Alternatively, join us on Discord.

Pasco Xplorer GLX Hardware

Started by CVSoft, November 01, 2015, 10:38:42 am

Previous topic - Next topic

0 Members and 1 Guest are viewing this topic.

CVSoft

November 01, 2015, 10:38:42 am Last Edit: November 01, 2015, 11:02:29 am by CVSoft
I took some highly detailed PCB pictures of the Pasco PS-2002 Xplorer GLX. Pasco hasn't really published anything about its hardware so I do not have much to go off of (unlike Vernier, Pasco doesn't talk much about their hardware). I've worked out the following info:
  • The CPU is clocked at 50 MHz. I don't even know which IC the CPU is, and I don't know what type of CPU it has; Pasco calls it a "floating point CPU." I hope it isn't in the FPGA.
  • There's a FPGA in there, and it makes the most heat. It's an Altera Cyclone EP1C12F256C8N.
  • 8 MB FlashROM
  • There's a bunch of RAM chips. One of them is a 32 KB SRAM, and somewhere the system has a 16-ish MB RAM chip (11 MB available to the user). It could be the BGA IC below the FPGA, I haven't worked out its identity.
  • The system uses six NiCad/NiMH batteries in series to receive 7.2V. The system expects those batteries to be present, as there are numerous warnings to not connect the system to power without batteries installed.
  • There's a TI MSP430F147 in there, I think it is used to decode PasPORT data but I'm not sure. It has its own 512KB FlashROM.
  • The LCD is not made by Pasco. It uses a Powertip PG320240H-P2 LCD module glued to the front housing.
  • A TI AIC28I handles audio I/O. The GLX has a microphone, speaker, and speaker-out port.


I also wrote down the names of the ICs on the LCD and keyboard-audio PCBs:

LCD board:
IC1         Row driver: Sitronix ST8024F4 AOG659.1W8B1187703
IC2/IC3 Column drivers: Sitronix ST8016F3 AOM275.1 AS9500Q
IC4          EL Driver: ZSP4\403L [ZSP4403]

555-0894O-D Keyboard/Audio board:
U1            Microcontroller: (TI)96A2PKT G4\M430F147\REV N [TI MSP430F147]
U2            Serial FlashROM: 25P40VP
U3                           : BY42
U4           Audio Controller: AIC28I\TI 96W\Z13N G4
U5/U6                  Op-amp: BB OPA\2340UA\96JQD
U7                           : Not present
U8          Voltage Converter: [National Semiconductor logo]CHAB\LMC76\96JQD [LMC7660]
U9                           : PDP
U10                          : R2B
U11 Instrumentation Amplifier: AD623A\[Analog Devices logo]#0926\1654476


Should anyone be bored enough to try and reverse-engineer or hack this device, the above information should be helpful.

Streetwalrus

Nice job on the pictures and the research. :)

CVSoft

After some analysis of the firmware by @Adriweb and myself, we found that it is likely based on the Ubicom32 architecture, a proprietary architecture not related to ARM.

Adriweb

At least that's what binwalk detected.
If that's it, reversing won't be easy, if that ever was the goal.
Co-founder & co-administrator of TI-Planet and Inspired-Lua

CVSoft

With an Ubicom32 architecture, I would expect to see a Ubicom-branded chip somewhere in there though. I don't see anything that would indicate this. The architecture is an oddball.

Streetwalrus

It's very likely that the CPU is hosted in the FPGA if there's no Ubicom or Qualcomm chip on the board.

CVSoft

That's what I'm thinking, but hoping against. An FPGA-hosted CPU would be a nightmare for homebrewing. The firmware includes a raw binary for the FPGA, but I don't have any idea how to have ideas on interpreting that data. I also don't know how the FPGA would be able of self-updating its firmware (maybe the MSP430 can do this?).

I counted up the occurrence of each byte in the firmware, the PNGs are here, and the CSV source files are here.

I'm searching DataStudio for any references to the CPU. This will take a fair bit of time.

Streetwalrus

November 02, 2015, 09:24:49 am #7 Last Edit: November 02, 2015, 09:26:42 am by Streetwalrus
Quote from: CVSoft on November 02, 2015, 09:19:21 am
That's what I'm thinking, but hoping against. An FPGA-hosted CPU would be a nightmare for homebrewing. The firmware includes a raw binary for the FPGA, but I don't have any idea how to have ideas on interpreting that data. I also don't know how the FPGA would be able of self-updating its firmware (maybe the MSP430 can do this?).

FPGAs usually load their firmware from external flash when you power them up then they work entirely from the internal block RAM. Pretty simple to reflash the firmware from there, and as you said the msp430 can do it otherwise.

Also, reversing a bitstream is not easy, it's basically a massive truth table and the format changes for each device.

CVSoft

After poking around in the firmware files, I've determined the OS was written in C++. Strings in the firmware are weird, they're stored with 32 bits per character. The OS uses Unicode, but the character map only shows a UTF-16 implementation. I still can't match up binary characteristics to any architecture I compared against, but the CPU is a 32-bit architecture.

Adriweb

Quote from: CVSoft on November 05, 2015, 09:27:02 pmAfter poking around in the firmware files, I've determined the OS was written in C++.

Lies! I've told you that since the very beginning!

(however you made it much clearer after properly extracting stuff :P)
* Adriweb runs
Co-founder & co-administrator of TI-Planet and Inspired-Lua

CVSoft

Quote from: Adriweb on November 05, 2015, 09:32:55 pm
Quote from: CVSoft on November 05, 2015, 09:27:02 pmAfter poking around in the firmware files, I've determined the OS was written in C++.

Lies! I've told you that since the very beginning!


The firmware, or the GLX Simulator which is a Windows executable?

Adriweb

November 05, 2015, 09:49:14 pm #11 Last Edit: November 05, 2015, 09:50:51 pm by Adriweb
Firmware. I believe it was glx.bin, but I'm not 100% sure.
Co-founder & co-administrator of TI-Planet and Inspired-Lua

CVSoft

Yup, that's firmware. The string tables I extracted from the simulator (it had some debug info about the GLX OS), the bin files are firmware updates extracted out of S-Record format.

CVSoft

So after a bit of tomfoolery I found that the Nios II CPU architecture used with the Altera Cyclone FPGAs is a viable candidate for the GLX's instruction set. It would be easy to implement, uses a 32-bit word size, and supports compiled C/C++ code via GCC or something. Once I get time, I'll manually disassemble the first couple of bytes of the firmware and see if the content makes sense.

DJ Omnimaga

So you could get some games to run on this? :D

Powered by EzPortal