What launchpad can run all F2617 function? - Page 1
Forum section: electronics / general

author: planc
author_rank: Regular Contributor
timestamp: January 04, 2023, 01:17:49 pm
content: What Texas Instrument Launchpad to get that can run all MSP430F2617 functions?Can all Launchpad run them?

author: josip
author_rank: Regular Contributor
timestamp: January 04, 2023, 01:28:11 pm
content: Quote from: planc on January 04, 2023, 01:17:49 pmThere is only one F/G2xx LP, EXP430G2ET (https://www.ti.com/tool/MSP-EXP430G2ET), where target chip (G2553) can be replaced with any other device (SBW only) with identical pinout. Any other off board target device can be connected to FET part from LP by jumper section. Don't know what you think by "run all MSP430F2617 functions". FET on LP can not generate VPP to blow JTAG fuse on F2xx devices.EXP430G2ETis new version with new updateable FET. EXP430G2 is old version with slow FET without update options.Any TI LP FET (except EXP430G2) can flash all MSP430 SBW devices. There is no voltage level translator so target device must work on FET voltage (3.3V).EDIT: Just checked F2617 datasheet. It is not device with SBW, JTAG only, so unfortunately it can not be used with LP.

author: planc
author_rank: Regular Contributor
timestamp: January 04, 2023, 03:18:39 pm
content: If you have a firmware in F2617. Can you transfer the firmware to say the G2553, and run the debugger? If the G2553 can't do it. What other chip that can make you put the firmware so you can run CSS to look at the assembly code?

author: josip
author_rank: Regular Contributor
timestamp: January 04, 2023, 03:33:40 pm
content: Quote from: planc on January 04, 2023, 03:18:39 pmIf F2617 JTAG is unlocked, than binary can dump by MSP-FET and MSP-flasher. If F2617 and G2553 are similar regarding peripherals and address space, firmware can be transferred to G2553.If F2617 JTAG is locked, than firmware can be dumped by BSL, but you must know BSL password (vector space). With wrong password mass erase will be triggered, and main and info memory will be erased.Best solution is to connect by JTAG interface with MSP-FET to F2617 and analyze executing code. If you have MSP-FET and F2617 JTAG is unlocked.

author: planc
author_rank: Regular Contributor
timestamp: January 04, 2023, 07:30:01 pm
content: I have dumped the MAIN, INFO, BSL and even RAM of an F2617 via the MSP Flasher.I want to flash it at another chip or Launchpad to avoid the original device from being corrupted (some CCS user reported it can corrupt the chip even with JTAG fuse blow button disabled at CCS).I'm now thinking of using another MSP-FET430UIF as target instead of using Launchpad, Imagine having 2 MSP-FET430UIF and having one as the target by connecting the flying JTAG pins wire to the 7 header center of the following. Will it work?

author: josip
author_rank: Regular Contributor
timestamp: January 05, 2023, 08:56:15 am
content: Quote from: planc on January 04, 2023, 07:30:01 pmThis chip (F2617) is special and expensive (20 euros at mouser) so I am sure that similar from economy G2xx LP series don't exist. You dumped complete original chip contest so even if chip will be JTAG locked, it can be reloaded with BSL anytime. However breakpoint debugging will be disabled in this (blown fuse) state.As I mention before UIF is today unsupported device (as yourself also found mentions cases of bricked target device chip), and don't know what will be safe way to do what you want to do. LP can't help here anyway. Another UIF too, because chip in UIF (F1xx) is completely another animal.EDIT: If you want just to analyze dumped code offline, you don't need any hardware tool. If you want to attach to running code and analyze it during execution, buy MSP-FET.

author: planc
author_rank: Regular Contributor
timestamp: January 05, 2023, 09:47:18 am
content: The MSP430F1612IPM has almost same spec as the MSP430F2617. Why can't firmware in the latter be made to run in the former?Also why can't CCS be made to run in the UIF as target with another UIF as debugger as the UIF has also MSP430 chip??

author: planc
author_rank: Regular Contributor
timestamp: January 05, 2023, 09:54:48 am
content: The UIF has JTAG pin for interface too, see above comment for the following:

author: josip
author_rank: Regular Contributor
timestamp: January 05, 2023, 10:05:26 am
content: Quote from: planc on January 05, 2023, 09:47:18 amNo, this are two different family. It will not work.Quote from: planc on January 05, 2023, 09:47:18 amNo problem with this. I was using master FET (5528) on 5529 LP to debug slave FET (5529 LP target device) without issues. But I was analyzing execution of the same code on the same target device (5528 and 5529 are identical except pinout).

author: planc
author_rank: Regular Contributor
timestamp: January 05, 2023, 10:42:35 am
content: What happens when you run debug on an empty chip with only the JTAG pins connected to the debugger. Will the debugger still run analysis of the running code and analyze it during execution even with empty I/O pins connected versus the real product with full I/O pins connected?Also for MSP430 chip in washing machine, TV, cars, etc. They are final production. How many percent of their JTAG fuse not blown? Why didn't they blow the fuse since it is final product (and they can access it via BSL if need service) and it only takes one simple command to do blow JTAG fuse with the the FET they used in the programming?

author: josip
author_rank: Regular Contributor
timestamp: January 05, 2023, 12:09:25 pm
content: Quote from: planc on January 05, 2023, 10:42:35 amDebugger will run anyway. If for example program in device, ADC check for some analog voltage on I/O pin, and see that right value is missing (I/O unconnected) it will stay there or do what author decide to do in this case. But this is irrelevant for debugger that will continue stepping inside program during execution.Quote from: planc on January 05, 2023, 10:42:35 amDon't know. They probably think that coping their unprotected firmware can't make any (financial) damage to the company. That is dumped firmware useless for someone else.

author: planc
author_rank: Regular Contributor
timestamp: January 05, 2023, 12:59:49 pm
content: Disadvantage of the Naken disassemble is there is no label and without labels, it is difficult to trace the different jumps and subroutine. Do you use CCS or IAR debugger? Which of them have labels? What other debugger have labels?Also I heard CCS has 8K limit. Which free debugger has no limit? If the firmware address is say between 3100 to 9E50, how do you compute how many K is it for the CSS limit?Many thanks for your tips.

author: josip
author_rank: Regular Contributor
timestamp: January 05, 2023, 01:39:02 pm
content: Quote from: planc on January 05, 2023, 12:59:49 pmThere is no KB limit for CCS. If older CCS version (that request license) is used than on TI web pages can be downloaded key that make it free (registered) without KB limit.https://www.ti.com/design-resources/embedded-development/ccs-development-tools/ccs-faq.htmlEffective with release of Code Composer Studio v7 – TI is no longer charging for CCS licenses. Simply download fromwww.ti.com/ccstudioand begin.IAR is with code limit if it is used with free license, forever. But there is also "full" version without code limit (but with time limit) that can be used (if I remember right) 2 weeks for free. Registration data are provided before downloading installation.

