pok3r-custom / pok3r_re_firmware

Reverse engineering project for the POK3R and related keyboards.
219 stars 17 forks source link

Unable to flash pok3r #39

Closed Mrorlovsky closed 1 year ago

Mrorlovsky commented 1 year ago

similar to #23, I've got as far as flashing the QMK firmware, but have what seems to be a dead keyboard. I could not get openocd-ht32 to build cleanly, so resorted to pyocd, as it has support for both my CMSIS-DAP adapter, and ht32 chips:

hello@mac Downloads $ pyocd pack show | grep -i ht32
  Holtek.HT32_DFP   1.0.44
hello@mac Downloads $ pyocd erase --verbose --chip -t ht32f1655
0000852 I Target type is ht32f1655 [board]
0001010 I DP IDR = 0x2ba01477 (v1 rev2) [dap]
0001015 I AHB-AP#0 IDR = 0x24770011 (AHB-AP var1 rev2) [ap]
0001029 I AHB-AP#0 Class 0x1 ROM table #0 @ 0xe00ff000 (designer=000 part=000) [rom_table]
0001036 I [0]<e000e000:SCS v7-M class=14 designer=43b:Arm part=000> [rom_table]
0001040 I [1]<e0001000:DWT v7-M class=14 designer=43b:Arm part=002> [rom_table]
0001042 I [2]<e0002000:FPB v7-M class=14 designer=43b:Arm part=003> [rom_table]
0001044 I [3]<e0000000:ITM v7-M class=14 designer=43b:Arm part=001> [rom_table]
0001048 I [4]<e0040000:TPIU M3 class=9 designer=43b:Arm part=923 devtype=11 archid=0000 devid=ca0:0:0> [rom_table]
0001050 I CPU core #0 is Cortex-M3 r2p0 [cortex_m]
0001053 I 4 hardware watchpoints [dwt]
0001055 I 6 hardware breakpoints, 4 literal comparators [fpb]
0001064 I Erasing chip... [eraser]
0001273 I Chip erase complete [eraser]
hello@mac Downloads $ pyocd flash --verbose -t ht32f1655 --format bin firmware_builtin.bin
0000820 I Target type is ht32f1655 [board]
0000970 I DP IDR = 0x2ba01477 (v1 rev2) [dap]
0000975 I AHB-AP#0 IDR = 0x24770011 (AHB-AP var1 rev2) [ap]
0000983 I AHB-AP#0 Class 0x1 ROM table #0 @ 0xe00ff000 (designer=000 part=000) [rom_table]
0000987 I [0]<e000e000:SCS v7-M class=14 designer=43b:Arm part=000> [rom_table]
0000989 I [1]<e0001000:DWT v7-M class=14 designer=43b:Arm part=002> [rom_table]
0000991 I [2]<e0002000:FPB v7-M class=14 designer=43b:Arm part=003> [rom_table]
0000993 I [3]<e0000000:ITM v7-M class=14 designer=43b:Arm part=001> [rom_table]
0000997 I [4]<e0040000:TPIU M3 class=9 designer=43b:Arm part=923 devtype=11 archid=0000 devid=ca0:0:0> [rom_table]
0001001 I CPU core #0 is Cortex-M3 r2p0 [cortex_m]
0001004 I 4 hardware watchpoints [dwt]
0001007 I 6 hardware breakpoints, 4 literal comparators [fpb]
0001020 I Loading firmware_builtin.bin [load_cmd]
[==================================================] 100%
0002521 I Erased 9216 bytes (18 sectors), programmed 9216 bytes (18 pages), skipped 0 bytes (0 pages) at 6.00 kB/s [loader]
hello@mac Downloads $
hello@mac pokertool-build $ ./pok3rtool list
List Devices...
Vortex POK3R (bootloader): CLEARED
hello@mac pokertool-build $

which seems to work. Flashing, using the default keymap them seems too work, but the keyboard never shows up, despite replugging it. The log from this last flashing attempt is here

