CodeWalrus

Development => Hardware => Topic started by: CVSoft on November 01, 2015, 10:38:42 AM

Title: Pasco Xplorer GLX Hardware
Post by: CVSoft on November 01, 2015, 10:38:42 AM
I took some highly detailed PCB pictures of the Pasco PS-2002 Xplorer GLX (http://imgur.com/a/81MHS). Pasco hasn't really published anything about its hardware so I do not have much to go off of (unlike Vernier, Pasco doesn't talk much about their hardware). I've worked out the following info:
I also wrote down the names of the ICs on the LCD and keyboard-audio PCBs:

LCD board:
IC1         Row driver: Sitronix ST8024F4 AOG659.1W8B1187703
IC2/IC3 Column drivers: Sitronix ST8016F3 AOM275.1 AS9500Q
IC4          EL Driver: ZSP4\403L [ZSP4403]

555-0894O-D Keyboard/Audio board:
U1            Microcontroller: (TI)96A2PKT G4\M430F147\REV N [TI MSP430F147]
U2            Serial FlashROM: 25P40VP
U3                           : BY42
U4           Audio Controller: AIC28I\TI 96W\Z13N G4
U5/U6                  Op-amp: BB OPA\2340UA\96JQD
U7                           : Not present
U8          Voltage Converter: [National Semiconductor logo]CHAB\LMC76\96JQD [LMC7660]
U9                           : PDP
U10                          : R2B
U11 Instrumentation Amplifier: AD623A\[Analog Devices logo]#0926\1654476


Should anyone be bored enough to try and reverse-engineer or hack this device, the above information should be helpful.
Title: Re: Pasco Xplorer GLX Hardware
Post by: novenary on November 01, 2015, 10:49:23 AM
Nice job on the pictures and the research. :)
Title: Re: Pasco Xplorer GLX Hardware
Post by: CVSoft on November 02, 2015, 05:45:18 AM
After some analysis of the firmware by @Adriweb and myself, we found that it is likely based on the Ubicom32 architecture, a proprietary architecture not related to ARM.
Title: Re: Pasco Xplorer GLX Hardware
Post by: Adriweb on November 02, 2015, 05:47:39 AM
At least that's what binwalk detected.
If that's it, reversing won't be easy (http://reverseengineering.stackexchange.com/a/2721), if that ever was the goal.
Title: Re: Pasco Xplorer GLX Hardware
Post by: CVSoft on November 02, 2015, 05:52:21 AM
With an Ubicom32 architecture, I would expect to see a Ubicom-branded chip somewhere in there though. I don't see anything that would indicate this. The architecture is an oddball.
Title: Re: Pasco Xplorer GLX Hardware
Post by: novenary on November 02, 2015, 09:12:52 AM
It's very likely that the CPU is hosted in the FPGA if there's no Ubicom or Qualcomm chip on the board.
Title: Re: Pasco Xplorer GLX Hardware
Post by: CVSoft on November 02, 2015, 09:19:21 AM
That's what I'm thinking, but hoping against. An FPGA-hosted CPU would be a nightmare for homebrewing. The firmware includes a raw binary for the FPGA, but I don't have any idea how to have ideas on interpreting that data. I also don't know how the FPGA would be able of self-updating its firmware (maybe the MSP430 can do this?).

I counted up the occurrence of each byte in the firmware, the PNGs are here (https://www.dropbox.com/s/fvcjhg6wtxc7mut/glx-graphs.7z?dl=1), and the CSV source files are here (https://www.dropbox.com/s/02pex69aavbs5gc/glx-rawdata.7z?dl=1).

I'm searching DataStudio for any references to the CPU. This will take a fair bit of time.
Title: Re: Pasco Xplorer GLX Hardware
Post by: novenary on November 02, 2015, 09:24:49 AM
Quote from: CVSoft on November 02, 2015, 09:19:21 AM
That's what I'm thinking, but hoping against. An FPGA-hosted CPU would be a nightmare for homebrewing. The firmware includes a raw binary for the FPGA, but I don't have any idea how to have ideas on interpreting that data. I also don't know how the FPGA would be able of self-updating its firmware (maybe the MSP430 can do this?).
FPGAs usually load their firmware from external flash when you power them up then they work entirely from the internal block RAM. Pretty simple to reflash the firmware from there, and as you said the msp430 can do it otherwise.

Also, reversing a bitstream is not easy, it's basically a massive truth table and the format changes for each device.
Title: Re: Pasco Xplorer GLX Hardware
Post by: CVSoft on November 05, 2015, 09:27:02 PM
After poking around in the firmware files, I've determined the OS was written in C++. Strings in the firmware are weird, they're stored with 32 bits per character. The OS uses Unicode, but the character map only shows a UTF-16 implementation. I still can't match up binary characteristics to any architecture I compared against, but the CPU is a 32-bit architecture.
Title: Re: Pasco Xplorer GLX Hardware
Post by: Adriweb on November 05, 2015, 09:32:55 PM
Quote from: CVSoft on November 05, 2015, 09:27:02 PMAfter poking around in the firmware files, I've determined the OS was written in C++.
Lies! I've told you that since the very beginning!

(however you made it much clearer after properly extracting stuff :P)
/me runs
Title: Re: Pasco Xplorer GLX Hardware
Post by: CVSoft on November 05, 2015, 09:39:58 PM
Quote from: Adriweb on November 05, 2015, 09:32:55 PM
Quote from: CVSoft on November 05, 2015, 09:27:02 PMAfter poking around in the firmware files, I've determined the OS was written in C++.
Lies! I've told you that since the very beginning!

The firmware, or the GLX Simulator which is a Windows executable?
Title: Re: Pasco Xplorer GLX Hardware
Post by: Adriweb on November 05, 2015, 09:49:14 PM
Firmware. I believe it was glx.bin, but I'm not 100% sure.
Title: Re: Pasco Xplorer GLX Hardware
Post by: CVSoft on November 06, 2015, 12:01:49 AM
Yup, that's firmware. The string tables I extracted from the simulator (it had some debug info about the GLX OS), the bin files are firmware updates extracted out of S-Record format.
Title: Re: Pasco Xplorer GLX Hardware
Post by: CVSoft on May 10, 2016, 12:08:43 PM
So after a bit of tomfoolery I found that the Nios II CPU architecture used with the Altera Cyclone FPGAs is a viable candidate for the GLX's instruction set. It would be easy to implement, uses a 32-bit word size, and supports compiled C/C++ code via GCC or something. Once I get time, I'll manually disassemble the first couple of bytes of the firmware and see if the content makes sense.
Title: Re: Pasco Xplorer GLX Hardware
Post by: Dream of Omnimaga on May 10, 2016, 06:57:48 PM
So you could get some games to run on this? :D
Title: Re: Pasco Xplorer GLX Hardware
Post by: CVSoft on July 21, 2016, 07:14:43 AM
If I figured out both the processor architecture and a method to load third-party (read: non-OS) code, then definitely. But that is beyond my skill levels and time allocations.
Title: Re: Pasco Xplorer GLX Hardware
Post by: steelethomas14 on January 14, 2019, 11:40:13 PM
Has anyone found a place to get cheap batteries that actually fit the xplorer? I want to use it with one of my physics classes but all 24 of my handhelds have dead batteries, and most 7.2 V packs seem to have either the 2-pin or 3-pin connector, these require a 4-pin and pasco charge $35 a pop for a new battery not counting shipping.