How to clone firmware on Atmel AT91SAM - Page 1
Forum section: electronics / general

author: Signal32
author_rank: Frequent Contributor
timestamp: July 17, 2016, 03:53:25 pm
content: Hello,I have 2xAT91SAM7S256's. One of them has gotten their firmware corrupted. I do not have access to the original firmware.I am looking to clone the good firmware from the intact one on to the corrupted one. I will need them to both be intact / have good firmware after.I see that programming can be done via JTAG, with which I am unfamiliar.Primarily I am wondering if JTAG programmers are universal and therefore I could use any JTAG programmer to read the firmware from the 1st and copy it unto the 2nd, or would I need a specific programmer from ATMEL?Since this is going to be a one-off fix, I was looking at getting the most basic programmer, such as this:http://www.aliexpress.com/item/Free-Shipping-New-Mini-Usb-Blaster-Cable-For-ALTERA-CPLD-FPGA-NIOS-JTAG-Altera-Programmer-in/1487146376.htmlPS: I do know that the chip has some security features which might be enabled that may prevent me reading the firmware, I am just hoping that these are disabled.So my question would be what would be the easiest way for me to clone the firmware from one onto the other?Thanks!

author: donotdespisethesnake
author_rank: Super Contributor
timestamp: July 17, 2016, 05:08:43 pm
content: Theeasiestmethod I know of is to buy a genuine JLINK and use Segger software to read/write Flash. If you only need it for Atmel devices, then SAM-ICE is a cheaper option, as is JLINK-EDU version.

author: Signal32
author_rank: Frequent Contributor
timestamp: July 18, 2016, 04:54:31 am
content: Quote from: donotdespisethesnake on July 17, 2016, 05:08:43 pmThanks. In this case, easiest also includes cheap as this is going to be used only once.I think I found a cheap China alternative:http://www.ebay.com/itm/-/182197178568It says it supports ARM7TDMI so allegedly it would work, wondering if someone can confirm ?Bit off topic:I'm somewhat surprised that basic features such as firmware reading/writing are not able to be done with all JTAG programmers on all chips.What actually is JTAG/what's the purpose of saying a chip has "JTAG support" if different manufacturers can have different implementations of it ? Is it more like a feature set ?From the Wikipedia article I would think that there should only be one JTAG protocol and therefore different programmers should be able to talk to different chips implementing the protocol(at least for the basic features such as firmware read/write/erase, etc ). Why is this not the case ?

author: Kilrah
author_rank: Unknown
timestamp: July 18, 2016, 08:21:36 am
content: The protocol to get data in/out of the chip is standard, but the algorithms (where that data has to be put, how and when to achieve something) depends on the chip's design and capabilities.While the actual interface is standard the tools are often manufacturer-specific.

author: richardman
author_rank: Frequent Contributor
timestamp: July 18, 2016, 09:12:54 am
content: The writing part is particularly nasty as it is dependent on the flash technology and size etc. e.g. basically vendor and chip (family) specific

author: donotdespisethesnake
author_rank: Super Contributor
timestamp: July 18, 2016, 09:40:30 am
content: Quote from: Signal32 on July 18, 2016, 04:54:31 amI think all the cheap "JLINK" adapters on ebay are unofficial clones, Segger call them counterfeit. The Segger software detects clones and refuses to work with them, so I would not advise buying a clone.The Flash writing algorithms are in the software, so the questions are 1) what software supports SAM7S series, 2) what JTAG adapters does that software support.So for example, IAR and Keil support SAM7S and a range of adapters, but the free versions of IAR/Keil might be limited to 32K. The cheap route might use OpenOCD, but you might end up having to write your own programming routines, as well as a lot of messing with config files.I have been down all these routes, so I can tell you the easiest method is an official Segger JLINK. The cheap routes eat up a whole lot of time, and is not easy.QuoteThere are many many things that are not standard, so I wouldn't worry about that. If there is no commercial incentive to make products compatible with competitors, it doesn't happen.

