• Welcome to TechPowerUp Forums, Guest! Please check out our forum guidelines for info related to our community.

Thunderbolt 1 Into deep. Notes, Boardviews etc.

Joined
May 22, 2020
Messages
148 (0.11/day)
Location
Ukraine
debug.jpg




Everything begin a year ago. Few of thunderbolt dongles failed because of cable damage. Influence of time. Okay easy to buy a new, that is cheap. Okay i did it, but decided to look inside and maybe repair for fun. So Disassembly was pretty hard, but successful. one of wires was partially frayed i have cut that wires to resolder them back. It was hard, wires are shielded 36 or 32 AWG. So a year i decided to come back to project and rebuild Thunderbolt dongle to cheap pci expansion for x1 pcie cards like USB 3.0 hub or soundcard.



The first files:
Apple Thunderbolt Ethernet - SPI Eeprom flash - 4096 bytes - 32 b.bin
HPM-em-00020007.bin
iMac-21.4-22-01.bin
iMac-27-22-01.bin
MBP-22-01.bin
ThorUtil.efi

from two dongles - spi roms.zip with two firmwares for comparison

Problem:
Thunderbolt require patching to make dsl2210 to work as root or switch




PINS.png

 

Attachments

  • Apple Thunderbolt Ethernet - SPI Eeprom flash - 4096 bytes - 32 b.bin.zip
    1.7 KB · Views: 113
  • Thunderbolt update.zip
    87.2 KB · Views: 102
  • from two dongles - spi roms.zip
    3.1 KB · Views: 99
Last edited:
Joined
May 22, 2020
Messages
148 (0.11/day)
Location
Ukraine
If disconnect clockrequest, wake, nc dongle still working fine at S0 state hotplug only test
FA71AD94-8AB7-4DF4-86E6-ABC51453B17C.jpeg52E79323-8342-4401-92DF-BDB79F7B9AB0.jpeg847E9DEA-1DDD-4C75-9D9F-D6E413737462.jpeg

Also if connect 3.3v dp power and 3.3v power_en Drain then there is no reason to use “G” wire - Power_Enable.

So only important wires are:
3.3v dp power
1.05v dsl2210 power
Gnd

Pci rx, tx, refclk, pairs and Reset PERST#
 
Joined
May 22, 2020
Messages
148 (0.11/day)
Location
Ukraine
Next steps:
1. Find Broadcom option rom for 1 and 2 ics. It seems like that ic is clean and requires oprom from dsl spi flash.
2. Capture traffic signals at uart (thunderbolt connector. Jtag signals from cortex processor that goes to dsl2210
3. Analyze spi rom data, offsets, possibly whitelist
 
Joined
May 22, 2020
Messages
148 (0.11/day)
Location
Ukraine
At least I do have a cheap cool Ethernet pcb for joy

Pins are okay.

Important to solder TXD on Apple Ethernet pcb to RXD pcie pin to make it work
 

Attachments

  • A123A006-CDF4-4301-889B-8CE3DB656B1E.jpeg
    A123A006-CDF4-4301-889B-8CE3DB656B1E.jpeg
    4 MB · Views: 175
  • 985DD3C9-27CC-4F3E-A59F-D96FB89AADAC.jpeg
    985DD3C9-27CC-4F3E-A59F-D96FB89AADAC.jpeg
    1.4 MB · Views: 180
Joined
May 22, 2020
Messages
148 (0.11/day)
Location
Ukraine
****** INPUT ********


FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF1370F816060200010048314D98016E0001000380010508810000602A00000B820001400A00000000000E014170706C652C20496E632E002A025468756E646572626F6C7420746F20476967616269742045746865726E65742041646170746572001A3044544E363236373030343444574B48424D000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF


****** DECODING ********


13

******

70F8
160602000100

= UID = UID: 0x000100020616F870

******

48314D98016E00


******

0100

= Vendor ID: 0x1
******

0380

= Device ID: 0x8003

******

010508810000602A00000B820001400A00000000000E01

******

4170706C652C20496E632E
= ASCII = Vendor Name: Apple Inc.

