Above shown is a BlueBoard LPC1768 header board. I got this board from NGX technologies. This board contains an ARM cortex M3 based LPC1768 microcontroller from NXP (Philips). NGX technologies has similar ARM development boards which can be purchased from their webshop.

NGX technologies BlueBoard LPC1768 header board is of size 95mm x 55mm size. It has an power connector to connect DC power. The board can also be powered using its mini USB port. It also contains an LED and a switch(other than the rest switch) for basic operation. All the pins of the controller can be accessed through the header pin port. It also contains an JTAG port for debugging the ARM microcontroller. There is also an EEPROM chip to store information which is independent of the power.

The greatest advantage of this board is that it can be flashed using its USB port. There is no seperate flashing tool hardware or software needed. Just plug the board into the USB port and press a button sequence. The board will appear as an mass storage device(like our USB pen drives). The compiled bin just has to be pasted into the drive. Once the reset button is pressed, the new compiled software will start to work. More information can be found from here.

These type of header boards are really helpful when you want to prototype your designs. Its really hard for a newbie or even time consuming for an expert to design a PCB for the microcontroller and then start development. This board contains all the basic circuit to bring up the microcontroller and start development.

Some useful links
1) Google code page(contains complete source code and hardware design): http://code.google.com/p/blueboard-lpc1768/
2) Product page(Contains more information about this products and various tools): http://shop.ngxtechnologies.com/product_info.php?cPath=21&products_id=65
3) Documents form NXP for LPC1768: http://ics.nxp.com/support/documents/microcontrollers/?scope=LPC1768

-- MAIL BEGIN --
> 1) After opening a device, how do you understand which chip is the CPU ?

This is usually fairly obvious from the layout and the connectivity on the board. It really depends on the device, but it's usually one of the larger chips, and may be connected to Flash memory, and/or to a quartz crystal. On larger devices it will have its own power supply, while on smaller ones the only telltale might be that it's connected to most parts of the board. And of course, often you can just look up the part numbers and figure out what most chips are.

> 2) How are the firmwares extracted from the devices ? Is there a general principle ?

This depends heavily on the device. It can be as easy as connecting to a debug serial port and getting a text-based console into a bootloader that lets you dump the flash. Or it can be as hard as requiring a clock/power glitching setup in order to dump an internal mask ROM buried inside the CPU. Usually if the flash is external, you can remove it and dump it externally, or there might be a JTAG port through which you can read/write it. Microcontrollers with embedded flash usually have programming ports but the code is usually protected from readout; these are nearly impossible to dump unless you know of a specific vulnerability in the particular chip's protection.

> 3) After getting a firmware dump how do you read it ?

If you know the CPU architecture in use, you run it through a disassembler and see if it makes sense. If you don't know the architecture, you can try some educated guesses. After a while you learn to recognize some popular CPU architectures from a simple hex dump (e.g. ARM code sticks out like a sore thumb due to the condition code field, which means that every 32-bit word almost always starts with 'E'). You can just use GNU binutils (objdump) to disassemble code (usually), but the IDA disassembler by Hex-Rays is quite popular in the reverse engineering community (albeit quite pricey). Sometimes the CPU architecture is unknown. I know some crazy people who can eventually make sense of an unknown binary and figure out what the opcodes mean, but I'm not one of them.

And sometimes if the firmware has very high entropy (it looks like "garbage" - no patterns, you learn to recognize this too) it usually means it's either encrypted or compressed, so you might look to see whether you can find an offset after which there's valid compressed data using a popular algorithm (zlib, LZMA, etc...). If it's encrypted sometimes there are blockwise patterns (e.g. duplicated 16byte or 8byte blocks) that often mean it's encrypted using a block cipher in ECB mode.

-- MAIL END --

It supports one of my favourite feature - Its a hackable device! Flashing a new GNU/Linux firmware. Buffalo-NAS is based on GNU/Linux and also they provide its sourcecode in the downloads section webpage.

Also there is an dedicated hack portal for the Buffalo-NAS. Below is the link
Buffalo NAS-Central - http://buffalo.nas-central.org/wiki/Main_Page

I will post some hacks in my web log as I proceed.

