Break IC, Recover MCU, Microcontroller Reverse Engineering

Posts Tagged ‘копирам mcu flash’

We can Break IC MB90F598 Firmware, please view the IC MB90F598 features below for your reference:

The MB90595/595G series with FULL-CAN*1 interface and FLASH ROM is especially designed for automotive and industrial applications. Its main features are two on board CAN Interfaces, which conform to V2.0 Part A and Part B, while supporting a very flexible message buffer scheme and so offering more functions than a normal full CAN approach when Attack IC.

The instruction set of F2MC-16LX CPU core inherits an AT architecture of the F2MC*2 family with additional instruction sets for high-level languages, extended addressing mode, enhanced multiplication/division instructions, and enhanced bit manipulation instructions. The microcontroller has a 32-bit accumulator for processing long word data after Attack IC.

The MB90595/595G series has peripheral resources of 8/10-bit A/D converters, UART (SCI), extended I/O serial interface, 8/16-bit PPG timer, I/O timer (input capture (ICU), output compare (OCU)) and stepping motor controller if Attack IC.

*1: Controller Area Network (CAN) – License of Robert Bosch GmbH

*2: F2MC stands for FUJITSU Flexible Microcontroller.

Clock

Embedded PLL clock multiplication circuit

Operating clock (PLL clock) can be selected from divided-by-2 of oscillation or one to four times the oscillation (at oscillation of 4 MHz, 4 MHz to 16 MHz) before Attack IC.

Minimum instruction execution time: 62.5 ns (operation at oscillation of 4 MHz, four times the oscillation clock, VCC of 5.0 V)

Instruction set to optimize controller applications

Rich data types (bit, byte, word, long word)

Rich addressing mode (23 types)

Enhanced signed multiplication/division instruction and RETI instruction functions after Attack IC

Enhanced precision calculation realized by the 32-bit accumulator

· Instruction set designed for high level language (C language) and multi-task operations

Adoption of system stack pointer

Enhanced pointer indirect instructions

Barrel shift instructions

· Program patch function (for two address pointers)

· Enhanced execution speed: 4-byte instruction queue

· Enhanced interrupt function: 8 levels, 34 factors when Attack IC

· Automatic data transmission function independent of CPU operation

Extended intelligent I/O service function (EI2OS): Up to 10 channels

· Embedded ROM size and types

Mask ROM: 128 Kbytes

Flash ROM: 128 Kbytes

Embedded RAM size: 4 Kbytes (MB90V595/595G : 6 Kbytes)

· Flash ROM

Supports automatic programming, Embedded Algorithm TM*

Write/Erase/Erase-Suspend/Resume commands after Attack IC

A flag indicating completion of the algorithm

Hard-wired reset vector available in order to point to a fixed boot sector

Erase can be performed on each block

Block protection with external programming voltage

· Low-power consumption (stand-by) mode

Sleep mode (mode in which CPU operating clock is stopped)

Stop mode (mode in which oscillation is stopped)

CPU intermittent operation mode

Hardware stand-by mode

· Process: 0.5 µm CMOS technology

· I/O port

General-purpose I/O ports: 78 ports

Push-pull output and Schmitt trigger input.

Programmable on each bit as I/O or signal for peripherals for Attack IC.

· Timer

Watchdog timer: 1 channel

8/16-bit PPG timer: 8/16-bit × 6 channels

16-bit re-load timer: 2 channels

· 16-bit I/O timer

Input capture: 4 channels

Output compare: 4 channels

· Extended I/O serial interface: 1 channel

· UART0

With full-duplex double buffer (8-bit length)

Clock asynchronized or clock synchronized (with start/stop bit) transmission can be selectively used.

UART1 (SCI)

With full-duplex double buffer (8-bit length)

Clock asynchronized or clock synchronized serial transmission (I/O extended transmission) can be selectively used if Attack IC.

· Stepping motor controller (4 channels)

· External interrupt circuit (8 channels)

A module for starting an extended intelligent I/O service (EI2OS) and generating an external interrupt which is triggered by an external input.

· Delayed interrupt generation module: Generates an interrupt request for switching tasks.

· 8/10-bit A/D converter (8 channels)

8/10-bit resolution can be selectively used.

Starting by an external trigger input.

· FULL-CAN interface: 1 channel

Conforming to Version 2.0 Part A and Part B

Flexible message buffering (mailbox and FIFO buffering can be mixed) after Attack IC

· 18-bit Time-base counter

· External bus interface: Maximum address space 16 Mbytes

*: Embedded Algorithm is a trademark of Advanced Micro Devices Inc.