******

002A02


******

5468756E646572626F6C7420746F20476967616269742045746865726E65742041646170746572
= ASCII = Device Name: Thunderbolt to Gigabit Ethernet Adapter
******

001A30
*******

44544E363236373030343444574B48424

= ASCII S\N = Apple Serial Number: DTN62670044DWKHBM

*******

D000000000000000000000000000000000000000000000000000000000000000000000000000000
 
Joined
May 22, 2020
Messages
148 (0.11/day)
Location
Ukraine
Screen Shot 2021-12-04 at 18.23.00.png

Logic Analyzing

The only problem: I don’t know how to decode uart data. What the speed and bits
 

Attachments

  • UART+I2C+PWR+RST.zip
    22.5 KB · Views: 92
Last edited:
Joined
May 22, 2020
Messages
148 (0.11/day)
Location
Ukraine
DECODING SIGNALS

TX Data

FE050690110A020260185753D8958C4F030000F5C1EDFE40FE05030460F2FE40FE050A01A6A1FE40FE817EFE807FFEA15EFEA05FFE817EFE807FFEA15EFEA05FFE817EFE807FFEA15EFEA05FFE817EFE807FFEA15EFEA05FFE817EFE807FFEA15EFEA05FFE817EFE807FFE817EFE827DFEA15EFEA05FFEA15EFEA05FFEA15EFEA05FFEA15EFEA05FFEA15EFEA05FFEA15EFEA05FFEA15EFEA05F

RX Data
FE040690008D15FE40FE0403044150502086C6FE40FE040A011F614EFE40FE817EFE807FFE817EFE807FFE817EFE807FFE817EFE807FFE817EFE807FFE817EFE807FFE817EFE807FFE817EFE827D


I2C Data
name ack address read data
I2C
I2C true 0x15 false
I2C true 0x0F
I2C
I2C true 0x15 true
I2C true 0x08
I2C true 0x00
I2C true 0x00
I2C false 0x00
I2C
I2C
I2C true 0x15 false
I2C true 0x0F
I2C
I2C true 0x15 true
I2C true 0x08
I2C true 0x00
I2C true 0x00
I2C false 0x00
I2C
I2C
I2C false 0x12 false
I2C
I2C
I2C false 0x13 false
I2C
I2C
I2C false 0x14 false
I2C
I2C
I2C true 0x15 false
I2C true 0x10
I2C true 0x57
I2C true 0x61
I2C true 0x6B
I2C true 0x65
I2C
I2C
I2C true 0x15 false
I2C true 0x0A
I2C
I2C true 0x15 true
I2C false 0x1F




The last signal to analyze is SPI from ARM to DSL2210
 

Attachments

  • RX Data.bin.zip
    824 bytes · Views: 92
  • TX Data.bin.zip
    847 bytes · Views: 83
Last edited:
Joined
May 22, 2020
Messages
148 (0.11/day)
Location
Ukraine
How to dump cortex firmware? The cortex schematic show that it has internal flash rom
 

4ts9v

New Member
Joined
Jul 24, 2020
Messages
2 (0.00/day)
How to dump cortex firmware? The cortex schematic show that it has internal flash rom
I'm not certain at this moment but this is a very cool/neat project!

I'd love to help and this gives me ideas for some things we might work on together...

Do you have some Instant Messenger or something? PM me (I'm new) and I'll add you. I would happily fund/help out if it would expedite things for the current internal flash read... Actually I think I know how we can do that.
 
Joined
May 22, 2020
Messages
148 (0.11/day)
Location
Ukraine
New soldering iron arrives and I continued research, and what I do know now:


Spi interface from arm to dsl2210 is quite, none data signals at any power states.





Also I soldered dsl pcie wires to pcie slot female, insert there working Ethernet (second part of dongle) which was soldered to pcie male and nothing happened. I check everything few times and electrically it should work but actually not.





I measured voltages of pcie lanes and seems Ethernet ic is not responding. Okay that means that ic trx wont transmit.





Okay I connected that to pc pcie and everything is working. Solder dsl wires directly to Ethernet ic (second part of dongle) and all working again.





So I solder dsl2210 pcie wires directly to pcie male and it still won’t work.





Why Apple engineers used covered wires ( with gnd isolated)?





Maybe signals from dsl2210 have no filters and they are dirty enough to be unrecognizable by Ethernet ic.





Hate those tiny wires soldering...








The next step: connect dsl2210 pcie wires to additional same wires to see if pcie signals will work correctly.





