Skip to content

Instantly share code, notes, and snippets.

View mnaberez's full-sized avatar

Mike Naberezny mnaberez

226 followers · 45 following
View GitHub Profile
@mnaberez
mnaberez / cbmreadall.py
Created March 23, 2022 15:55
Read all PRG and SEQ files from a disk using cbmread
#!/usr/bin/env python3
"""
Read all PRG and SEQ files from a disk using cbmread.
Other file types (e.g. REL, USR) are ignored.
Usage: %s <device number>
"""
import shlex
import subprocess
@mnaberez
mnaberez / nec_78k0_flash.md
Last active November 12, 2024 05:43
NEC 78K0 Flash Vulnerability

NEC 78K0 Flash Vulnerability

Overview

The microcontroller that I studied was removed from a Volkswagen car radio manufactured by Delco (now Delphi). The chip had only Delco markings on the package. It was decapsulated and the markings "NEC D78F0831Y" were found on the die. I reverse engineered the device definition files for the NEC toolchain (RA78K0) and determined that the uPD78F0831Y is a subset of a documented chip, the uPD78F0833Y. The '833Y adds 3 more timers, extended I2C functionality, and adds registers that allow firmware running on the '833Y to reprogram the flash ("self-programming"). Otherwise, the '831Y and '833Y are the same.

The uPD78F0831Y uses the NEC 78K0 core. Note that NEC (now Renesas) produced a number of incompatible cores with similar names such as 78K0S and 78K0R. Those

@mnaberez
mnaberez / MKE06Z128VLD4.md
Last active December 7, 2022 00:36
NXP Freescale Kinetis E Series KE06 Info
@mnaberez
mnaberez / adapter.md
Last active September 20, 2018 12:21
Adapter to allow the M38869FFAHP microcontroller to be read as an M5M28F101 parallel flash memory.

Adapter to allow the M38869FFAHP microcontroller to be read as an M5M28F101 parallel flash memory.

Flash Name Flash Pin MCU Pin MCU Name
A16 2 61 P31/PWM10
A15 3 39 P17
A12 4 42 P14
A7 5 47 P07
A6 6 48 P06
A5 7 49 P05
@mnaberez
mnaberez / log2bin.py
Created June 14, 2018 15:53
Parse a memory dump log from the KWP1281 tool and write it to a binary file (https://github.com/mnaberez/vwradio)
#!/usr/bin/env python
'''
Parse a log file containing "MEM:" lines from the KWP1281 tool
and write the data to a binary file.
Usage: %s file.log
'''
import os
import sys
@mnaberez
mnaberez / d80read2.bas
Created June 12, 2018 17:36
CBM BASIC program that reads a real disk and creates a D80 image. Alternate version that handles bad sectors and writes the error map at the end of the image file.
;d80 read 2 ==0801==
5 input"source unit";su
6 input"destination unit";du
7 input"image filename";f$
8 if right$(f$,4)=".d80" then f$=left$(f$, len(f$)-4)
9 fi$=f$+".d80":fe$=f$+".txt"
10 bl$="":rem bad sector list
30 open2,du,2,fi$+",p,w"
35 open15,su,15
40 open3,su,3,"#"
@mnaberez
mnaberez / d80read.bas
Created June 12, 2018 17:34
CBM BASIC program that reads a real disk and creates a D80 image
;d80 read ==0801==
5 input"source unit";su
6 input"destination unit";du
7 input"image filename";f$
30 open2,du,2,f$+",p,w"
35 open15,su,15
40 open3,su,3,"#"
45 lt=77
50 for t=1 to lt
60 if t>=1 and t<=39 then ls=28
@mnaberez
mnaberez / d82write.bas
Created June 12, 2018 17:28
CBM BASIC program that writes a D82 image to a real disk
;d82 write ==0801==
5 input"source unit";su
6 input"destination unit";du
7 input"image filename";f$
30 open2,su,2,f$+",p,r"
35 open15,du,15
40 open3,du,3,"#"
45 lt=154
50 for t=1 to lt
60 if t>=1 and t<=39 then ls=28
@mnaberez
mnaberez / d80write.bas
Last active June 12, 2018 17:27
CBM BASIC program that writes a D80 image to a real disk
;d80 write ==0801==
5 input"source unit";su
6 input"destination unit";du
7 input"image filename";f$
30 open2,su,2,f$+",p,r"
35 open15,du,15
40 open3,du,3,"#"
45 lt=77
50 for t=1 to lt
60 if t>=1 and t<=39 then ls=28
@mnaberez
mnaberez / KWP1281 Measuring Block Value Formulas.txt
Created June 6, 2018 19:39
KWP1281 Measuring Block Value Formulas.txt (http://nefariousmotorsports.com/forum/index.php?topic=22.0)
Blocktitle 0xE7 (dez. 231)
R6L = B
R7L = A
Byte 1 Meaning Value (a means byte2, b means byte3) Caption
1 ??? a*0.2*b rpm
2 ??? a*0.002*b %
3 ??? a*0.002*b Deg
4 ??? abs(b-127)*0.01*a "ATDC if Value >127, else ""BTDC"""