]>
Commit | Line | Data |
---|---|---|
e54e4db0 KR |
1 | ------------------------------------------------------------------------------- |
2 | Maxim Integrated DS2432 1k-Bit Protected 1-Wire EEPROM with SHA-1 Engine | |
3 | ------------------------------------------------------------------------------- | |
4 | ||
5 | This is a set of example captures of the 1-Wire traffic from a Maxim Integrated | |
6 | (previously Dallas Semiconductor) DS2432 1k-Bit Protected 1-Wire EEPROM with | |
7 | SHA-1 Engine. | |
8 | ||
9 | Details: | |
10 | http://datasheets.maximintegrated.com/en/ds/DS2432.pdf | |
11 | http://pdf.datasheetcatalog.com/datasheet/maxim/DS2432.pdf | |
12 | ||
13 | ||
14 | Logic analyzer setup | |
15 | -------------------- | |
16 | ||
17 | The logic analyzer used was a MCU123 Saleae Logic clone: | |
18 | ||
19 | Channel DS2432 pin | |
20 | ------------------------ | |
21 | 1 (OWR) 1 (1-WIRE) | |
22 | ||
23 | sigrok-cli was used to capture the trace with the following parameters: | |
24 | ||
25 | - sample rate: 1 MHz | |
26 | - samples: 1 M | |
27 | - trigger: falling channel 1 (OWR) | |
28 | ||
29 | sigrok-cli --driver fx2lafw --channels D0=OWR --config samplerate=1m \ | |
30 | --samples 1M --triggers OWR=f --output-file ds2432.sr | |
31 | ||
32 | ||
33 | ds2432.sr | |
34 | --------- | |
35 | ||
36 | The DS2432 chip in TSOC 6 package has the same following top marking: | |
37 | DS | |
38 | 2432 | |
39 | 618B1 | |
40 | ||
41 | And bottom marking: | |
42 | 32AC | |
43 | ||
44 | The communication is initiated by a Bus Pirate HW v3b FW v6.6 in 1-Wire mode. | |
45 | ||
46 | The Bus Pirate in 1-Wire (master) mode performs the following actions: | |
47 | ||
48 | - Read ROM ID using "READ ROM" ROM command (0x33): `(51)` | |
49 | ||
50 | - Write scratchpad with 0's at target address 0x80 (secret memory) and read | |
51 | resulting CRC using "Write Scratchpad" function command (0x0Fh): | |
52 | `[0xcc 0x0f 0x80 0 0:8 r:2` | |
53 | ||
54 | - Read target address, status byte, scratchpad, CRC using "Read Scratchpad" | |
55 | function command (0xAA): `[0xcc 0xaa r:3 r:8 r:2` | |
56 | ||
57 | - Provide authentication pattern store secret from scratchpad to memory and | |
58 | read result after 10 ms using "Load First Secret" function command (0x5A): | |
59 | `[0xcc 0x5a 0x80 0x00 0x5F %:10 r` | |
60 | ||
61 | - Read authentication pattern using "Read Scratchpad" function command | |
62 | (0xAA): `[0xcc 0xaa r:3` | |
63 | ||
64 | - Copy scratchpad to memory with erroneous MAC and read result after 10 ms | |
65 | using "Copy Scratchpad" function command (0x55): | |
66 | `[0xcc 0x55 0x80 0x00 0xDF 0x42:20 %:10 r` | |
67 | ||
68 | - Read first 8 bytes starting at target address 0 using "Read Memory" | |
69 | function command (0xF0): `[0xcc 0xf0 0 0 r:8` | |
70 | ||
71 | - Read page 0 and authentication using "Read Authenticated Page" function | |
72 | command (0xa5): `[0xcc 0xa5 0 0 r:32 r:1 r:2 %:2 r:20 r:2` | |
73 | ||
74 | - Compute next secret using memory page 0 and read result after 12 ms using | |
75 | "Compute Next Secret" function command (0x33): `[0xcc 0x33 0x00 0x00 %:12 r` | |
76 | ||
77 | - Read scratchpad to verify result: `[0xcc 0xaa r:3 r:8 r:2` |