hello@mac pokertool-build $ ./pok3rtool -t pok3r flash "QMK_POK3R" ./vortex_pok3r_default.bin
WARNING: THIS TOOL IS RELATIVELY UNTESTED, AND HAS A VERY REAL RISK OF CORRUPTING YOUR KEYBOARD, MAKING IT UNUSABLE WITHOUT EXPENSIVE DEVELOPMENT TOOLS. PROCEED AT YOUR OWN RISK.
Type "OK" to continue:
OK
Proceeding...
Opened Vortex POK3R (bootloader)
Update Firmware: vortex_pok3r_default.bin
Current Version: CLEARED
Clear Version
Erase...
Write...
Check...
Clear Version
Writing Version: QMK_POK3R
Reset to Firmware
true
hello@mac pokertool-build $ ./pok3rtool list
List Devices...
hello@mac pokertool-build $

Any help greatly appreciated!

ChaoticEnigma commented 1 year ago

Does the keyboard not work at all after flashing? Nothing new in lsusb (or the mac equivalent)? What's the exact commit you built qmk-pok3r from?

Mrorlovsky commented 1 year ago

Hey, thanks for responding so quickly! The keyboard send input - albeit garbage - while in boot loader mode, and does show in what passes for something close to lsusb (system_profiler SPUSBDataType) under osx when at the bootloader:

        USB-HID Keyboard:

          Product ID: 0x1141
          Vendor ID: 0x04d9  (Holtek Semiconductor, Inc.)
          Version: 1.01
          Speed: Up to 12 Mb/s
          Location ID: 0x14200000 / 27
          Current Available (mA): 500
          Current Required (mA): 100
          Extra Operating Current (mA): 0

Flashing the firmware results in no corresponding entry, no input at all from the keyboard.

I've done a clean checkout and rebuild of the firmware: https://pastebin.com/DGDTcCn1 with no improvement. two related notes, from this pass of erasing/flashing/flashing:

This actually has an older chip - it's marked as a HT32F1654. I've tried re-running things via pyocd calling that specific module, with no improvement. subsequently, I should add that this is also an older pok3r - pcb is labelled as:

VT2023R KB
Ver02 20160506
P/N:KA01
#towards the bottom of the board:
K08044NN2C
ChaoticEnigma commented 1 year ago

Ahh, ok. That makes sense then. Your keyboard is a POK3R RGB (v2). You can flash the bootloader from here to get it back into a working state. You can also find the factory firmware here (upload with pokertool).

qmk_pok3r might work for the pok3r rgb (I think I have it noted as "unstable"), but I'm uncertain if it would work with the pok3r rgb v2. It does not currently support the RGB LEDs, although another contributor has just recently done some very interesting work on that.

Mrorlovsky commented 1 year ago

Aha! well apologies for the unhelpful confusion here. I purchased this keyb so log ago, I'd apparently clean forgot it was the 'rgb' var, and I'd never used that feature anyway! I'm on the right path, and with the correct bootloader, I have a working board of sorts. Cannot get the linked factory fw to flash, but that might be a local problem?

$ ./pok3rtool list
List Devices...
Vortex POK3R RGB2 (bootloader): CLEARED
$ ./pok3rtool --ok -t pok3r-rgb flash test ./vortex_pok3r_rgb_default.bin
No device found, check connection and permissions $

it's certainly connected:

        USB-HID IAP:

          Product ID: 0x1207
          Vendor ID: 0x04d9  (Holtek Semiconductor, Inc.)
          Version: 11.01
          Speed: Up to 12 Mb/s
          Location ID: 0x14200000 / 6
          Current Available (mA): 500
          Current Required (mA): 100
          Extra Operating Current (mA): 0

But this is a major help, thanks ChaoticEnigma!

too late in the day, that's the RGB2 bootloader, and I'm sending the wrong device with -t in pok3rtool. Mystery solved!
ChaoticEnigma commented 1 year ago

Yep, you need -t pok3r-rgb2.

I've been meaning to "finish" the pok3r rgb support forever. Maybe I can get to that soon.

Glad I could help.