Does anyone recognize this display SPI protocol? - Page 1
Forum section: electronics / projects

author: NiHaoMike
author_rank: Super Contributor
timestamp: October 11, 2022, 01:09:26 am
content: I'm trying to reverse engineer the display module in an Onkyo TX-NR509 so I can take over control using a Raspberry Pi Pico. (The end goal is to turn that unit into a "smart" audio box with an Atomic Pi inside handling audio playback and various automation applicable to a home audio/video system.) The module itself is marked "16-BT-165GINK", not that helpful. I have attached a Pulseview capture of the SPI lines.I'm under the assumption that the controller is going to be one of the off the shelf ones and not a custom ASIC. I'm hoping someone would recognize that what family of controller it is, maybe even the exact one used.

author: coromonadalix
author_rank: Super Contributor
timestamp: October 11, 2022, 02:23:23 am
content: normally you can / could search for inscriptions on the display ?in the service manual we clearly see the 4 lines going into the display, and yes it's an intelligent display, it is used in others models ...Could be custom made too ??And the problem will be to sniff out the data and figure it out, and many infos / characters will be displayed ....in your file i don't see where you define your CLK, RST D0, CS lines ??

author: NiHaoMike
author_rank: Super Contributor
timestamp: October 11, 2022, 02:45:30 am
content: D0 is /Reset, D1 is /CS, D2 is CLK, D3 is MOSI.The module is custom but I would be very surprised if the chip itself is as well. Doesn't make sense to design a custom chip when there's off the shelf chips for those sorts of display modules.

author: DavidAlfa
author_rank: Super Contributor
timestamp: October 11, 2022, 11:10:33 pm
content: Theservice manualmentions M66005 (M66005-0001AHP ?), which is a VFD controller:Found thedatasheetbut in japanese only.Tried to translate it using Google but it only did it partially, as not all of it is encoded as text, some parts are plain images.Then tried Google Lens, does a decent job (See attached screenshots).

author: NiHaoMike
author_rank: Super Contributor
timestamp: October 12, 2022, 02:15:20 am
content: A step closer but that is definitely not the exact chip since the commands do not appear to match up. The display is also 2 row while that chip is single row.Therefore, I think the chip used is most likely a 2 row variant in that family.

author: DavidAlfa
author_rank: Super Contributor
timestamp: October 12, 2022, 02:20:53 pm
content: This is the decoded output after correctly settings the clock polarity and edges.Yo me it makes some sense, at least what I've found so far.Each row is a single transfer, made while CS=low.Quote

author: DavidAlfa
author_rank: Super Contributor
timestamp: October 12, 2022, 03:36:50 pm
content: Found the Onkyo TX-SR706 actually uses 2x discrete M66005 drivers, and the display is very similar:But yeah, the commands just don't match.

