Microcontroller reverse engineer
Microcontroller reverse engineer
Everything they make, We can break! 
  HOME COMPANY PCB COPY MCU HACK FAQ CONTACT US
Disassembler Software   
WHY US ?
World first mcu hack company
In business since 1998
Reversed tens of thousands of chips
Copied thousands of pcbs
Foreseen all pertential problems
Integrity with payments
crack ic
 
 
Architecture and programming of 8051 MCU's for reverse engineering

Chapter 7 : Development systems

7.1 At the end - from the beginning...

What is always the most difficult thing to do? You have bought the microcontroller, you have learned everything about its circuits and registers, you have a great idea how to apply all your knowledge in practice. But the most difficult thing to do is to start...

How to start working?

A microcontroller is a good-natured “genie in the bottle” and no extra knowledge is required to use it.

In order to create a device controlled by the microcontroller, it is necessary to provide the simplest PC, program for compiling and simple device to transfer the code from PC to the chip itself.

Even though the whole process is quite logical, there are often some queries, not because it is complicated, but for numerous variations. Let’s take a look.

Writing program in assembly language

In order to write a program for the microcontroller, a specialized program in the Windows environment may be used. It may, but it does not have to... When using such a software, there are numerous tools which facilitate the operation (simulator tool comes first), which is an obvious advantage. But there is also another ways to write a program. Basically, text is the only thing that matters. Any program for text processing can be used for this purpose. The point is to write all instructions in such an order they should be executed by the microcontroller, observe the rules of assembly language and write instructions exactly as they are defined. In other words, you just have to follow the program idea. That’s all!

;RESET    VECTOR
          CSEG    AT      0
          JMP     XRESET           ; Reset vector
 
          CSEG
          ORG     100H
 
XRESET:   ORL     WMCON,#PERIOD    ; Define Watch-dog period
          ORL     WMCON,#WDTEN     ; Watch-dog timer is enabled
 
               

To enable the compiler to operate successfully, it is necessary that a document containing this program has the extension, .asm in its name, for example: Program asm.

When a specialized program (mplab) is used, this extension will be automatically added. If any other program for text processing (Notepad) is used then the document should be saved and renamed. For example: Program.txt -> Program.asm. This procedure is not necessarily performed. The document may be saved in original format while its text may be copied to the programmer for further use.

Compiling a program

The microcontroller “does not undrestand” assembly language as such. That is why it is necessary to compile the program into machine language. It is more than simple when a specialized program (mplab) is used because a compiler is a part of the software. Just one click on the appropriate icon solves the problem and a new document with .hex extension appears. It is actually the same program, only compiled into machine language which the microcontroller perfectly understands. Such documentation is commonly named “hex code” and seemingly represents a meaningless sequence of numbers in hexadecimal number system.

:03000000020100FA1001000075813F
7590FFB29012010D80F97A1479D40
90110003278589EAF3698E8EB25B
A585FEA2569AD96E6D8FED9FAD
AF6DD00000001FF255AFED589EA
F3698E8EB25BA585FEA2569AD96
DAC59700D00000278E6D8FED9FA
DAF6DD00000001FF255AFED8FED
9FADAF6DD000F7590FFB29013278
E6D8FED9FADAF6DD00000001FF2
55AFED589EAF3698E8EB25BA585
FEA2569AD96DAC59D9FADAF6D
D00000001FF255AFED8FED9FADA
F6DD000F7590FFB29013278E6D82
78E6D8FED9FA589EAF3698E8EB2
5BA585FEA2569AD96DAF6DD000
00001FF2DAF6DD00000001FF255A
ADAF6DD00000001FF255AFED8FE
D9FA

In the event that other software for program writing in assembly language is used, a special software for compiling the program must be installed and used as follows - set up the compiler, open the document with .asm extension and compile. The result is the same- a new document with extension .hex. The only problem now is that it is stored in your PC.

Programming a microcontroller

In order to transfer a “hex code” to the microcontroller, it is necessary to provide a cable for serial communication and a special device, called programmer, with software. There are several ways to do it.

A large number of programs and electronic circuits having this purpose can be found on the Internet. Do as follows: open hex code document, set a few parameters and click the icon for compiling. After a while, a sequence of zeros and ones will be programmed into the microcontroller through the serial connection cable and programmer hardware. What's left is to place the programmed chip into the taget device. In the event that it is necessary to make some changes in the program, the previous procedure may be repeated an unlimited number of times.

Copying program to a microcontroller

The end or...?

This section briefly describes the use of MPLAB and programmer software developed by Mikroelektronika. Everything is very simple...

Mikroelektronika Asm51 Console

Start the program Mikroelektronika Asm51 Console. The window appears...

...Open a new document: File -> New. Write your program or copy text...

