Determining Baud Rate of Data - Page 1
Forum section: electronics / beginners

author: mojobojo
author_rank: Newbie
timestamp: December 13, 2013, 11:20:57 pm
content: I procured a printer that no longer printed (Lexmark Pro 805). Interested in the insides I decided to strip it down to its motherboard and muck around with it. Near the JTAG points I came across what seems to be a serial transmit pad. I hooked it up to a serial to USB converter, tried all the baud rates I could think of, also tried a few uncommon combinations, nothing seemed to work so I hooked up my saleae logic analyzer and captured it. After messing around an hour or two trying to figure it out I kinda ran out of ideas. I think its either a bizarre baud rate or its not serial at all.The session file is right here if somebody could maybe take a look and try to help me figure this out. I am fairly new to this. My other option was trying to find it in the firmware files.https://www.dropbox.com/s/5fiqjsync0myepd/printer.logicdataScreenshot, just because.

author: JoeyP
author_rank: Frequent Contributor
timestamp: December 13, 2013, 11:35:17 pm
content: It doesn't look like async data. It's probably SPI or similar. There's probably a clock signal around there somewhere that goes with it.

author: mojobojo
author_rank: Newbie
timestamp: December 13, 2013, 11:41:56 pm
content: Quote from: JoeyP on December 13, 2013, 11:35:17 pmI see, I will poke around the board some more when I get up tomorrow and see what I can find. The pad connects to a 25l6405dmi-126, upon googling said chip I could not find a datasheet, but apparently leads me to the DD-WRT forum which is a site for hacking wireless modems, that may be a place I need to look some more at.

author: AndreasF
author_rank: Frequent Contributor
timestamp: December 14, 2013, 10:04:02 am
content: I think the "6" in "...-126" is actually a "G" in which case this is a serial Flash chip with what looks to be an SPI interface.http://www.ebay.com/itm/1-MX25L6405-25L6405DMI-12G-25L6405-64M-BIT-IC-A98-/180652487295

author: amyk
author_rank: Super Contributor
timestamp: December 14, 2013, 11:28:33 am
content: MX25L6405 64MbitSPIflash.If you're interested in further investigation, it might be fun to dump the flash and inspect its contents.

author: mojobojo
author_rank: Newbie
timestamp: December 14, 2013, 03:41:49 pm
content: Quote from: amyk on December 14, 2013, 11:28:33 amAh thank you. I am going to hack around with it today, like I said this is new to me but I will post my progress. I am interested in repurposing this printer board, every other part of the printer was deemed unrepairable when I opened it up to fix it and found that the printhead had leaked ink onto everything. I found after looking at the firmware images that it is running a version of 2.6.18.5 linux running on an ARM processor and it actually uses flash to display its images.EDIT: Did another go around connected to all the right pins.https://www.dropbox.com/s/ux3b7vr2izzuink/printer2.zipAnother cap at slower speedshttps://www.dropbox.com/s/zg1rmebxb2i7xp7/printer3.zip

