Forum Discussion

DavidSmoot's avatar
DavidSmoot
Icon for New Contributor rankNew Contributor
8 months ago

Read flash attached to Max II in Parallel Flash Configuration on legacy system

I have a customer requesting that I reverse engineer the firmware on a legacy system so he can program some older blank stock for spares. No available source code. No available schematics. The ...
Programmable Logic Device
WZ2's avatar
WZ2
Icon for Frequent Contributor rankFrequent Contributor
8 months ago

Hi David,

Based on your description, I guess you want to read back the contents of the Micron Flash (28F128J3), right? From my point of view, this is quite difficult:

  1. The "Examine" function can be used to read back the MAX II internal program, that is, the contents of the MAX II cfm/ufm.
  2. The PFL IP itself does not have the ability to read back the contents of the flash; possibly the ASMI IP has this ability, but I’m not sure whether MAX II supports this IP.
  3. If it is purely about reading back the flash, the Micron manufacturer might be able to help you better. As far as I know, if you can connect to the flash pins, they can read back the contents of the flash using flash commands.
  4. However, even if you read back the image from the flash, it is, in my opinion, not feasible to reverse-engineer the .sof file from that image, so restoring the internal logic layout is not possible.

Best regards,

WZ


  • DavidSmoot's avatar
    DavidSmoot
    Icon for New Contributor rankNew Contributor
    8 months ago

    Thank you.

    Mostly agree with your conclusions but not what you think I am attempting.

    I don't care to reverse engineer the contents of the flash, I just want to be able to acquire them and place them on "blank" boards. I basically want to be able to take a working board and "clone" it to a blank board and have it behave exactly the same. To that end, I don't need to understand the flash contents, I just need to be able to duplicate them.

    Had conversation with FAE and he gave me an idea that should work if I can extract / acquire a pin map between CPLD and flash chip.

    1. Save off current CPLD image (done)
    2. Write a new CPLD program from scratch that allows me to read and write flash through the JTAG terminal.
    3. Dump contents of flash to PC
    4. Dump flash contents to blank board using same program.
    5. Write back the original CPLD image from step 1 on both board.

    That should work but I am currently stumped on a pin map. X-rayed the board but way to many layers and intersecting traces to get a pin map. In discussions with customer about cost / feasibility of pulling both CPLD and flash chips from a dead board and using a flying probe or manual labor to determine pin map.

    Any thoughts or criticisms on this approach?

    David