... Save and name your document: File -> Save As... (Document name is limited to 8 characters!)

Finally, to compile program into HEX code select: Project -> Build or click the 'play' icon.

If everything works properly, the computer will respond with a short report.

Computer will reward you with a minireport

The program is written and successfully compiled. All that's left is to dump the program to the microcontroller. For this purpose it is necessary to have a software that takes the written and compiled program and passes it to the microcontroller.

Start the program 8051 Flash_setup.exe...

8051 Flash setup installation

Program installation is performed as usually - just click Next, Accept, Next...

...and finally - Finish!

The program has been installed and ready for use. The settings are easily performed so that there is no need for additional explanations (the type of the microcontroller, frequency and clock oscillator etc.).

  • Connect the PC and programmer via a USB cable;
  • Load the HEX code using command: File -> Load HEX; and
  • Click the 'Write' push button and wait...
USB 2.0 Programmer Software

That’s all! The microcontroller is programmed and everything is ready for operation. If you are not satisfied, make some changes in the program and repeat the procedure. Until when? Until you feel satisfied...

Development systems

Easy8051A Development System

A device which in the testing program phase can simulate any environment is called a development system. Apart from the programmer, the power supply unit and the microcontroller’s socket, the development system contains elements for input pin activation and output pin monitoring. The simplest version has every pin connected to one push button and one LED as well. A high quality version has LED displays, LCD displays, temperature sensors and all other elements which can be supplied with the target device. These peripherals can be connected to the MCU via miniature jumpers. In this way, the whole program may be tested in practice during its development stage, because the microcontroller doesn't know or care whether its input is activated by a push button or a sensor built in a real device.

Easy8051A Development System Overview

7.2 Easy8051A Development System

The Easy8051A development system is a high-quality development system used for programming 8051 compatible microcontrollers manufactured by Atmel. In addition to chip programming, this system enables all the parts of the program to be tested as it contains most components which are normally built in real devices.

The Easy8051A development system consists of:

  • Sockets for placing microcontrollers in (14, 16, 20 and 40- pin packages)
  • Connector for external power supply (DC 12V)
  • USB programmer
  • Power Supply Selector (external or via USB cable)
  • 8 Mhz Quartz Crystal Oscillator
  • 32 LEDs for output pin state indication
  • 32 push buttons for input pin activation
  • Four 7-segment LED displays in multiplex mode
  • Graphic LCD display
  • Alphanumeric LCD display (4- or 8- bit mode)
  • Connector and driver for serial communication RS232
  • Digital thermometer DS1820
  • 12- bit A/D converter (MCP3204)
  • 12- bit D/A converter (MCP4921)
  • Reference voltage source 4.096V (MCP1541)
  • Multiple-pin connectors for direct access to I/O ports

The following text describes in short some circuits within this development system. It is rather illustration of its features than complete manual. Besides, by learning about this device, one understands that microcontrollers and its tools are intended to everybody, not only to the privileged.

Sockets

Easy8051A MCU Sockets

All microcontrollers manufactured by Atmel appear in a few standard DIP packages. In order to enable their programming using one device, corresponding pins (having the same name) on sockets are connected in parallel. As a result, by being placed in the appropriate socket, each microcontroller is automatically properly connected. Figure on the right shows a microcontroller in 40-pin package and connection of one of its I/O pins (P1.5). As seen, the pin can be connected to an external device (connector PORT1), LED (microswitch SW2), push button or resistor through connectors. In the last two cases, polarity of voltage is selected using on-board jumpers.

Easy8051A MCU Sockets Schematic Overview

Programmer

Easy8051A Programmer

The purpose of the programmer is to transfer HEX code from PC to appropriate pins and provide regular voltage levels during chip programming as well. For this development system, the programmer is built in it and should be connected to PC via USB cable. When the process of programming is completed, pins used for it are automatically available for other application.

Easy8051A Programmer Schematic Overview

Development system power supply

Easy8051A power supply

There is a connector on the development board enabling commection to external power supply source (AC/DC, 8-16V). Besides, voltage necessary for device operation can also be obtained from PC via USB cable. Jumper J5 is used for power supply selection.

Easy8051A power supply Schematic Overview

8MHz Oscillator

Easy8051A 8MHz Oscillator

The EASY8051A development system has built-in oscillator used as a clock signal generator. The frequency of this oscillator is stabilized by 8Hz quartz crystal. Besides, it is also possible to select internal RC oscillator during chip programming,.

Easy8051A 8MHz Oscillator Schematic Overview

LEDs for output pin state indication

Easy8051A LEDs

Each I/O port pin is connected to one LED which enables visual indication of its logic state. In the event that the presence of directly polarized LEDs and serial resistors is not acceptable in some applications, DIP switch SW2 enables them to be disconnected from the port.

