Renesas/Hitachi H8/36049 EPROM signals to pins mapping

[gashtaan]

Hi, I'm looking for any information about EPROM signals to pins mapping for Renesas H8/36049 family group, specifically about flash version HD64F36049 MCU. Unfortunately it is not described in the hardware manual for this MCU. It should look something like this (taken from hardware manual for other MCU family from the same manufacturer):

[Postal2]

I see one way. You need to create hardware environment with FPGA and scan the pins. But this mcu is really “tiny” and no one needs it. Renesas bought mcu from Hitachi and quickly convert it to a junk.

[pcprogrammer]

@gashtaan,

are you sure that the H8/300 series is even capable of supporting external memory in such that it can directly address it from the CPU core?

I looked at the general manual here: https://www.manualslib.com/manual/1851554/Hitachi-H8-300l-Series.html and did not find any indication that it can.

The example connection you show might be a setup where the code emulates an address and data bus to read data from an external memory device, but that it can't be used to run code from.

No expert on the H8/300 series though, so I might be wrong.

[gashtaan]

are you sure that the H8/300 series is even capable of supporting external memory in such that it can directly address it from the CPU core?

You got it wrong. I want to directly address internal flash memory, not the opposite. It's vaguely described in hardware manuals as "Programmer mode".

[m k]

So you want to read its program?

One of the basic no-nos, I guess.

[Postal2]

One of the basic no-nos, I guess.

No, this is industrial mcu in the past. 20 years ago closed read was bad form. Mostly locks needed to steal software, close/cifer and nobody can catch. Otherwise, a signature is enough.

For example, a major accident occurred due to the fault of electronics. 10 mcu can be read, but one is blocked. Who will get problems?

[pcprogrammer]

are you sure that the H8/300 series is even capable of supporting external memory in such that it can directly address it from the CPU core?

You got it wrong. I want to directly address internal flash memory, not the opposite. It's vaguely described in hardware manuals as "Programmer mode".

You should have worded your question more clear then. 

See chapter 19 in the manual found here: https://www.farnell.com/datasheets/1500333.pdf

It shows an adapter for the H8/3048F, but might be the same as what you already found and suited for the one you are searching for.

[gashtaan]

You should have worded your question more clear then. 

See chapter 19 in the manual found here: https://www.farnell.com/datasheets/1500333.pdf

It shows an adapter for the H8/3048F, but might be the same as what you already found and suited for the one you are searching for.

Ok, maybe I should. I thought it was clear what information I need, especially when I put related table from other datasheet in the post. I just need to know on what pins are EPROM address/data lines and control signals exposed when MCU is reset to programmer mode.

I've seen few other datasheets of different groups, every single one has EPROM mapped to different pins. Hard to say if H8/3048F is the same mapping as H8/36049F. I rather not guess.

[gashtaan]

So you want to read its program?

One of the basic no-nos, I guess.

Yes, I do. I have a hobby of extracting firmwares out of various devices (even the protected ones) and then reverse engineer them to document how they works or create alternative firmwares. But I never publish extracted firmwares or my techniques how to overcome MCU protections... for ethical reasons.
You can see some of my work here: https://github.com/gashtaan

[m k]

You can make it kosher by having a third party for coding.

That's the original Compaq method for cloning IBM PC.

[Postal2]

What the device on this "tiny" chip, alarm-clock? Electric kettle?

[gashtaan]

What the device on this "tiny" chip, alarm-clock? Electric kettle?

80pin 16bit MCU with 96kB flash in alarm-clock or kettle? It would be a bit too much IMO. Even if it can't run Linux or Doom, but it's used in rather complex boiler system.

[Postal2]

I see "BCD"-format inside - I seem alarm-clock. You can try manually check pins for CE and OE, but I recommend FPGA instead because need calculations for address and data lines.

I will start the project for FPGA, it seems to be interested.

[gashtaan]

I see "BCD"-format inside - I seem alarm-clock. You can try manually check pins for CE and OE, but I recommend FPGA instead because need calculations for address and data lines.

It could have also ~PGM and/or ~WE exposed, some family does. These are tricky, because even data lines could be in high impedance mode when those signals are driven low. It seems at least data lines are always consecutive on single IO port, my idea was to exploit this fact to find out on what port group these are. ~PGM/~WE signals would make the brute force approach more difficult.

The best would be to have some spare ICs to decap and just see where bond wires go. But those are hard to get and/or too expensive to just throw them into the bin :\ I have only single sample and I can't damage it.

[Postal2]

....But those are hard to get and/or too expensive to just throw them into the bin :\ I have only single sample and I can't damage it.

You need to buy spare chips for testing first. They are cheap like a dog soap.
https://aliexpress.com/item/1005006994759425.html

Approx. 10 times cheaper than SH7047.

I ordered.

[gashtaan]

You need to buy spare chips for testing first. They are cheap like a dog soap.
https://aliexpress.com/item/1005006994759425.html

Approx. 10 times cheaper than SH7047.

You're right, thanks! I always searched for HD64F36049GHV Version without G should suffice enough for such research... if they are not some fakes

Anyway, how did you find it? I've tried to search "HD64F36049HV" and "DF36049HV" on aliexpress, but it not give me the item you're referring to. Weird.

[Postal2]

.... how did you find it? ....

I didn’t see any difficulties with this, but at first I was offered an expensive option.
This mcu has 96KB of memory because the bootrom takes up exactly 32. It is most likely exactly the same as the SH7047. You can search for holes in it according to your hobby, I have attached the file.

[gashtaan]

This mcu has 96KB of memory because the bootrom takes up exactly 32. It is most likely exactly the same as the SH7047. You can search for holes in it according to your hobby, I have attached the file.

SH7047 is 32bit MCU, H8/36049 is 16bit MCU and completely different architecture... obviously the bootloader can't be the same.

[Postal2]

... obviously the bootloader can't be the same. ....

It most likely contain the same C-code compiled differently. Because size is matched.

And you can compare algorithm for flash - very similar.

[gashtaan]

It most likely contain the same C-code compiled differently. Because size is matched.

I doubt that. How do you know that bootrom in H8/36049 has 32kB? Seems a bit excessive. Bootrom in Renesas M16C has 4kB for example.

[Postal2]

I doubt that. ....

Okay. I repeat - see datasheet for SH7047 and compare. And write your advice after.

[gashtaan]

Okay. I repeat - see datasheet for SH7047 and compare. And write your advice after.

I've looked on datasheet and there are some similarities for sure... but for example H8/36049 erases the flash before it accepts the programming code, SH7047 do it in different order.

[Postal2]

I've looked on datasheet and there are some similarities for sure...

Pages about flash of your mcu looks like a copy from SH7047. What's not clear?

[gashtaan]

Pages about flash of your mcu looks like a copy from SH7047. What's not clear?

Yes, it looks like a copy at the first sight... until you actually read it.

[Postal2]

Okay.