Close

Initial thoughts

A project log for BARCO NX-4 GROUP REVERSING ADVENTURE

This a project for a group of folks working to reverse engineer the Barco NX-4 LED panels.

kevtriskevtris 11/23/2017 at 04:301 Comment

Well I got on the bandwagon and bought 70 of these modules.  I hope they all or mostly all work.  Anyways, I have been poking through the ROM images posted, and I found a font inside of the parallel flash.  It lives around 83180h or so (I will check for more than 1 copy of it... the install PDF claims there's backup firmware in the flash in one of the troubleshooting sections).   The font looks like this:

I used yy-chr to grab it.  Interesting that it's 6 pixels high, I guess this is so they can fit 6 lines of it on one of the modules. 

Was poking through the EEPROM_panel file too, and it seems to be calibration data and possibly pixel order data too.  There's several distinct sections of data.     The EEPROM_control file is kind of weird, there's obviously data in here but it doesn't seem to be calibration data, I am not sure what would be living in here.   I guess it could be a local copy of adjusted calibration data maybe?

My current working theory is on bootup, the controller will fetch the panel's calibration and control data out of the EEPROM_panel chip and load it into the SRAM (after some kind of processing and possible calibration with the light sensor/LEDs).  I guess over time the panel could recalibrate itself too.   The SRAM most likely holds the frame buffer as well, and during scanout it reads the pixel data and calibration data and does the fixup.

Reading literature for other similar LED walls, they do a 3*3 matrix multiply for every single pixel to effect the calibration.  I am not sure if this does it, but I wouldn't be surprised if it does.   It might be interesting to creatively corrupt the RAM contents as it runs to see if anything happens.

Because there is a font in the ROM, this thing most likely has some kind of diagnostics it can perform.

Discussions

modder_mike wrote 11/23/2017 at 06:16 point

There is also a small number of ASCII strings in the flash, did you find those?  Seemed to me to be related to debug type functions, as if the panel is able to parse a small number of ASCII commands. 

First set of strings starts around 0x3CEB0 - "S29AL016D" "UPDT" "INIT" "CHKS" "DONE" "ERR TFER" "ERR" "TEMP" "MOD CAR CNT ERR MSYS" "TILE" "RUN" "TIME" "FAN SPD" "STOP" "SLOW" "AGNG" "ontm" "RUN BCKP" "SOFT" "BOOT" "FPGA" "SN" "PWM DBL".

Second set of strings starts around 0xA0EB0 - "S29AL016D" "UPDT" "INIT" "CHKS" "DONE" "ERR TFER" "ERR" "TEMP" "BURN" "IN" "BUSY" "END" "DONE" "NOT" "MOD CAR CNT ERR MSYS" "TILE" "RUN TIME" "FAN SPD FAIL" "HALT" "STOP" "SLOW" "HIGH" "NR" "AGNG" "ONTM" "LED ID" "AC" "ART" "INDX" "PROD" "TEST".

Third set of strings starts around 0x110EB0 - "S29AL016D" "UPDT" "INIT" "CHKS" "DONE" "ERR TFER" "ERR" "TEMP" "BURN" "IN" "BUSY" "END" "DONE" "NOT" "MOD CAR CNT ERR MSYS" "TILE" "RUN TIME" "FAN SPD FAIL" "HALT" "STOP" "SLOW" "HIGH" "NR" "AGNG" "ONTM" "LED ID" "AC" "ART" "INDX" "PROD" "TEST".


[Edit] Assuming you meant 0xA3180 rather than 0x83180, the font appears to repeat at around 0x113180.  The strings noted above repeat at the same interval, which points at a second firmware image at offset +0x70000 from the first.

[Edit 2] There's a third font near the third set of strings noted above, at around 0x3D180.  There may be three firmware images in the flash.

  Are you sure? yes | no