeros.The quick way to see if that's the case is to install the old MPLAB 8.92 IDE software, select the correct PIC device, import the hex file read from the device (as you aren't using a programmer it supports), then look at the program memory view (window).Even if it isn't protected, reverse engineering a C program complex enough to contain a USB stack (and odds are its C as there was no official Microchip USB stack in assembly for PIC18) from a disassembly listing, for anything more serious than recovering strings and other data tables is the computing equivalent of trying to turn hamburger back into a live cow.

author: MLXXXp
author_rank: Frequent Contributor
timestamp: December 15, 2019, 08:23:56 pm
content: Quote from: Ian.M on December 15, 2019, 06:26:39 pmI realised that but since I don't have any 74HCT parts or other suitable buffer on hand, the 573 is as good as any. I could also get a 74HCT244 for the same price. Either may come in handy at a later date once I'm done with it for this purpose. It's possible that I could eliminate the buffer altogether and just use the level shifter alone, but keeping the buffer is probably being on the safe side.QuoteI know that's a risk, which is why I don't want to spend much money on a programmer/reader. As I said in the other post, the power supply could be a hobby kit and includes the programming header, so there's a reasonable chance that the code won't be protected. I have good evidence that a schematic was published for it.QuoteTrue. I was mostly hoping just to see some ASCII strings that might give a clue as to what the commands are. The disassembler might somewhat isolate code from data if it does a reasonable job.I have a good amount of experience with various microprocessors and assembler (8080, Z80, SC/MP, IBM 360, AVR, etc., and even PIC16C54A) since 1975. But having not programmed or read a PIC without a high end out of circuit programmer (which I no longer have access to), I just want some assurance that this setup has a reasonable chance of reading the program (assuming it's not protected).Thanks for your reply,Scott

author: MarkF
author_rank: Super Contributor
timestamp: December 15, 2019, 09:20:49 pm
content: Your best bet to try to read the PIC code is to buy a PICkit 3 clone and download the latest MPLAB X IDE and XC8 compilier.PICKit3 Microchip Programmerfor $18.95I doubt you could build something for that and with the PICkit you can then program any of the PICs.The TLVP - Trivial LVP programmer you reference depends on the Low Voltage programming mode being enabled in the PIC. IT MAY NOT BE. I don't enable LVP mode in my programs. The PICkit does not depend on LVP.

author: brucehoult
author_rank: Super Contributor
timestamp: December 15, 2019, 09:40:35 pm
content: Quote from: MLXXXp on December 15, 2019, 08:23:56 pmWow, there wouldn't be many people around now (or ever) with scamp experience.Quite a pleasant ISA for the time, especially with four pointer registers (one the PC) that you could index off to access PC-relative variables or constants, stack frames, fields of structs etc. Cool "swap pointer register with PC" function call mechanism. I think the more frustrating aspects were you couldn't load or store the pointer registers directly (only by shuffling the hi and lo bytes through the accumulator), and array indexing was awkward -- small arrays you could calculate the byte offset in the accumulator, transfer it to the extension reg, and then use -128 as an immediate offset from the array base (in a pointer register) which actually used the contents of E as the offset instead of -128. For bigger arrays .. yuk. The main problem was it used clock cycles like am 8080/z80, but was clocked like a 6502 ... so ran very slow.The 2650 was another interesting CPU from that time, but no one now remembers it. I think it was just too limited in address space, in small subroutine return stack, and lack of any 16 bit registers (or good substitutes such as pointers in the 6502 zero page) to see widespread adoption. The SC/MP was a better design.

author: Ian.M
author_rank: Super Contributor
timestamp: December 15, 2019, 10:45:20 pm
content: It may not be worth buying a PICkit 3 clone if you will have no other use for it in the future.Its possible to mod the'Tait Classic'parallel programmer to support normal high voltage programming on PICs that either don't run at 5V Vdd, or need a Vpp level other than +12.5V. Simply replace the Vpp regulator with an adjustable one so you can set the +8.5V that a PIC18F14K50 requires for programming, and add a separate adjustable regulator to supply PIC Vpp and the PGC and PGD pullups. The PIC18F14K50 is a special case - you need to power the pullups as-if its 3.3V PIC but supply 5V Vdd.N.B. in the Tait design, the 7407 requires 5V Vcc, so you cant use the same regulator as the PIC for it if you are adding 3.3V support. Also the 7407 must be any family of real bipolar TTL as CMOS ones cant have their outputs pulled up above Vcc and mostly don't have 3.3V logic compatible input thresholds.

author: MarkF
author_rank: Super Contributor
timestamp: December 16, 2019, 04:00:29 am
content: Quote from: Ian.M on December 15, 2019, 10:45:20 pmFor the little cost, is it really worth it?If you build the 'Tait Classic', you WILL be debugging both the programmer and the PIC at the same time.Plus any modifications you make to the programmer.Just, start adding up the cost of the parts... Will you be saving anything? You can find the bare PICkit for $12.And you also NEED to find a computer now days WITH a parallel port.It's a simple choice for me! How valuable is you time?Plus, the PICkit works with all the Microchip tools.

author: MLXXXp
author_rank: Frequent Contributor
timestamp: December 16, 2019, 01:06:52 pm
content: Quote from: MarkF on December 16, 2019, 04:00:29 amI'm not going to spend $12 to work on a power supply that cost $5. I probably won't even use the supply much, let alone its USB interface. At this point it's just for the fun of doing the detective work to figure out something that I can't find information about.My parts cost for the "TLVP" programmer, or even the "Tait Classic" would be less than $1 since I already have everything except maybe one IC. Build, debug and "fiddling" time isn't an issue since this is a hobby thing and learning experience.Unless someone says that my original plan of using the "TLVP" programmer definitely won't work, I think I proceed with it. If it turns out I need a high voltage programmer, I'll look into the "Tait Classic". (Thanks @Ian.M for the additional info about the Tait.)QuoteIf you read my original post, you'd see that I already have a PC with a parallel port, running Win XP withPICPgminstalled and working.