author: planc
author_rank: Regular Contributor
timestamp: January 05, 2023, 11:06:26 pm
content: But for other app, there is 8K limit. Anyway If the firmware address is say between 3100 to 9E50, how do you compute how many K is it?About BSL password, if the contents at FFFE to FFFF are all FF. Then should the password be blank or FF too if BSL software will be used?:10FFE000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF21:10FFF000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF11Have you tried this before?

author: josip
author_rank: Regular Contributor
timestamp: January 06, 2023, 07:12:17 am
content: Quote from: planc on January 05, 2023, 11:06:26 pm9E50 - 3100 = 6D50 -> 27984 / 1024 = 27 KAttaching to running target by debugger should work, because size in this case is irrelevant. I guess. If I remember right, limitation is applied to code size generating by C compiler. There is no limitation for assembler projects.For blank devices, BSL password is all 0xFF, 0xFF, ...Never used this MSP-FET GUI, and don't see reason why using today anything except TI solutions because all of them are open source and working on all OS's.

author: planc
author_rank: Regular Contributor
timestamp: January 06, 2023, 01:13:43 pm
content: Here is the puzzling part. In the chip with full codes (where I copied the 27k (addresses with contents) to a file via JTAG), the last lines FFFE to FFFF in main program are all FFs, like in blank chip.:10FF0000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF01:10FF1000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF1:10FF2000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE1:10FF3000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFD1:10FF4000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC1:10FF5000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFB1:10FF6000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFA1:10FF7000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF91:10FF8000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF81:10FF9000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF71:10FFA000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF61:10FFB000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF51:10FFC000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF41:10FFD000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF31:10FFE000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF21:10FFF000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF11:00000001FFI know that FFE0h through FFFFh contain interrupt vector table entries. So how could they all be FFFFs??Another thing. While googling, I read "https://www.eevblog.com/forum/microcontrollers/need-ideas-for-msp430cp2102-bsl-circuit-running-bsl-scripter/"The BSL is automatically entered if the reset vector is 0xffff, this way a blank chip will automatically accept an update. The password is the contents of the vectors at 0xffe0-fffe (if memory serves), so for a blank chip is all 0xff's. If you give the wrong password during update the BSL will mass erase, and now you can flash the blank device as if it were a factory flash. (For USB devices this means a different VID/PID, but that complication isn't present for the devices without USB that use a serial port.) So if you don't go through the trouble of making sure your interrupt handlers are located to specific addresses it will Just Work anyway. The only gotcha is you lose any InfoFlash sectors in the process, so if you want to keep those you need to maintain a BSL password by making sure interrupt handlers have specific addresses. (This is somewhat easily done by creating separate link section(s) for them and relocating these to a specific address(es) at the top of the flash region.)"The module I'm learning is connected to pc via USB. So if mass erase via BSL will be attempted, there will be a different VID/PID, will it make the firmware no longer run?There is no JTAG fuse blown and the BSL password is all FFFF as if they just don't care if people read them. But how can you make the FFFE to FFFF all FFFF or blank state. Where did interrupt vector table entries go??

author: Peabody
author_rank: Super Contributor
timestamp: January 08, 2023, 06:22:27 pm
content: If this chip is actually working, then I think you must be wrong about the contents of the vector space. I don't know why Flasher would fail to read that range properly, but it just seems there must at least be a reset vector in FFFE. The datasheet says if that location is blank (FFFF), the chip goes into LPM4, and I don't know how it could recover from that.

author: josip
author_rank: Regular Contributor
timestamp: January 08, 2023, 07:29:02 pm
content: Quote from: planc on January 06, 2023, 01:13:43 pmI guess that you are looking to the wrong place. Vector space is in 0x0FFC0 - 0x0FFFF area, and you are looking somewhere else in main flash 0x03100 - 0x19FFF. Use some hex editor with viewable data address to clear this. MSP430Flasher should dump all main memory (92 KByte) from F2617.F2617 is without USB hardware module and communicate with world by some other IC that is used for USB connection. If vector space is really empty and F2617 not working, than measuring device on USB connection can still be enumerated correctly and working fine (part related to USB).

author: planc
author_rank: Regular Contributor
timestamp: January 08, 2023, 08:19:30 pm
content: It was only after I ran Elprotronic Fetpro430 Lite that I realised there were 2 FFFF reported in Msp-flasher. Instead Elprotronic reported it as:"===== Extended Main Memory Block #1 (0x10000-0x1FFFF) =====0x10000: ------- b l a n k ----(all 0xFF)------- "In Elprotronic the FFF0 To FFFF has contents which are the interrupt vectors.But in MSP Flasher.The 10000 started with (right after the FFFF with contents):020000021000EC:10000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00:10001000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0and ends up with FFFF instead of 1FFFF.":10FFE000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF21:10FFF000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF1100000001FFWhy can't MSP Flasher report the so called Extended Main Memory Block as 1FFFF instead of just double or 2nd FFFF in the 2nd to last line of the code? the last line of the Intel Hex file is 00000001FF as shown above.(added. MSP Flasher reported the chip as MSP430F2618 although physically chip has 2617 written on it. How do you explain that? 2618 has memory up to 1FFFF instead of just 19FFF

author: planc
author_rank: Regular Contributor
timestamp: January 08, 2023, 10:18:07 pm
content: pls see added comment above about the chip and picture

author: Peabody
author_rank: Super Contributor
timestamp: January 08, 2023, 11:30:37 pm
content: Ok, I take this to mean that you found the vector table entries. I don't have an MSP430 with an extended address space (beyond 64K), so I can't test Flasher. But you're right that it ought to handle that properly.The other key address that's related to BSL is the word at 0xFFBE. If it's FFFF, then the BSL will do a mass erase if the password you provide when attempting a BSL action is invalid.(7) The address 0FFBEh is used as bootloader security key (BSLSKEY).A 0xAA55h at this location disables the BSL completely.A zero disables the erasure of the flash if an invalid password is supplied.Normally you want it to be zero unless you're at final production, and want to secure everything. But even then, I question the usefulness of the mass erase. What you want is the ability to erase everything except the calibration data so you can program the chip again. But if the JTAG fuse is blown, you can't do that with BSL. If you don't know the password, you lose the chip.

