Hacking a Test Equipment: best way to read and modify an EEPROM - Page 1
Forum section: electronics / projects

author: Bicurico
author_rank: Super Contributor
timestamp: November 12, 2017, 06:45:02 pm
content: Hi,I am trying to hack a TV field meter (another one). This particular model comes in three flavours: Light, Standard and Premium.I have the Standard version, but would like to have the Premium mode, which offers a few extra functions.What I know so far:The model type (Light, Standard or Premium), as well as serial number, OEM version and calibration date (and possibly calibration data) are stored in a ST M24C64W SOC serial eeprom.If I short two pins (don't remember which ones, but I think it was the RESET pin), the field meter starts without serial number and in Light mode.So my idea is to read out the contents of said eeprom and change the relevant bytes to get the Premium model.For this I hooked up a SOC clamp to the eeprom, connected to my Genius G540 universal programmer. I tested the programmer and clamp on the SOC eeproms of memory DIMM's and could read/write them.On the field meter, however, all I get is FF, meaning I am not reading out anything. I noticed that during the reading, the power LED of the field meter turns on. This means that probably Vcc of the eeprom is connected to a lot of other stuff and my programmer simply cannot provied enough power to turn on the eeprom.I tried to read out the eeprom with the device turned on, but again it was a fail, possibly because the eeprom was already driven by the device (clock cycles, etc.).This means, my last resort would be to extract (de-solder) the eeprom from the PCB. I don't want to do that for the folloing reasons:1) I don't have ANY backup of its contents and if I break the eeprom in the process, I end up with the Light version - which would be not good at all!2) Even if I extract the eeprom's content successfully, I wouldn't know what to edit in its contents. Trial and error would come in and this could mean soldering and de-soldering the eeprom many times - not healthy for either eeprom or PCBSo here I am asking for your ideas.I have a DS1054Z (hacked, of course), as well as, the cloned USB logic analyzer. I was wondering if/how using them to log the communication of the eeprom would give me some insight, before trying to de-solder the eeprom. Does that make any sense?Any other tips or suggestions?Disclaimer:- I will not reveal the brand/model of the field meter in this thread- The "hack" is just for my own amusement - in reality it doesn't matter if I have the Standard or Premium version, as I own other field meter which have all functions anywayRegards,Vitor

author: frozenfrogz
author_rank: Frequent Contributor
timestamp: November 12, 2017, 06:58:19 pm
content: Maybe you could just cut the VCC line somewhere near the EEPROM. If there is a resistor in-line just unsolder it. Optionally you might have to physically cut a trace and solder in a jumper afterwards.

author: Bicurico
author_rank: Super Contributor
timestamp: November 13, 2017, 08:53:57 am
content: Hi,Yesm I have thought about this one. What prevents me to go this route is the fact that the device has a +5.000 Euro pricetag and I don't want to go cutting traces on the PCB. De-soldering miniscule SMD resistors has a similar problem: once de-soldered, they have a tendency to simply vanish!I was thinking more in the line of using the clamp, but connecting the lines to a logic analyzer or the DS1054Z and somehow monitor the communication between CPU and eeprom.Regards,Vitor

author: Rerouter
author_rank: Super Contributor
timestamp: November 13, 2017, 09:23:48 am
content: I would recommend logging the I2C pins, this will reduce your search space to only the data it pulls when it wakes up and initialises (probably only 10s of locations)From there, you can ground the micros reset pin, this will leave the micro powered. and the pins pulled up as inputs, and use your own microcontroller or similar to try getting an ack from the EEPROM, with that working, you can now read out the contents,Next check that the write protect pin is not hard wired, if it is, well thats a pain, if its wired to a now input pin or left open your good to try a write,from there, you have a reduced search space, and can try setting each byte in sequence to 00, and then booting the device, equivalently the same as shorting out the I2C pins.Been modifying stored data in equipment for the last 3 years this way.

author: stj
author_rank: Super Contributor
timestamp: November 13, 2017, 04:45:07 pm
content: just the usual problem, the i2c bus is in use.and the usual solution - put the microcontroller into reset or short it's crystal.