author: Ian.M
author_rank: Super Contributor
timestamp: December 16, 2019, 01:42:01 pm
content: A TLVP or a Tait Classic is pretty easy to get going as long as you have a DMM and some way of setting outputs on the parallel port and monitoring its inputs so you can check the required functionality pin by pin before you commit to a real PIC and have a spare PIC you can test programming and readback functionality on with a dead simple 'hello world' LEDblinker. I built a modded classic as my first programmer back when the PIC16F84 was fairly new, and rebuilt its DOS software to add a release from Reset so I could program and run in-circuit and to add I2C EEPROM support. The software gave me far more trouble than the hardware, so you shouldn't have much trouble building and running one from PICpgm.

author: MLXXXp
author_rank: Frequent Contributor
timestamp: December 16, 2019, 03:18:18 pm
content: Quote from: MLXXXp on December 16, 2019, 01:06:52 pmI guessI myselfis that someone. Looking closer at the schematic, I see that the PGM pin (7) isn't connected to the ICSP header and is being used as an I/O output. Therefore, the ICSP must use high voltage mode. I'll consider the "Tait" with modifications for 3.3V PGC an PGD signals, which I think just means tying the 7407 output pullups for PGC and PCD to 3.3V instead of 5V.I won't need any voltage regulator circuitry. I can get Vpp from the supply itself in "manual" mode. I'll get 5V from one of the numerous USB chargers or 5V wallwarts I have lying around. 3.3V for PGC and PGD signal levels can be obtained from Vusb of the PIC itself. The programmer circuitry will just be built on a solderless breadboard.Quote from: Ian.M on December 16, 2019, 01:42:01 pm[...]I have no less than 9 DMMs and an old Tek TDS210 scope and am well versed in their use. I'll proceed slowly and carefully, as you suggest.If it turns out that the programmer works but the program is protected, and I want to get ambitious, I can always reprogram the PIC and use a standard or my own control protocol.

author: Ian.M
author_rank: Super Contributor
timestamp: December 16, 2019, 05:29:06 pm
content: You cant draw much current from PIC Vusb safely. It may be better to use potential dividers in place of pullups to get the desired 3.3V logic '1' level.Personally, I'd use a 5V regulator running from your bench supply that's also going to be the Vpp supply to power the PIC and the 7407, so you don't have to worry about ripple on the 5V from a cheap charger, and so the supply rails come up and power down together.N.B. there are alternatives to the 7407 if you don't have a real TTL one in your junk box - if you edit the programmer definition file to tell it the signals are inverted, you can also use a 7406.

author: KL27x
author_rank: Super Contributor
timestamp: December 16, 2019, 07:39:17 pm
content: TAIT is dead simple if you have a parallel port. It's just a matter of voltage conversion and not doing something stupid to burn out your port.You can't drive it from a USB to parallel port adapter, though.The high programming voltage should be roughly 2.5x the supply voltage. For a PIC18 at 3.3V supply, you want something like 7-8V, and it's not super critical. Can go up to probably 9 or 10V and still work fine.There is 99.9% chance that the code is read-protected.And a disassembly will be of limited value. You have better chance to learn what it is doing with a logic analyzer and scope, and then to write your own code. Unless you are really familiar with dissassemblies of C, and PIC assembly, specifically, which would be weird that you don't have a PIC programmer, yet.I cut my teeth on a DIY TAIT programmer and PICpgm. I build some with only 4-5 transistors and a 9V battery for the high programming voltage. Voltage followers for clock and program, npn as switch for Vsupply. 5V sourced from USB. Then npn and pnp to control the 9V supply. It doesn't matter the logic. In PICpgm you can invert any of the signals you want.

author: ebclr
author_rank: Super Contributor
timestamp: December 16, 2019, 10:00:39 pm
content: Did you try sending ? on the terminal, maybe just maybe have a help

author: MLXXXp
author_rank: Frequent Contributor
timestamp: December 17, 2019, 12:38:36 am
content: Quote from: Ian.M on December 16, 2019, 05:29:06 pmThePIC18F1XK50 datasheetsection 22.2.2.3 states:QuoteSo using Vusb for the 10k pullups used by the "Tait" should be fine.Quote from: Ian.M on December 16, 2019, 05:29:06 pmI'll use my scope to check the ripple of whatever 5V supply I decide to use, under a decent load. I'll use a DPST switch to switch in both supplies at the same time, after they're powered up.Quote from: Ian.M on December 16, 2019, 05:29:06 pmI've looked and couldn't find any open collector output parts. I'll pick up a 7407 for $0.65 from a store I'll be passing by on the weekend.Quote from: KL27x on December 16, 2019, 07:39:17 pmI know what the PIC is supposed to do. It sets output pins based on commands it receives on the USB port. What I'm trying to determine is what those commands are. A logic analyzer or scope won't help me with this.I've written assembly code for PIC many years ago. I used a programmer at the place where I worked at the time but no longer have access to one. I've done a fair bit of analysis of the assembler output of C and C++ for other architectures. However, as I said, I'm just hoping to find strings or other data that might give a clue about what the USB commands are.Quote from: ebclr on December 16, 2019, 10:00:39 pmI've tried sending many, many things (includingSCPIcommands). I've never seen any changes on the output pins. It echoes back whatever I send (up to 20 characters, which must be its buffer size) and I always get back a ">" prompt after anything I send that ends with CR LF but no other response (but this tells me that it's seeing what I send).