I've just started to work with LPCXpresso LPC1769. Unfortunately it seems, that the LPC-Link is able to work only with the CodeRed software and doesn't work with OpenOCD. As full schematic of LPC-Link part is available (
formatting link
), it should be possible to write and put my own firmware to the LPC-Link part (BTW it is nice piece of hardware which could be used to make quite flexible open JTAG dongle ;-) ).
Is it possible to replace the original firmware in LPC3154 with my own, or is it somehow locked by the OTP in LPC3154? Has anybody tried to do it?
I'm afraid you are right... Quick inspection of the board and its schematic layout leads to assumption that the JTAG pins are available (9 undocumented pads on the lower edge of the LPC-Link board are probably connectors to the "breakout section LPC3154-JTAG", however the order of pins is probably changed, as most left is GND and most right is Vcc). The question is however if the JTAG is still left enabled... Probably not.
So it seems, that the most effective solution to work with the target part of LPCXpresso LPC1769 is simply to remove the LPC-Link part and attach any other not vendor-locked JTAG dongle... (e.g.
Rowley tried to go in through the front door to get an official sanction from NXP to use that interface. No joy. See
I suppose that if one had enough tools and enough time then reverse engineering the protocol would be possible. However, given the large number of existing JTAG options, including some that are quite inexpensive, doing so would only be for the benefit of getting "hacker cred" for the effort.
If I were a developer of this solution I'd provide full encryption in the USB layer also. LPC1354 is powerful enough to handle encrypted data stream. So probably even analysis of the USB protocol will not give any results.
The only way would be to find the 128-bit AES key and encrypt own firmware with it. Quite interesting if the method used to transfer the firmware is resistant to plaintext cryptoanalysis, as probably the header of the firmware is quite predictable ;-). OK. I have no time to go further with that...
Well, I've simply cut off the LPC-Link, soldering a male gold-pin connector to the target board and a female gold-pin connector to the LPC-Link. So I can still quickly connect the LPC-Link if one of my students is going to use the closed Code Red solution, while another open JTAG controller may be connected for everyday use with OpenOCD.
And that's probably why it is sold in such "closed" state... From NXP point of view it is a way to promote LPC1769 without disturbing market for LPC3154 ;-). The LPC3152 (like 3154 but without AES protection) kit costs 179=80
formatting link
(well, it is a little better equipped than LPCXpresso target board)
ElectronDepot website is not affiliated with any of the manufacturers or service providers discussed here.
All logos and trade names are the property of their respective owners.