author: Bicurico
author_rank: Super Contributor
timestamp: November 13, 2017, 04:51:04 pm
content: Hi,Thanks for the valuable information.I have to learn more about I2C, as I don't really know anything about this protocol (this is the main reason I want to try and do the hack - one learns so much trying).What I did not understand: if I short the RESET pin (to GND), how should that enable me to read the EEPROM? Should I short the pin only while booting the device (EEPROM does not get "locked" to the microcontroller) and then afterwards I connect with my programmer?What is the best way to monitor the I2C pins? Just connecting them to relevant pins on the USB logic analyzer? Is there anything to pay attention to? Never used it...Regards,Vitor

author: Mjolinor
author_rank: Frequent Contributor
timestamp: November 13, 2017, 05:10:07 pm
content: With an I2C interrogator you should be able to read it passively while it is running normally, decoding all the I2C traffic.I don't know anyone that has done it but it should give you all the parts that are used in normal operation eventually.Now there's a worthwhile project in its own right.

author: Bicurico
author_rank: Super Contributor
timestamp: November 13, 2017, 05:15:48 pm
content: Can you please elaborate on the "I2C interrogator"?Again guys, please apologize my ignorance, but I am really into learning by hacking, as the result can be very awarding!As an example, I recently "hacked" another different field meter. In this case, to update to the lastest firmware, the ordinary customer has to purchase a license key. This needs to be entered in the firmware uploader. Well, what I did was to just extract the flash memory IC and programmed it externally. Sounds easy, but of course I had to:a) figure out which one was the relevant flash IC (the device had two)b) extract the originally programmed firmware from the existing flashc) HEX edit the bootloader from it and paste it to the new firmware filed) flash a new flash IC (to keep the original one intact)In the end it worked, so now I know they "forgot" to encrypt the firmware file...Regards,Vitor

author: Mjolinor
author_rank: Frequent Contributor
timestamp: November 13, 2017, 05:20:21 pm
content: The I2C protocol is very specific so every read of the EE is identifiable in the traffic that is happening between the components of the device when it is operating normally.If you catch all the I2C traffic then filter it, removing the address packets that are to the device you need then filter for the reads and get the address of that read then the data returned is what is stored in that location.I think that the logic sniffer (and lots of other things) will catch I2C but what it has in terms of filtering is unknown to me.I am sure it can be done, whether it is more work than removing it is another thing entirely.

author: Bicurico
author_rank: Super Contributor
timestamp: November 13, 2017, 05:23:58 pm
content: Oh, now I understand what you meant.I thought that the "I2C interrogator" was an existing product (software and/or hardware)...I will be busy with work this week, so my plan is to educate myself on I2C and when possible use my clamp and connect the relevant I2C pins to the logic analyzer. Hopefully I should see bytes moving in and out...

author: Mjolinor
author_rank: Frequent Contributor
timestamp: November 13, 2017, 05:27:01 pm
content: Go and look at the "logic sniffer" and the "bus pirate". They may do it or maybe someone more familiar than I can tell you yes or no.

author: helius
author_rank: Super Contributor
timestamp: November 13, 2017, 05:51:07 pm
content: The best way to read and modify it is to remove it. You cannot apply power and data to a single device on a board when it is interconnected with other devices using the same pins. The in-circuit stuff only works with dedicated pins that are designed to be programmed in-circuit.

author: Rerouter
author_rank: Super Contributor
timestamp: November 14, 2017, 01:22:21 am
content: Quote from: Bicurico on November 13, 2017, 04:51:04 pmNormally with the microcontroller awake it may decide to try and talk to the eeprom at any old time, and it is likely not programmed expecting collision detection, so it would corrupt what ever read or write you where in the process of doingjust about every microcontroller out there, when held in reset will have all of its pins configured as inputs with a ~10-100K pullup, while in this state you can talk to the eeprom just by grounding SCL and SDA to communicate as the micro is still providing a lift up. allowing you to hijack communications.QuoteI generally pull out my older model saleae 8 channel usb logic analyser, but the cheap clones still work fine. I would say connect ground, 1 channel to SDA, 1 to SCL, and to begin with another to the reset pin, when the device wakes up you will see this pin go high, and gives you a starting reference pointmost logic analysers will have an I2C decoder, this will tell you the Address and commands sent to the chip and data returned from it, the chips ID is fixed, so you if the I2C bus is connected to other things you only need to worry about communications to that ID.For the actual data it is reading, the host microcontrollers datasheet will spell it all out, but the short form is the host will send the ID of what it wants to talk to, the last bit of the ID generally is the Read / write bit, then it will send an address in the eeprom, and if its a write will send the data, or if its a read, the eeprom will reply with the data.