Renesas/Hitachi H8/36049 EPROM signals to pins mapping - Page 1
Forum section: electronics / general

author: gashtaan
author_rank: Regular Contributor
timestamp: July 10, 2024, 07:42:59 am
content: Hi, I'm looking for any information about EPROM signals to pins mapping for Renesas H8/36049 family group, specifically about flash version HD64F36049 MCU. Unfortunately it is not described in the hardware manual for this MCU. It should look something like this (taken from hardware manual for other MCU family from the same manufacturer):

author: Postal2
author_rank: Frequent Contributor
timestamp: July 10, 2024, 10:17:44 pm
content: I see one way. You need to create hardware environment with FPGA and scan the pins. But this mcu is really “tiny” and no one needs it. Renesas bought mcu from Hitachi and quickly convert it to a junk.

author: pcprogrammer
author_rank: Super Contributor
timestamp: July 11, 2024, 05:57:50 am
content: @gashtaan,are you sure that the H8/300 series is even capable of supporting external memory in such that it can directly address it from the CPU core?I looked at the general manual here:https://www.manualslib.com/manual/1851554/Hitachi-H8-300l-Series.htmland did not find any indication that it can.The example connection you show might be a setup where the code emulates an address and data bus to read data from an external memory device, but that it can't be used to run code from.No expert on the H8/300 series though, so I might be wrong.

author: gashtaan
author_rank: Regular Contributor
timestamp: July 11, 2024, 07:09:05 am
content: Quote from: pcprogrammer on July 11, 2024, 05:57:50 amYou got it wrong. I want to directly address internal flash memory, not the opposite. It's vaguely described in hardware manuals as "Programmer mode".

author: m k
author_rank: Super Contributor
timestamp: July 11, 2024, 11:38:37 am
content: So you want to read its program?One of the basic no-nos, I guess.

author: Postal2
author_rank: Frequent Contributor
timestamp: July 11, 2024, 12:51:47 pm
content: Quote from: m k on July 11, 2024, 11:38:37 amNo, this is industrial mcu in the past. 20 years ago closed read was bad form. Mostly locks needed to steal software, close/cifer and nobody can catch. Otherwise, a signature is enough.For example, a major accident occurred due to the fault of electronics. 10 mcu can be read, but one is blocked. Who will get problems?

author: pcprogrammer
author_rank: Super Contributor
timestamp: July 11, 2024, 04:39:11 pm
content: Quote from: gashtaan on July 11, 2024, 07:09:05 amYou should have worded your question more clear then.See chapter 19 in the manual found here:https://www.farnell.com/datasheets/1500333.pdfIt shows an adapter for the H8/3048F, but might be the same as what you already found and suited for the one you are searching for.

author: gashtaan
author_rank: Regular Contributor
timestamp: July 11, 2024, 05:19:28 pm
content: Quote from: pcprogrammer on July 11, 2024, 04:39:11 pmOk, maybe I should. I thought it was clear what information I need, especially when I put related table from other datasheet in the post. I just need to know on what pins are EPROM address/data lines and control signals exposed when MCU is reset to programmer mode.I've seen few other datasheets of different groups, every single one has EPROM mapped to different pins. Hard to say if H8/3048F is the same mapping as H8/36049F. I rather not guess.

author: gashtaan
author_rank: Regular Contributor
timestamp: July 11, 2024, 05:26:32 pm
content: Quote from: m k on July 11, 2024, 11:38:37 amYes, I do. I have a hobby of extracting firmwares out of various devices (even the protected ones) and then reverse engineer them to document how they works or create alternative firmwares. But I never publish extracted firmwares or my techniques how to overcome MCU protections... for ethical reasons.You can see some of my work here:https://github.com/gashtaan

author: m k
author_rank: Super Contributor
timestamp: July 11, 2024, 06:13:03 pm
content: You can make it kosher by having a third party for coding.That's the original Compaq method for cloning IBM PC.

author: Postal2
author_rank: Frequent Contributor
timestamp: July 11, 2024, 07:36:49 pm
content: What the device on this "tiny" chip, alarm-clock? Electric kettle?

author: gashtaan
author_rank: Regular Contributor
timestamp: July 11, 2024, 07:56:43 pm
content: Quote from: Postal2 on July 11, 2024, 07:36:49 pm80pin 16bit MCU with 96kB flash in alarm-clock or kettle? It would be a bit too much IMO. Even if it can't run Linux or Doom, but it's used in rather complex boiler system.