author: planc
author_rank: Regular Contributor
timestamp: January 09, 2023, 12:42:38 am
content: The address 0FFBEh or bootloader security key has FF contents. What does it mean?I found the vector table entries with many different contents starting at FFDC to FFFF.Also the following is the calibration data.@1000FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FFFF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FFFF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FFFF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FFFF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FFFF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FFFF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FFFF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FFFF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FFFF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FFFF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FFFF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF70 84 FE 16 FF FF FF FF FF FF FF FF FF FF FF FFFF FF FF FF FF FF FF FF FF FF 08 10 00 80 01 0047 82 B2 0B E2 0D B5 82 FE 06 42 08 FE 08 FF FFFF FF FF FF FF FF 01 08 9D 8F A2 8E 8F 8D C9 86qWith that. Even if the chip is totally mass erased. I could still put back everything, isn't it. Why does they put Segment A at bottom. Is it like ground as lower level hence they started A at bottom?

author: josip
author_rank: Regular Contributor
timestamp: January 09, 2023, 04:01:32 am
content: Quote from: planc on January 08, 2023, 08:19:30 pmBecause all MSP430F261x are with the same Device ID. Don't know if "-nMSP430F2617" in MSP430 flasher can help.Anyway, inside "-r" dump operation, desired address range can be specified.-r [Filename, mem_section]0x****-0x**** = custom memory sectionQuote from: planc on January 09, 2023, 12:42:38 amDefault factory value.Quote from: planc on January 09, 2023, 12:42:38 amInfo memory segments address is specified in device datasheet 9.6. section, screenshot attached by you. Sorted by address low-to-high, first is D and last is A. Also you can see that complete memory organization table is sorted by high-to-low address value.Just note, that AFAIK in MSP430 world hex files with address outside of 0x0000 - 0xFFFF range are not supported. In this case for binary files must be used ti txt format.

author: Peabody
author_rank: Super Contributor
timestamp: January 09, 2023, 02:56:41 pm
content: Quote from: planc on January 09, 2023, 12:42:38 amIf the word at 0xFFBE is 0xFFFF, then BSL is enabled, and entry of an invalid password will result in a mass erase of the entire chip, including the calibration data in INFOA. Unless you are working for the CIA, you want to write a null word at that location - always - which disables the mass erase on an invalid password.Yes, if you have a copy of INFOA, you can restore it after a mass erase.

author: planc
author_rank: Regular Contributor
timestamp: January 09, 2023, 10:53:06 pm
content: Ok. You give me full confidence that chip can be written and all the information is backed up. Thank you.Now. Do you know anyone or company who can make the conversion of the chip machine code to assembly language that is compatible to run in CCS. For 27Kbytes code, how much do you estimate they will charge for the conversion? I'm looking for someone with full access to IDA PRO or other state of the art converter. I think IDA PRO is very expensive, like many thousand dollars? for example $3000 or more?If they can charge me $100. It is ok. Who can do it. Please help me find one. Thanks.

author: Peabody
author_rank: Super Contributor
timestamp: January 10, 2023, 12:24:38 am
content: I've never used CCS, but wonder if it includes a regular assembler, or whether you have to "embed" assembler lines inside C code. Also I wonder if you will ever be able to get the linker to put your code in exactly the same place it appears in your chip.Why don't you just use the Naken assembler? Here's an assembler file I wrote for Naken. Note the way labels are done, with a colon, and the .org format to define where you want to start.Code:.msp430;FR2311 test - turns on LED on P1.0;Written for the Naken AssemblerResetVectorequ0xFFFE; Couldn't find .h file for this partRAMendequ0x2400WDTPWequ0x5A00WDTHOLDequ0x80WDTCTLequ0x01CCP1OUTequ0x0202P1DIRequ0x0204P1RENequ0x0206P2OUTequ0x0203P2DIRequ0x0205P2RENequ0x0207LOCKLPM5equ1PM5CTL0equ0x0130LPM4equ0xF0.org0xF100Powerup:mov.wRAMend-4,SP; Initialize stackpointermov.w#WDTPW+WDTHOLD,&WDTCTL; Stop WDTPortSetup:mov.b#0,&P1DIR; Set both ports to Input, PD resistormov.b#0,&P1OUTmov.b#0xFF,&P1RENmov.b#0,&P2DIRmov.b#0,&P2OUTmov.b#0xFF,&P2RENbic.b#1,&P1REN; Set P1.0 to high output, no resistorbis.b#1,&P1DIRbis.b#1,&P1OUTbic.w#LOCKLPM5,&PM5CTL0; Unlock I/O pinsbis.w#LPM4,SR; go to sleepLoop:nop; In case we get here (shouldn't)jmpLoopnop.orgResetVector.dwPowerup

