Probing a Lucent Voicemail Machine

[jeremyb]

I'm trying to retrieve a recording from an 1997-ish Lucent voice mail machine. I managed to find the JTAG interface pins but am having trouble dumping its memory. I can't halt the CPU or use GDB. I'm pretty sure my OpenOCD configuration or CPU is incorrect...

I used JTAGulator to locate the pins.
I'm using a J-Link + OpenOCD to connect to the JTAG interface.

This is the output I get:

Code:

Info : J-Link V11 compiled May 28 2024 15:36:02
Info : Hardware version: 11.00
Info : VTarget = 5.003 V
Info : clock speed 100 kHz
Info : JTAG tap: auto0.tap tap/device found: 0x164d303b (mfg: 0x01d (Lucent (AT&T)), part: 0x64d3, ver: 0x1)


I'm guessing that it's using ARM Thumb instructions because it outputs this with cpu arm720t

Code:

Info : Embedded ICE version 0
Error: unknown EmbeddedICE version (comms ctrl: 0x00000000)
Info : auto0.tap: hardware has 2 breakpoint/watchpoint units
Info : [auto0.tap] Examination succeed

Any suggestions?

[fzabkar]

Just curious. Is repair or chip-off not an option for this old device? Or are you just engaging in an intellectual exercise?

[okton]

"Error: unknown EmbeddedICE version (comms ctrl: 0x00000000)" this sounds like the debug interface is not responding. There could be no debug interface inside this chip (cheaper variant) or it is disable by fuses or configuration.
Why you are messinging with processor? If this device is manufactured in 1997 recordings are likely in external memory in simple format like PCM or delta-sigma. Can you share image of board? Is the processor marking visible?