Every embedded developer has blinked a LED—this is both a rite of passage and a smoke test for bring-up of new hardware. Most often you do it in software. Sometimes you do it by connecting the LED directly to a peripheral. Have you ever blinked a LED using DMA? No loops. No use of the CPU after the initial configuration. No use of the timer PWM output, either. Just the DMA peripheral, unbothered,…
While working on reverse-engineering the Microchip ATF15xx CPLD family, I found myself deriving minimal logic functions from a truth table. This useful because while it is easy to sample all possible states of a black box combinatorial function using e.g. boundary scan , these truth tables are unwieldy and don’t provide much insight into the hardware. While a minimal function with the same truth…
While working on an application targeting Nordic nRF24LE1, a wireless SoC with a fairly slow 8051 core, I was wondering if I can have fast, or at least not unusably slow, cryptography. Most cryptographic algorithms involve wide rotates, and the 8051 only has instructions for rotating a 8-bit accumulator by one bit at a time. In this note I explore deriving optimal code for rotating values in…
While working with nRF24LU1+, I discovered that the chip has lots and lots of odd corners that are sparsely or strangely documented, where the silicon doesn’t match documentation, etc.
In this note I describe the on-air protocol of Pixel Pawn wireless flash trigger.
Recently, I’ve using an extremely cursed setup where my XPS 13 9360 laptop is connected to a Sonnet EchoExpress 2 box rewired for Thunderbolt 3 that has an nVidia Quadro 600 GPU, and Linux is set up for render offload to the eGPU and then frame transfer back to iGPU to be displayed on the laptop’s integrated display, which (to my sheer surprise) not only works quire reliably, but even gives me…
I have been asked to determine if a (pirate) Game Boy Advance cartridge with the PCB marked “SMC805-2 VER:1.5 2006.11.16” can be reflashed. The cartridge contains a battery, an ASIC in a chip-on-board package (epoxy blob), an unidentified Intel chip marked “RL0ZAA00” (possibly “RLOZAA00” or “RLOZAAOO”) “A5367952” “Z37LA59B” in a VFBGA-56 package, an ISSI (neé ICSI) static RAM IS62LV1024LL-55H in a…
I’ve been provided a Z144SN005 LCD that has split in halves as a result of excess mechanical force. Z144SN005 is a ST7735S-based LCD organized as 128RGB×128; it has 384 sources and 128 gates. I took some microphotographs of it using an Amscope ME300TZ-2L-3M metallurgical microscope. The following microphotographs of the front glass plate that contains color filters demonstrate the pixels lighting…
I took some microphotographs of a Nokia 3220 (RH-37) transflective LCD using an Amscope ME300TZ-2L-3M metallurgical microscope. These microphotographs were taken on an intact LCD, i.e. transmitted light images were acquired by shining a flashlight through the entire LCD stackup (the built-in diascopic light source is not powerful enough); the 90° reflected light images were acquired using the…
I took some microphotographs of a counterfeit Sony Xperia Z2 LCD display, bought on Taobao circa 2017, using an Amscope ME300TZ-2L-3M metallurgical microscope. (This display would not initialize with an unmodified firmware, and was factory-programmed to match the never used, due to a bug, DeviceTree display configuration present in the Xperia Z2 kernel image.) The combined light photo is not…