author: planc
author_rank: Regular Contributor
timestamp: January 10, 2023, 01:26:57 am
content: In the following disassembly of the BSL intel hex machine codes into assembly code by Naken. How do you know where to insert the original labels? Without the labels, the subroutine or jump or loop can't happen as I experienced extensively when I was programming the Motorola 68HC11. I had to use THRSim11 simulator to debug it, and I had many mistakes with looping initially.Also do you know a simple app where I can just copy the codes at the right side by cutting all the addresses and opcodes in every line on the left? I forgot how to use Word and the free Word may not accept long pages. And I must also delete the cycles?When using the Naken diassembly. Can you assemble it back to the original machine code? I'd like to see if it can get back the original. Thanks.naken_util - by Michael KohnJoe DavissonWeb:http://www.mikekohn.net/Email: mike@mikekohn.netVersion:Loaded hexfile outputbsl.hex from 0x0c00 to 0x0fffType help for a list of commands.Addr Opcode Instruction Cycles------- ------ ---------------------------------- ------0x0c00: 0x0c06 mova @r12, r6 ?0x0c02: 0x0c1e mova @r12+, r14 ?0x0c04: 0x3fff jmp 0x0c04 (offset: -2) 20x0c06: 0x40b2 mov.w #0xa540, &0x012c 50x0c08: 0xa5400x0c0a: 0x012c0x0c0c: 0x90b2 cmp.w #0xaa55, &0xffbe 50x0c0e: 0xaa550x0c10: 0xffbe0x0c12: 0x27ff jeq 0x0c12 (offset: -2) 20x0c14: 0x4031 mov.w #0x0224, SP 20x0c16: 0x02240x0c18: 0x430b mov.w #0, r11 10x0c1a: 0x43c0 mov.b #0, 0x0216 20x0c1c: 0xf5fa0x0c1e: 0xc232 dint -- bic.w #8, SR 10x0c20: 0xc0f2 bic.b #0x32, &0x0000 50x0c22: 0x00320x0c24: 0x00000x0c26: 0x40b2 mov.w #0x5a80, &0x0120 50x0c28: 0x5a800x0c2a: 0x01200x0c2c: 0x430f mov.w #0, r15 10x0c2e: 0x40f2 mov.b #0x88, &0x0057 50x0c30: 0x00880x0c32: 0x00570x0c34: 0x40f2 mov.b #0x80, &0x0056 50x0c36: 0x00800x0c38: 0x00560x0c3a: 0xd3e2 bis.b #2, &0x0021 40x0c3c: 0x00210x0c3e: 0xd3e2 bis.b #2, &0x0022 40x0c40: 0x00220x0c42: 0xc3e2 bic.b #2, &0x0026 40x0c44: 0x00260x0c46: 0xc2e2 bic.b #4, &0x002a 40x0c48: 0x002a0x0c4a: 0xc2e2 bic.b #4, &0x002e 40x0c4c: 0x002e0x0c4e: 0x40b2 mov.w #0xa500, &0x0128 50x0c50: 0xa5000x0c52: 0x01280x0c54: 0xc03b bic.w #0x007a, r11 20x0c56: 0x007a0x0c58: 0x12b0 call #0x0e86 50x0c5a: 0x0e860x0c5c: 0x4382 mov.w #0, &0x0212 40x0c5e: 0x02120x0c60: 0x4309 mov.w #0, r9 10x0c62: 0x4036 mov.w #0x020a, r6 20x0c64: 0x020a0x0c66: 0x4237 mov.w #8, r7 10x0c68: 0x12b0 call #0x0f54 50x0c6a: 0x0f540x0c6c: 0x4cc6 mov.b r12, 0(r6) 40x0c6e: 0x00000x0c70: 0x5316 add.w #1, r6 10x0c72: 0x8317 sub.w #1, r7 10x0c74: 0x23f9 jne 0x0c68 (offset: -14) 20x0c76: 0xb32b bit.w #2, r11 10x0c78: 0x202e jne 0x0cd6 (offset: 92) 20x0c7a: 0x4255 mov.b &0x020b, r5 30x0c7c: 0x020b0x0c7e: 0x4216 mov.w &0x020e, r6 30x0c80: 0x020e0x0c82: 0x0fe6 adda r15, r6 ?0x0c84: 0x4217 mov.w &0x0210, r7 30x0c86: 0x02100x0c88: 0x9075 cmp.b #0x12, r5 20x0c8a: 0x00120x0c8c: 0x2479 jeq 0x0d80 (offset: 242) 20x0c8e: 0x9075 cmp.b #0x10, r5 20x0c90: 0x00100x0c92: 0x2454 jeq 0x0d3c (offset: 168) 20x0c94: 0x12b0 call #0x0e58 50x0c96: 0x0e580x0c98: 0x4255 mov.b &0x020b, r5 30x0c9a: 0x020b0x0c9c: 0x9075 cmp.b #0x18, r5 20x0c9e: 0x00180x0ca0: 0x2432 jeq 0x0d06 (offset: 100) 20x0ca2: 0xb22b bit.w #4, r11 10x0ca4: 0x2418 jeq 0x0cd6 (offset: 48) 20x0ca6: 0x9075 cmp.b #0x20, r5 20x0ca8: 0x00200x0caa: 0x241b jeq 0x0ce2 (offset: 54) 20x0cac: 0x9075 cmp.b #0x16, r5 20x0cae: 0x00160x0cb0: 0x2428 jeq 0x0d02 (offset: 80) 20x0cb2: 0x9075 cmp.b #0x14, r5 20x0cb4: 0x00140x0cb6: 0x24a1 jeq 0x0dfa (offset: 322) 20x0cb8: 0x9075 cmp.b #0x1a, r5 20x0cba: 0x001a0x0cbc: 0x241e jeq 0x0cfa (offset: 60) 20x0cbe: 0x9075 cmp.b #0x1c, r5 20x0cc0: 0x001c0x0cc2: 0x2432 jeq 0x0d28 (offset: 100) 20x0cc4: 0x9075 cmp.b #0x21, r5 20x0cc6: 0x00210x0cc8: 0x2409 jeq 0x0cdc (offset: 18) 20x0cca: 0x3c05 jmp 0x0cd6 (offset: 10) 20x0ccc: 0xd22b bis.w #4, r11 10x0cce: 0x12b0 call #0x0ee6 50x0cd0: 0x0ee60x0cd2: 0x3fbd jmp 0x0c4e (offset: -134) 20x0cd4: 0x5321 add.w #2, SP 10x0cd6: 0x12b0 call #0x0eec 50x0cd8: 0x0eec0x0cda: 0x3fb9 jmp 0x0c4e (offset: -142) 20x0cdc: 0x002f mova &0x20e, r15 ?0x0cde: 0x020e0x0ce0: 0x3ff6 jmp 0x0cce (offset: -20) 20x0ce2: 0x12b0 call #0x0ee6 50x0ce4: 0x0ee60x0ce6: 0x42d2 mov.b &0x020e, &0x0056 60x0ce8: 0x020e0x0cea: 0x00560x0cec: 0x42d2 mov.b &0x020f, &0x0057 60x0cee: 0x020f0x0cf0: 0x00570x0cf2: 0x42d2 mov.b &0x0210, &0x0216 60x0cf4: 0x02100x0cf6: 0x02160x0cf8: 0x3faa jmp 0x0c4e (offset: -172) 20x0cfa: 0x12b0 call #0x0ee6 50x0cfc: 0x0ee60x0cfe: 0x4210 mov.w &0x020e, PC 30x0d00: 0x020e0x0d02: 0x4315 mov.w #1, r5 10x0d04: 0x3c05 jmp 0x0d10 (offset: 10) 20x0d06: 0x40b2 mov.w #0xa50e, &0x0210 50x0d08: 0xa50e0x0d0a: 0x02100x0d0c: 0x4035 mov.w #0x000c, r5 20x0d0e: 0x000c0x0d10: 0x4292 mov.w &0x0210, &0x0128 60x0d12: 0x02100x0d14: 0x01280x0d16: 0x1840 movx.w #-1, 0(r6) ?0x0d18: 0x43b60x0d1a: 0x00000x0d1c: 0xb392 bit.w #1, &0x012c 40x0d1e: 0x012c0x0d20: 0x23fd jne 0x0d1c (offset: -6) 20x0d22: 0x8315 sub.w #1, r5 10x0d24: 0x23f5 jne 0x0d10 (offset: -22) 20x0d26: 0x3fd3 jmp 0x0cce (offset: -90) 20x0d28: 0x4335 mov.w #-1, r5 10x0d2a: 0x1840 cmpx.b @r6+, r5 ?0x0d2c: 0x96750x0d2e: 0x2003 jne 0x0d36 (offset: 6) 20x0d30: 0x8317 sub.w #1, r7 10x0d32: 0x23fb jne 0x0d2a (offset: -10) 20x0d34: 0x3fcc jmp 0x0cce (offset: -104) 20x0d36: 0x4682 mov.w r6, &0x0200 40x0d38: 0x02000x0d3a: 0x3fcd jmp 0x0cd6 (offset: -102) 20x0d3c: 0x4036 mov.w #0xffe0, r6 20x0d3e: 0xffe00x0d40: 0x4037 mov.w #0x0020, r7 20x0d42: 0x00200x0d44: 0xc22b bic.w #4, r11 10x0d46: 0x12b0 call #0x0f54 50x0d48: 0x0f540x0d4a: 0x967c cmp.b @r6+, r12 20x0d4c: 0x2403 jeq 0x0d54 (offset: 6) 20x0d4e: 0xd03b bis.w #0x0040, r11 20x0d50: 0x00400x0d52: 0x3c02 jmp 0x0d58 (offset: 4) 20x0d54: 0x3c00 jmp 0x0d56 (offset: 0) 20x0d56: 0x3c00 jmp 0x0d58 (offset: 0) 20x0d58: 0x8317 sub.w #1, r7 10x0d5a: 0x23f5 jne 0x0d46 (offset: -22) 20x0d5c: 0x12b0 call #0x0e58 50x0d5e: 0x0e580x0d60: 0xb03b bit.w #0x0040, r11 20x0d62: 0x00400x0d64: 0x27b3 jeq 0x0ccc (offset: -154) 20x0d66: 0x9382 cmp.w #0, &0xffbe 