author: Postal2
author_rank: Frequent Contributor
timestamp: July 11, 2024, 08:16:56 pm
content: I see "BCD"-format inside - I seem alarm-clock. You can try manually check pins for CE and OE, but I recommend FPGA instead because need calculations for address and data lines.I will start the project for FPGA, it seems to be interested.

author: gashtaan
author_rank: Regular Contributor
timestamp: July 12, 2024, 04:20:04 am
content: Quote from: Postal2 on July 11, 2024, 08:16:56 pmIt could have also ~PGM and/or ~WE exposed, some family does. These are tricky, because even data lines could be in high impedance mode when those signals are driven low. It seems at least data lines are always consecutive on single IO port, my idea was to exploit this fact to find out on what port group these are. ~PGM/~WE signals would make the brute force approach more difficult.The best would be to have some spare ICs to decap and just see where bond wires go. But those are hard to get and/or too expensive to just throw them into the bin :\ I have only single sample and I can't damage it.

author: Postal2
author_rank: Frequent Contributor
timestamp: July 12, 2024, 05:59:20 am
content: Quote from: gashtaan on July 12, 2024, 04:20:04 amYou need to buy spare chips for testing first. They are cheap like a dog soap.https://aliexpress.com/item/1005006994759425.htmlApprox. 10 times cheaper than SH7047.I ordered.

author: gashtaan
author_rank: Regular Contributor
timestamp: July 12, 2024, 06:20:30 am
content: Quote from: Postal2 on July 12, 2024, 05:59:20 amYou're right, thanks! I always searched for HD64F36049GHVVersion without G should suffice enough for such research... if they are not some fakesAnyway, how did you find it? I've tried to search "HD64F36049HV" and "DF36049HV" on aliexpress, but it not give me the item you're referring to. Weird.

author: Postal2
author_rank: Frequent Contributor
timestamp: July 12, 2024, 09:39:07 am
content: Quote from: gashtaan on July 12, 2024, 06:20:30 amI didn’t see any difficulties with this, but at first I was offered an expensive option.This mcu has 96KB of memory because the bootrom takes up exactly 32. It is most likely exactly the same as the SH7047. You can search for holes in it according to your hobby, I have attached the file.

author: gashtaan
author_rank: Regular Contributor
timestamp: July 12, 2024, 09:49:31 am
content: Quote from: Postal2 on July 12, 2024, 09:39:07 amSH7047 is 32bit MCU, H8/36049 is 16bit MCU and completely different architecture... obviously the bootloader can't be the same.

author: Postal2
author_rank: Frequent Contributor
timestamp: July 12, 2024, 09:53:05 am
content: Quote from: gashtaan on July 12, 2024, 09:49:31 amIt most likely contain the same C-code compiled differently. Because size is matched.And you can compare algorithm for flash - very similar.

author: gashtaan
author_rank: Regular Contributor
timestamp: July 12, 2024, 10:01:35 am
content: Quote from: Postal2 on July 12, 2024, 09:53:05 amI doubt that. How do you know that bootrom in H8/36049 has 32kB? Seems a bit excessive. Bootrom in Renesas M16C has 4kB for example.

author: Postal2
author_rank: Frequent Contributor
timestamp: July 12, 2024, 10:13:00 am
content: Quote from: gashtaan on July 12, 2024, 10:01:35 amOkay. I repeat - see datasheet for SH7047 and compare. And write your advice after.

author: gashtaan
author_rank: Regular Contributor
timestamp: July 12, 2024, 10:16:47 am
content: Quote from: Postal2 on July 12, 2024, 10:13:00 amI've looked on datasheet and there are some similarities for sure... but for example H8/36049 erases the flash before it accepts the programming code, SH7047 do it in different order.

author: Postal2
author_rank: Frequent Contributor
timestamp: July 12, 2024, 10:27:54 am
content: Quote from: gashtaan on July 12, 2024, 10:16:47 amPages about flash of your mcu looks like a copy from SH7047. What's not clear?

author: gashtaan
author_rank: Regular Contributor
timestamp: July 12, 2024, 10:31:07 am
content: Quote from: Postal2 on July 12, 2024, 10:27:54 amYes, it looks like a copy at the first sight... until you actually read it.

author: Postal2
author_rank: Frequent Contributor
timestamp: July 12, 2024, 10:45:20 am
content: Okay.

