Marvell 88i6745n JTAG

[_dex_]

Dejan,

I guess by looking @ your post here about this issue you are familiar with the SoftICE right?

really interesting post

I don't know that SoftICE can debugg ARM cores?
You can use any JTAG ARM Debugger, WinARM, Ti CCS, NoICE, KEIL, etc,etc...

Dejan,

After Squeezing my Memory for a very long time, I REMEMBER NOW
but seems YOU FORGOT REALLY

We Have done some Biz. long time back, and i mean here long (more than 6-7y)
Am looking @ my old Archived MailBox (hope i can find it) and will extract some discussions info. from there which we had long time back by emails and will get back to you here and PM once i find it

Really, NICE TO SEE YOU HERE AGAIN, As they said: Life Circulate.

???
I'm not sure that I discussed on this forum before.

[einstein9]

Dejan,

I guess by looking @ your post here about this issue you are familiar with the SoftICE right?

really interesting post

I don't know that SoftICE can debugg ARM cores?
You can use any JTAG ARM Debugger, WinARM, Ti CCS, NoICE, KEIL, etc,etc...

Dejan,

After Squeezing my Memory for a very long time, I REMEMBER NOW
but seems YOU FORGOT REALLY

We Have done some Biz. long time back, and i mean here long (more than 6-7y)
Am looking @ my old Archived MailBox (hope i can find it) and will extract some discussions info. from there which we had long time back by emails and will get back to you here and PM once i find it

Really, NICE TO SEE YOU HERE AGAIN, As they said: Life Circulate.

???
I'm not sure that I discussed on this forum before.

Am not talking about this subject, it was something else
i dono really where i kept my Portable OLD mailbox but will find it

and if am not mistaking here, we were discussing the SIM cards structure @ that time or something similar

[bigman4hacking]

Hello,

Is there anyone who have pinouts of 88i6745n JTAG?
or PASS for RAR file: http://www.griol.com/ftp/WD/88I6745.rar ?
or a way to rewrite broken ROM in 88i6745n ?
or a way to boot from external U12 EEPROM 24p10, 24p20 ?

B.R.
Dex

did you find the solution for this problem
a way to rewrite broken ROM in 88i6745n
a way to boot from external U12 EEPROM
i have read your post it is helpfull
but send me if you solve it
and i will try to find a solution for this problem

[zzb]

It seems that nobody wants to help me, so I've find JTAG pins by my self!
Hope that somebody will be interested.

JTAG pins are on board CON1 and it seems that is same on all boards?!!
I tested on 2061-701335-c00 Marvell 88i6545 and 2061-701499-e00 Marvell 88i6745n.
Both chips have same ID 0x259663d3 !!!

Here is connection to 2061-701499-e00.



And closeup connection to JTAG test points.



And closeup connection to JTAG CON1.




B.R.
Dejan

Very fascinating. You should really get a job in HDD/SSD company...

Zvonimir

[fzabkar]

Very fascinating. You should really get a job in HDD/SSD company...

He should be teaching DR. In the 4 years that I've been watching this group I have yet to see anyone who even comes close to his skill set.

[ici_lemmy]

He should be teaching DR. In the 4 years that I've been watching this group I have yet to see anyone who even comes close to his skill set.

He sould be teaching. PERIOD

[HaQue]

It is a pity the pictures don't work anymore. Very interesting stuff.

For those that like to JTAG ... there is a tool created by Joe Grand of Grand Idea Studio http://www.grandideastudio.com/portfolio/jtagulator/ called the JTAGulator. http://www.parallax.com/product/32115

It is distributed by Parallax

JTAGulator is an open source hardware tool that assists in identifying OCD connections from test points, vias, or component pads on a target device.

Linkies:

http://threatpost.com/joe-grand-on-hardware-hacking-and-the-jtagulator
and google.

This tool is supposed to figure out where the JTAG connections are, and what they are. Im buying one as soon as I can - IF and when they ever get any in stock, dammnit.

[Doomer]

In the 4 years that I've been watching this group I have yet to see anyone who even comes close to his skill set.

Some people do not seek public attention
Although that guy is definitely good, I assure you, he is not unique. I personally know several guys who are very good in RE and they also do DR professionally

[tyrdonar]

In the 4 years that I've been watching this group I have yet to see anyone who even comes close to his skill set.

Some people do not seek public attention
Although that guy is definitely good, I assure you, he is not unique. I personally know several guys who are very good in RE and they also do DR professionally

This is true, but I can say from my experience working with big box data recovery companies, the willingness to do this kind of research is pretty rare. 2 thumbs up for anyone who does.

[zzb]

Well - I really wanted to contact Dejan, and see if he is interested in a job. If You guys think
you know some comparable engineer-hackers, let them contact me. I am hiring for very good jobs - SSDs and non-volat. memories.

[Benko]

Old, but still great topic. Again, one of Dejans quick 'masterpieces'. After having read the thread I'm positive this is GSM Dejan, the guy responsible for cracking Nokias DCT and BB5 devices breaking their sim locks, must have been in 1998 or something. He was selling the first GSM Nokia flasher at the time and was the driving innovation machine of the scene. Probably until these chinese copycats spoiled his business, there were tons of reversed copies soon and much trouble, envy and sh*t in that scene.
Funny to see him posting here 'cause his HDD was corrupt
So, if I'm not mistaken he probably did have the best job offers in the industrie. I learnt most of my GSM knowledge then through his work, basically the base of my business up to today. If you read this, Dejan: it's time for a big thanks.

[Haltec]

To je taj Dejan. Ne brini.

[WhitePP]

Hi _dex_, you work of this JTAG debugging on the hard drive is excellent and wonderful! I have a hard drive(WD5000AAKX-083CA1,PCB 2060-771640-003, Marvel 88i9045 ). I can't find CON1 on this PCB. Can you tell me how to find the JTAG-interface on the PCB? Thanks for your reply and help.Here is my PCB.
http://img01.taobaocdn.com/bao/uploaded ... 185752.jpg

[Haltec]

http://events.ccc.de/congress/2009/Fahr ... 5_JTAG.pdf

http://forum.gsmhosting.com/vbb/f672/jt ... 0-1661635/

https://www.youtube.com/watch?v=CBThd8nBKQ8




Haltec

[Haltec]

Rest in peace Dejan. (_dex_)





Haltec

Attachments

[Kamen]

Rest in peace

[Mikippp]

Rest in peace

[labtech]

His post and work will live forever. God bless.

[HaQue]

"Tiny Console" is activated!
Connect resistor 4k7 to P1 test point (+3.3v) and E6 test point.

So you made "5" (or maybe it was 0x1C00A84E)
If you make it "3" you'll get X-Modem
Great work

I am looking at some similar stuff, but on SSD. I believe the great Dex isn't with us anymore, which is sad.
I wonder if anyone can tell me... how does one come to the conclusion that a 4k7 resistor would need to be across there?

Is it some kind of knowledge of other systems that this is the case?
a guess?
something points to it in the firmware disassembly?
access to a manual?
access to inside info or another hacker?

I can fully se someone figuring out the JTAG pads, but this seems like not something that is accidently happened apon.

[NuttyProfessor]

Post clear image(s) of the SSD board.