author: DavidAlfa
author_rank: Super Contributor
timestamp: October 20, 2022, 09:40:05 am
content: Had a moment to look at it.Downloaded the firmware here:https://www.intl.onkyo.com/support/firmware/tx-nr509.htmlDecrypted it using this:http://divideoverflow.com/2014/04/decrypting-onkyo-firmware-files/Analized the output files: There's a kernel, a squashfs filesystem and then two suspicious files containing lot of menu strings:- of2.ONKAVR0007_00NA00EA00NA.NA103- of3.ONKAVR0007_00NA00EA00NA.NA108Knowing the controller UPD70F3746GJ (datasheet] has 1MB of flash, perhabs one of them is a flash update.- The display is connected to CSIB5 (SPI5 for normal people).- CSB5 base address is FFFFFD50- Chip Enable is connected to P68, so address FFFFF40D (PORT6H), bit 0Open of3.ONKAVR0007_00NA00EA00NA.NA108 in ghidra, uncheck "Show only recommended Language", choose V850 processor.First find where the SPI is configured:- FFFFFD50 (CB5CTL0) = 0xF1- FFFFFD51 (CB5CTL1) = 5- FFFFFD52 (CB5CTL2) = 0Comparing these values with the datasheet: Master, clock/64, the clock mode matches the waveform...And wait! LSB first! This will mean we need to search reversed bytes in the code!So this:Code:07 F027 0405 87 0703 C0 C0 C0 C0 C0 C0 C0 C0 C0 C0 C0 C0 C0 C0 C0 C0Becomes this in code:Code:E0 0FE4 20A0 E1 E0C0 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03Let's find those values...kind of! But slightly different:It's sending this. Maybe I looked in the wrong place of the code, but looks extremely similar and has same pattern.Code:E0 0FE4 F0A0 F0 F0C0 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03Which would be seen like this by the analyzer:Code:07 F027 0F05 0F 0F03 C0 C0 C0 C0 C0 C0 C0 C0 C0 C0 C0 C0 C0 C0 C0 C0Compared again againt what you got, it's like it picked up some noise:Code:07 F027 0405 87 0703 C0 C0 C0 C0 C0 C0 C0 C0 C0 C0 C0 C0 C0 C0 C0 C0So maybe your capture data is wrong?Also, perhabs the controller also expects LSB first, so these would be the actual commands?Now let's find where somewhere where CE is toggled.Looks like it's this part, but didn't inspect any longer:Well, that's all, now it's time for you to dive into the binaries!Extracted firmware here:https://anonfiles.com/9fEb47D8yf/onkyo_zip

