How to read/write to EEPROM - Page 1
Forum section: electronics / beginners

author: McDogg
author_rank: Contributor
timestamp: September 02, 2024, 04:01:44 am
content: Hello,I'm a software developer who took some EE classes in college. Forgive my lack of "common" EE knowledge, I only know enough to be dangerous.I'm trying to read/reset/modify the memory of a Taser X26 battery pack. It holds the "battery level" digitally on the chip inside the battery pack. It is not a true level indicator.Quotehttps://ifixtasere2error.com/x26-dpm/I've replaced the cells in the battery pack but the weapon's display will still show the last battery level. So I'd like to flip some bits and set it back to 100%.Here's the chip on the underside of the battery's contact board.[ Attachment Invalid Or Does Not Exist ]I searched for a datasheet using the numbers on that chip but couldn't come up with anything.4A128I303739I asked chatgpt and it claims this chip is a "24AA128-I/MS" from Microchip Technology, a 128 Kbit serial EEPROM with I2C interface.The datasheet for that ishttps://ww1.microchip.com/downloads/en/DeviceDoc/24AA128-24LC128-24FC128-128K-I2C-Serial-EEPROM-DS.pdfI'd like to know if this is something relatively easy, or if it would require an absurd amount of work.I'm a tinkerer, and as such I understand some things just aren't worth reverse engineering.My hope is that I can buy a gadget to interface with the I2C and dump the memory to my computer. From there, I can determine where the battery level is stored, change those bits, and write everything back to the chip.I understand there might be some encryption or proprietary stuff standing in the way of reading it normally, but if I can dump the contents of the chip before and after I fire it a few times (to change the battery level), I can run a diff on the dumps and find out where the gold is.I read the datasheet, and part of me wonders if this is going to take some specialized circuitry and custom software to even interface the chip.Your advice is greatly appreciated![ Attachment Invalid Or Does Not Exist ] [ Attachment Invalid Or Does Not Exist ] [ Attachment Invalid Or Does Not Exist ] [ Attachment Invalid Or Does Not Exist ]ps. If you're that one guy who likes to step in and berate people for whatever perceived slight, save it please. I come in peace.

author: McDogg
author_rank: Contributor
timestamp: September 02, 2024, 04:04:15 am
content: My images didnt get uploaded. Here they are again

author: McDogg
author_rank: Contributor
timestamp: September 02, 2024, 04:05:59 am
content: more

author: Andy Chee
author_rank: Super Contributor
timestamp: September 02, 2024, 06:35:23 am
content: Quote from: McDogg on September 02, 2024, 04:01:44 amThis will be your problem: encryption. Detecting the difference between dumps, will not work with encrypted devices.If you want to experiment with cracking encryption, I would suggest you purchase a few blank EEPROMs, program them with "Hello World!", encrypt them, then experiment by hacking back into them and attempting to change the message.Experimenting in this manner, you will quickly discover that the dump difference method doesn't work. And without risking damage to the taser's existing hardware.

author: McDogg
author_rank: Contributor
timestamp: September 02, 2024, 07:41:34 am
content: Ah, I didnt consider that.But Im not giving up yet... I have a new battery pack that is 100% from the factory. I can copy it.

author: McDogg
author_rank: Contributor
timestamp: September 02, 2024, 07:44:50 am
content: I meant... I didnt consider that when I suggested the encryption part.Thats was just a one off. There is nothing indicating that it uses any kind of encryption.Is it common to do so?

author: Andy Chee
author_rank: Super Contributor
timestamp: September 02, 2024, 07:54:26 am
content: Quote from: McDogg on September 02, 2024, 07:44:50 amwhat do you mean by common?Common for tasers? I would say yes!Common for any device using an EEPROM? Depends on the device. Could be anything from a vehicle odometer, to cable TV subscription, to video game console security.

author: McDogg
author_rank: Contributor
timestamp: September 02, 2024, 08:56:43 am
content: Only one way to find out for sure, right?How do I read this thing?