Easy8051A LED Schematic Overview

Push buttons for input pin activation

Easy8051A Pushbuttons

Similar to LEDs, each I/O port pin is connected to one push button on the development board. It enables simple activation of input pins. Jumper J6 is used for selecting voltage polarity (+ or -) brought to pins by pressing appropriate push button.

Easy8051A Pushbuttons Schematic Overview

7-segment LED displays

Easy8051A 7-segment LED displays

Being often applied in the industry, four high-performance LED displays set in multiplex mode belong to the development system. Display segments are connected to the port P0 via resistors. Transistor drivers used for activating individual digits are connected to the first four port P1 pins. It enables programs using 7-segment displays to be tested with minimum use of I/O ports. Similar to LEDs, DIP switch SW2 enables transistor drivers to be disconnected from microcontroller pins.

Easy8051A 7-segment LED displays Schematic Overview

LCD displays

Easy8051A GLCD displays Easy8051A LCD displays

The EASY8051A development system provides connection to eather graphic or alphanumeric LCD display. Both types of displays are connected by being placed into appropriate connector and by switching position of the jumper J8. If displays are not in use, all pins used for their operation are available for other applications. Apart from connectors, there is also a potentiometer for contrast regulation on the board.

Easy8051A GLCD/LCD displays Schematic Overview

Serial communication via RS232

Easy8051A Serial communication

In order to enable programs using serial communication to be tested, the development system has built in standard 9-pin SUB-D connector. The MAX232 is used as a voltage regulator.

Similar to other built-in circuits, electronics supporting serial communication can be enabled or disabled by using jumpers J9 and J10.

Easy8051A Serial communication Schematic Overview

DS1820 Digital thermometer

Easy8051A DS1820 Digital thermometer

Temperature measurement is one of the most common tasks of devices which operate in the industry. For this reason, there is a circuit DS1820 on the EASY8051A development system which measures temperature in the range of -55 to +125oC with accuracy greater than 0.50. Results of measurement are transferred via serial communication to the pins P3.3 or P2.7. Jumper J7 is used for selecting pins for data reception. In the event that no jumper is installed, port pins are available for other applications.

Easy8051A DS1820 Digital thermometer Schematic Overview

12-bit A/D converter MCP3204

Easy8051A 12-bit A/D converter MCP3204

A built-in 12-bit AD Converter MCP3204 has four input channels connected to on-board connectors. Data are interchanged with the microcontroller via SPI serial communication system using pins P1.5, P1.6, P1.7 and P3.5. If A/D converter is not in use, these pins can be used for other applications (DIP switch SW1). In order to check operation, there is a potentiometer on the development board used as a variable voltage source. It can be brought to the converter’s input pins using one of four jumpers J12. As a special convenience, a reference voltage source MCP1541 (4,096V) is built in. Jumper J11 is used to select whether converter will use this voltage or 5V.

Easy8051A 12-bit A/D converter MCP3204 Schematic Overview

12-bit D/A converter MCP4921

Easy8051A 12-bit D/A converter MCP4921

Digital to analog conversion (D/A) is another operation ofen performed by the microcontroller in practice. For this reason, there is a special on-board chip which interchanges data with the microcontroller via SPI communication system. It can also generate analog voltage in 12-bit resolution on its output pin. When it is not in use, all microcontroller pins are available for other applications using DIP switch SW1. Similar to A/D converter, jumper J11 is used for selecting reference voltage.

Easy8051A 12-bit D/A converter MCP4921 Schematic Overview

Connectors for direct access to I/O ports

Easy8051A direct access to I/O ports

In order to enable microcontroller ports to be directly connected to additional components, each of them is connected to one on-board connector. Besides, two pins of each connector are connected to power supply voltage while each pin can be connected to + or - polarity of voltage via resistors (pull up or pull down resistors). Presence and connection of these resistors are determined by jumpers. Jumper J3 which controls port P3 is shown in figure on the right.

Easy8051A direct access Schematic Overview
 
 

 

  • Mikatech Nuvoton/Winbond 8051 MCU reverse engineer list:
  • W77Exx series ic code extraction: W77E51 W77E52 W77E54 W77E58 W77E058A W77E516 W77E516A W77E532 W77E532A W77E058 W77E58A W77I058A 77L058 W77L516A W77LE58 W77IE58 W77L058A W77L516A W77L532A W77LE516 W77LE532 ...

