Reverse Engineering a debug interface - decoding an unknown protocoll - Page 1
Forum section: electronics / beginners

author: paschwuerfler
author_rank: Newbie
timestamp: October 23, 2022, 10:26:36 pm
content: Hello,I'm trying to reverse-engineer the debug interface of a laser distance-measuring device (The Parkside Plem 50 C3), my goal is to extract the measured distance from the device.The device seems to utilize a MM32SPIN05x microcontroller (TW - TSSOP, 20 Pins) (Arm-M0, 32-bit RISC).The device has 4 contact pads accesible from the battery cover. (The same contact points are also broken out at a seperate point within the device), the pinout is as follows (determined via continuity measurements, pinout via Datasheethttp://47.103.60.28:8090/userfiles/images/MM32SPINXiLieWenDang/DS_MM32SPIN05x_q_V1.09_EN.pdf):1 - 3.3V2 - PA13 - SWDIO/SPI2_MISO/MCO/TIM1_CH2/TIM1_BKIN3 - PA14 - SWDCLK/UART2_TX/SPI1_NSS4 - GNDI have attached a logic analyzer (HANTEK6022BL) to a pogo-pin-probe to see what the port is sending:Upon power on, there is some recurring Activity on PA13 that changes when a measurement is taking place.PA14 seems to be related to the power-state of the device (high when devie is on), but does not seem tansmit any kind of data.Here is my problem:Looking at the Datasheet pin functionality, PA13 does not seem to be capable of UART communication, i've also not been able to get a working UART docoding from the data i gathered.I'd like to think the protocoll used here is SWDIO, but i lack the clock signal that would be required for this.What can i do to proceed?What data format should i expect to recieve?Are there any kind of "standard" UART-Settings used for ports like this? (Is UART even relevant when the pin is not explicitly marked for this?)Are there any other protocols i can look into?Is it possible i need to send something to the device? If so: Where should i start?I have attached two PulseView files below:1) Debug Header Power On: When powered directly via the debug header, the device seems to enter some kind of debug mode, the display does not turn on, communication seizes shortly after power on (allthough the laser stays on)2) PLEM C50 Measurements: here, i power on the device like normal (not via debug interface, but via the battery terminals), take one measurement and then power off the device (actions marked in file).I'd be very happy, if anyone could point me into the right direction.Thanks,Paul

author: ataradov
author_rank: Super Contributor
timestamp: October 23, 2022, 10:41:49 pm
content: I can't open the traces. It may be better to attach them as more accessible formats.But with MCU being Cortex-M0 and debug pins being regular SWDIO/SWCLK, there is zero chance it is not a standard ARM SWD interface.ARM SWD interface is not active until contacted by the debugger, so it you see any toggles on reset, they must remap those pins to secondary functions and may be outputting some application specific stuff. It can be literally anything, so you would need to provide those traces in a more accessible format. I doubt a lot of people here would bother downloading Hatnek software just for this.

author: paschwuerfler
author_rank: Newbie
timestamp: October 23, 2022, 10:51:41 pm
content: Hey,thanks for the advice, i'll look into that.What would be a better Data format for the traces?EDIT: the inital Post are PulseView Files. I have uploaded more formats here:https://drive.google.com/drive/folders/1teK_7nwWcuh1PUVzBksS_vmDq1ezCSFK?usp=sharing

author: ataradov
author_rank: Super Contributor
timestamp: October 23, 2022, 11:01:04 pm
content: Sorry, I missed that they were in a regular PilseView format, I assumed it was some proprietary Hantek stuff. This is good enough.This is definitely not UART. Looking at possible bit times, it appears something really fast. Or may be not that fast. The width of a "regular" short bit seems to be consistent with 115200 bps. But short intermediate pulses don't make sense for UART.And it looks like most of the data is just repetitive pattern separated by a very narrow pulse.

author: ataradov
author_rank: Super Contributor
timestamp: October 23, 2022, 11:13:05 pm
content: Also, what makes you think this protocol even outputs measurement data? Are there accessories that normally attach to those pins and use that data?This does not resemble any regular protocol. It is probably something they generate as a regular GPIO. It would not be trivial to decode.I would do more measurements and observe what changes between them and what changes and what stays the same between different measured values.

author: DavidAlfa
author_rank: Super Contributor
timestamp: October 23, 2022, 11:38:20 pm
content: Could be just MCO, the system clock, way too fast for your 10MHz analyzer (Probably 72MHz or so), it's sampling completely random data.

author: ataradov
author_rank: Super Contributor
timestamp: October 23, 2022, 11:50:19 pm
content: But why output the clock?It is worth checking, of course.

author: DavidAlfa
author_rank: Super Contributor
timestamp: October 23, 2022, 11:54:55 pm
content: Don't know, if it was SWO it would make sense as it's async, but not available on Cortex-M0 devices.AFAIK SWDCLK and SWDIO don't generate anything by themselves, it's the master (Debugger) who inits and generates the clock?I don't think the system is doing anything there!

author: ataradov
author_rank: Super Contributor
timestamp: October 24, 2022, 12:06:09 am
content: This is definitely not SWD protocol. It is not active without a debugger. They just output some random data. Or it is actually MCO just sampled weird. But this would be very strange.

author: DavidAlfa
author_rank: Super Contributor
timestamp: October 24, 2022, 11:28:15 am
content: Have you checked if it goes elsewhere? Could be an input.Otherwise it still could be Output compare or One-pulse mode output.I doubt it's pwm but who knows.I wouldn't burn my brain off until checking that signal with a higher bandwidth scope/analyzer, this all could be just aliasing artifacts.Official MM page has newer docs:MM32SPIN05 pageDatasheet v1.23User Manual v1.19

author: geggi1
author_rank: Frequent Contributor
timestamp: October 24, 2022, 04:03:21 pm
content: I got two suggestions for you.1. There was a post here onthe forum regardig hacking Bosch laser distance meter. I have checked the pictures on the Parkside meter and it looks very similar to Bosch.2. If there are a bluetooth version of the Parkside check on how the bluetooth is implemented.