Track Every Watt can display additional information such as Voltage(V), Current(A), Watts(W), Volt-Amp(VA), Frequency(Hz), Power Factor(PF), Kilo Watt Hour(KWH), Time Elapsed. It uses an Analog Devices Energing Metering IC ADE7763. There is also an application note AN-564 for this IC.

Today I did a small hacking on the board. I added the capacitor as needed by USB. Now the board is working fine. There came the next problem. GCC-AVR version which I had, didn't support ATMEGA32U2. Also for loading the hex into the controller, I used the dfu-programmer. Since I had installed it from the Ubuntu repository, dfu-programmer was of older version and it also didn't support ATMEGA32U2.

After a few Google search, I found that if you compile for AT90USB162, the hex generated is supported by ATMEGA32U2. So I wrote the C code and compiled it for AT90USB162. Next task was to make the dfu-programmer to work. The only solution was to get the latest code and compile it. Below shown is the way to compile the dfu-programmer from source

$ mkdir dfu-programmer
$ svn co https://dfu-programmer.svn.sourceforge.net/svnroot/dfu-programmer/trunk/ dfu-programmer
$ cd dfu-programmer/dfu-programmer
$ ./bootstrap.sh
$ ./configure
$ make

Once installed, flashing the controller is very easy. First we have to bring the controller into USB bootloader mode. For that first press and hold the RESET button. Then press and hold the HWB button. Now release the RESET button and then release the HWB button. This will bring the controller into USB bootloader mode. Now we can issue the following instructions to flash the controller.

$ dfu-programmer atmega32u2 erase
$ dfu-programmer atmega32u2 flash blink.hex
$ dfu-programmer atmega32u2 reset

This is an Open Hardware project and I will soon post the schematic and PCB layout once adding the missing capacitor in the old design. Below shown is the snap shot of the board.

For the newly developed Phoenix-MDK, I suggested few hardware modifications. Among them was the hardware modification for resetting the Phoenix-MDK through software i.e the user doesn't have to press the reset button on the board to load a new program. I copied the design of software resetting from Arduino project.

The plan was to reset the controller using two pins i.e there was a pin (RTS) coming from the FTDI chip connected via a 100Kohm resistor to the reset pin of the ATMega32 and also a pin (DTR) from FTDI chip connected via a 100Kohm resistor to the PD2 pin of ATMega32. The two 100Kohm resistor was for current limit. So when the user wants to flash a software, he has to hold the PD2 down (because bootloader will wait for code from serial port only if this pin is low), send LOW pulse on RESET. Then Avrdude loads the code, take PD2 high and then send a Reset pulse again.

When I checked the Arduino design, they were only using the RESET pin to load the software using Avrdude. Arduino bootloader loaded the code in the following manner - Send a reset pulse. The bootloader will wait for the software from serial port . If the data is coming, then they will write the flash memory using that data or else they will jump to the main code. The greatest advantage over here was of using only one pin (DTR) of the FTDI chip to load the software.

I adapted the same design to the Phoenix-MDK. Now The other pin (RTS) need not be used i.e the DTR pin of FTDI chip was connected to the RESET pin of ATMega32 via 100nF capacitor. So we saved one pin (PD2) of ATMega32 which is not used in the new design.

The below python code can flash code to Phoenix-MDK (written by Pramode).
import serial, time
import os, sys
fd = serial.Serial(port='/dev/ttyUSB0', baudrate=19200)
print fd
fd.setDTR(1)
time.sleep(.1)
fd.setDTR(0)
cmd = 'avrdude -b 19200 -P /dev/ttyUSB0 -pm32 -c stk500v1 -U ' + sys.argv[1]
os.system(cmd)

Usage:
1) Save the above code as load.py
2) Write the code which you want to run on ATMega32 and Compile the code using avr-gcc.
avr-gcc -mmcu=atmega32 -Os filename.c
3) Convert a.out to hex file
avr-objcopy -j .text -j .data -O ihex a.out a.hex
4) Load the hex to Phoenix-MDK
python load.py a.hex

Update: I will soon upload the pics of newly developed Phoenix-MDK .