    W78Exx series ic code recovery: W78E51 W78E51B W78E52 W78E52B W78E54 W78E54B W78E58 W78E58B W78E516 W78E051A W78E62 W78E65 W78E65B W78E516B W78E051B W78E051C W78E052A W78E052B W78E052C W78E054A W78E054B W78E054C W78E058A W78E058B W78E065A W78E365 W78E365A W78E378 W78E378E W78E51 W78E516B W78E51B W78E51C W78E52 W78E52B W78E52C W78E54 W78E54B W78E54C W78E58 W78E58B W78E62 W78E65 W78E858 W78ERD2 W78ERD2A W78E051DDG W78E051DFG W78E051DLG W78E051DPG W78E052DDG W78E052DFG W78E052DLG W78E052DPG W78E054DDG W78E054DFG W78E054DLG W78E054DPG W78E058DDG W78E058DFG W78E058DLG W78E058DPG W78E065 W78E354 W78E374B W78E378P W78E516DDG W78E516DFG W78E516DLG W78E516DPG W78E62B ...

    W78IExx series ic code extraction: W78IE52 W78IE54 W78IRD2 W78IRD2A W78I051DDG W78I051DFG W78I051DLG W78I051DPG W78I052 W78I052DDG W78I052DFG W78I052DLG W78I052DPG W78I054 W78I054DDG W78I054DFG W78I054DLG W78I054DPG ...
    W78Lxx series ic code recovery: W78L051A W78L051C W78L052A W78L052C W78L054A W78L054C W78L058A W78L365A W78L516A W78L812A W78L051 W78L052 W78L054 W78L058 W78L365 W78L516 W78L812 ...

    W78LExx series ic code extraction: W78LE58 W78LE58B W78LE051A W78LE365 W78LE51 W78LE516 W78LE51C W78LE52 W78LE52C W78LE54 W78LE54C W78LE812 ...

    W79Exx series ic code recover: W79E201 W79E201A W79E532 W79E532A W79E533A W79E548 W79E548A W79E549 W79E549A W79E558A W79E559A W79E632 W79E632A W79E633A W79E648 W79E648A W79E649 W79E649A W79E658A W79E659A W79E801 W79E802 W79E803 W79E804 W79E821 W79E822 W79E823 W79E824 W79E825 W79E82J W79E832 W79E833 W79E834 W79E83J W79E2051 W79E216AFG W79E217AFG W79E225A W79E226A W79E227A W79E4051 W79E633 W79E83J W79E801A W79E802A W79E803A W79E804A W79E821A W79E822A W79E822B W79E823A W79E823B W79E824A W79E825A W79E831A W79E832A W79E833A W79E834A ...

    W79Lxx series ic code extraction: W79L532 W79L532A W79L548 W79L548A W79L549 W79L549A W79L558A W79L559A W79L632 W79L632A W79L633A W79L648 W79L648A W79L649 W79L649A W79L658A W79L659A W79L633 ...

    W83Lxx series ic code recovery: W83L950D W83L950G W83L951D W83L951DG W83L951F W83L951FG W83L951ADG W83L951DF ...

 
 
     
 
PCB Copying Service
PCB Projects Overview
PCB Clone
PCB Reverse Engineering
PCB Prototype
PCB Assembly Production
 
 
 
Mcu Hacking Service
Atmel /Analog Mcu Hack
Actel Mcu Attack
Altera Microcontroller Crack
Cygnal Mcu Unlock
Cypress IC Reverse Engineer
Dallas / Elan Mcu Code Extract
Fujitsu Microprocessor Decryption
Freescale IC Code Extraction
Giga Device circuit Hack
Hitachi Mcu Code Extract
Holtek Chip Reverse Engineer
Infineon Microcontroller Dump
Intel Mcu Read Code Protection
ICT Microcontroller Duplication
Lattice Microcontroller Clone
Microchip Source Code Recovery
Motorola Microcontroller Crack
Maxim Mcu Attack
MDT Controller Hack
Megawin Microcontroller Unlock
NEC Mcu Reverse Engineer
NTK Microcontroller Code Extract
Nuvoton Chip Decryption
NXP Semiconductor Code Extraction
Philips integrated circuit Crack
Renesas Microcontroller Dump
ST Processor Reverse Engineer
Silicon Labs Mcu Read Protection
Samsung Mcu Duplication
SST Mcu Clone
Sinowealth Source Code Recovery
SyncMOS Mcu Unlock
Sonix Mcu Read Source Code
STC Microprocessor Code Extract
Tenx Microcontroller Decryption
Texas Instruments MCU Hack
Winbond MCU Code Extraction
Xilinx integrated circuit Crack
Zilog MCU Reverse Engineer
 
     
 
 
More MCU brands we can reverse engineer below, please contact us if yours not listed here:
AMD Feeling LG / Hyundai Myson STK
ChipON Hynix Mitsubishi National Semi Temic
Coreriver ICSI Mosel Vitelic Portek Toshiba
Dallas ISSI MXIC SSSC Gal / Pal / Palce
Copyright © 2013 Mikatech. All rights reserved. Full dedicated reverse engineering company