Last post, we looked at the comms between the board and the GPRS modem. There was a long, interesting, string send to a remote server:
LjS1WQjg8FHqR1a4P4DVsjO8eUITXY6ifHPlaFhkZ2SJ
When we look out to the rest of the logic trace, we can see that the EEPROM is accessed exactly as this begins:
From this view, it might look like the EEPROM access is too late for it to be used to generate that long string. However, in microcontroller terms, there is ~0.3ms between the end of the EEPROM access and the start of the first character on serial (I suspect the ‘1’ is a start character). I’ve not checked the crystal speed, but it’s between 2MHz and 20MHz. Even at 2MHz, that’s 600 instructions – plenty of time to act on the EEPROM data.
We now need to zoom in on the EEPROM data and see what is happening:
The trace is maybe a little confusing here. The green bordered binary is the DI line – the microcontroller to the memory. The yellow bordered binary is the DO line – the memory to the microcontroller. The Saleae Logic software has no decoder to deal with Microwire, so we need to use the SPI decoder set with a bit-width to deal with both the receive and transmit sides.
According to the data sheet for the EEPROM, this should be 29 clock cycles. For whatever reason there is an additional clock cycle here though – the very short transition in the middle of the trace. So we set the SPI decoder to 30bits.
The first 3bits of the green bordered binary are 0b110 – a read command. The next 10bits are the address – 0b00 1001 1000 – i.e. 0x098. After this point, we can ignore the green bordered binary.
The last 16bits of the yellow bordered binary are the value from memory – 0x4489.
We should be able to find this in the .prm file. 0x098 is 152. The prm file has a byte per row, and 2 bytes on the first row, so we should need to go to row 304 of the file – and there we go – 89, 44. Perfect.
If we continue going through the trace, we read the following addresses:
0x098 0x098 0x099 0x099 0x09A 0x09A 0x09B 0x09B 0x09C 0x09C
Strangely each of the addresses is read twice. Why? Not sure at this time.
What data do we get back?
8944 1000 3006 3711 7619
This is the ICCID – the unique ID assigned to the SIM card in the GPRS modem.
Could the board be using the ICCID as a key to encrypt the data?
