5110 DSP ROM v4

[AlexD]

In attach full DSP ROM

[hanzelko]

Hi

How did you read the DSP ROM program area when it is protected?

[AlexD]

There is a security hole.

[wumpus]

How is it normally protected?

[AlexD]

Originally posted by wumpus
How is it normally protected?
TI writes in datasheet:
Emulator cannot run.
Instructions from on-chip ROM can read data from on-chip ROM.
Instructions from on-chip RAM or external program cannot read data from on-chip ROM and will read FFFFh.

[wumpus]

Cool, and you managed to rip it anyway :)

They state that in what datasheet? Which chip is so alike the MAD but has a datasheet around?

[AlexD]

It's a common datasheet for all c54x family.
TMS320C54x DSP Reference Set, Volume 1, p3-30.

[capotixplus]

What software are you using for reading DSP ?

It could be possible with "studio" from TI ?

Or with modified knok ?

Thanks, i'm trying to do the same with 3320 (TDMA)

[wumpus]

I think he used his ICE (In Circuit Debugger) to read the memory ranges, not sure though, he found a security hole in the DSP ROM protection.
No modified KNOK could do it though. It is not flashable or even in the MCU memory range.

AlexD:Any change you can get the DSP ROM6 dump?

[AlexD]

ICE is useless in reading ROM, it simply doesn't work with DSP.
So Code Composer Studio is useless too.

[wumpus]

I *think* I know which security hole.. hmm... takes a lot of poking and jumping around in DSP rom, that's for sure.

[tudor]

The listed ROM4 is gone... does anybody still have it?

[mestrini]

try this site (don't know if it's ROM4 though)

http://www.geocities.com/nok5rev/

just scroll down and you'll see the link to donwload ;)

[tudor]

AlexD took the ROM out of the DSP. It is not in the phone firmware. Maybe somebody still has that file.
On the link you gave me it's a normal 5110 flash file.

[tudor]

AlexD gave me this:

Hope it will help you too :)