[solved] Flashing bricked Proxmark3 v2 Easy using Jlink

ntk · 2017-04-29 08:23:03

I have found pin layout mapping , according to
https://code.google.com/archive/p/proxmark3-lcd/wikis/JTAGpins.wiki
is
VCC = Pin 1 GND = Pin 20 TCK = Pin 9
TDO = Pin 13 TDI = Pin 5 TMS = Pin 7

I have tried Setting following the PM3 forum http://www.proxmark.org/forum/viewtopic.php?id=2422
01 - Plugged the Proxmark and the Segger J-LINK in to the computer
02 - Attached the J-LINK to the Proxmark JTAG port
03 - Opened J-Flash ARM V4.50 software
04 - Created a new project by selecting File > New project
05 - Changed the project settings by going to Options > Project settings
06 - Clicked on the Target Interface tab
07 - Changed the "JTAG speed before init" to 200 kHz
08 - Clicked on the CPU tab
09 - Selected the "Device" radio button and selected "Atmel AT91SAM7S256" from the drop-down list
10 - Changed the Clock speed to "Auto detection"
11 - Applyed the changes -> OK
12 - Tested connectivity to the Proxmark by selecting Target > Connect
13 - Target -> Read back -> Entire chip

.

Last edited by ntk (2017-05-11 12:47:48)

ntk · 2017-04-29 08:35:43

(This is not a double post. For clarity I should post this information separated from the question1)

related to Pin1 to pin20

I found pin information on the 20-pin JTAG header of the Proxmark3 here https://umeahackerspace.se/2013/03/21/bus-pirate-saves-the-day-proxmark3-jtag-flashing/

The following image shows the 20-pin JTAG header of the Proxmark3. Pin number 1 is in the corner of the circuit board (pin 20 being closest to the center):

Proxmark ARM JTAG 20 pin header

Last edited by ntk (2017-04-29 08:38:59)

iceman · 2017-04-29 08:52:06

maybe not set the 200khz speed? try auto?

ntk · 2017-04-29 09:21:59

Thanks Iceman

I just got Elechouse Easy PM3 connected to JLINK V8 now.

Connecting ...
 - Connecting via USB to J-Link device 0
 - J-Link firmware: V1.20 (J-Link ARM V8 compiled Jun 19 2012 11:29:30)
 - JTAG speed: 200 kHz (Fixed)
 - Initializing CPU core (Init sequence) ...
    - Initialized successfully
 - JTAG speed: 6000 kHz (Auto)
 - CPU clock frequency: 32 kHz (Auto detected)
 - J-Link found 1 JTAG device. Core ID: 0x3F0F0F0F (ARM7)
 - Connected successfully
Filling with zero ...
 - 1024 of 1024 sectors selected, 1 range, 0x100000 - 0x13FFFF
 - RAM tested O.K.
 - Fill operation completed successfully - Completed after 52.279 sec

ntk · 2017-04-29 09:40:04

.

Last edited by ntk (2017-05-11 12:37:47)

ntk · 2017-04-29 09:49:17

Once the connection is ok you can set in the new project option the initial frequency to 200kHz or use auto for getting Jlink connected to easy PM3. Both should work.

Last edited by ntk (2017-05-11 12:40:02)

ntk · 2017-04-30 04:09:10

for summary:

Basically I connect a Segger J-Link to the Elechouse Easy Pm3 board for JTAG programming. I use following way best discribed by words of Mr Teuwen, (in http://wiki.yobi.be/wiki/Proxmark#JTAG_programming) :

"To make it easier, solder a breakable single-row male curved header.

Choose a curved one so you can leave it in place later and still stack the PM3 daughterboard.

Then using Dupont wires male-female, wire it to the JTAG programmer.

For the J-Link, the pinout is:

--------------------------
|19 17 15 13 11 9 7 5 3 1|
|20 18 16 14 12 10 8 6 4 2|
--------------------------

PM3 JLink
--- -----
TMS 7
TDI 5
TDO 13
TCK 9
GND 6
3.3 not connected

He does not connect 3.3V. I connect GND to pin 20 and 3.3 to Pin1. So I can concentrate on just one connection and it does not harm anything.

