Rotimatic
All your roti's are belong to teh hackz0R!
ThanX Vinita for dropping a rabbit hole in the lab ;+)
Original Teardown
https://wiki.recessim.com/view/Roti_making_robot_rotimatic
SPI dump
Initial attempt with chip in circuit, 3v3 power from Tigard, WP & HOLD tied together with 10k resistor and HOLD 10k to ground.
PIC32 held in reset by connecting MCLR to ground via pins 1 & 3 on P8 (presumably populated factory programming header)
~/tigard/roti$ sudo flashrom -p ft2232_spi:type=2232H,port=B,divisor=4 --flash-name flashrom is free software, get the source code at https://flashrom.org Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns). Found Eon flash chip "EN25QH64" (8192 kB, SPI) on ft2232_spi. vendor="Eon" name="EN25QH64" ~/tigard/roti$ sudo flashrom -p ft2232_spi:type=2232H,port=B,divisor=4 --flash-size Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns). Found Generic flash chip "unknown SPI chip (RDID)" (0 kB, SPI) on ft2232_spi. === This flash part has status NOT WORKING for operations: PROBE READ ERASE WRITE This flash part has status UNTESTED for operations: WP 0
Same setup as above, no device detected initially. Pulled Chip Select high then low thru 10k resistor and then...
~/tigard/roti$ sudo flashrom -p ft2232_spi:type=2232H,port=B,divisor=4 -r roti-b Found Eon flash chip "EN25QH64" (8192 kB, SPI) on ft2232_spi. Block protection could not be disabled! Reading flash... done. Error: WIP bit after WRSR never cleared
Generated 8MB file, saved to disk.
Revised process, leave Chip Select floating, works first time on power cycle. Momentarily ground thru 10k resistor to reset for additional commands/queries.
Or toggle between pulled high or low with 10k resistor as needed.
~/tigard/roti$ sudo flashrom -p ft2232_spi:type=2232H,port=B,divisor=4 --flash-size Found Eon flash chip "EN25QH64" (8192 kB, SPI) on ft2232_spi. 8388608
Flash Memory hexdump
The 8MB of data read only contains 0x70 0x17 0x1c over and over and over.
Here is a dump of the first 256 bytes, is the same until the end of the file.
~/tigard/roti$ hexdump -n 256 -C roti-b 00000000 70 17 1c 70 17 1c 70 17 1c 70 17 1c 70 17 1c 70 |p..p..p..p..p..p| 00000010 17 1c 70 17 1c 70 17 1c 70 17 1c 70 17 1c 70 17 |..p..p..p..p..p.| 00000020 1c 70 17 1c 70 17 1c 70 17 1c 70 17 1c 70 17 1c |.p..p..p..p..p..| 00000030 70 17 1c 70 17 1c 70 17 1c 70 17 1c 70 17 1c 70 |p..p..p..p..p..p| 00000040 17 1c 70 17 1c 70 17 1c 70 17 1c 70 17 1c 70 17 |..p..p..p..p..p.| 00000050 1c 70 17 1c 70 17 1c 70 17 1c 70 17 1c 70 17 1c |.p..p..p..p..p..| 00000060 70 17 1c 70 17 1c 70 17 1c 70 17 1c 70 17 1c 70 |p..p..p..p..p..p| 00000070 17 1c 70 17 1c 70 17 1c 70 17 1c 70 17 1c 70 17 |..p..p..p..p..p.| 00000080 1c 70 17 1c 70 17 1c 70 17 1c 70 17 1c 70 17 1c |.p..p..p..p..p..| 00000090 70 17 1c 70 17 1c 70 17 1c 70 17 1c 70 17 1c 70 |p..p..p..p..p..p| 000000a0 17 1c 70 17 1c 70 17 1c 70 17 1c 70 17 1c 70 17 |..p..p..p..p..p.| 000000b0 1c 70 17 1c 70 17 1c 70 17 1c 70 17 1c 70 17 1c |.p..p..p..p..p..| 000000c0 70 17 1c 70 17 1c 70 17 1c 70 17 1c 70 17 1c 70 |p..p..p..p..p..p| 000000d0 17 1c 70 17 1c 70 17 1c 70 17 1c 70 17 1c 70 17 |..p..p..p..p..p.| 000000e0 1c 70 17 1c 70 17 1c 70 17 1c 70 17 1c 70 17 1c |.p..p..p..p..p..| 000000f0 70 17 1c 70 17 1c 70 17 1c 70 17 1c 70 17 1c 70 |p..p..p..p..p..p|
Repair Budgeting
...and now for Round II
- $60 busted up broken up rotimatic
- $62 Kneading/Stirrer Cup†
- $60 Flour Container†
- $39 Water Container†
- $35 Oil Container†
- $45 Front Door†
- $37 Dough Tray†
- $52 Kicker Pad†
- $390 Sub Total Machine & Parts
- $7.99 Disinfecting Wipes
- $3.49 Isopropyl Alcohol
- $3.99 Pack of Sharpies
- $13.99 Lube
- $20 gas to here and there
- $439.46 Estimated Total ($1,599/$1,399 new/re-manufactured)†
† Parts priced from rotimatic.com