projects / sigrok-dumps.git / blame
| Commit | Line | Data |
|---|---|---|
| e54e4db0 KR |
1 | ------------------------------------------------------------------------------- |
| 2 | Maxim Integrated DS2432 1k-Bit Protected 1-Wire EEPROM with SHA-1 Engine | |
| 3 | ------------------------------------------------------------------------------- | |
| 4 | ||
| 5 | This is a set of example captures of the 1-Wire traffic from a Maxim Integrated | |
| 6 | (previously Dallas Semiconductor) DS2432 1k-Bit Protected 1-Wire EEPROM with | |
| 7 | SHA-1 Engine. | |
| 8 | ||
| 9 | Details: | |
| 10 | http://datasheets.maximintegrated.com/en/ds/DS2432.pdf | |
| 11 | http://pdf.datasheetcatalog.com/datasheet/maxim/DS2432.pdf | |
| 12 | ||
| 13 | ||
| 14 | Logic analyzer setup | |
| 15 | -------------------- | |
| 16 | ||
| 17 | The logic analyzer used was a MCU123 Saleae Logic clone: | |
| 18 | ||
| 19 | Channel DS2432 pin | |
| 20 | ------------------------ | |
| 21 | 1 (OWR) 1 (1-WIRE) | |
| 22 | ||
| 23 | sigrok-cli was used to capture the trace with the following parameters: | |
| 24 | ||
| 25 | - sample rate: 1 MHz | |
| 26 | - samples: 1 M | |
| 27 | - trigger: falling channel 1 (OWR) | |
| 28 | ||
| 29 | sigrok-cli --driver fx2lafw --channels D0=OWR --config samplerate=1m \ | |
| 30 | --samples 1M --triggers OWR=f --output-file ds2432.sr | |
| 31 | ||
| 32 | ||
| 33 | ds2432.sr | |
| 34 | --------- | |
| 35 | ||
| 36 | The DS2432 chip in TSOC 6 package has the same following top marking: | |
| 37 | DS | |
| 38 | 2432 | |
| 39 | 618B1 | |
| 40 | ||
| 41 | And bottom marking: | |
| 42 | 32AC | |
| 43 | ||
| 44 | The communication is initiated by a Bus Pirate HW v3b FW v6.6 in 1-Wire mode. | |
| 45 | ||
| 46 | The Bus Pirate in 1-Wire (master) mode performs the following actions: | |
| 47 | ||
| 48 | - Read ROM ID using "READ ROM" ROM command (0x33): `(51)` | |
| 49 | ||
| 50 | - Write scratchpad with 0's at target address 0x80 (secret memory) and read | |
| 51 | resulting CRC using "Write Scratchpad" function command (0x0Fh): | |
| 52 | `[0xcc 0x0f 0x80 0 0:8 r:2` | |
| 53 | ||
| 54 | - Read target address, status byte, scratchpad, CRC using "Read Scratchpad" | |
| 55 | function command (0xAA): `[0xcc 0xaa r:3 r:8 r:2` | |
| 56 | ||
| 57 | - Provide authentication pattern store secret from scratchpad to memory and | |
| 58 | read result after 10 ms using "Load First Secret" function command (0x5A): | |
| 59 | `[0xcc 0x5a 0x80 0x00 0x5F %:10 r` | |
| 60 | ||
| 61 | - Read authentication pattern using "Read Scratchpad" function command | |
| 62 | (0xAA): `[0xcc 0xaa r:3` | |
| 63 | ||
| 64 | - Copy scratchpad to memory with erroneous MAC and read result after 10 ms | |
| 65 | using "Copy Scratchpad" function command (0x55): | |
| 66 | `[0xcc 0x55 0x80 0x00 0xDF 0x42:20 %:10 r` | |
| 67 | ||
| 68 | - Read first 8 bytes starting at target address 0 using "Read Memory" | |
| 69 | function command (0xF0): `[0xcc 0xf0 0 0 r:8` | |
| 70 | ||
| 71 | - Read page 0 and authentication using "Read Authenticated Page" function | |
| 72 | command (0xa5): `[0xcc 0xa5 0 0 r:32 r:1 r:2 %:2 r:20 r:2` | |
| 73 | ||
| 74 | - Compute next secret using memory page 0 and read result after 12 ms using | |
| 75 | "Compute Next Secret" function command (0x33): `[0xcc 0x33 0x00 0x00 %:12 r` | |
| 76 | ||
| 77 | - Read scratchpad to verify result: `[0xcc 0xaa r:3 r:8 r:2` |