author: mojobojo
author_rank: Newbie
timestamp: December 15, 2013, 11:35:21 am
content: Wired up an Arduino to the SPI. Wrote up a bit of code to read the chip ID however I am getting a different ID than what the datasheet says I should be getting 3 bytes C2 20 17 but instead am getting 40 00 03. I am going to tinker around with this a bit more.EDIT: I cannot get any speed or consistency out of reading. I assume the speed issue is do to me printing the data out through the serial, but after a few small dumps compared its showing them as different in some places, my wiring is secure so I am unsureCode so far.Code:// MX25L6405 SPI// Datasheet http://www.macronix.com/QuickPlace/hq/PageLibrary4825740B00298A3B.nsf/$defaultview/3F21BAC2E121E17848257639003A3146/$File/MX25L6405,%203V,%2064Mb,%20v1.3.pdf?OpenElement// Some code from http://arduino.cc/en/Tutorial/SPIEEPROM// Pin Definitions#define DATAOUT 11//MOSI#define DATAIN 12//MISO#define SPICLOCK 13//sck#define SLAVESELECT 10//ss// Command Definitions#define WREN 0x06 // Sets the (WEL) write enable latch bit#define WRDI 0x04 // Reset the (WEL) write enable latch bit#define RDID 0x9F // Output the manufacturer ID and 2-byte device ID (outputs 3 bytes)#define RDSR 0x05 // To read out the status register (outputs 1 byte)#define WRSR 0x01 // To write new values to the status register#define READ 0x03 // N bytes read out until CS# goes high (requires input address of 3 bytes) (outputs ? bytes)#define FAST_READ 0x0B // (requires input address of 3 bytes, optional fourth?) (outputs ? bytes)#define PARALLEL_MODE 0x55 // Enter and stay in parallel mode until power off#define SE 0x20 // Sector erase (input 3 bytes address)#define SE_ALT 0xD8#define CE 0x60 // Chip erase#define CE_ALT 0xC7#define PP 0x02 // Page Program (input 3 byte address)#define DP 0xB9 // Deep Power Down#define EN4K 0xB5 // Enter 4Kb sector#define EX4K 0xB5 // Exit 4Kb sector#define RDP 0xAB // Release from deep power down#define RES 0xAB // Read electronic id (optional 3 byte input?)#define REMS 0x90 // Read electronic manufacturer & device id (2 byte optional? third byte if 0 will// output manufacturer id first, 1 will output device id first)char fmt; // Some place to sprintf intobyte eeprom_output_data = 0;byte eeprom_input_data = 0;byte clr = 0;byte spi_transfer(volatile byte data){SPDR = data; // Start the transmissionwhile (!(SPSR & (1 << SPIF))) // Wait the end of the transmission{};return SPDR; // return the received byte}void setup(){Serial.begin(9600);pinMode(DATAOUT , OUTPUT);pinMode(DATAIN , INPUT);pinMode(SPICLOCK , OUTPUT);pinMode(SLAVESELECT , OUTPUT);// Data sheet says this must be highdigitalWrite(SLAVESELECT, HIGH);// SPCR = 01010000//interrupt disabled, spi enabled, msb 1st, master, clk low when idle,//sample on leading edge of clk, system clock/4 rate (fastest)SPCR = (1 << SPE)|(1 << MSTR);clr = SPSR;clr = SPDR;delay(1000);}void ReadID() {digitalWrite(SLAVESELECT, LOW);spi_transfer(RDID);int b1 = spi_transfer(0xFF);int b2 = spi_transfer(0xFF);int b3 = spi_transfer(0xFF);digitalWrite(SLAVESELECT, HIGH);sprintf(fmt, "%02X %02X %02X\n", b1, b2, b3);Serial.print(fmt);}void ReadElectronicId() {digitalWrite(SLAVESELECT, LOW);spi_transfer(RES);spi_transfer(0x00);spi_transfer(0x00);spi_transfer(0x00);int b1 = spi_transfer(0xFF);digitalWrite(SLAVESELECT, HIGH);sprintf(fmt, "%02X\n", b1);Serial.print(fmt);}void ReadManufactureId() {digitalWrite(SLAVESELECT, LOW);spi_transfer(REMS);spi_transfer(0x00);spi_transfer(0x00);spi_transfer(0x00);int b1 = spi_transfer(0xFF);int b2 = spi_transfer(0xFF);int b3 = spi_transfer(0xFF);digitalWrite(SLAVESELECT, HIGH);sprintf(fmt, "%02X %02X %02X\n", b1, b2, b3);Serial.print(fmt);}void ReadStatusReg() {digitalWrite(SLAVESELECT, LOW);spi_transfer(RDSR);int b1 = spi_transfer(0xFF);digitalWrite(SLAVESELECT, HIGH);sprintf(fmt, "%02X\n", b1);Serial.print(fmt);}void Dump() {int data;digitalWrite(SLAVESELECT, LOW);spi_transfer(READ); // Address auto increments so only need to do a read instruction once// Address 0x000000spi_transfer(0x00);spi_transfer(0x00);spi_transfer(0x00);for (int i = 0, x = 0; i < 0xFFFF; i++, x++) {if (x >= 16) {Serial.print('\n');x = 0;}sprintf(fmt, "%02X ", spi_transfer(0xFF));Serial.print(fmt);}digitalWrite(SLAVESELECT, HIGH);}void loop(){//ReadID(); // RDID//ReadElectronicId(); // RES//ReadManufactureId(); // REMSDump();while (1) {delay(1000);}}