author: Andy Chee
author_rank: Super Contributor
timestamp: September 02, 2024, 09:04:11 am
content: Many ways to read an EEPROM.TL866 programmer would be an obvious way to do it. An Arduino or Raspberry Pi can also be turned into an EEPROM reader/writer.Again, you should probably experiment on some blank EEPROMs before you risk destroying your taser.

author: voltsandjolts
author_rank: Unknown
timestamp: September 02, 2024, 09:08:37 am
content: Make a schematic diagram of the PCB, showing how the battery connector pins are wired to the chip (eeprom? **), etc. It's quite a small board by the looks of it, so a few minutes with a multimeter in 'continuity mode' (beeper) should get it done. Then you should be able to use the battery connector to program the chip, rather than direct to chip pins which are small and tricky.** I'm not convinced it's simple eeprom, but maybe.

author: McDogg
author_rank: Contributor
timestamp: September 02, 2024, 09:15:14 am
content: Excellent.Thank you!

author: McDogg
author_rank: Contributor
timestamp: September 02, 2024, 09:16:53 am
content: Now, who wants to make a few bucks?lolweighing how much curiosity I have.

author: McDogg
author_rank: Contributor
timestamp: September 02, 2024, 09:41:17 am
content: "** I'm not convinced it's simple eeprom, but maybe."Right?ChatGpt isnt known for its accuracy.I'd really like to find a datasheet that has the same numbers on it.

author: pcprogrammer
author_rank: Super Contributor
timestamp: September 02, 2024, 09:46:20 am
content: Quote from: voltsandjolts on September 02, 2024, 09:08:37 amNeither am I.An I2C based EEPROM needs a microcontroller or some other logic device to read/write it. It could be that the microcontroller is in the taser itself and that there are connections from the battery pack to access it, or that it is on the other side of the PCB. The only way of knowing with more certainty is by drawing up a schematic.

author: dustooff
author_rank: Contributor
timestamp: September 02, 2024, 09:47:43 am
content: "** I'm not convinced it's simple eeprom, but maybe."the datasheet you linked does correlate with the marking you have,for a 24AA128 in a MSOP case, 4A128I does seem to match.second line decodes as YWWNNNY = 3 (2003)WW = 03 week 3NNN = 739 ... Micropchip's traceability codesee page 16 of the datasheet.

author: pcprogrammer
author_rank: Super Contributor
timestamp: September 02, 2024, 10:01:47 am
content: I did some searching and dustooff seems to be correct. MSOP-8 uses that code.That means 8KB of data to weed through to see if it is possible to find the byte(s) that holds the battery state. Reading can easily be done with a CH341 based programmer.https://nl.aliexpress.com/item/32263275388.htmlOnly thing to be ware of is that these programmers could need modification for true 3,3V operation. According to the datasheet of the 24AA128 not a problem because it works over a wide range of voltages up to 5,5V.

author: McDogg
author_rank: Contributor
timestamp: September 02, 2024, 10:02:42 am
content: other side

author: McDogg
author_rank: Contributor
timestamp: September 02, 2024, 10:10:34 am
content: Is pin1 bottom left when viewing from this way?

author: voltsandjolts
author_rank: Unknown
timestamp: September 02, 2024, 10:15:33 am
content: Yes, pin 1 is bottom left.

author: dustooff
author_rank: Contributor
timestamp: September 02, 2024, 10:17:21 am
content: I2C SDA & SCL connect to the second and third pads (from the left in your pic)

author: McDogg
author_rank: Contributor
timestamp: September 02, 2024, 10:38:53 am
content: Oof, Im glad you pointed that out. I had it in my head that pin5 started on the same side as pin1, ascending left to right.I'm going to finish mapping this out tomorrow.Thanks for all the help everyone!

