For fun I have taken it upon myself to try to reverse engineer a consumer blood pressure device. The device uses a C8051F007 32 pin MCU. I am trying to figure out how I can eavesdrop on the communication between the MCU and the various sensors so I can obtain blood pressure readings. From the documents I have read the chip supports in system JTAG debugging. I don't know enough yet to utilize this knowledge.

What am I trying to do is identify the UART pins or any kind of serial communication pins. I have an oscilloscope and am hoping I will be able to identify some values in the communication.I need some tips on figuring out how to get data off this chip

Here is the pinout (notice no TX or RX)

enter image description here

Any information or tips will be welcomed.

  • 2
    \$\begingroup\$ You don't seem to have found a decent datasheet. Here's one: keil.com/dd/docs/datashts/silabs/c8051f0xx.pdf \$\endgroup\$ – AngryEE Feb 17 '12 at 3:48
  • \$\begingroup\$ I actually found that and have been trying to figure out what information I can use and what I can't. Any advice? \$\endgroup\$ – reverser889 Feb 17 '12 at 3:55
  • 2
    \$\begingroup\$ Do you not know how to read datasheets? That could be an impediment to reverse-engineering something. \$\endgroup\$ – AngryEE Feb 17 '12 at 15:21

Fig 1.1 page 9 shown that there is an internal crossbar switch between the 24 pins of Ports 0, 1 & 2 and most peripherals. ie any of the functions shown can possibly be mapped at compile time to any of those pins. The data sheet may elsewhere limit that flexibility but from fig 1.1 it seems that it may not.

If the peripherals are fully flexibly mappable then sniffing the pins in some way is the only option if you cannot find implementation information.

If you can tell us brand and model one of us may have some luck turning up information.

It should be "easy enough" TM to determine which pins are inputs from whatever is used as a pressure sensor.

IF the UART is continually transmitting during operation )(and it may well not be) then setting your scope to about one division per bit time for various standard com rates may give you a screen of properly timed pulses when you look at the UART TX pin when transmitting. eg if the TX rate is 9600 baud then setting the scope to say 100 or 200 uS/division ~+ 1 to 2 bit times per division may show bits at about 1 or 2 per division when the UART TX pin is observed. This will probably not sync without fiddling but should let you know when/if you find an operating UART TX line.

  • \$\begingroup\$ actually the figure on page 11 more closely aligns to the graphical pinout shown in the OP's question... which means there's really only the 8 digital I/O pins that the UART traffic can be mapped to. \$\endgroup\$ – vicatcu Feb 17 '12 at 19:40

Well the TMS, TCK, TDI, TDO pins are the JTAG interface, for what it's worth... also looks like it has 4 analog inputs, two DAC outputs, and an 8-bit digital i/o port...

The "various sensors" are probably on the AIN0 ... AIN3 pins and you'd want to look at those using an oscilloscope. You'll want to take measurements with respect to AGND. There could also be sensors with a digital interface (e.g. I2C or SPI) and those could be "bit-banged" on any of the P0.1 ... P0.7 pins.

That should get you started.

  • \$\begingroup\$ Do you have any links to articles that could possibly help me? \$\endgroup\$ – reverser889 Feb 17 '12 at 3:38
  • \$\begingroup\$ I'm guessing you don't have access to an oscilloscope and are wishing you could attach to the processor and read it's Analog to Digital conversion registers to glean the values it reads ... you'll need a JTAG debugger for that processor for that which is probably fairly pricey \$\endgroup\$ – vicatcu Feb 17 '12 at 3:42
  • \$\begingroup\$ I do have an oscilloscope! \$\endgroup\$ – reverser889 Feb 17 '12 at 3:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.