Anyway that dsl2210 isn’t good for creating of something like pcie adapter. Even if I will cut half of the oem wire it could not work...
 

Attachments

  • BC18A47D-6110-4434-93DC-D04EFA7DBD56.jpeg
    BC18A47D-6110-4434-93DC-D04EFA7DBD56.jpeg
    3.3 MB · Views: 134
  • 66F2AA71-D2DA-466B-9B1E-73DAE31F9F45.jpeg
    66F2AA71-D2DA-466B-9B1E-73DAE31F9F45.jpeg
    4.6 MB · Views: 123
  • A6DCE836-74D9-4945-AA36-5F61AD85D104.jpeg
    A6DCE836-74D9-4945-AA36-5F61AD85D104.jpeg
    1.8 MB · Views: 115
  • F0C86ED1-5C3E-4145-AA6D-CCCF0F1D1498.jpeg
    F0C86ED1-5C3E-4145-AA6D-CCCF0F1D1498.jpeg
    874.1 KB · Views: 113
Joined
May 22, 2020
Messages
148 (0.11/day)
Location
Ukraine
Actually there is no data or clock at spi:


Then how this two ics are communicating?
 

Attachments

  • 151F24E1-29D8-4A95-94EE-D8C698608043.jpeg
    151F24E1-29D8-4A95-94EE-D8C698608043.jpeg
    146.5 KB · Views: 76
Last edited:
Joined
May 22, 2020
Messages
148 (0.11/day)
Location
Ukraine
That’s how it should be

IMG_1137.jpgIMG_1138.jpg

Tried long cable ( two wires covered by ground. Results: no initialization
IMG_1135.jpgIMG_1136.jpg

Directly connected to pcie card. Result: no initialization but ic stars because of pcireset
IMG_1125.jpgIMG_1124.jpg
So that’s the long wire or whitelist



Low light but LED affects
IMG_1132.jpgIMG_1133.jpg
I will try to cut wire for 60%. If that’s not work, then that’s whitelist. For solving that need FireWire firmware to unlock proper device id
 
Joined
May 22, 2020
Messages
148 (0.11/day)
Location
Ukraine
other firmware apple updates 1.2 from apple
 

Attachments

  • Firmware Updates.zip
    878.3 KB · Views: 88
Joined
May 22, 2020
Messages
148 (0.11/day)
Location
Ukraine
Spi captured data 70% of data is important to boot. 30% data is ... maybe for os recognazion (cosmetics)



FFFFFF

========================================================================================
========BOOTLOADER:

4A0004670149150021800500008003092C418F045353515100006D800010A01B24000000000000002E000000000000002727B800000000000000000000000000082D2B2D2D2DAAAA80000000400000010300D00808187822B126042A6A0002206B215F227C2335240025002600270E281C000010A01110130000010448080F0A2A0B7B100E00E1751479101245B9DB00E0E0A300F01B500000010100D0910500F025400000000000000000000000000000000000000000000000000000000000000000000000000000000000004000F3A050A1F1A888603D611962406314A50000F0402000012E5700112E5700212E5700312E570000010300020D03077A0000010100F38BFFD3090000000000F140E8410300F174A7753200F160010002083909C400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800F001030002040000050A8E00F00101FFFFFFFFFFFFFFFF

========================================================================================
=======THUNDERBOLT FIRMWARE (DOUBLE TIMES):

8200410200100000800C0500800908F07F0702F01006A25C92050230F20A234CFE070230F80A234CFE070A30F40A234CFE0704006406280F86031050070510A436050400800986F40008040080094E8CDE070230F80A374CFE072030F40A314CFE070800A4002230F40A374CFE070A00A4000430F80A4F4CFE072030F40A4F4CFE07050080091010A20004006406280F86030000A600021F360A0400800986F4000804006406280F860386F4000874022A200000800C688CDE070230F80A694CFE072030F40A634CFE070800A4002230F40A694CFE070A00A40004F064060400FA01EAF400087C0237300000800C0430F80A774CFE070410AA00A0F53F0718F5000848023D400000800C1500800900F010062250930500F030060430F80A8F4CFE071030F20A8F4CFE070450070504F056061400800992F40008C4034A50F8F07307F6F060010030F00AA33CFE071000A00971F040088AF7000808FF7F07810080099400A00902F05006045C1A0500783A0510008E065400AC0008F171070408A20004005206280F800304005606280F8003800080098AF700082D006160FEFFA109F8F0E002F6F0E002F8F07307B8F47F0702F05006F8F0EA024000A00910008E065CF000082E026B701A30F20AE54CFE07F8F06001F6F0E0020800A0090800A400DAF5000828F60008760073800000800CF6F0600100

