2

I'm working on reverse engineering a USB controller. The name of the controller chip is the "UD6810" which appears to be a Chinese clone of another chip (since a lot of results about it have been removed from Google via DMCA requests). I've found a program which can successfully flash the firmware.

However, I obviously need to determine the instruction set before I can modify it. The datasheets I've found on the web seem to be missing this key information and docs are generally quite hard to find. I have the binary code since I can both see it in the flashing program's files and capture it in the USB traffic as it flashes the chip.

How can I determine the instruction set?

Improve this question
4
  • 1
    Unless you have at least an idea of what the controller is similar to, and a datasheet of that, i doubt this is possible with acceptable effort. The second of these guys claims he can do it, but these guys say they extract, back-cut, laser grind and re-wirebond transplanted dies from SoCs/MCMs... which we then probe, extract and decrypt, so you'll need at least some serious hardware hacking (if that site isn't a fake at all).
    – Guntram Blohm
    Commented Jan 9, 2015 at 7:06
  • Do you have a working firmware image for the device?
    – joxeankoret
    Commented Jan 9, 2015 at 9:10
  • If the name of this clone isn't totally random, you could compare the instructions with that of a Motorola MCM6810. Can you post a snippet of a hex dump? Personally, I can recognize some instruction sets by looking at the hex.
    – Jongware
    Commented Jan 9, 2015 at 10:00
  • @Jongware: I thought of the Motorola 68xx family, but the MCM 6810 was the 128 byte RAM module, and the 6809 processor is a bit outdated now. Someone found a cheap USB picture frame to countain a 6502 compatible processor a few years ago, so i wouldn't rule it out completely, but i have some doubts. Maybe the best the OP can do is open it with as many Ida Pro loaders as possible and check if one of them seems to make sense.
    – Guntram Blohm
    Commented Jan 9, 2015 at 10:21

1 Answer 1

Reset to default
6

I will answer not what you asked in the title but what you actually need.

There's around 99% probability it's a 8051 derivative. I don't know a single Chinese USB controller which does not use one. Although I haven't seen them all, of course.

I downloaded a random MPTOOL for this controller from flashboot.ru and it had some binaries. They do look like 8051 code:

ROM:1B24             RESET_0:                                ; CODE XREF: RESETj
ROM:1B24 75 81 7E                    mov     SP, #RAM_7E     ; Stack Pointer
ROM:1B27 02 1B 65                    ljmp    ROM_1B65
ROM:1B2A             ; ---------------------------------------------------------------------------
ROM:1B2A
ROM:1B2A             ROM_1B2A:                               ; CODE XREF: RESET_0+48j
ROM:1B2A 02 1D 20                    ljmp    ROM_1D20
ROM:1B2D             ; ---------------------------------------------------------------------------
ROM:1B2D
ROM:1B2D             ROM_1B2D:                               ; CODE XREF: RESET_0+5Fj
ROM:1B2D E4                          clr     A
ROM:1B2E 93                          movc    A, @A+DPTR
ROM:1B2F A3                          inc     DPTR
ROM:1B30 F8                          mov     R0, A
ROM:1B31
ROM:1B31             ROM_1B31:                               ; CODE XREF: RESET_0+17j
ROM:1B31 E4                          clr     A
ROM:1B32 93                          movc    A, @A+DPTR
ROM:1B33 A3                          inc     DPTR
ROM:1B34 40 03                       jc      ROM_1B39
ROM:1B36 F6                          mov     @R0, A
ROM:1B37 80 01                       sjmp    ROM_1B3A

(this is a typical startup produced by the Keil C51 compiler)

Some common opcodes seen in 8051 binaries:

02 xx xx   ljmp (absolute)
12 xx xx   lcall (absolute)
22         ret
E4         clr A
90 xx xx   mov DPTR, xxxx
A3         inc DPTR
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.