40x0d68: 0xffbe0x0d6a: 0x2407 jeq 0x0d7a (offset: 14) 20x0d6c: 0x4031 mov.w #0x1000, SP 20x0d6e: 0x10000x0d70: 0x1204 push.w r4 30x0d72: 0x9031 cmp.w #0x0226, SP 20x0d74: 0x02260x0d76: 0x23fc jne 0x0d70 (offset: -8) 20x0d78: 0x3fc6 jmp 0x0d06 (offset: -116) 20x0d7a: 0x12b0 call #0x0eec 50x0d7c: 0x0eec0x0d7e: 0x3f67 jmp 0x0c4e (offset: -306) 20x0d80: 0xb22b bit.w #4, r11 10x0d82: 0x2434 jeq 0x0dec (offset: 104) 20x0d84: 0xd03b bis.w #0x0010, r11 20x0d86: 0x00100x0d88: 0x12b0 call #0x0f54 50x0d8a: 0x0f540x0d8c: 0xb32b bit.w #2, r11 10x0d8e: 0x2030 jne 0x0df0 (offset: 96) 20x0d90: 0x0096 cmpa #0x1000, r6 ?0x0d92: 0x10000x0d94: 0x2c07 jhs 0x0da4 (offset: 14) 20x0d96: 0x0096 cmpa #0x100, r6 ?0x0d98: 0x01000x0d9a: 0x2c07 jhs 0x0daa (offset: 14) 20x0d9c: 0x1840 movx.b r12, 0(r6) ?0x0d9e: 0x4cc60x0da0: 0x00000x0da2: 0x3c1d jmp 0x0dde (offset: 58) 20x0da4: 0x40b2 mov.w #0xa540, &0x0128 50x0da6: 0xa5400x0da8: 0x01280x0daa: 0xb316 bit.w #1, r6 10x0dac: 0x2003 jne 0x0db4 (offset: 6) 20x0dae: 0x4cc2 mov.b r12, &0x0214 40x0db0: 0x02140x0db2: 0x3c15 jmp 0x0dde (offset: 42) 20x0db4: 0x4cc2 mov.b r12, &0x0215 40x0db6: 0x02150x0db8: 0x184f cmpx.w r10, -3(r6) ?0x0dba: 0x9a860x0dbc: 0xfffd0x0dbe: 0x2401 jeq 0x0dc2 (offset: 2) 20x0dc0: 0xd32b bis.w #2, r11 10x0dc2: 0x0096 cmpa #0x201, r6 ?0x0dc4: 0x02010x0dc6: 0x2804 jlo 0x0dd0 (offset:20x0dc8: 0xd23b bis.w #8, r11 10x0dca: 0xb03b bit.w #0x0010, r11 20x0dcc: 0x00100x0dce: 0x2402 jeq 0x0dd4 (offset: 4) 20x0dd0: 0xc03b bic.w #0x0032, r11 20x0dd2: 0x00320x0dd4: 0x421a mov.w &0x0214, r10 30x0dd6: 0x02140x0dd8: 0x184f movx.w r10, -1(r6) ?0x0dda: 0x4a860x0ddc: 0xffff0x0dde: 0x00a6 adda #0x1, r6 ?0x0de0: 0x00010x0de2: 0x8317 sub.w #1, r7 10x0de4: 0x23d1 jne 0x0d88 (offset: -94) 20x0de6: 0x12b0 call #0x0e58 50x0de8: 0x0e580x0dea: 0x3f71 jmp 0x0cce (offset: -286) 20x0dec: 0x12b0 call #0x0f54 50x0dee: 0x0f540x0df0: 0x8317 sub.w #1, r7 10x0df2: 0x23fc jne 0x0dec (offset: -8) 20x0df4: 0x12b0 call #0x0e58 50x0df6: 0x0e580x0df8: 0x3f6e jmp 0x0cd6 (offset: -292) 20x0dfa: 0x40b2 mov.w #0x0080, &0x020a 50x0dfc: 0x00800x0dfe: 0x020a0x0e00: 0x42d2 mov.b &0x0210, &0x020c 60x0e02: 0x02100x0e04: 0x020c0x0e06: 0x42d2 mov.b &0x0210, &0x020d 60x0e08: 0x02100x0e0a: 0x020d0x0e0c: 0x4382 mov.w #0, &0x0212 40x0e0e: 0x02120x0e10: 0x4309 mov.w #0, r9 10x0e12: 0x120e push.w r14 30x0e14: 0x403e mov.w #0x020a, r14 20x0e16: 0x020a0x0e18: 0x4224 mov.w #4, r4 10x0e1a: 0x4e7c mov.b @r14+, r12 20x0e1c: 0x12b0 call #0x0ef0 50x0e1e: 0x0ef00x0e20: 0x8314 sub.w #1, r4 10x0e22: 0x23fb jne 0x0e1a (offset: -10) 20x0e24: 0x413e pop.w r14 -- mov.w @SP+, r14 20x0e26: 0x0096 cmpa #0x100, r6 ?0x0e28: 0x01000x0e2a: 0x2805 jlo 0x0e36 (offset: 10) 20x0e2c: 0x1840 movx.b @r6+, r12 ?0x0e2e: 0x467c0x0e30: 0x12b0 call #0x0ef0 50x0e32: 0x0ef00x0e34: 0x8317 sub.w #1, r7 10x0e36: 0x1840 movx.b @r6+, r12 ?0x0e38: 0x467c0x0e3a: 0x12b0 call #0x0ef0 50x0e3c: 0x0ef00x0e3e: 0x8317 sub.w #1, r7 10x0e40: 0x23f2 jne 0x0e26 (offset: -28) 20x0e42: 0xe3b2 xor.w #-1, &0x0212 40x0e44: 0x02120x0e46: 0x425c mov.b &0x0212, r12 30x0e48: 0x02120x0e4a: 0x12b0 call #0x0ef0 50x0e4c: 0x0ef00x0e4e: 0x425c mov.b &0x0213, r12 30x0e50: 0x02130x0e52: 0x12b0 call #0x0ef0 50x0e54: 0x0ef00x0e56: 0x3efb jmp 0x0c4e (offset: -522) 20x0e58: 0x4218 mov.w &0x0212, r8 30x0e5a: 0x02120x0e5c: 0x12b0 call #0x0f54 50x0e5e: 0x0f540x0e60: 0x4cc2 mov.b r12, &0x0212 40x0e62: 0x02120x0e64: 0x12b0 call #0x0f54 50x0e66: 0x0f540x0e68: 0x4cc2 mov.b r12, &0x0213 40x0e6a: 0x02130x0e6c: 0xe338 xor.w #-1, r8 10x0e6e: 0xb23b bit.w #8, r11 10x0e70: 0x2404 jeq 0x0e7a (offset:20x0e72: 0x961a cmp.w -2(r6), r10 30x0e74: 0xfffe0x0e76: 0x2401 jeq 0x0e7a (offset: 2) 20x0e78: 0xd32b bis.w #2, r11 10x0e7a: 0x9218 cmp.w &0x0212, r8 30x0e7c: 0x02120x0e7e: 0x232a jne 0x0cd4 (offset: -428) 20x0e80: 0xb32b bit.w #2, r11 10x0e82: 0x2328 jne 0x0cd4 (offset: -432) 20x0e84: 0x4130 ret -- mov.w @SP+, PC 30x0e86: 0xb2e2 bit.b #4, &0x0028 40x0e88: 0x00280x0e8a: 0x27fd jeq 0x0e86 (offset: -6) 20x0e8c: 0xb2e2 bit.b #4, &0x0028 40x0e8e: 0x00280x0e90: 0x23fd jne 0x0e8c (offset: -6) 20x0e92: 0x40b2 mov.w #0x0224, &0x0160 50x0e94: 0x02240x0e96: 0x01600x0e98: 0xb2e2 bit.b #4, &0x0028 40x0e9a: 0x00280x0e9c: 0x27fd jeq 0x0e98 (offset: -6) 20x0e9e: 0x4215 mov.w &0x0170, r5 30x0ea0: 0x01700x0ea2: 0x1105 rra.w r5 10x0ea4: 0x1105 rra.w r5 10x0ea6: 0x1105 rra.w r5 10x0ea8: 0x4582 mov.w r5, &0x0202 40x0eaa: 0x02020x0eac: 0x1105 rra.w r5 10x0eae: 0x4582 mov.w r5, &0x0204 40x0eb0: 0x02040x0eb2: 0x80b2 sub.w #0x001e, &0x0204 50x0eb4: 0x001e0x0eb6: 0x02040x0eb8: 0x4257 mov.b &0x0216, r7 30x0eba: 0x02160x0ebc: 0x8037 sub.w #0x0003, r7 20x0ebe: 0x00030x0ec0: 0x1105 rra.w r5 10x0ec2: 0x1105 rra.w r5 10x0ec4: 0x5317 add.w #1, r7 10x0ec6: 0x23fd jne 0x0ec2 (offset: -6) 20x0ec8: 0x5035 add.w #0xa540, r5 20x0eca: 0xa5400x0ecc: 0x4582 mov.w r5, &0x012a 40x0ece: 0x012a0x0ed0: 0x4235 mov.w #8, r5 10x0ed2: 0x40b2 mov.w #0x0224, &0x0160 50x0ed4: 0x02240x0ed6: 0x01600x0ed8: 0x9292 cmp.w &0x0170, &0x0202 60x0eda: 0x01700x0edc: 0x02020x0ede: 0x2ffc jhs 0x0ed8 (offset: -8) 20x0ee0: 0x8315 sub.w #1, r5 10x0ee2: 0x23f7 jne 0x0ed2 (offset: -18) 20x0ee4: 0x4309 mov.w #0, r9 10x0ee6: 0x407c mov.b #0x90, r12 20x0ee8: 0x00900x0eea: 0x3c02 jmp 0x0ef0 (offset: 4) 20x0eec: 0x407c mov.b #0xa0, r12 20x0eee: 0x00a00x0ef0: 0x434d mov.b #0, r13 10x0ef2: 0xecc9 xor.b r12, 530(r9) 40x0ef4: 0x02120x0ef6: 0xe319 xor.w #1, r9 10x0ef8: 0xc31b bic.w #1, r11 10x0efa: 0x4d45 mov.b r13, r5 10x0efc: 0x4555 mov.b 3842(r5), r5 30x0efe: 0x0f020x0f00: 0x5500 add.w r5, PC 20x0f02: 0x2e0c jhs 0x0b1c (offset: -1000) 20x0f04: 0x2e2e jhs 0x0b62 (offset: -932) 20x0f06: 0x2e2e jhs 0x0b64 (offset: -932) 20x0f08: 0x2e2e jhs 0x0b66 (offset: -932) 20x0f0a: 0x1a2e?0x0f0c: 0x3434 jge 0x0f76 (offset: 104) 20x0f0e: 0x4292 mov.w &0x0170, &0x0172 60x0f10: 0x01700x0f12: 0x01720x0f14: 0x50b2 add.w #0x000c, &0x0172 50x0f16: 0x000c0x0f18: 0x01720x0f1a: 0x3c07 jmp 0x0f2a (offset: 14) 20x0f1c: 0xb31b bit.w #1, r11 10x0f1e: 0x200b jne 0x0f36 (offset: 22) 20x0f20: 0x4382 mov.w #0, &0x0162 