FFFFFF

8200410200100000800C0500800908F07F0702F01006A25C92050230F20A234CFE070230F80A234CFE070A30F40A234CFE0704006406280F86031050070510A436050400800986F40008040080094E8CDE070230F80A374CFE072030F40A314CFE070800A4002230F40A374CFE070A00A4000430F80A4F4CFE072030F40A4F4CFE07050080091010A20004006406280F86030000A600021F360A0400800986F4000804006406280F860386F4000874022A200000800C688CDE070230F80A694CFE072030F40A634CFE070800A4002230F40A694CFE070A00A40004F064060400FA01EAF400087C0237300000800C0430F80A774CFE070410AA00A0F53F0718F5000848023D400000800C1500800900F010062250930500F030060430F80A8F4CFE071030F20A8F4CFE070450070504F056061400800992F40008C4034A50F8F07307F6F060010030F00AA33CFE071000A00971F040088AF7000808FF7F07810080099400A00902F05006045C1A0500783A0510008E065400AC0008F171070408A20004005206280F800304005606280F8003800080098AF700082D006160FEFFA109F8F0E002F6F0E002F8F07307B8F47F0702F05006F8F0EA024000A00910008E065CF000082E026B701A30F20AE54CFE07F8F06001F6F0E0020800A0090800A400DAF5000828F60008760073800000800CF6F0600100

========================================================================================
=======THUNDERBOLT FUNCTIONALITY??? (Look like pci initialization or hardcoded instructions):

30F00AF33CFE071000A00971F0400872F30008
FFFFFF
86804915
FFFFFF
00003000
FFFFFFFFFFFFFFFFFFFF
001CA000
FFFFFF86804915FFFFFF
001CA000
FFFFFF
00000100
FFFFFF
3C04A000
FFFFFF
50090080
FFFFFF
421DA000
FFFFFF
39000000
FFFFFF
431DA000
FFFFFF
00000004
FFFFFF
3A402800
FFFFFF
00041100
FFFFFF
32003000
FFFFFF
C0040000
FFFFFF
34003000
 
Last edited:
Joined
May 22, 2020
Messages
148 (0.11/day)
Location
Ukraine
some new. cant map code to decompiler

============================================================================
============================================================================
*************** HEX DATA OF ROM (WHOLE)
============================================================================
============================================================================

4A0004670149150021800500008003092C418F045353515100006D800010A01B24000000000000002E000000000000002727B800000000000000000000000000082D2B2D2D2DAAAA80000000400000010300D00808187822B126042A6A0002206B215F227C2335240025002600270E281C000010A01110130000010448080F0A2A0B7B100E00E1751479101245B9DB00E0E0A300F01B500000010100D0910500F025400000000000000000000000000000000000000000000000000000000000000000000000000000000000004000F3A050A1F1A888603D611962406314A50000F0402000012E5700112E5700212E5700312E570000010300020D03077A0000010100F38BFFD3090000000000F140E8410300F174A7753200F160010002083909C400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800F001030002040000050A8E00F00101FFFFFFFFFFFFFFFF8200410200100000800C0500800908F07F0702F01006A25C92050230F20A234CFE070230F80A234CFE070A30F40A234CFE0704006406280F86031050070510A436050400800986F40008040080094E8CDE070230F80A374CFE072030F40A314CFE070800A4002230F40A374CFE070A00A4000430F80A4F4CFE072030F40A4F4CFE07050080091010A20004006406280F86030000A600021F360A0400800986F4000804006406280F860386F4000874022A200000800C688CDE070230F80A694CFE072030F40A634CFE070800A4002230F40A694CFE070A00A40004F064060400FA01EAF400087C0237300000800C0430F80A774CFE070410AA00A0F53F0718F5000848023D400000800C1500800900F010062250930500F030060430F80A8F4CFE071030F20A8F4CFE070450070504F056061400800992F40008C4034A50F8F07307F6F060010030F00AA33CFE071000A00971F040088AF7000808FF7F07810080099400A00902F05006045C1A0500783A0510008E065400AC0008F171070408A20004005206280F800304005606280F8003800080098AF700082D006160FEFFA109F8F0E002F6F0E002F8F07307B8F47F0702F05006F8F0EA024000A00910008E065CF000082E026B701A30F20AE54CFE07F8F06001F6F0E0020800A0090800A400DAF5000828F60008760073800000800CF6F060010030F00AF33CFE071000A00971F0400872F30008FFFFFFFFFFFFFFFFFFFFFFFFFFFFFF8680491500003000FFFFFFFF001CA00086804915001CA000000001003C04A00050090080421DA00039000000431DA000000000043A4028000004110032003000C004000034003000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF184000003720280000000000220030004D0000002100300080000000220030002A00000023003000900000002500300008000000230030001000000025003000530000002300300010000000250030006C00000023003000100000002500300065000000230030001000000025003000700000002300300050000000250030000000000025003000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF84D0B37A010200010045CFB3E9016E0001000380010508810000602A00000B820001400A00000000000E014170706C652C20496E632E002A025468756E646572626F6C7420746F20476967616269742045746865726E65742041646170746572001A3044544E333235323033325344574B48424B000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF


