P
C++?
Size: a a a
2020 December 25
S
are you sure that firmware into eeprom, not into bt chip?
i'm not sure. I only know there is an eeprom and it's used to store something. Maybe just user configuration is stored in the eeprom.
L
i got a cheap BT mouse that goes to sleep after 10 minutes of inactivity. I have to use a button to wake it. It takes 2 or 3 seconds till the mouse reconnect and responds to the moves. Thats anoying. It has a CYW20730 BT chip (which was a BCM20730 before) and a 24C128 TSSOP EEPROM. Is there a chance to change or disable the deepsleep behavior? I grabbed a 16k eeprom dump and inspect it with ghidra. But because it's thumb code it's hard so find something. I can see BT link key but no information about power management.
well, it's just how BT works (it needs to establish connection after waking up), and without deepsleep it would drain the battery if you leave it on. i'm also afraid that putting a lot of effort into reverse engineering the firmware of a cheap mouse wouldn't worth it when you can buy non-BT mouse which comes with a dongle that doesn't have such problems.
AK
seems firware stored into 320k rom
L
except if BT is a must for your usecase
L
lovely scope captures, though
S
well, it's just how BT works (it needs to establish connection after waking up), and without deepsleep it would drain the battery if you leave it on. i'm also afraid that putting a lot of effort into reverse engineering the firmware of a cheap mouse wouldn't worth it when you can buy non-BT mouse which comes with a dongle that doesn't have such problems.
i have some other mice that doesn't behave like that. My microsoft modern mouse needs just a small push to wake and reconnect. I think it uses another power state. Not deepsleep with controller turned off. I just want to try if it'S possible to change this. Sadly there is no firmware file for this cheap ANEwish mouse.
S
lovely scope captures, though
it's not a scope, it's from Keithley DMM6500
S
ok, so i could try to grab the firmware from CYW20730 ROM with the segger or simply by using UART.
S
except if BT is a must for your usecase
i don't like to use a wired mouse on my laptop
A
они дешевые?
Относительно.
Но вроде пока не дорожали.
Но вроде пока не дорожали.
S
any idea how to connect j-link to a CYW20730/BCM20730? It's a cortex-m3 with bluetooth. I connected jlink-CYW20730 like 1-VTref to 28-VDDO, 15-Reset to 18-RST_N, 7-SWDIO to 15-SDA, 9-SWCLK to 16-SCL and 4-GND to GND. But j-link can't connect to target.
S
A
MCU must be protected (similar with ROP mode in STM32 which completely removes the access to JTAG)
MS
any idea how to connect j-link to a CYW20730/BCM20730? It's a cortex-m3 with bluetooth. I connected jlink-CYW20730 like 1-VTref to 28-VDDO, 15-Reset to 18-RST_N, 7-SWDIO to 15-SDA, 9-SWCLK to 16-SCL and 4-GND to GND. But j-link can't connect to target.
Check jtag pins. SDA and SCL are spi, not jtag.
It seems using an uart for firmware.
And firmware may be locked (90%).
It seems using an uart for firmware.
And firmware may be locked (90%).
L
any idea how to connect j-link to a CYW20730/BCM20730? It's a cortex-m3 with bluetooth. I connected jlink-CYW20730 like 1-VTref to 28-VDDO, 15-Reset to 18-RST_N, 7-SWDIO to 15-SDA, 9-SWCLK to 16-SCL and 4-GND to GND. But j-link can't connect to target.
jtag could be disabled by vendor
ED
By the way, the firmware is most probably locked indeed.
T
any idea how to connect j-link to a CYW20730/BCM20730? It's a cortex-m3 with bluetooth. I connected jlink-CYW20730 like 1-VTref to 28-VDDO, 15-Reset to 18-RST_N, 7-SWDIO to 15-SDA, 9-SWCLK to 16-SCL and 4-GND to GND. But j-link can't connect to target.
SDA and SCL are I2C signals, what makes you think they can do SWD?
L
are there any testpoints on the board? they should have some way to flash the damn thing at the factory