Help disassembling MC68360 rom file - Page 1
Forum section: electronics / general

author: giosif
author_rank: Frequent Contributor
timestamp: March 10, 2025, 08:18:04 am
content: Hi,I dumped the contents of the flash IC used by a board based on the Motorola MC68360 processor (from an Oscilloquartz OSA 5240 unit) and I am trying to determine where in that file the various settings for the unit might be stored (please see attached - just rename the extension of the file from HEX to BIN).My aim is to change the outputs of the unit from giving out a 2.048 MHz signal, to a 10 MHz signal.This is normally possible through configuration commands, but it needs a special software which I could not obtain (Oscilloquartz have kindly ignored my multiple emails asking for such software).Is there anyone here with experience in MC68360 / MC68000 disassembly who could help, please?Thanks!

author: fzabkar
author_rank: Super Contributor
timestamp: March 10, 2025, 10:21:15 am
content: Are you able to change any settings at all? If so, then change something and then compare the ROM dumps before and after the change.

author: PA0PBZ
author_rank: Super Contributor
timestamp: March 10, 2025, 11:32:57 am
content: According to the text in the flash dump there is an EEPROM which probably contains the settings.EEPROM_VALIDITYCODE_INVALID

author: giosif
author_rank: Frequent Contributor
timestamp: March 10, 2025, 11:43:36 am
content: Thank you both!PA0PBZ, you are correct (and I didn't have the brain fully engaged): the flash IC contains only the running code / firmware and there is a DS1744 keeping the settings.fzabkar, I did manage to change some settings (it's a longer story, but short version is I cannot change the specific settings I want) and I have "before" and "after" dumps of the DS1744.I did try a quick comparison between the two, but nothing obvious popped up for the settings I want to change.Will have another look.

author: PA0PBZ
author_rank: Super Contributor
timestamp: March 10, 2025, 02:42:05 pm
content: It looks like the 5240 has an extensive SNMP server built in, did you ever try to get that going?Also, it looks like it can only do either 2048KHz or 10MHz (no arbitrary frequencies) so the difference could be only one bit in the config, that would not be easy to find.Edit: Did you try the serial port, 19200 baud?I'm looking at the code but 68000 code gives me kind of a headacheCode:OM:000B2CD8 loc_B2CD8: ; CODE XREF: ROM:000B2C2C↑jROM:000B2CD8 move.b (a3),d0ROM:000B2CDA subq.b #2,d0ROM:000B2CDC bne.w loc_B2D5CROM:000B2CE0 moveq #$A,d0ROM:000B2CE2 move.l d0,-(sp)ROM:000B2CE4 moveq #$D,d0ROM:000B2CE6 move.l d0,-(sp)ROM:000B2CE8 pea 8(a4)ROM:000B2CEC pea (aStypeMbitCC).l ; "%sTYPE=MBIT,%c%c"ROM:000B2CF2 pea 8(a4)ROM:000B2CF6 jsr sub_99D0ROM:000B2CFC lea $14(sp),spROM:000B2D00 moveq #$A,d0ROM:000B2D02 move.l d0,-(sp)ROM:000B2D04 moveq #$D,d0ROM:000B2D06 move.l d0,-(sp)ROM:000B2D08 pea 8(a4)ROM:000B2D0C pea (aSfrequency2048).l ; "%sFREQUENCY=2048,%c%c"ROM:000B2D12 pea 8(a4)ROM:000B2D16 jsr sub_99D0

author: giosif
author_rank: Frequent Contributor
timestamp: March 10, 2025, 04:29:28 pm
content: Thank you PA0PBZ,The manual mentions the unit "can include an SNMP agent", but I think this means it was an optional functionality.This looks to be confirmed by the existence of "1.1E" and "1.1E – SNMP" units in the ordering section of the manual.Also, checking the list of commands the unit supports, there is nothing related to SNMP.Finally, I tried connecting to UDP/161 with MIB-explorer software, as well as as "raw connection" (i.e. using netcat) and the unit responds with "port unreachable" in both cases.So, I think it is safe to conclude my unit does not come with SNMP functionality.On the serial port, I can indeed connect to the unit at 19200 baud rate, but the issue is I have the try a given command multiple times before it would accept it (using Minicom in Linux).There is something unusual/broken with how the serial communication works: it is as if I need to land on a specific point in time with my command, in order for the unit to completely read the string I enter.This might have to do with the requirement to send <stx> and <etx> characters at the start, respectively the end, of each command, and/or the fact I am entering this manually in Minicom, but I'm not sure.In any case, I am able to (eventually) login and run some commands, but the specific command to configure the output of the unit always returns "SYNTAX_ERROR", no matter what format or how many times I try.I am suspecting this is because of the expected format of the command which, unlike most of other commands, seems to need a <CR><LF> in the middle of the command (quote from the manual):<stx>OUOCS:[SID=sid,][CID=cid,]CARD_NUMBER=card_number,<cr><lf>OUTPUT_NUMBER=output_number,TYPE=type;<cr><lf><etx>And, given that I usually need to enter a given (command) line multiple times before it accepts it, managing to enter two such line in sequence and have both accepted by the unit probably has 0% chance of success.I also tried entering the command as a single line (i.e. without the <CR><LF> sequence in the middle), but I get the same response.

