Tuesday, 10 March 2015

HP Printer JTAG

Harvesting parts from a HP Officejet 6310 the other day I saw this:

Of course I couldn't leave something like that without at least attempting to find out what they were for! Luckily I hadn't yet destroyed any important bits so it went back together...

And typically, they didn't seem to do anything at all. Maybe because it had no cartridges? Well I certainly wasn't going to buy any, so I thought I'd take a ROM image and if I got bored enough some day I could have a poke around it. But then - I found a connector header covered over with soldermask. As a 2x19 with central ground pins I took a lucky guess at "Mictor 38" layout and got a JTAG connection.

VTarget = 2.691V
Info: TotalIRLen = 4, IRPrint = 0x01
Info: CP15.0.0: 0x41059461: ARM, Architecure 5TE
Info: CP15.0.1: 0x0F0D20D2: ICache: 4kB (4*32*32), DCache: 4kB (4*32*32)
Info: Cache type: Separate, Write-back, Format B
Found 1 JTAG device, Total IRLen = 4:
 #0 Id: 0x1594602B, IRLen: 04, IRPrint: 0x1, ARM946E-S Core
Found ARM with core Id 0x1594602B (ARM9)
  ETM V1.3: 4 pairs addr.comp, 2 data comp, 8 MM decs, 2 counters, sequencer
Target interface speed: 100 kHz

...and that's where my knowledge of JTAG debugging ends at the moment. The CPU is some kind of custom HP "top secret" NXP part that doesn't exist, which makes things a bit trickier. This probably isn't the best way to learn about JTAG either. Nevertheless, I'll just keep prodding it until something pops!

<-- "Door open"?! that's the least of your problems haha

No comments:

Post a Comment