============================================================================
============================================================================
*************** DECODING
============================================================================
============================================================================




============================================================================
============================================================================
*************** BOOTLOADER
============================================================================
============================================================================



1001010000000000000010001100111000000010100100100010101000000000010000110000000000001010000000000000000100000000000001100001001001011000100000110001111000001000101001101010011010100010101000100000000000000000110110110000000000000000001000010100000000110110010010000000000000000000000000000000000000000000000000000000000001011100000000000000000000000000000000000000000000000000000000000100111001001111011100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000010110100101011001011010010110100101101101010101010101010000000000000000000000000000000010000000000000000000000000000010000001100000000110100000000100000001000000110000111100000100010101100010010011000000100001010100110101000000000000000100010000001101011001000010101111100100010011111000010001100110101001001000000000000100101000000000010011000000000001001110000111000101

0000001110000000 - tb Device ID: 0x8003

0000000000000010000101000000001000100010000000100110000000000000000000000010000010001001000000010000000111100001010001010100000101101111011000100

0000001110000000 - tb Device ID: 0x8003

00111000010111010100010100011110010001000000010010010001011011100111011011000000001110000011100000101000110000000011110000000110110101000000000000000000000000000100000001000000001101000010010001000001010000000011110000001001010100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000001111001110100000010100001010000111110001101010001000100001100000001111010110000100011001011000100100000001100011000101001010010100000000000000001111000001000000001000000000000000000001001011100101011100000000000100010010111001010111000000000010000100101110010101110000000000110001001011100101011100000000000000000000000100000011000000000000001000001101000000110000011101111010000000000000000000000001000000010000000011110011100010111111111111010011000010010000000000000000000000000000000000000000111100010100000011101000010000010000001100000000111100010111010010100111011101010011001000000000111100010110000000000001000000000000001000001000001110010000100111000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000001111000000000001000000110000000000000010000001000000000000000000000001010000101010001110000000001111000000000001000000011111111111111111111111111111111111111111111111111111111111111111


============================================================================
============================================================================
*************** TB FIRMWARE (LOADED 2 Times)
============================================================================
============================================================================


100000100000000001000001000000100000000000010000000000000000000010000000000011000000010100000000100000000000100100001000111100000111111100000111000000101111000000010000000001101010001001011100100100100000010100000010001100001

