TaterLi 个人博客

BCK XC7V415T 逆向分析

整版外观是这样的.

首先瞎猜找到JTAG接口,一开始不小心把9V接到单片机直接报废了单片机,本来是打算单片机写一个JTAG扫描程序,挨个换IO扫,右边还有一些不知道什么IO,没分析.

然后用TopJTAG Probe找到他的启动模式是被动串行,那就一定是有下载IO在Beaglebone引脚上.

然后因为是挖矿机,所以IO通信肯定不多,所以IO应该不多.从网上找到一个这么的BCK下载日志.

root@BCKMiner:/sys/devices/virtual/gpio/gpio27# /usr/bin/loadfpga --help
----FPGA_BIN_FILE:/fpgabit/--help----SD_FPGA_BIN_FILE:/sdcard/--help
----Start LoadFPGA:/fpgabit/--help----
Failed to export gpio 45!set direction 45 succeed!
Failed to export gpio 23!set direction 23 succeed!
Failed to export gpio 50!set direction 50 succeed!
Failed to export gpio 22!set direction 22 succeed!
Failed to export gpio 113!set direction 113 succeed!
Failed to export gpio 86!set direction 86 succeed!
Failed to export gpio 7!set direction 7 succeed!
Failed to export gpio 117!set direction 117 succeed!
Failed to export gpio 27!set direction 27 succeed!
Failed to export gpio 44!set direction 44 succeed!
Failed to export gpio 46!set direction 46 succeed!
Failed to export gpio 47!set direction 47 succeed!
Failed to export gpio 88!set direction 88 succeed!
Failed to export gpio 115!set direction 115 succeed!
read 22 succeed!
read 27 succeed!

还原了一下引脚.

Linux gpioNAM335x 名称排针脚位
117GPIO3_21P9_25
22GPIO0_22P8_19
27GPIO0_27P8_17
44GPIO1_12P8_12
46GPIO1_14P8_16
50GPIO1_18P9_14
65GPIO2_1P8_18
115GPIO3_19P9_27
20GPIO0_20P9_41
23GPIO0_23P8_13
4GPIO0_4P9_18
45GPIO1_13P8_11
47GPIO1_15P8_15
51GPIO1_19P9_16
88GPIO2_24P8_28

但是我实测只有一些FPGA有反应,可能是因为这个本身是板载其他电路.但是我看了下是足够的.

信号名FPGA对应引脚
DS3 (电源LED)-
DS4 (DONE LED)-
DS5AD34
DS6AE34
P9_24D34
P9_28INIT_B (T8)
P9_30DIN (AN34)
P9_31CCLK (T9)
P9_25AF34

我猜测原始电路是Beaglebone主板(有可能是蚂蚁自己改的板子),通过DIN + CCLK下载好bit,然后大多数运算在FPGA,最后慢慢和主机通信.所以这个板子除了电源也没什么其他电路.

退出移动版