I am also JTAGGING an PM851 now since it's firmware maybe affected by a pretty resistant rootkit.
The MEX-script did not work with latest OpenOCD (I am using a Raspberry PI as the interface).
debugging it works nice after changing the script to
Code:
source [find interface/raspberrypi-native.cfg]
transport select jtag
adapter_khz 100
reset_config none
# enable tcl_port of course when using the scripts
# currently just connected using telnet
tcl_port disabled
#jtag newtap auto0 tap -irlen 1 -expected-id 0x25966f0f
jtag newtap auto0 tap -irlen 4 -expected-id 0x4ba00477
dap create mydap -chain-position auto0.tap
target create mex1 cortex_r4 -dap mydap -coreid 0
target create mex2 cortex_r4 -dap mydap -coreid 1 -dbgbase 0x80002000
target create mex3 cortex_r4 -dap mydap -coreid 2 -dbgbase 0x80003000
init
targets
halt
transport select jtag
adapter_khz 100
reset_config none
# enable tcl_port of course when using the scripts
# currently just connected using telnet
tcl_port disabled
#jtag newtap auto0 tap -irlen 1 -expected-id 0x25966f0f
jtag newtap auto0 tap -irlen 4 -expected-id 0x4ba00477
dap create mydap -chain-position auto0.tap
target create mex1 cortex_r4 -dap mydap -coreid 0
target create mex2 cortex_r4 -dap mydap -coreid 1 -dbgbase 0x80002000
target create mex3 cortex_r4 -dap mydap -coreid 2 -dbgbase 0x80003000
init
targets
halt
btw the connector is 4-Pin JTAG only. There is NO sRST or tRST available
Looks like it uses other memory regions. I cannot dump 0x8A0000 for example but having lot other readable regions.
I will check the dumps now and try to find the proper regions.
Would be nice to have a genuine firmware image for PM851
| Attachments: |
|
IMG_20181128_153128_resize.jpg [ 141.33 KiB | Viewed 13512 times ] |
