It has been a while but I just couldn't just watch as people hacked their Amazon Dashes without a cute little debugging board.
I have had these since May of 2015... kind of. The first version I have had since May 2015. The second version, pictured above, I have had since early 2016. Both of the versions were done through MacroFab. I liked MacroFab when I did the first board but I love MacroFab after I did my second board. It kept track of the versioning, changes, and makes it feel like I am going through the various stages of product
The fact that I took so long to actually try these was a blessing in disguise. By the time I got around to testing the debuggers there was already a Amazon Dash Version 2. The first version was nice but had a Broadcom chip which made it a little less bit twiddler friendly. When I saw the second version teardown and spotted a glimpse of the familiar Atmel logo. I knew I had to buy a few
I gracefully tore mine down... opening the things are a pain. At first I just scored it over and over again until I was able to pry it open. I then tried applying heat (this didn't work too well). The trick that works really well 100% for me so far (15 Amazon Dashes) is just running a smaller flathead through the groove a handful of times until the slot has a good fit. Insert the flat head and give a twist and presto-change-o you now have an open Dash and only a minute of your time lost.
Okay so now you have an open Dash. Now you can take one of your V1 Amazon Dashes and steal a connector from there. They are the same footprints for both and solder down in a snap. If you send me a V1 Dash and V2 Dash, I will swap them for you.
After placing the debug connector on the V2 Dash, simply connect your DashDebugger and hack away...
Or so I thought...
It actually went more like, get a console... a locked down console... with taunts (courtesy of the exit command) and change some LED colors. The changing LED colors is cool but I wanted more. There are clearly other commands if you type help but the menu for users is menu (a much less exciting menu). You can read some firmware version numbers but that is about it. The worst of this restricted menu was the lock bit. The menu is kind enough to expose a register that reads from the NVM of the Atmel indicating whether or not the security bit is set. If the bit is set, you cannot touch it over JTAG (under normal conditions). I figured, what the heck, and gave JTAG a try anyways. Turns out it is locked (I was using the Atmel SAM ICE) and very annoyingly so, but the story doesn't end there. You might be asking yourself, okay so it is locked. There must be a way to unlock it. To unlock the chip you must bring the ERASE pin high. This will clear the security bit as well as the flash. I didn't really care about reversing the flash. I just wanted a cute little dev board. Next step was to find pin 3, the ERASE pin.
How hard could it be. I bet the nice engineers just added a jumper or via or something that could easily be reworked.
|No Caption Needed|
Okay, maybe just a little caption. I had stripped all the components off a board just to reverse the entire thing and found what I had feared. If you look at the picture above, look at pin 3 (the one with the green arrow). You can see that pin 3 (the ERASE pin) is not only tied with a via through the board but also directly to the ground pad underneath the chip. So in order to erase the microcontroller with the ERASE pin, you have to desolder the micro, cut the traces around the pad, and then solder it back down. This becomes less practical if you just wanted to write blinky for your device in assembly. That being said I have reworked a few and have been successful on all (except for the one that I cut the wrong trace).
Moral of the story, I need to learn more about power and clock glitching so I can reset the NVM security bit without desoldering anything... and who knows, I just might be able to preserve the flash too.
Happy bit twiddling and let me know if you need a hand.
UPDATE: You can now purchase that cute little connector here: https://www.tindie.com/products/qbit/amazon-dash-debugger-connector/