The bootloader used in arduino's are the optiboot which has a very small footprint (around 512kb) and it was using the serial protocol STK500 for its communication. So I took the optiboot and made some modifications. But it failed. I don't know where I went wrong and also I bricked one ATMega32 chip.

I had one more ATMega32 chip with me. But this time I was really careful not to brick again a chip. It was really hard to find a bootloader. After a long search I found this page which really helped me a lot - http://wiki.edwindertien.nl/doku.php?id=software:bootloaders

The bootloader can be obtained from http://wiki.edwindertien.nl/lib/exe/fetch.php?media=software:atmegaboot-32.zip. Phoenix-MDK uses 8MHz crystal. So I had to modify a line in the makefile which contains the clock frequency to AVR_FREQ = 8000000L . Thats all. I gave a make and got the hex file.

Below are the steps for flashing the bootloader and using it.

1) Flashing the bootloader using parallel programmer
flashing the hex:
avrdude -c dapa -patmega32 -U flash:w:ATmegaBOOT_168_atmega32.hex
flashing the fuse:
avrdude -c dapa -patmega32 -U lfuse:w:0xff:m -U hfuse:w:0xda:m
2) Testing the bootloader
avrdude -b 19200 -P /dev/ttyUSB0 -pm32 -c stk500v1 -n
This should give a proper response.
3)Uploading a hex file using the serial bootloader
avrdude -b 19200 -P /dev/ttyUSB0 -pm32 -c stk500v1 -U flash:w:a.hex

For the above code to work on Phoenix-MDK, I also had to do some hardware hack. Now the DTR pin is connected to the reset pin so that reset can be done by software. I have to find a software way to reset the chip.

This is my LPC2148 (ARM 7) test bench setup.

The LPC2148 header board was bought from Rhydo Labz. You cannot directly power up and start to use. It lacks communication interface. To flash the controller, you need a serial port or a JTAG port. Since this board doesn't have these port connectors, you need to solder them. So it might be hard for a newbie.

Instead of this board, you can try the BlueBoard which has all the port connectors. I will recommend this for a newbie. I hope that board is worth for its price.

The next thing which you need is a power supply to power the board. You can build your own power supply (If someone needs to know how to build a power supply, I will write a tutorial. But please put a comment in this post saying that you need the tutorial.) ,or you can buy 5V DC power supply (adapters).

Once the board is powered up, it can start to execute your code in its memory. But a fresh controller wont be having any code in its memory to execute. You need a programmer to load the code into its memory. But the LPC series controllers have built-in serial boot-loaders. These boot-loaders can get the code from the serial port and write into its flash memory. So you don't need a programmer.

To program the controller using the serial boot-loader, you just need to connect the controller to the host PC and the host PC needs to run a serial programmer software. You can get a lot of serial programmer software for LPC controllers. Some of them are

So thats all. Power up the board and connect the serial port to the controller. Run the serial programmer software in the PC. You controller will execute the code flashed into its memory.

But wait. From where you can get the hex file to flash into its memory? Its simple. You just need a cross-compiler. To the cross-compiler, you just need to feed your C source file. It will compile and give you *.out files, which later can be converted into *.hex files.

I will soon try to post a wiki page about how to compile and flash the code into the memory.

The PCB was successfully fabricated and also tested the LED blink sketch. Everything is working fine.

NOTE: The below shown are only prototype's to verify the design. High quality PCB's cab be made with the design files.

Here are some snapshots

The screen printed copper clad's

Etching the PCB

After drilling holes

GNUduino is ready

When I saw the existing Arduino boards, I felt there is still a freedom missing. The existing Arduino boards are designed using a proprietary CAD tool. But GNUduino is free from those. It is designed using a complete free Schematic and PCB CAD tool named gEDA. This is my first Open Hardware project.

I would like to say special thanks to Pramode Sir for suggesting this name for the board.

You can download the schematic and PCB layout files from the below link
http://github.com/jeffreyantony/GNUduino

Update: Cooking GNUduino