40x0f22: 0x01620x0f24: 0xb392 bit.w #1, &0x0162 40x0f26: 0x01620x0f28: 0x27fd jeq 0x0f24 (offset: -6) 20x0f2a: 0xc3e2 bic.b #2, &0x0021 40x0f2c: 0x00210x0f2e: 0x3c0a jmp 0x0f44 (offset: 20) 20x0f30: 0x114c rra.b r12 10x0f32: 0x2bf6 jlo 0x0f20 (offset: -20) 20x0f34: 0xe31b xor.w #1, r11 10x0f36: 0x4382 mov.w #0, &0x0162 40x0f38: 0x01620x0f3a: 0xb392 bit.w #1, &0x0162 40x0f3c: 0x01620x0f3e: 0x27fd jeq 0x0f3a (offset: -6) 20x0f40: 0xd3e2 bis.b #2, &0x0021 40x0f42: 0x00210x0f44: 0x5292 add.w &0x0202, &0x0172 60x0f46: 0x02020x0f48: 0x01720x0f4a: 0x535d add.b #1, r13 10x0f4c: 0x907d cmp.b #0x0c, r13 20x0f4e: 0x000c0x0f50: 0x23d4 jne 0x0efa (offset: -88) 20x0f52: 0x4130 ret -- mov.w @SP+, PC 30x0f54: 0x434e mov.b #0, r14 10x0f56: 0xc31b bic.w #1, r11 10x0f58: 0x4e45 mov.b r14, r5 10x0f5a: 0x4555 mov.b 3936(r5), r5 30x0f5c: 0x0f600x0f5e: 0x5500 add.w r5, PC 20x0f60: 0x560c add.w r6, r12 10x0f62: 0x5656 add.b 22102(r6), r6 30x0f64: 0x56560x0f66: 0x5656 add.b 13910(r6), r6 30x0f68: 0x36560x0f6a: 0x0074 mova PC, -19742(r4) ?0x0f6c: 0xb2e20x0f6e: 0x0028 mova &0x23fd, r8 ?0x0f70: 0x23fd0x0f72: 0x4292 mov.w &0x0170, &0x0172 60x0f74: 0x01700x0f76: 0x01720x0f78: 0x5292 add.w &0x0204, &0x0172 60x0f7a: 0x02040x0f7c: 0x01720x0f7e: 0x4382 mov.w #0, &0x0162 40x0f80: 0x01620x0f82: 0xb392 bit.w #1, &0x0162 40x0f84: 0x01620x0f86: 0x27fd jeq 0x0f82 (offset: -6) 20x0f88: 0xb2e2 bit.b #4, &0x0028 40x0f8a: 0x00280x0f8c: 0x281e jlo 0x0fca (offset: 60) 20x0f8e: 0xd32b bis.w #2, r11 10x0f90: 0x3c1c jmp 0x0fca (offset: 56) 20x0f92: 0x104c rrc.b r12 10x0f94: 0x3c1a jmp 0x0fca (offset: 52) 20x0f96: 0x4382 mov.w #0, &0x0162 40x0f98: 0x01620x0f9a: 0xb392 bit.w #1, &0x0162 40x0f9c: 0x01620x0f9e: 0x27fd jeq 0x0f9a (offset: -6) 20x0fa0: 0xb2e2 bit.b #4, &0x0028 40x0fa2: 0x00280x0fa4: 0x2801 jlo 0x0fa8 (offset: 2) 20x0fa6: 0xe31b xor.w #1, r11 10x0fa8: 0xb31b bit.w #1, r11 10x0faa: 0x2401 jeq 0x0fae (offset: 2) 20x0fac: 0xd32b bis.w #2, r11 10x0fae: 0xecc9 xor.b r12, 530(r9) 40x0fb0: 0x02120x0fb2: 0xe319 xor.w #1, r9 10x0fb4: 0x3c0a jmp 0x0fca (offset: 20) 20x0fb6: 0x4382 mov.w #0, &0x0162 40x0fb8: 0x01620x0fba: 0xb392 bit.w #1, &0x0162 40x0fbc: 0x01620x0fbe: 0x27fd jeq 0x0fba (offset: -6) 20x0fc0: 0xb2e2 bit.b #4, &0x0028 40x0fc2: 0x00280x0fc4: 0x2be6 jlo 0x0f92 (offset: -52) 20x0fc6: 0x104c rrc.b r12 10x0fc8: 0xe31b xor.w #1, r11 10x0fca: 0x5292 add.w &0x0202, &0x0172 60x0fcc: 0x02020x0fce: 0x01720x0fd0: 0x535e add.b #1, r14 10x0fd2: 0x3fc2 jmp 0x0f58 (offset: -124) 20x0fd4: 0x4382 mov.w #0, &0x0162 40x0fd6: 0x01620x0fd8: 0xb392 bit.w #1, &0x0162 40x0fda: 0x01620x0fdc: 0x27fd jeq 0x0fd8 (offset: -6) 20x0fde: 0xb2e2 bit.b #4, &0x0028 40x0fe0: 0x00280x0fe2: 0x2c01 jhs 0x0fe6 (offset: 2) 20x0fe4: 0xd32b bis.w #2, r11 10x0fe6: 0x4130 ret -- mov.w @SP+, PC 30x0fe8: 0xffff and.b @r15+, -1(r15) 50x0fea: 0xffff0x0fec: 0xffff and.b @r15+, -1(r15) 50x0fee: 0xffff0x0ff0: 0x6ff2 addc.b @r15+, &0x6007 50x0ff2: 0x60070x0ff4: 0x0000 mova @PC, PC ?0x0ff6: 0x0000 mova @PC, PC ?0x0ff8: 0x0000 mova @PC, PC ?0x0ffa: 0x130250x0ffc: 0x0001 mova @PC, SP ?0x0ffe: 0x1cf6?The code is not frowning, It is just three question mark as shown in the above snipshotHere is the original Intel Hex BSL code in case you can't copy the text above well.:100C0000060C1E0CFF3FB24040A52C01B29055AA25:100C1000BEFFFF27314024020B43C043FAF532C226:100C2000F2C032000000B240805A20010F43F2406F:100C300088005700F24080005600E2D32100E2D342:100C40002200E2C32600E2C22A00E2C22E00B24025:100C500000A528013BC07A00B012860E8243120222:100C6000094336400A023742B012540FC64C000006:100C700016531783F9232BB32E2055420B0216422D:100C80000E02E60F1742100275901200792475903B:100C900010005424B012580E55420B0275901800E3:100CA00032242BB21824759020001B247590160056:100CB000282475901400A12475901A001E247590A4:100CC0001C003224759021000924053C2BD2B0125F:100CD000E60EBD3F2153B012EC0EB93F2F000E02BD:100CE000F63FB012E60ED2420E025600D2420F027A:100CF0005700D24210021602AA3FB012E60E10426E:100D00000E021543053CB2400EA5100235400C0002:100D10009242100228014018B643000092B32C0101:100D2000FD231583F523D33F3543401875960320E3:100D30001783FB23CC3F82460002CD3F3640E0FFC5:100D4000374020002BC2B012540F7C9603243BD0B6:100D50004000023C003C003C1783F523B012580EC3:100D60003BB04000B3278293BEFF07243140001000:100D7000041231902602FC23C63FB012EC0E673FEE:100D80002BB234243BD01000B012540F2BB33020C0:100D900096000010072C96000001072C4018C64C46:100DA00000001D3CB24040A5280116B30320C24CF0:100DB0001402153CC24C15024F18869AFDFF0124FF:100DC0002BD39600010204283BD23BB01000022432:100DD0003BC032001A4214024F18864AFFFFA60099:100DE00001001783D123B012580E713FB012540F77:100DF0001783FC23B012580E6E3FB24080000A02E7:100E0000D24210020C02D24210020D0282431202A0:100E100009430E123E400A0224427C4EB012F00EEC:100E20001483FB233E4196000001052840187C46B0:100E3000B012F00E178340187C46B012F00E1783E4:100E4000F223B2E312025C421202B012F00E5C42D4:100E50001302B012F00EFB3E18421202B012540FF1:100E6000C24C1202B012540FC24C130238E33BB210:100E700004241A96FEFF01242BD3189212022A236F:100E80002BB328233041E2B22800FD27E2B228002C:100E9000FD23B24024026001E2B22800FD27154282:100EA00070010511051105118245020205118245E7:100EB0000402B2801E00040257421602378003006B:100EC000051105111753FD23355040A582452A0110:100ED0003542B24024026001929270010202FC2F5E:100EE0001583F72309437C409000023C7C40A0001E:100EF0004D43C9EC120219E31BC3454D5545020F82:100F000000550C2E2E2E2E2E2E2E2E1A34349242BA:100F100070017201B2500C007201073C1BB30B2030:100F20008243620192B36201FD27E2C321000A3CC1:100F30004C11F62B1BE38243620192B36201FD2741:100F4000E2D321009252020272015D537D900C00A7:100F5000D42330414E431BC3454E5545600F0055C9:100F60000C5656565656565656367400E2B228005F:100F7000FD23924270017201925204027201824377:100F8000620192B36201FD27E2B228001E282BD332:100F90001C3C4C101A3C8243620192B36201FD2753:100FA000E2B2280001281BE31BB301242BD3C9ECB8:100FB000120219E30A3C8243620192B36201FD27E7:100FC000E2B22800E62B4C101BE39252020272019F:100FD0005E53C23F8243620192B36201FD27E2B2D7:100FE0002800012C2BD33041FFFFFFFFFFFFFFFF45:100FF000F26F076000000000000002130100F61C01:00000001FF