author: gashtaan
author_rank: Regular Contributor
timestamp: July 12, 2024, 10:53:19 am
content: Quote from: Postal2 on July 12, 2024, 10:45:20 amI'm just skeptical, different order of these major boot mode events are suspicious. Renesas has too many different bootloaders in their MCUs, not sure why they reinvent the wheel for every family. Anyway, thanks for the SH7407 bootloader, I'll look on it. How did you obtain it? It's directly accessible by ISP or from the program in flash?

author: Postal2
author_rank: Frequent Contributor
timestamp: July 12, 2024, 08:22:13 pm
content: Quote from: gashtaan on July 12, 2024, 10:53:19 amIt's accessible from RAM.

author: Postal2
author_rank: Frequent Contributor
timestamp: July 31, 2024, 12:27:04 pm
content: I got the chips but only see one purchase from the seller. This doesn't surprise me, but some people have asked why I paint the world in dark colors.

author: gashtaan
author_rank: Regular Contributor
timestamp: July 31, 2024, 12:58:15 pm
content: Quote from: Postal2 on July 31, 2024, 12:27:04 pmWhat is the problem? Do those ICs at least look like genuine? I didn't order them, it seemed shady that aliexpress did not show me that seller when I searched for those ICs.

author: pcprogrammer
author_rank: Super Contributor
timestamp: July 31, 2024, 01:20:52 pm
content: Quote from: gashtaan on July 31, 2024, 12:58:15 pmThat might be a cookie related thing. The Aliexpress site has a very poor search engine that at times needs the cookies removed to produce better results.

author: Postal2
author_rank: Frequent Contributor
timestamp: July 31, 2024, 01:47:45 pm
content: The chips are normal, new, in the factory grid.

author: gashtaan
author_rank: Regular Contributor
timestamp: August 01, 2024, 03:59:07 am
content: Quote from: pcprogrammer on July 31, 2024, 01:20:52 pmI tried that before, all the cookies and the cache wiped out and that seller didn't came out in the search - it could be related to the country I've set up in my account.

author: gashtaan
author_rank: Regular Contributor
timestamp: August 26, 2024, 07:09:01 am
content: Quote from: Postal2 on July 31, 2024, 01:47:45 pmI ordered those MCUs and today I received 1pcs completely different IC... it was a scam.

author: Postal2
author_rank: Frequent Contributor
timestamp: August 26, 2024, 03:37:25 pm
content: I sometimes get the same, last time I got some small chip from a cell phone instead of AM3352. I got all 5 chips, I can take a photo. If you were the first to order - it would be the other way around. Check the price of the chip you received and return the difference.

author: gashtaan
author_rank: Regular Contributor
timestamp: August 27, 2024, 03:58:31 am
content: Quote from: Postal2 on August 26, 2024, 03:37:25 pmMaybe, to me the seller seems shady from the first sight. You got lucky. I received some DSP for CD players instead, useless. Anyway, AliExpress approves my request for full refund so I guess I got lucky too.

author: amyk
author_rank: Super Contributor
timestamp: August 27, 2024, 04:08:27 am
content: Here's another pinout for QFP80 adapter programming Hitachi/Renesas MCUs:https://www.mqp.com/ad633.htmLooking at the pinouts for all the adapters I could find, it seems /RES is always Vpp and TEST is pulled high if present, while other I/O port pins are used for the rest.It might be worth asking Renesas itself, since it clearly published this information for other MCUs in similar families around the same time, so the omission of this one could be accidental instead of deliberate.

author: gashtaan
author_rank: Regular Contributor
timestamp: August 27, 2024, 04:32:21 am
content: Quote from: amyk on August 27, 2024, 04:08:27 amI'm sure it's not accidental - Renesas began to delete this information from the datasheets after they acquired the Hitachi and they didn't publish such info on their later designs at all. Often I have to search for older revisions to get this info:

author: gashtaan
author_rank: Regular Contributor
timestamp: August 27, 2024, 04:44:13 am
content: Quote from: amyk on August 27, 2024, 04:08:27 amThanks. Yes, I know about that one. So far, I've found out socket mapping for 25 different MCUs and actually the H8/38024 is the closest one to H8/36049. Unfortunately some pins doesn't exist on H8/36049.VPP and TEST are not a problem, they are only known variables in this equation. For me, the problem are I/O pins that must be pulled high (PGM and some others).