author: NiHaoMike
author_rank: Super Contributor
timestamp: October 21, 2022, 05:04:56 am
content: I kind of figured something was up with the bit order when the symbols seem to be scattered about instead of being in a logical sequence.For others who have the same display to interface to, these Bus Pirate commands will get you started:Code:[ % 0x07 0xF0 % ][ % 0x27 0x04 % ][ % 0x05 0x07 0x07 % ][ % 0x03 0xC0 0xC0 0xC0 0xC0 0xC0 0xC0 0xC0 0xC0 0xC0 0xC0 0xC0 0xC0 0xC0 0xC0 0xC0 0xC0 % ][ % 0x62 0xAA 0x54 0xAB 0x5C 0xAA 0x54 0xAA 0x54 0xAA 0x54 % ][ % 0x17 % ][ % 0x27 0x04 % ][ % 0x42 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 % ][ % 0x04 0x20 0x04 0x04 0x04 0x04 0x04 0x04 0x04 0x04 0x04 0x04 0x04 0x04 0x04 0x04 0x40 % ][ % 0x00 0x20 0x59 0x99 0x04 0x84 0xf6 0x86 0x85 0x1a 0x04 0xf6 0x3e 0x3e 0xa6 0x12 0x40 % ]I know from other observations that 0x27 sets the brightness.0x42 appears to be custom characters.0x04 is the top row.0x00 is the bottom row.This is the list of symbols, I know at least some of the "blanks" can be programmed.Code:0x00 blank0x01 ball on pedestal0x02 @ (open)0x03 A with \ above0x04 blank0x05 ||0x06 high \0x07 a with \ above0x08 low ||0x09 refresh0x0A P0x0B D with - through0x0C 00x0D high clover0x0E p0x0F a with x above0x10 up arrow0x11 mouse cursor0x12 H0x13 E with \ above0x14 (0x15 high ..0x16 h0x17 e with \ above0x18 down right arrow0x19 thumbs down0x1A X0x1B O with / through0x1C 80x1D ,0x1E x0x1F o with / through0x20 blank0x21 left down waves0x22 D0x23 A with .. above0x24 $0x25 chain link0x26 d0x27 a with .. above0x28 II0x29 key0x2A T0x2B O with ^ above0x2C 40x2D high /0x2E t0x2F o with ^ above0x30 [ up0x31 search0x32 L0x33 I with \ above0x34 large ,0x35 sideways L0x36 l0x37 i with \ above0x38 >>0x39 star0x3A \0x3B U with .. above0x3C <0x3D 1/40x3E |0x3F u with .. above0x40 blank0x41 musical note0x42 B0x43 A with o above0x44 high ||0x45 cent0x46 b0x47 a with ^ above0x48 square D0x49 square !0x4A R0x4B O with \ above0x4C 20x4D small 20x4E r0x4F o with \ above0x50 left arrow0x51 office0x52 J0x53 E with ^ above0x54 *0x55 a with _ below0x56 j0x57 e with ^ above0x58 right triangle0x59 filled heart0x5A Z0x5B U with / above0x5C large :0x5D o with _ below0x5E z0x5F u with / above0x60 hash cursor0x61 half filled theta0x62 F0x63 joined AE0x64 &0x65 split |0x66 f0x67 joined ae0x68 left triangle0x69 lock0x6A V0x6B O with .. above0x6C 60x6D paragraph0x6E v0x6F o with .. above0x70 hollow up arrow0x71 iPod0x72 N0x73 tree0x74 .0x75 @0x76 n0x77 I with ^ above0x78 portal0x79 butterfly0x7A ^0x7B joined |O0x7C >0x7D 3/40x7E high ~0x7F joined |o0x80 blank0x81 CD0x82 A0x83 A with / above0x84 !0x85 high i0x86 a0x87 a with / above0x88 small |0x89 ()0x8A Q0x8B N with ~ above0x8C 10x8D +-0x8E q0x8F n with ~ above0x90 down arrow0x91 on0x92 I0x93 E with / above0x94 )0x95 tunnel0x96 i0x97 e with / above0x98 left up arrow0x99 heart0x9A Y0x9B U with \ above0x9C 90x9D small 10x9E y0x9F u with \ above0xA0 blank0xA1 folder0xA2 E0xA3 A with o above0xA4 %0xA5 Yen0xA6 e0xA7 a with o above0xA8 Ohm0xA9 ID0xAA U0xAB O with ~ above0xAC 50xAD micro0xAE u0xAF o with ~ above0xB0 OK0xB1 light bulb0xB2 M0xB3 I with / above0xB4 -0xB5 ~0xB6 m0xB7 i with / above0xB8 <<0xB9 Tr0xBA ]0xBB Y with / above0xBC =0xBD 1/20xBE }0xBF y with / above0xC0 blank0xC1 2 musical notes0xC2 C0xC3 A with ~ above0xC4 #0xC5 pound0xC6 c0xC7 a with ~ above0xC8 square reverse D0xC9 square ?0xCA S0xCB O with / above0xCC 30xCD small 30xCE s0xCF o with / above0xD0 right arrow0xD1 square i0xD2 K0xD3 E with .. above0xD4 +0xD5 <<0xD6 k0xD7 e with .. above0xD8 small ||0xD9 00xDA [0xDB U with ^ above0xDC ;0xDD >>0xDE {0xDF u with ^ above0xE0 mesh0xE1 audio file0xE2 G0xE3 C with . below0xE4 '0xE5 section0xE6 g0xE7 c with . below0xE8 up down triangles0xE9 thumbs up0xEA W0xEB multiply0xEC 70xED middle .0xEE w0xEF divide0xF0 left arrow (large)0xF1 factory0xF2 O0xF3 I with .. above0xF4 /0xF5 high -0xF6 o0xF7 i with .. above0xF8 left right arrow0xF9 clock0xFA _0xFB beta0xFC ?0xFD inverted ?0xFE filled square0xFF y with .. above

author: NiHaoMike
author_rank: Super Contributor
timestamp: October 23, 2022, 02:49:50 pm
content: After correcting for bit order, it basically implements ISO-8859-1 with additional symbols in the undefined locations.

author: wfdudley
author_rank: Newbie
timestamp: December 13, 2024, 08:55:08 pm
content: This chip is used in Onkyo receivers and other Japanese goods.Refer to this threadhttps://www.eevblog.com/forum/projects/does-anyone-recognize-this-display-spi-protocol/Original datasheet is here:https://www.renesas.com/ja/document/dst/933676A lot of fiddling with Google Translate (once for documents, once for images), yields the attached.