Category: Pager

Using AVRDUDE with USBASP to flash firmware on Arduino Atmega328P chip

This is the command that I used to program Atmega328P with a firmware to hack Motorola Advisor firmware:

$ avrdude -C /etc/avrdude.conf -c usbasp -p atmega328p -U flash:w:"v3/ADVISOR_EEP_ARD328_v3.hex":i -v

avrdude: Version 6.3-20171130
         Copyright (c) 2000-2005 Brian Dean, http://www.bdmicro.com/
         Copyright (c) 2007-2014 Joerg Wunsch

         System wide configuration file is "/etc/avrdude.conf"
         User configuration file is "/home/alan/.avrduderc"
         User configuration file does not exist or is not a regular file, skipping

         Using Port                    : usb
         Using Programmer              : usbasp
         AVR Part                      : ATmega328P
         Chip Erase delay              : 9000 us
         PAGEL                         : PD7
         BS2                           : PC2
         RESET disposition             : dedicated
         RETRY pulse                   : SCK
         serial program mode           : yes
         parallel program mode         : yes
         Timeout                       : 200
         StabDelay                     : 100
         CmdexeDelay                   : 25
         SyncLoops                     : 32
         ByteDelay                     : 0
         PollIndex                     : 3
         PollValue                     : 0x53
         Memory Detail                 :

                                  Block Poll               Page                       Polled
           Memory Type Mode Delay Size  Indx Paged  Size   Size #Pages MinW  MaxW   ReadBack
           ----------- ---- ----- ----- ---- ------ ------ ---- ------ ----- ----- ---------
           eeprom        65    20     4    0 no       1024    4      0  3600  3600 0xff 0xff
           flash         65     6   128    0 yes     32768  128    256  4500  4500 0xff 0xff
           lfuse          0     0     0    0 no          1    0      0  4500  4500 0x00 0x00
           hfuse          0     0     0    0 no          1    0      0  4500  4500 0x00 0x00
           efuse          0     0     0    0 no          1    0      0  4500  4500 0x00 0x00
           lock           0     0     0    0 no          1    0      0  4500  4500 0x00 0x00
           calibration    0     0     0    0 no          1    0      0     0     0 0x00 0x00
           signature      0     0     0    0 no          3    0      0     0     0 0x00 0x00

         Programmer Type : usbasp
         Description     : USBasp, http://www.fischl.de/usbasp/

avrdude: auto set sck period (because given equals null)
avrdude: warning: cannot set sck period. please check for usbasp firmware update.
avrdude: AVR device initialized and ready to accept instructions

Reading | ################################################## | 100% 0.00s

avrdude: Device signature = 0x1e950f (probably m328p)
avrdude: safemode: lfuse reads as FF
avrdude: safemode: hfuse reads as DA
avrdude: safemode: efuse reads as FD
avrdude: NOTE: "flash" memory has been specified, an erase cycle will be performed
         To disable this feature, specify the -D option.
avrdude: erasing chip
avrdude: auto set sck period (because given equals null)
avrdude: warning: cannot set sck period. please check for usbasp firmware update.
avrdude: reading input file "v3/ADVISOR_EEP_ARD328_v3.hex"
avrdude: writing flash (5732 bytes):

Writing | ################################################## | 100% 3.92s

avrdude: 5732 bytes of flash written
avrdude: verifying flash memory against v3/ADVISOR_EEP_ARD328_v3.hex:
avrdude: load data flash data from input file v3/ADVISOR_EEP_ARD328_v3.hex:
avrdude: input file v3/ADVISOR_EEP_ARD328_v3.hex contains 5732 bytes
avrdude: reading on-chip flash data:

Reading | ################################################## | 100% 2.93s

avrdude: verifying ...
avrdude: 5732 bytes of flash verified

avrdude: safemode: lfuse reads as FF
avrdude: safemode: hfuse reads as DA
avrdude: safemode: efuse reads as FD
avrdude: safemode: Fuses OK (E:FD, H:DA, L:FF)

avrdude done.  Thank you.