1110010000010100 - Vendor Id - Broadcom - 0x14E4

010001101001100111111100000011100000010001100001111100000001010001000110100110011111110000001110000101000110000111101000000101000100011010011001111111000000111000001000000000001100100000001100010100000001111100001100000001100010000010100000000011100000101000100001010010000110110000001010000010000000000100000000000100110000110111101000000000000001000000001000000000010000000000010010100111010001100110111100000011100000010001100001111100000001010001101110100110011111110000001110010000000110000111101000000101000110001010011001111111000000111000010000000000010100100000000000010001000110000111101000000101000110111010011001111111000000111000010100000000010100100000000000000010000110000111110000000101001001111010011001111111000000111001000000011000011110100000010100100111101001100111111100000011100000101000000001000000000001001000100000001000010100010000000000000010000000000011001000000011000101000000011111000011000000011000000000000000010100110000000000000001000011111001101100000101000000100000000001000000000001001100001101111010000000000000010000000010000000000011001000000011000101000000011111000011000000011100001101111010000000000000010000111010000000010001010100010000000000000000000001000000000001100011010001000110011011110000001110000001000110000111110000000101001101001010011001111111000000111001000000011000011110100000010100110001101001100111111100000011100001000000000001010010000000000001000100011000011110100000010100110100101001100111111100000011100001010000000001010010000000000000001001111000001100100000001100000010000000000111110100000000111101010111101000000000000001000011111000000001000110111001100000000000000000000100000000000110000000100001100001111100000001010011101110100110011111110000001110000010000010000101010100000000010100000111101010011111100000111000110001111010100000000000010000100100000000010001111010100000000000000000000001000000000001100000101010000000010000000000010010000000011110000000100000000011000100010010100001001001100000101000000001111000000110000000001100000010000110000111110000000101010001111010011001111111000000111000100000011000011110010000010101000111101001100111111100000011100000100010100000000011100000101000001001111000001010110000001100001010000000000100000000000100110010010111101000000000000001000110001000000001101001010010100001111100011110000011100110000011111110110111100000110000000000001000000000011000011110000000010101010001100111100111111100000011100010000000000001010000000001001011100011111000001000000000010001000101011110111000000000000100000001000111111110111111100000111100000010000000010000000000010011001010000000000101000000000100100000010111100000101000000000110000001000101110000011010000001010000000001111000001110100000010100010000000000001000111000000110010101000000000010101100000000000000100011110001011100010000011100000100000010001010001000000000000001000000000001010010000001100010100000001111100000000000001100000100000000000101011000000110001010000000111110000000

0000001110000000 - tb Device ID: 0x8003 ?????

000000001000000000001001100010101111011100000000000010000010110100000000011000010110000011111110111111111010000100001001111110001111000011100000000000101111011011110000111000000000001011111000111100000111001100000111101110001111010001111111000001110000001011110000010100000000011011111000111100001110101000000010010000000000000010100000000010010001000000000000100011100000011001011100111100000000000000001000001011100000001001101011011100000001101000110000111100100000101011100101010011001111111000000111111110001111000001100000000000011111011011110000111000000000001000001000000000001010000000001001000010000000000010100100000000001101101011110101000000000000100000101000

1111011000000000 - Subsystem ID: 0x00f6 ?????

000010000111011000000000011100111000000000000000000000001000000000001100111101101111000001100000000000010000000000


110000111100000000101011110011001111001111111000000111000100000000000010100000000010010111000111110000010000000000100001110010111100110000000000001000





============================================================================
============================================================================
*************** END OF FILE
============================================================================
============================================================================




111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111





============================================================================
============================================================================
*************** Some instructions - very looking same as PCIe Initialization
============================================================================
============================================================================






======== *** yes, loaded in one sequence - (out of binary-note only) 10000110100000000100100100010101

1000011010000000 - Intel Device ID - 0x8086

0100100100010101 - Suspect DSL 2210 Device Id = 0x1549 ?????

00000000000000000011000000000000


11111111111111111111111111111111

00000000000111001010000000000000

1000011010000000 - Intel Device ID - 0x8086

0100100100010101 - Suspect DSL 2210 Device Id = 0x1549 ????