author: amyk
author_rank: Super Contributor
timestamp: August 27, 2024, 05:24:02 am
content: There is a bit more (Russian) discussion here which may or may not be relevant:https://monitor.espec.ws/section7/topic88228p40.htmlI did a bit more digging and found mentions that this family actually doesn't map directly to any EEPROM but uses a protocol called "FZTAT64V5" or "FZTAT128V5" (probably depends on the capacity) - and from there found other Hitachi/Renesas CPUs that use this type, such as theH8S/2138 and H8S/2134whose hardware manual documents the full protocol. It appears to be a self-timed write (needs an oscillator connected) and notably does NOT use a high Vpp.

author: gashtaan
author_rank: Regular Contributor
timestamp: August 27, 2024, 05:41:45 am
content: Quote from: amyk on August 27, 2024, 05:24:02 amNot sure what are you referring to. The ICP protocol that is being handled be the software in boot ROM? Yes, this is well documented, but this is what I want to avoid. As I'm understand it, FZTATxVy is not a "protocol" it's type of flash that is supposedly stacked on main MCU die.I believe that also this family maps EEPROM directly to the pins, because manufacturer of one of programmers that supports programming this MCU claims they support direct access to the flash - but I'm not going to spend thousands € to buy programmer and the socket for it.

author: peter-h
author_rank: Super Contributor
timestamp: August 27, 2024, 10:42:49 am
content: I use the H8/323 and it emulates a 27C256 EPROM. Needs high VPP just like the EPROM.QuoteOf course they can. 64k external address space for code or data. But that's not the question here.Unfortunately I don't have the data books to hand but it should be in there and nowadays they are all online.

author: gashtaan
author_rank: Regular Contributor
timestamp: August 27, 2024, 11:32:29 am
content: Quote from: peter-h on August 27, 2024, 10:42:49 amWas Renesas still releasing H8 data books after they bought technology from Hitachi? I believe they stopped publishing those and such data is confidential, shared only to major programmers manufacturers.

author: amyk
author_rank: Super Contributor
timestamp: August 28, 2024, 02:07:19 pm
content: Quote from: gashtaan on August 27, 2024, 05:41:45 amI am saying that FZTATxV5 looks like a parallel EEPROM, but not any standard type I'm aware of - writing 40h followed by 128 bytes initiates a sector write, 20h 20h is chip erase, and 71h 71h enters status read mode.

author: gashtaan
author_rank: Regular Contributor
timestamp: August 28, 2024, 03:26:35 pm
content: Quote from: amyk on August 28, 2024, 02:07:19 pmOh, now I see what do you mean. I was mislead by that they also call ICP programming over UART in boot-mode as "F-ZTAT On-board programming".I was focused on H8/38024 which seems to be most alike to H8/36049. The term F-ZTAT is mentioned in its datasheet multiple times, but now I understand the PROM programmer mode details are related strictly to masked ROM versions and details about F-ZTAT are completely omitted there. It would indeed means that VPP is not needed but the MCU has to be externally clocked.

author: gashtaan
author_rank: Regular Contributor
timestamp: September 03, 2024, 03:45:50 pm
content: Quote from: Postal2 on July 31, 2024, 01:47:45 pmTried another seller. Just received the package - the IC is obviously fake, poorly printed marking on sanded surface

author: Postal2
author_rank: Frequent Contributor
timestamp: September 03, 2024, 06:59:24 pm
content: Sometimes I received chips with bad marking, and they worked. I received one with good marking AT91RM9200 - it didn't start. The Hitachis that I received absolutely exactly matched the product photo, I'm sure that they work. But now "the product doesn't exist", apparently you scared the seller with something.

author: gashtaan
author_rank: Regular Contributor
timestamp: September 03, 2024, 07:30:00 pm
content: Quote from: Postal2 on September 03, 2024, 06:59:24 pmThis has nothing to do with me, I noticed the product already did not exist when I received the package. Anyway, I got full refund from AliExpress. Will see how it'll end with my second attempt. I'll try it, although I highly doubt it's genuine.

author: Postal2
author_rank: Frequent Contributor
timestamp: September 03, 2024, 07:43:18 pm
content: Don't doubt it. I always get Motorola mcu with horrible markings, but the pin is just as easy to break off as the original.

author: peter-h
author_rank: Super Contributor
timestamp: September 04, 2024, 11:05:10 am
content: Not sure if any data books existed with "Renesas" on them. I never collected any.The H8/325 hardware book, page 202, has the EPROM pin connections. I built an adaptor for a Data I/O chiplab from that, many years ago. The info may enable you to work out the pins; I can scan to a PDF if you PM me your email address.