This are the instructions to wire the Arduino board and the Pager:

By request, I post the Motorola advisor EEPROM editor.
You need an arduino with AtMega328p or any other board with such a processor and 16 MHz quartz.
The program shows the password, the password can be deactivated. You can reset the lock mode and the invalid input attempt counter, you can override the serial number, you can write any data to the specified EEPROM address.
The program has a minimum of checks and warnings, whether there will be a brick, if something is written in the wrong place, I don’t know, it’s not interesting.
The program is written in a different environment than the Arduino. You need an SPI programmer or a utility that can load HEX via Boot. The connection to the pager is 6 wires, it is desirable to run the signal circuits through ~ 1K resistors.
You need to connect the ground and these lines:
Portc.1 (MISO, A1) -> 8 pin U2
Portc.0 (MOSI, A0) -> 7 pin U2
Portc.2 (SCK, A2) -> 6 pin U2
Portc.3 (CS, A3) -> 9 pin U2
Portc.4 (RST, A4) -> 41 pin CPU
Solder the wires to the U2 (Cmos Support) pins, RST is convenient to connect to the R11 resistor, from the processor side.
Terminal set to 57600 8n1/

Converting Russian text from IBM866 to UTF-8

To run the Motorola Advisor Pager programmer I need to follow the instruction, but the extended-ASCII charset wasn’t helping:

1.<8e>âªà®©â¥ ¯¥©¤¦¥à ¨ á¥¬¨â¥ ¯à¨¥¬ãî ¯« âã
2.<90> á¯®ïâì á®¡à ë© ¢ ¬¨ èãà (¯® áå¥¬¥) ®â ãáâà®©áâ¢    ¬¨ªà®áå¥¬ã
98<95>05 ¨«¨   «®£¨çãî ¥©,(¯®å®¦    ®â«¨âãî
¨§ ç¥à®£® ¬ â¥à¨ «  ¯«îèªã)



        ßÚÄÄÁÄÁÄÁÄÁÄÁÄÁÄÄ¿ß 11
        Ä³               ³Ä
        Ä³               ³Ä> 9
        Ä³               ³Ä> 8
        Ä³     98X05     ³Ä> 7
        Ä³               ³Ä> 6
        Ä³       ®       ³Ä
        ÜÀÄÄÂÄÂÄÂÄÂÄÂÄÂÄÄÙÜ
                    2

3. <87> ¯ãáâ¨âì ä ©« digadv.exe
4. <8f>®á«¥ ¢ë¯®«¥¨ï ¨áâàãªæ¨æ
ãª § ëå ¢ ä ¨«¥ digadv.exe
§ ¯ãáâ¨âì ä ©« dat2pvd.com

After searching in the Internet I discovered a nice program called “uchardet” that corrected guessed the charset:

$ uchardet INSTR.TXT
IBM866

Next step was to convert it to UTF8:

$ iconv -f IBM866 -t UTF-8//TRANSLIT INSTR.TXT -o INST.TXT

Way better now, at least google translate will help:

1.Откройте пейджер и снемите приемную плату
2.Распоять собранный вами шнур (по схеме) от устройства на микросхему
98Х05 или аналогичную ей,(похожа на отлитую
из черного материала плюшку)

    ▀┌──┴─┴─┴─┴─┴─┴──┐▀ 11             
    ─│               │─ 
    ─│               │─> 9 
    ─│               │─> 8 
    ─│     98X05     │─> 7 
    ─│               │─> 6      
    ─│       о       │─                        
    ▄└──┬─┬─┬─┬─┬─┬──┘▄
                2

Запустить файл digadv.exe
После выполнения инструкциц
указанных в фаиле digadv.exe
запустить файл dat2pvd.com

References:
https://stackoverflow.com/questions/805418/how-can-i-find-encoding-of-a-file-via-a-script-on-linux
https://www.tecmint.com/convert-files-to-utf-8-encoding-in-linux/