[sane-devel] USB recordings MD6190 available

[Bertrik Sikken]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Lauri Pirttiaho wrote:
> Bertrik Sikken on Sun Sep 25 13:26:18 UTC 2005
> 
>>Hi again,
>>
>>I just noticed that many of the things I reported in my other
>>reply in this thread were already figured out by you in a thread
>>on the canoscan 3200 on june 26th 2005.
> 
> 
> Further things that I have figured out since then are e.g
> the following:
> -- values 0029 and 002a are a write/read pair that handle two integers
>    at addresses FB83/FB82 and FB81/FB80. These integers are used
>    later by the scan command (value 0030) but I don't yet know
>    for what.
> -- value 0080 returns a version number string

Hmm, haven't seen this one in the logs.

> -- values 00e1 and 00e0 are a write/read pair that access consecutive
>    bytes in the external 64K address space of the processor. High
>    addresses FE00-FFFF are peripherals (USB interface is at FE00-FE0B
>    but others I haven't figured out yet, except interrupt mask
>    for USB at FE15 and cause at FE17).
> -- values 002b and 002c are a similar pair as above but access
>    bytes at FB00 up. That area seems to be used as a parameter
>    buffer e.g. for the scan command.
> -- ie0 of the processor indicates USB traffic, ie1 is connected to
>    motor control and maybe something else.
> -- value 0040 returns state of a state machine driven by ie1 as its
>    first byte and I suspect that state machine to be the motor control.
>    The second byte is port 1 bit 0 which I suspect to be he head home
>    detector. Additionally there are 3 more bytes of info (I con't
>    know the meaning of these yet), 0xAA and then 0's.

I noticed some increasing number at bytes 2 and 3 and suspect that
this is the current line number of the carriage.

> -- There is some kind of clocked serial device connecter to processor
>    port 0 bits 5-7 -- it may be an EEPROM but maybe also something else.

Wow, you opened up the device and attached a 'scope?

> -- Also I know that the so-called mystery files contain parameters
>    that are written directly to HW registers but I don't know their
>    meanings yet.
> 
> CanoScan firmware carries version number 0054 but the Medion
> one has 1228 (at the end of the file). Also the structure of the
> code is so much different that I suspect a driver for CanoScan
> may not work with the Medion scanner, but then, maybe it does.
> Have to check once we have some kind of test driver available...
> 
> 
>>How about creating a kind of 'reverse-engineered datasheet' for
>>this scanner (and similar ones) on the wiki page of Martin?
> 
> 
> That is being worked on but proceeds slowly, about 1 hour per night...

I made a start with the datasheet on Martin's wiki page.

> If someone wants to help with reading the firmware I can provide
> more details about tools to do the disassembly and code analysis.
> It would help if someone decompiled the Medion version of the
> firmware (doing manual detection of the C-compiler emit patterns 
> in the assembly code or write a tool to do that automatically).

I can have a try at that. I don't have any experience with the 8032
but I do have experience with other (similar) processors.

All the best,
Bertrik
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (MingW32)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFDNworETD6mlrWxPURAqiRAKCSXVelOaRpaIEM4VkEJppBvbwMvgCfdPUj
cOxki5zbgpM0VM2Ep9S2rVU=
=qEqI
-----END PGP SIGNATURE-----