author: Peabody
author_rank: Super Contributor
timestamp: January 10, 2023, 02:25:04 am
content: I use an editor called ConTEXT, which lets you select text by columns. It could be used to remove all the numbers on the left and the cycles data.I don't have time to work on this for you, and don't want to get involved in pirating the code, if that's what you're doing.

author: planc
author_rank: Regular Contributor
timestamp: January 10, 2023, 04:36:16 am
content: Thanks for all the info you shared enough for me to study the firmware.Is reverse engineering considered pirating?The BSL have source file in the non rom version. And you can download the BSL in any MSP rom version. So there is nothing to pirate.Speaking of pirating.above is chinese version of msp-fet430uif you can find so much at ebay. It has no VCC_Target. Is the chip for the voltage follower in vcc_target hard to implement? Is it not open source, so it's not pirating, right?

author: planc
author_rank: Regular Contributor
timestamp: January 11, 2023, 06:54:43 am
content: Quote from: Peabody on January 10, 2023, 12:24:38 amI was able to run IAR Workbench and disassembled the machine code from chip to assembly without any source code.I compared Naken to the IAR disassembler resultsThere was these lines that are different.I'll mention one as example. In Naken. Hex instructions (not address) 0x4685 is intepreted as mov.w r6 while for IAR, 85 and 45 is intepreted as DC8. Why the big difference?for Naken,For IARI'd just mention them and not others. It would take me long time to study MSP430 assembly code, so I'll just mention these two as example. I only know 68HC11 assembly code which is simpler. Thanks.

