2018.04.18 - original firmware and debug session using OpenOCDThe connection for firmware programming and debug are available on the connector for the speed sensor -- see below more details.
The original firmware was not read protected. I was able to read the option bytes, firmware, EEPROM and finally connect with OpenOCD for a debug session.
TSDZ2 motor controller:
Connection of STLinkV2 clone to the controller, on the wires available on the speed sensor connector:
The connections to STLinkV2 clone:
Purple wire: RST
Reading Option Bytes and original firmware with stm8flash and connect a debug session using OpenOCD:
Original Option Bytes and Firmware:
|Linked file: TSDZ2_original_firmware_protected_option_bytes.bin|
Contents of the option bytes of the read file:
Read original firmware file:
|Linked file: TSDZ2_original_firmware.bin|
The firmware was disassembled using Naken ASM, using the following command:
./naken_util -disasm -stm8 -address 0x8000 ./TSDZ2_original_firmware.bin > ./TSDZ2_original_firmware.asm
|Linked file: TSDZ2_original_firmware.asm|
|Linked file: TSDZ2_original_firmware_eeprom.bin|