Good evening all,
Sorry I’ve been quiet recently - work and family etc.!
@rant welcome to the community! I certainly don’t do this for a living, and it’s great that you’ve joined the effort. Please do get in touch if you’ve got any ideas or see some glaring errors!
Here’s an annotated version of @gmoney’s photo (thanks George!), he is now definitely the official photographer of the group.
There’s ultimately still a lot to fill in on the above picture, and it still needs to be determined whether what looks to be jumpers on the underside of the board will faciliate UART/SWD in addition to the JTAG connection I’ve managed to make. If you can access UART then it would make life seemingly a bit easier and open up the use of tools like CC3200tool etc…
On that note, I don’t yet have clarity on what each test port is for yet. Some staring at the technical documentation is required perhaps.
@apr in terms of getting into the wifi module which is fully sealed, I took the approach of using a stanley knife heated by a blow torch to cut along the evident join. Caution:there’s not a huge amount of space on the other side and you do run the risk of hitting/overheating components!! I compared notes with @gmoney who has complete access to the underside, where as I don’t currently. I will try to glean everything I can before taking the additional risk to cut away the plastic that’s keeping the PCB in place.
I’ve purchased a Texas Instruments LaunchXL CC3200 which has a JTAG in-circuit debugger connector. I chose this board to make the physical connection because I thought it might also be useful later down the line. You may be able to use a cheaper JTAG interface to make the connection but can’t say for sure. By connecting the corresponding ports on the LaunchXL to the CC3200MOD as per the image above, and then subsequently using the Texas Instrument’s Uniflash, I was able to dump the contents of the module’s SRAM flash memory. I’ll need to write this up in fuller detail when I’m next able. If you get this far, do check the memory address ranges in the datasheet for the CC3200MOD as its not immediately obvious otherwise that you’re on the right track. (I’ve also tried other tools like OpenOCD but not had much success so far).
You then need to use an appropriate decompiler to convert the binary into something human interpretable → in the first instance assembly and most decompilers I’ve used on this will translate this into some psuedo C. The time consuming and extremely challenging thing about this is you lose 90% of the context of the programming that was originally there before it was compiled into binary - no function or variable labels, no easily determinable file structure etc… As ever, more from me to come soon.
@APR it would be good to chat, your work on the websocket is a piece of the puzzle I haven’t gotten to yet and some real hurdles to overcome.
Thanks to everyone for the support given to date!