Then I can do recovery procedure (on Github), usign JTAG to write firmware, full image to Proxmark

SEGGER J-Link Commander V4.24c ('?' for help)
Compiled Mar 4 2011 20:04:53
DLL version V4.24c, compiled Mar 4 2011 20:04:34
Firmware: J-Link ARM V8 compiled Jun 19 2012 11:29:30
Hardware: V8.00
S/N: 99999998
Feature(s): RDI,FlashDL,FlashBP,JFlash,GDBFULL
VTarget = 3.002V
Info: TotalIRLen = 4, IRPrint = 0x01
Found 1 JTAG device, Total IRLen = 4:
#0 Id: 0x3F0F0F0F, IRLen: 04, IRPrint: 0x1, ARM7TDMI Core
Found ARM with core Id 0x3F0F0F0F (ARM7)
JTAG speed: 100 kHz

J-Link>exec device = AT91SAM7S256

J-Link>exec EnableFlashDL

J-Link>h
Info: TotalIRLen = 4, IRPrint = 0x01
PC: (R15) = 00111494, CPSR = 400000F3 (SVC mode, THUMB FIQ dis. IRQ dis.)
R0 = 00000000, R1 = 00000300, R2 = 00000001, R3 = FFFB0000
R4 = FFFFF400, R5 = 00000002, R6 = 00000100, R7 = 00000000
USR: R8 =00000000, R9 =00000000, R10=00000000, R11 =00000000, R12 =0003E8DE
R13=00000000, R14=00000000
FIQ: R8 =00000000, R9 =00000000, R10=00000000, R11 =00000000, R12 =00000000
R13=00000000, R14=00000000, SPSR=00000010
SVC: R13=0020FD40, R14=001114B3, SPSR=00000010
ABT: R13=00000000, R14=00000000, SPSR=00000010
IRQ: R13=00000000, R14=00000000, SPSR=00000010
UND: R13=00000000, R14=00000000, SPSR=00000010

(Here at this step proxmark still stayed lit with 4 LED lights, when connect to an USB port, PM3 appeared as an Unknow USB device)
J-Link>loadbin "C:\pm3_upd\recovery\proxmark3_recovery.bin" 0x100000
Loading binary file... [C:\pm3_upd\recovery\proxmark3_recovery.bin]
Writing bin data into target memory @ 0x00100000.
(proxmark started now to switch off the LEDs)

J-Link>loadbin "C:\pm3_upd\recovery\bootrom.bin" 0x100000
Loading binary file... [C:\pm3_upd\recovery\bootrom.bin]
Writing bin data into target memory @ 0x00100000.

J-Link>loadbin "C:\pm3_upd\recovery\fullimage.bin" 0x102000
Loading binary file... [C:\pm3_upd\recovery\fullimage.bin]
Writing bin data into target memory @ 0x00102000 .
(now promark is alive again)
J-Link>

Last edited by ntk (2017-05-11 12:46:26)

ntk · 2017-05-02 02:05:35

If you have a bricked PM3 either of version with 20 pins or version with 6 pins JTAG connector, and you want to bring it back to life again, but, you have no Jlink, JTAG nor the time to learn to setup your system,
then you can PM me to arrange doing that for you.

PatienceIsAVirtue102@gmail.com

Last edited by ntk (2017-05-11 13:40:22)

KinnyAdelaide · 2018-12-17 09:34:09

J-Link>exec device = AT91SAM7S256
Device "AT91SAM7S256" selected.
J-Link>exec EnableFlashDL
J-Link>h
Target connection not established yet but required for command.
Please specify device / core. <Default>: AT91SAM7S256
Type '?' for selection dialog
Device>
Device "AT91SAM7S256" selected.


Connecting to target via JTAG
Cannot connect to target.
J-Link>

Proxmark3 community

Announcement

#1 2017-04-29 08:23:03