Close

Scanning the bus - be amazed!

A project log for Hacking a Supervisor Password - With a Beagle Bone

I found myself being intrigued with the low level safety features of my X201. I experimented with the I2C bus and it got interesting...

timo-birnscheinTimo Birnschein 02/14/2021 at 18:390 Comments

After a fresh installation of Debian on my Beaglebone Black I was greeted with a console interface that had all the essential tools already installed. It's a development platform after all. They provide everything for I2C devices as well. I had a 24C02 EEPROM sitting around, so made it my first target. I set the address to 0x57 in this example - why will be clear in a later entry.

debian@beaglebone:/var/lib/cloud9$ i2cdetect -r -y 2
     0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f
00:          -- -- -- -- -- -- -- -- -- -- -- -- --
10: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
20: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
30: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
40: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
50: -- -- -- -- -- -- -- 57 -- -- -- -- -- -- -- --
60: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
70: -- -- -- -- -- -- -- --

 I was happy to see that the bus worked. I had one device connected to I2C-2 which is sitting on P9_19 (SCL) and P9_20 (SDA) and work right away.

(source: https://datko.net/2013/11/03/bbb_i2c/)

I ran a couple of experiments with this EEPROM to make sure I can read and write to the various addresses. It's a 2kBit (256byte) EEPROM - not a lot of space. this particular one can be accessed incrementally with a page size of 256byte. That makes, when reading, I can set the address counter to 0x00 and then run 256 consecutive reads and always get the next byte until it rolls over at the end of the page (address 0xFF).

i2cset -y 2 0x57 0x00 // write to the address counter 0x00 i.e. RESET it

ic2get -y 1 0x57 // returns byte at 0x01
ic2get -y 1 0x57 // returns byte at 0x02
ic2get -y 1 0x57 // returns byte at 0x03

 I tested this concept on the console before I jump in and write the python code - of which I knew almost nothing about at this point.

You can also simply dump an entire 256 byte chunk of an EEPROM (with 8 bit address space) buy using

debian@beaglebone:/var/lib/cloud9$ i2cdump -y 2 0x57
No size specified (using byte-data access)
     0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f    0123456789abcdef
00: 21 f8 f8 f8 41 50 21 21 74 20 69 73 20 70 72 6f    !???AP!!t is pro
10: 76 65 20 74 68 61 74 20 79 6f 75 20 68 61 76 65    ve that you have
20: 20 77 72 69 74 74 65 6e 20 32 35 36 20 62 79 74     written 256 byt
30: 65 73 20 69 6e 74 6f 20 61 6e 20 45 45 50 52 4f    es into an EEPRO
40: 4d 2e 20 49 20 64 6f 6e 27 74 20 6b 6e 6f 77 20    M. I don't know
50: 69 66 20 79 6f 75 72 20 45 45 50 52 4f 4d 20 69    if your EEPROM i
60: 73 20 61 63 74 75 61 6c 6c 79 20 32 35 36 20 62    s actually 256 b
70: 79 74 65 73 20 61 74 20 74 68 65 20 74 69 6d 65    ytes at the time
80: 20 6f 66 20 77 72 69 74 69 6e 67 20 62 75 74 20     of writing but
90: 6f 6e 20 74 68 65 20 6f 74 68 65 72 20 68 61 6e    on the other han
a0: 64 20 69 74 20 64 6f 65 73 6e 27 74 20 72 65 61    d it doesn't rea
b0: 6c 6c 79 20 6d 61 74 74 65 72 2e 20 54 68 65 20    lly matter. The
c0: 69 6d 70 6f 72 74 61 6e 74 20 70 61 72 74 20 69    important part i
d0: 73 20 74 68 61 74 20 79 6f 75 20 68 61 76 65 20    s that you have
e0: 77 72 69 74 74 65 6e 20 32 35 36 20 62 79 74 65    written 256 byte
f0: 73 20 73 75 63 65 73 73 66 75 6c 6c 79 21 21 21    s sucessfully!!!

 Very handy if you just want to see what the current contents of an EEPROM are. However, it must be said that at no time can two different bus masters access the same bus at the same time. On I2C there is always only one bus master allowed or corrupted data is guaranteed!

To write the above content to the EEPROM, I decided to start with Python.

Discussions