author: PA0PBZ
author_rank: Super Contributor
timestamp: March 10, 2025, 04:44:58 pm
content: About the SNMP: The code is there, so if it is an option I guess it has to be enabled by a license key or something like that. You can probably enable it in the EEPROM but that's a chicken-egg situation for now.Code:ROM:0006D5D4 dc.l aUsecmibnoauthc ; "usecMIBNoAuthCompliance"ROM:0006D5D8 dc.l a1361631135411 ; "1.3.6.1.6.3.1135.4.1.1"ROM:0006D5DC dc.b 0ROM:0006D5DD dc.b 0ROM:0006D5DE dc.b 0ROM:0006D5DF dc.b 0ROM:0006D5E0 dc.l aUsecmibauthcom ; "usecMIBAuthCompliance"ROM:0006D5E4 dc.l a1361631135412 ; "1.3.6.1.6.3.1135.4.1.2"ROM:0006D5E8 dc.b 0ROM:0006D5E9 dc.b 0ROM:0006D5EA dc.b 0ROM:0006D5EB dc.b 0ROM:0006D5EC dc.l aUsecmibprivcom ; "usecMIBPrivCompliance"ROM:0006D5F0 dc.l a1361631135413 ; "1.3.6.1.6.3.1135.4.1.3"ROM:0006D5F4 dc.b 0ROM:0006D5F5 dc.b 0ROM:0006D5F6 dc.b 0ROM:0006D5F7 dc.b 0ROM:0006D5F8 dc.l aUsecmibgroups ; "usecMIBGroups"ROM:0006D5FC dc.l a136163113542 ; "1.3.6.1.6.3.1135.4.2"ROM:0006D600 dc.b 0ROM:0006D601 dc.b 0ROM:0006D602 dc.b 0ROM:0006D603 dc.b 0ROM:0006D604 dc.l aUsecnoauthgrou ; "usecNoAuthGroup"ROM:0006D608 dc.l a1361631135421 ; "1.3.6.1.6.3.1135.4.2.1"

author: giosif
author_rank: Frequent Contributor
timestamp: March 10, 2025, 07:02:21 pm
content: You are correct yet again: looking into the rom file, I can indeed see a lot of SNMP OIDs, so the functionality is there.Enabling it, though, is another matter.In the meantime, through trial and error, I managed to get the terminal session via the serial port to accept my commands every time: turns out I have to insert <stx> (i.e. CTRL+b in Minicom) exactly four times, then paste my command, followed by Enter, then by <etx> (i.e. CTRL+c in Minicom).I can now reliably run any command... except the OUOCS command - every time I run this one, I get a "SYNTAX_ERROR".So, there must be something wrong about the syntax of this command, as described in the manual.

author: giosif
author_rank: Frequent Contributor
timestamp: March 10, 2025, 07:46:27 pm
content: Had a look through the rom file and found a section with the list of commands, looking for one which might allow enabling the SNMP agent.I extracted that list and compared it with the one in the manual, and there are some undocumented commands:DBERMDBRIPDBRIRNTAMPOE1CPOE1CSOT1CPOT1CSRMRASSYCFISYQTPSYQTSSYSUINow, the first three commands look interesting... DBxxx= Debug?I tried running the first two, but didn't get much useful:DBERM;DBERM:SYNTAX_ERROR;DBRIP;COM2.:SYNTAX_ERROR;The rest of the extra commands have parts in common with other documented commands and those are for configuration areas which are not interesting here.

author: PA0PBZ
author_rank: Super Contributor
timestamp: March 11, 2025, 04:34:49 pm
content: I was reading the user manual about the remote management port:"For detailed instructions concerning the remote management connections and settings, please refer to the SyncView software User Guide"I was unable to find that, do you have it?

author: giosif
author_rank: Frequent Contributor
timestamp: March 11, 2025, 09:51:38 pm
content: I don't have it, but don't think they would explain the actual communication protocol used.If I am to make an assessment based on the resources I could find so far (or, rather, couldn't) and their lack of even a "Go away!" response to my queries, I gather Oscilloquartz is the type that provide only the bare minimum to allow for the use of their products and I cannot see how including details on the communication protocol would fit in that category.I might very well be wrong, but I doubt it.

author: PA0PBZ
author_rank: Super Contributor
timestamp: March 11, 2025, 10:31:02 pm
content: It looks like you have at least a manual which lists some of the commands "I extracted that list and compared it with the one in the manual" so what manual is that? Do you have a link or can you attach that?

author: giosif
author_rank: Frequent Contributor
timestamp: March 11, 2025, 10:40:44 pm
content: I do indeed have what is called the MML Command Set document which I was referring to as "the manual".However, that was given to me by someone in confidence, so I need to check with them if they are happy for me to share it.

author: darkspr1te
author_rank: Frequent Contributor
timestamp: March 12, 2025, 11:25:22 am
content: The hex decompiles in Ghidra very well.Attached is the normal user manual i found while looking about.

author: darkspr1te
author_rank: Frequent Contributor
timestamp: March 12, 2025, 06:04:13 pm
content: full strings with mem locations, lots of compiler left overs

author: giosif
author_rank: Frequent Contributor
timestamp: March 13, 2025, 09:28:48 pm
content: Quote from: PA0PBZ on March 11, 2025, 10:31:02 pmI got confirmation from my source it is fine to share the documentation with the commands, so please see attached.Quote from: darkspr1te on March 12, 2025, 11:25:22 amThanks, darkspr1te!It's good to know the binary file decompiles well.Now, if only I could understand the source code.Quote from: darkspr1te on March 12, 2025, 06:04:13 pmHmmm... Thanks!I will have a look into the file contents.