[sane-devel] USB recordings MD6190 available

[Lauri Pirttiaho]

Bertrik Sikken on Sun Sep 25 13:26:18 UTC 2005
>Hi again,
>
>I just noticed that many of the things I reported in my other
>reply in this thread were already figured out by you in a thread
>on the canoscan 3200 on june 26th 2005.

Further things that I have figured out since then are e.g
the following:
-- values 0029 and 002a are a write/read pair that handle two integers
   at addresses FB83/FB82 and FB81/FB80. These integers are used
   later by the scan command (value 0030) but I don't yet know
   for what.
-- value 0080 returns a version number string
-- values 00e1 and 00e0 are a write/read pair that access consecutive
   bytes in the external 64K address space of the processor. High
   addresses FE00-FFFF are peripherals (USB interface is at FE00-FE0B
   but others I haven't figured out yet, except interrupt mask
   for USB at FE15 and cause at FE17).
-- values 002b and 002c are a similar pair as above but access
   bytes at FB00 up. That area seems to be used as a parameter
   buffer e.g. for the scan command.
-- ie0 of the processor indicates USB traffic, ie1 is connected to
   motor control and maybe something else.
-- value 0040 returns state of a state machine driven by ie1 as its
   first byte and I suspect that state machine to be the motor control.
   The second byte is port 1 bit 0 which I suspect to be he head home
   detector. Additionally there are 3 more bytes of info (I con't
   know the meaning of these yet), 0xAA and then 0's.
-- There is some kind of clocked serial device connecter to processor
   port 0 bits 5-7 -- it may be an EEPROM but maybe also something else.
-- Also I know that the so-called mystery files contain parameters
   that are written directly to HW registers but I don't know their
   meanings yet.

CanoScan firmware carries version number 0054 but the Medion
one has 1228 (at the end of the file). Also the structure of the
code is so much different that I suspect a driver for CanoScan
may not work with the Medion scanner, but then, maybe it does.
Have to check once we have some kind of test driver available...

>How about creating a kind of 'reverse-engineered datasheet' for
>this scanner (and similar ones) on the wiki page of Martin?

That is being worked on but proceeds slowly, about 1 hour per night...

If someone wants to help with reading the firmware I can provide
more details about tools to do the disassembly and code analysis.
It would help if someone decompiled the Medion version of the
firmware (doing manual detection of the C-compiler emit patterns 
in the assembly code or write a tool to do that automatically).

>Very nice perl script, BTW.

Thanks!

With best regards,

Lauri Pirttiaho
Oulu
Finland


...................................................................
Luukku Plus paketilla pääset eroon tila- ja turvallisuusongelmista.
Hanki Luukku Plus ja helpotat elämääsi. http://www.mtv3.fi/luukku