author: Peabody
author_rank: Super Contributor
timestamp: January 11, 2023, 02:52:37 pm
content: I don't recognize the IAR stuff as valid MSP430 opcodes. Perhaps someone else can explain what they mean.

author: josip
author_rank: Regular Contributor
timestamp: January 11, 2023, 04:12:39 pm
content: Quote from: planc on January 11, 2023, 06:54:43 amYou can not take one assembler line from somewhere, without contest around, and ask what is it. Naken see this line as assembler instruction, while IAR see it as definition of 2 byte constants. To ask Google "DC assembler" will take less time than writing your question.Just note, don't put here contest, because I will not analyze it for you.Quote from: planc on January 11, 2023, 06:54:43 amNo. IAR assembler is covered by PDF that is available on PC after IAR installation, and that can be read completely for one afternoon. It is not rocket since.

author: planc
author_rank: Regular Contributor
timestamp: January 11, 2023, 11:27:16 pm
content: I won't put their main code memory here. So don't worry about leaking out their secrets of secrets. However, the Peripheral addressees and registers are in everyone chip including yours.Above are the contents of Peripherals at say 000084 and 000086. They are the same in every chip, right?However, notice there is missing 000085. And it looks like the first few pages of the main code defined it. Is this normal or an IAR quirk? Naken didn't define it because it didn't read the memory 00000 to 001FF of the Peripherals.In succeeding lines of the main code. All 4685 opcodes are interpreted as "mov.w r6, 0(r5)" similar to Naken. So in the initial code. Why did it define the missing 000085? When you have time guys. Please also check if you have missing 85 in the Peripheral address in your chip. I want to know if it's an IAR default action to define it or if's somehow wrong and the code should be mov.w too. That's all I'll ask. I'll read the reference except asked this one in advance because it's not easily answered in the ref (and can shed light on many things. Thanks.

author: planc
author_rank: Regular Contributor
timestamp: January 12, 2023, 03:27:38 pm
content: I was able to figure out how to attach the CCS to the target without source code!josip, no one answered it how at your question athttps://e2e.ti.com/support/microcontrollers/msp-low-power-microcontrollers-group/msp430/f/msp-low-power-microcontroller-forum/1185310/msp430f2617-attaching-to-running-target-in-ccs-without-source-codealthough I managed to see this old post there made 13 years agohttps://e2e.ti.com/support/tools/code-composer-studio-group/ccs/f/code-composer-studio-forum/41947/iar-debug-without-downloading-in-ccsv4-for-msp430"IAR "Debug without Downloading" in CCSv4 for MSP430"So I went to TI and downloaded many old versions of CCS. CCSv4 couldn't run. only CCS7 could run. Then I found out the new CCS12 has the option to Load Symbol only. That is what was all that was need to attach to target without source code and not download to flash (and erase)!I was able to attach to the F2617 and read all the machine code and convert to assembly. In the above is the Peripheral area. Notice the 85 is really not there. But at least CCS converted the opcode to the right instructions (in the following in CCS12) whereas in IAR it used the directive DC8 which may not be correct at all!By the way, 85 is the ADC memory controlAnyway. My next task in the debugging is how to display the serial output of the target both in CCS and IAR. In the Motorola 68HC11, I could display the serial output in THRSIM11 program. Unfortunately I don't have company account to ask at TI CCS forum.If you got some idea how to display the serial USB output in the CCS and IAR debugging mode. Let me know as I don't know where to ask it. The laboratory equipment I'm studying has serial USB to PC as primary communications. Is it even possible to show the serial output inside CCS or IAR?