00000000000111001010000000000000

000000000000000000000001000000000011110000000100101000000000000001010000000010010000000010000000010000100001110110100000000000000011100100000000000000000000000001000011000111011010000000000000000000000000000000000000000001000011101001000000001010000000000000000000000001000001000100000000001100100000000000110000000000001100000000000100000000000000000000110100000000000011000000000000







============================================================================
============================================================================
*************** END OF FILE
============================================================================
============================================================================




1111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111




============================================================================
============================================================================
*************** Looking close to ARM instructions
============================================================================
============================================================================



000110000100000000000000000000000011011100100000001010000000000000000000000000000000000000000000001000100000000000110000000000000100110100000000000000000000000000100001000000000011000000000000100000000000000000000000000000000010001000000000001100000000000000101010000000000000000000000000001000110000000000110000000000001001000000000000000000000000000000100101000000000011000000000000000010000000000000000000000000000010001100000000001100000000000000010000000000000000000000000000001001010000000000110000000000000101001100000000000000000000000000100011000000000011000000000000000100000000000000000000000000000010010100000000001100000000000001101100000000000000000000000000001000110000000000110000000000000001000000000000000000000000000000100101000000000011000000000000011001010000000000000000000000000010001100000000001100000000000000010000000000000000000000000000001001010000000000110000000

0000001110000000 - tb Device ID: 0x8003

0000000000000000000000010001100000000001100000000000001010000000000000000000000000000001001010000000000110000000000000000000000000000000000000000000000100101000000000011000000000000




============================================================================
============================================================================
*************** END OF FILE
============================================================================
============================================================================


1111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111



============================================================================
============================================================================
*************** Cosmetics? Apple, Inc.*Thunderbolt to Gigabit Ethernet Adapter DTN3252032SDWKHBK, UUID, Etc
============================================================================
============================================================================



10000100110100001011001101111010000000010000001000000000000000010000000001000101110011111011001111101001000000010110111000000000

0000000100000000 - tb Vendor ID: 0x1

0000001110000000 - tb Device ID: 0x8003

0000000100000101000010001000000100000000000000000110000000101010000000000000000000001011100000100000000000000001010000000000101000000000000000000000000000000000000000

0000001110000000 - tb Device ID: 0x8003

0101000001011100000111000001101100011001010010110000100000010010010110111001100011001011100000000000101010000000100101010001101000011101010110111001100100011001010111001001100010011011110110110001110100001000000111010001101111001000000100011101101001011001110110000101100010011010010111010000100000010001010111010001101000011001010111001001101110011001010111010000100000010000010110010001100001011100000111010001100101011100100000000000011010001100000100010001010100010011100011001100110010001101010011001000110000001100110011001001010011010001000101011101001011010010000100001001001011000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000



============================================================================
============================================================================
*************** END OF FILE
============================================================================
============================================================================


1111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111
 
Joined
May 22, 2020
Messages
148 (0.11/day)
Location
Ukraine
_Ethernet_ArmCode.bin
_Ethernet_Bootloader.bin
_Ethernet_PcieINIT.bin
_Ethernet_ThunderboltFirmware.bin



In that parts, disassemblers can open code
 

Attachments

  • Archive.zip
    3.3 KB · Views: 72
Joined
May 22, 2020
Messages
148 (0.11/day)
Location
Ukraine
I wasn't here for a long time, and sharing the materials never post before, that was used for analyze of this wonderful dongle. I am not 100% sure that everything there is correct, as it was my first study project, so...

 
Joined
May 22, 2020
Messages
148 (0.11/day)
Location
Ukraine
That is how SPI rom is read when dongle is connected to MBP. Interesting here is that DSL2210 never reads this code:

184000003720280000000000220030004D0000002100300080000000220030002A00000023003000900000002500300008000000230030001000000025003000530000002300300010000000250030006C00000023003000100000002500300065000000230030001000000025003000700000002300300050000000250030000000000025003000

@7 ("0M!0"0*#0%0#0%0S#0%0l#0%0e#0%0p#0P%0%0

1370F816060200010048314D98016E0001000380010508810000602A00000B820001400A00000000000E014170706C652C20496E632E002A025468756E646572626F6C7420746F20476967616269742045746865726E65742041646170746572001A3044544E363236373030343444574B48424D000000000000000000000000000000000000000000000000000000000000000000000000000000


pøH1Mn`*@
Apple, Inc.*Thunderbolt to Gigabit Ethernet Adapter0DTN62670044DWKHBM
 

Attachments

  • SPI READ CAPTURE 3.txt
    3.5 KB · Views: 61
Joined
May 22, 2020
Messages
148 (0.11/day)
Location
Ukraine
Some OC PCIe code from Apple
 

Attachments

  • IOPCIMessagedInterruptController.txt
    25.9 KB · Views: 44
  • PCIe.txt
    530 bytes · Views: 50
Top