author: pcprogrammer
author_rank: Super Contributor
timestamp: September 02, 2024, 10:53:18 am
content: If these are rechargeable batteries, it is also possible that the number of times charged is stored in the EEPROM. If that information is also used by the charger or taser it would have to be reset too.An option to figure out what is going on is to monitor the I2C bus when the battery is connected to either the taser or the charger.Can easily be done with a logic analyzer likethis. (8 channel, 24MHz, USB) Can be used with the open source Sigrok suit.Solder three wires to the EEPROM or the PCB and connect them to the logic analyzer. Capture the communication and format it with I2C protocol analyzer. Then try to analyze the data. (GND => GND, SCL => channel 1, SDA => channel 2)

author: McDogg
author_rank: Contributor
timestamp: September 02, 2024, 11:20:56 am
content: They are not rechargeable, but they should be. Or at least user replaceable.They have simple Duracell CR123 batteries in them, spot welded to nickel strips and soldered to the board.I like the idea of monitoring the bus.

author: daisizhou
author_rank: Super Contributor
timestamp: September 02, 2024, 11:45:41 pm
content: Quote from: McDogg on September 02, 2024, 04:01:44 amI think you have two options.1、According to the formal way，Usually this type of eeprom has a special adapter to communicate with it,Assuming I2C communication,You need to find the location of the SDA, SCL, GND interfaces, as well as the internal management chip for reading and writing the eeprom.Or it is like TI's BQ series, with special adapters, such as EV2200, EV2300, EV2400..... and supporting tool software to read and write eeprom2、After you have determined the SDA, SCL, and GND definition pins,Use a logic analyzer to view the communication protocol.........,Finding the interpretation of the protocol to modify the exact EEPROM location requires a lot of time testing and analysis,Because in normal use, time or communication between them will always occur, and you need to capture these communication levels

author: pcprogrammer
author_rank: Super Contributor
timestamp: September 03, 2024, 06:06:43 am
content: Quote from: daisizhou on September 02, 2024, 11:45:41 pmThis has already been done. The what you call "internal management chip" will be in the taser itself. Reading it can be done conform the datasheet the OP already found.Quote from: daisizhou on September 02, 2024, 11:45:41 pmYes with a logic analyzer it should be very easy to see what is going on. In this case I suspect it to be fairly simple, since it will only be used for a small amount of data storage. I doubt that there will be a lot of communication between the taser and the battery data storage chip. Most likely only on power up and after each activation of the trigger.The communication protocol is described in the datasheet and will be pretty standard for reading/writing of EEPROM's.Only in the case that data encryption is used will it be problematic to determine the meaning of it. The messages can still be found easily since the I2C protocol does not support encryption in its basics. It all starts with the address bits and the read/write bit followed by the data. Within this data the first two bytes are the address of the start of the targeted data bytes. Only the remainder could be encrypted, but I doubt they would have done this for such a trivial application.

author: McDogg
author_rank: Contributor
timestamp: September 03, 2024, 06:25:20 am
content: @pcprogrammer, can you link to that logic analyzer again. The last link wouldn't work for me.I got swarmed with other stuff today, didnt finish mapping out the pads to the pins. I dont think anyone is waiting for me to finish doing that tho.....I'll likely have some more questions after I get my hands on the logic analyzer. I'll do my homework first.Thanks everyone.

author: pcprogrammer
author_rank: Super Contributor
timestamp: September 03, 2024, 06:42:08 am
content: Quote from: McDogg on September 03, 2024, 06:25:20 amThis is the search I did on Aliexpress "logic analyzer 24MHz 8ch"https://nl.aliexpress.com/w/wholesale-logic-analyzer-24MHz-8ch.html?g=y&SearchText=logic+analyzer+24MHz+8chYou will get many hits, and some different types of the analyzer, but these are mostly the same. Find the cheapest one, if you care about price, and check the reviews on that one to see if it is somewhat reliable.After ordering you will have some time to study on how to use it.You can use eitherSigrokorsaleaeto play with it. The saleae software is not really freeware and supposed to be only used with official saleae hardware, and it might not even work with what you get. It does work with my clone.

author: daisizhou
author_rank: Super Contributor
timestamp: September 03, 2024, 07:43:28 am
content: Quote from: McDogg on September 03, 2024, 06:25:20 amhttps://www.mydigit.cn/thread-257147-1-1.htmlThe above link is a post about how to analyze related content from a logic analyzer.I hope this helps your analysis.