author: andersm
author_rank: Super Contributor
timestamp: July 18, 2016, 11:27:20 am
content: OpenOCD supports the AT91SAM7 series out of the box, and it's not difficult to set up if you're at all able to read documentation. Keep in mind though that if the chips have their security bits set, you won't be able to read the flash.Quote from: Signal32 on July 18, 2016, 04:54:31 amJTAG was designed and specified only for boundary scan testing. Chip vendors figured out they could piggyback other features on the same interface, but this was not done via the IEEE 1149.1 working group.

author: stj
author_rank: Super Contributor
timestamp: July 18, 2016, 01:24:10 pm
content: that part sounds familiar, if it's a car ecu or an ecu manipulation tool then it will be protected.

author: Signal32
author_rank: Frequent Contributor
timestamp: July 18, 2016, 04:26:55 pm
content: Quote from: donotdespisethesnake on July 18, 2016, 09:40:30 amThat would actually work, as there is a fully functional 30 day trial of IAR. I think the trial version of Keil would also allow size-unrestricted flashing from what I can see on their website.Would I be able to use those Altera adapters with IAR/KEIL ?http://www.ebay.com/itm/-/262136733505Quote from: andersm on July 18, 2016, 11:27:20 amWhat adapter would I be using with OpenOCD ? Anything that I might have on hand / would have large applicability would be preferred. Also, could I do this on Windows ? I wouldn't mind taking my time to get familiar with OpenOCD as I was already wanting to try it out for STM32 development.Quote from: stj on July 18, 2016, 01:24:10 pmIt is part of an Agilent 34405A. The firmware on one got corrupted so need to "manually" re-flash it. I'm trying to clone the firmware from one onto the other. There is a header exposed, I'm rather sure it's a JTAG header. Not sure how much sense there would be on having security enabled on this.

author: Signal32
author_rank: Frequent Contributor
timestamp: August 08, 2016, 02:48:19 am
content: So I ended up getting a JLINK V8 clone and succesfully read the firmware on the good chip using the following command in J-Link commander:QuoteHowever, I don't seem to be able to write the firmware to the new chip.I'm trying to write memory by using:QuoteAfter this, commands like "mem 0 0x10" return valid firmware memory, however the data seems to be coming from cache, not the chip itself ( not sure what is going on here ). I suspect it is from cache since the call is returning instantly vs after a slight delay when I read memory initially, without writing it first.After power cycling the JLINK, and trying to do a "mem 0 0x10" I get all 0x00's.I've tried JFlash and it won't connect to the chip, giving the error:QuoteI'm using J-Link commander 4.24(should be good enough as this chip is quite old).What am I doing wrong ?

author: Signal32
author_rank: Frequent Contributor
timestamp: August 08, 2016, 02:57:18 am
content: Yes, I did try to write to the chip that I'm not sure it's still 100% working.I don't have a replacement chip right now, any way to test if the chip is still working ?Since I managed to connect & read all 0's I was assuming it's OK .Is there a reason to believe it is damaged, is the caching behavior of the j-link expected ?

author: andersm
author_rank: Super Contributor
timestamp: August 08, 2016, 03:55:22 am
content: Did you verify that the dump is good (eg. open it in a hex editor)?

author: Signal32
author_rank: Frequent Contributor
timestamp: August 08, 2016, 06:27:43 am
content: Quote from: andersm on August 08, 2016, 03:55:22 amHi, yes, I verified that the dump looks valid (semi-random data stream with some patterns, valid expected strings, etc).

author: batteksystem
author_rank: Regular Contributor
timestamp: August 08, 2016, 07:29:23 am
content: Quote from: Signal32 on August 08, 2016, 02:57:18 amFastest way to check is to do a full erase, see if every byte is 0xFF, then do a blank write, and see if every byte is 0x00. Of course, you will need a JLINK or something similar.