M37906F8CFP programmable? - Page 1
Forum section: electronics / general

author: ercapoccia
author_rank: Regular Contributor
timestamp: November 08, 2014, 10:10:41 am
content: Hi there, i do service for a big brand of professional laundry equipment.I have two motor control boards, that are basically an inverter plus some other security control related to the motor rpm. Those two board are exactly the same but the software in the CMOS CPU M37906F8CFP. I have pin (1-21-22),4,6,7,2,(23-39),41 connected to the 10pin plug J2. () means they are connected to the same pin in the plug.Is there an easy way to copy the flash from a CPU to another?Move the CPU is an option but i prefer don't go so far for now.ThanksDatasheet

author: Yansi
author_rank: Super Contributor
timestamp: November 08, 2014, 03:50:01 pm
content: No way to copy that, because the MCU you want to read the data from will beverylikely locked for any debugging or code downloading. Laundry machine vendors are not so stupid, to leave their code open for public to download it from their product and copy that somewhere else.

author: ercapoccia
author_rank: Regular Contributor
timestamp: November 08, 2014, 04:36:44 pm
content: Thanks Yansi, you are right. I must admit i haven't considered that it could be locked. I'll try to desolder, swap the chip and see how it goes.

author: amyk
author_rank: Super Contributor
timestamp: November 09, 2014, 03:17:10 am
content: Actually the datasheet for this CPU mentions absolutely nothing about memory protection, so it could be possible. I didn't find specific information on the programming protocol but there is info out there on similar related MCU families.

author: ercapoccia
author_rank: Regular Contributor
timestamp: November 09, 2014, 10:15:17 am
content: Could you please give me an example from where i can start my research?

author: Yansi
author_rank: Super Contributor
timestamp: November 09, 2014, 10:49:29 am
content: Hehe, I've just search throughout the datasheet, and amyk's right, there might be no protection. On the other hand, I've found on the web, that also MASK ROM microcontroller version of this exists (program code etched directly on the silicon), but I have no clue, how to identify the ROM version.Also, in the datasheet, there is stated thatProgramming/Erase control by software command- And I think we are home now, because the program download can be disabled that way, from code running in the MCU.Where to start research? Search for some better specsheet for this MCU to see, how does this software protection work.And the second task - borrow somewhere a professional programing tool, that can program these suckers. I would be really waste of time, hacking that by using your own programmer design with another MCU. Maybe Segger programmer can do this sucker. You can try.But do not waste too much time with that.

author: mikerj
author_rank: Super Contributor
timestamp: November 09, 2014, 11:21:47 am
content: Quote from: Yansi on November 09, 2014, 10:49:29 amPretty useless because the code has to start running to disable this feature, and you can normally attach a JTAG debugger whilst the device is in reset.

author: Yansi
author_rank: Super Contributor
timestamp: November 09, 2014, 12:45:25 pm
content: And the JTAG thingy you see where on this MCU?

author: amyk
author_rank: Super Contributor
timestamp: November 09, 2014, 01:33:59 pm
content: QuoteThe ones with "M" instead of "F", e.g. "M8C" vs "F8C".Quote from: ercapoccia on November 09, 2014, 10:15:17 amThe MCU you have is part of the "7906 group"; here is the datasheet for the "7641 group" which contains the description/pinout of the parallel programming mode although the method of entering the mode is slightly different ("CNVss" pin is used, compared to MD0/MD1 for the 7906):http://pdf.datasheetcatalog.com/datasheet/MitsubishiElectricCorporation/mXuutqw.pdfHere is a document for the "7902 group" that suggests MD0=MD1=Vcc to enter parallel programming mode:http://datasheet.eeworld.com.cn/pdf/MITSUBISHI/22641_M37902FCCHP.pdf

author: ercapoccia
author_rank: Regular Contributor
timestamp: November 09, 2014, 06:40:13 pm
content: Thank you guys for your very informative answer.This is a new thing for me, i have a very basic electronics background. I'm a computer engineer and i started to study electronics a couple of month ago in my very limited free time.I found a serial programming diagram in the Segger Flash 5 manuali also found a Suisei parallel writing unit that can write and read to/from the 7900 Series Mitsubishi Electricflash memory built-in MCUEF7906F-42S User's GuideMore info about the controllerComplete Datatasheet

author: ercapoccia
author_rank: Regular Contributor
timestamp: November 09, 2014, 07:33:04 pm
content: The pins on the pcb match the Segger flasher 5 connector, so probably this is the answer, i need a Seger Flasher 5, but it is pretty expensive and maybe the game isn't worth the candle.

author: ercapoccia
author_rank: Regular Contributor
timestamp: November 10, 2014, 03:17:52 pm
content: I read the Renesas datasheet and i can't find anything about password protection. Should i be able to read it with a proper serial reader, like the Segger Flash 5 PRO?

author: Yansi
author_rank: Super Contributor
timestamp: November 10, 2014, 06:07:39 pm
content: As I've said before, ask someone and borrow some beefy programmer which supports these MCUs. But if you want buy one and if you would have usage for it, thats no problem then.By the way, what is on that laundry machine board so interesting, you need to hack it?

author: ercapoccia
author_rank: Regular Contributor
timestamp: November 10, 2014, 07:35:50 pm
content: Thanks Yansi, i'll probably buy one and give it a try, i don't have anyone to ask for a programmer.A motor control with this board costs from 800$ to 1500$ it depends on the output power. I have several board that i fixed but i can't use because the software on the mcu. On the same board there are different software for different model. This way i'll be free to use any board on any model.

author: ercapoccia
author_rank: Regular Contributor
timestamp: November 15, 2014, 02:29:47 pm
content: Got the Segger flash 5 Pro programmer and it works. Thanks for your help.

author: Yansi
author_rank: Super Contributor
timestamp: November 15, 2014, 04:37:30 pm
content: Wow, that MCU really has no readout protection? Silly laundry designersI would never expect unprotected code there.And also congrats that it worked.

author: ercapoccia
author_rank: Regular Contributor
timestamp: November 15, 2014, 04:59:00 pm
content: It works also with the M30260F8AGP (M16/C26A) that is in the upgraded family version of the boards.

author: amyk
author_rank: Super Contributor
timestamp: November 15, 2014, 05:24:24 pm
content: Quote from: Yansi on November 15, 2014, 04:37:30 pmIt's a really old MCU family (now discontinued) and they probably didn't care for protection back then; also the ICSP protocol is not that well-documented so you could consider it "security through obscurity" - but even without the official programmer there's enough info floating around for someone determined enough to RE it.

author: DemasPPC
author_rank: Newbie
timestamp: November 25, 2023, 11:49:58 am
content: Hello everyone...can you share a dump for this controller? I would be very grateful, the EWD2300ZC device (the microcontroller burned out)