Taixin TX-Link-U, TXProgrammer 2.1.37 - pics, notes, OpenOCD JLink probing, ongoing investigations

divadiow wrote:

I was hoping it's just a CK-Link rebrand device. Maybe it is and I haven't got the process right with CK-Link. I ordered one from Taobao so that should arrive in a couple of weeks.

Here's a dump of information relating to the Taixin (Huge-IC) TXLink programmer/debugger I bought ages ago from Taobao. Mostly notes and pics. More to be added I expect.

refs:
https://www.elektroda.com/rtvforum/topic4121456.html
https://www.elektroda.com/rtvforum/topic4123724.html
https://github.com/voidobserve/project/tree/branch_1/Project/Keil

device = TX-Link-U
hw = V1.10
fw = L:V1.31 D:V1.15

Latest TXProgrammer versions are too new. TXLink connects OK with

TXProgrammer_V2.1.37

TXProgrammer_V2.1.37 does not support TXW81X, but does support TXW80X but only with USB programmer types


Choose a platform type that has TXLINK as an option and you get to connect to the com port that the connected TXLink device enumerates as. Open settings then you see it connecting to the TLink and fecthing serial, hw, device, fw info



However, as seen here in my forum post: https://dev.taixin-semi.com/topic/49/tx-link-...%E7%A8%8B%E5%BA%8F%E4%B8%8E%E6%96%87%E6%A1%A3

Quote:

The one without "lite" was used by us to burn other non-Wi-Fi products; the one with "lite" is for burning Wi-Fi products.

The Aucu AC201 MCU is not listed on the AUCU web site, but the attached datasheet for the AM32M2032JS5 appears very relevant. The package is the same. IOs match. SWDs for AU201 MCU and for connected Taixin to debugger are correct



C:\OpenOCD\bin\openocd.exe -f C:\AU201\au201-jlink-openocd.cfg

au201-jlink-openocd.cfg:


analysis

AU201 live read	AM32 manual	Interpretation
0x40000100 = 0x00000E9B	LVD_CON reset = 0x00000E9B	Exact address and exact value
0x40003030 = 0x00022281	EFLASH_TIME_REG0	Fields decode correctly as PGH=2 ADS=2 ADH=2 RW=8 RC=1
0x40003034 = 0x0003E80D	EFLASH_TIME_REG1	1ms unit=1000, 1us unit=13
0x1FF00600/04/08	UID0/1/2	Genuine non-zero 96-bit device identity
0x1FF005C8	User CFG2	Decodes coherently
0x1FF005E0	User CFG5	Decodes coherently

CFG2 @ 0x1FF005C8 = 0xFFFDFFFF

has bit 17 = 0.

which explains why I can't dump the 32kb flash by direct read.

Tapping on R10 and R14 can get us clear UART from the app. 🤔

this is true. also disassembly of txprogrammer. I should have started this thread yesterday because there are many more things I've done, including dumping the 32kb flash from the AU201.

one of the things was a uart connection probe. attached.

probe result


nvr and flash + report attached in zip.

flash was read using:

C:\OpenOCD\bin\openocd.exe -f C:\AU201\au201-jlink-openocd.cfg -l "C:\AU201\au201_main_crc_complete_32k.txt"

au201-jlink-openocd.cfg:


because the little bootloader was not protected from SWD readout, we could then disassemble it to discover the CRC engine can read the app data and give us the crc for areas we request

Quote:

The security mistake in the AU201 is essentially that debug protection hides the data path but leaves an information-equivalent oracle accessible. A CRC32 over a large region would be harmless enough. Allowing an external debugger to choose the address and ask for a CRC32 of exactly 32 unknown bits means the “checksum” can disclose all 32 bits.

And that is how we ended up dumping a read-protected AU201 without ever actually turning its read protection off.

divadiow wrote:

Aucu AC201 microcontroller

Is this the only microcontroller that can be programmed using the programmer mentioned in the title?
What other applications can be demonstrated?

The AUCU AU201 is the MCU at the heart of the TX-Link-U programmer, not the target platform of the programmer.

The target devices are Taixin (Huge-IC) MCUs. And it seems to be for the older non-wifi Taixin platforms at that.

So for investigations into how TXW81X can be made easier to flash for users (currently requiring CK-Link/STM32), this TXLink device I have seems less relevant than it once did. A TX-Link Lite would have been a better purchase.