Thunderbolt 1 Into deep. Notes, Boardviews etc.

[bigguygeo]

Everything begin a year ago. Few of thunderbolt dongles failed because of cable damage. Influence of time. Okay easy to buy a new, that is cheap. Okay i did it, but decided to look inside and maybe repair for fun. So Disassembly was pretty hard, but successful. one of wires was partially frayed i have cut that wires to resolder them back. It was hard, wires are shielded 36 or 32 AWG. So a year i decided to come back to project and rebuild Thunderbolt dongle to cheap pci expansion for x1 pcie cards like USB 3.0 hub or soundcard.



The first files:
Apple Thunderbolt Ethernet - SPI Eeprom flash - 4096 bytes - 32 b.bin
HPM-em-00020007.bin
iMac-21.4-22-01.bin
iMac-27-22-01.bin
MBP-22-01.bin
ThorUtil.efi

from two dongles - spi roms.zip with two firmwares for comparison

Problem:
Thunderbolt require patching to make dsl2210 to work as root or switch

 

[bigguygeo]

If disconnect clockrequest, wake, nc dongle still working fine at S0 state hotplug only test


Also if connect 3.3v dp power and 3.3v power_en Drain then there is no reason to use “G” wire - Power_Enable.

So only important wires are:
3.3v dp power
1.05v dsl2210 power
Gnd

Pci rx, tx, refclk, pairs and Reset PERST#

 

[bigguygeo]

Next steps:
1. Find Broadcom option rom for 1 and 2 ics. It seems like that ic is clean and requires oprom from dsl spi flash.
2. Capture traffic signals at uart (thunderbolt connector. Jtag signals from cortex processor that goes to dsl2210
3. Analyze spi rom data, offsets, possibly whitelist

 

[bigguygeo]

Yeah that Broadcom require Option ROM

 

[bigguygeo]

 

[bigguygeo]

At least I do have a cheap cool Ethernet pcb for joy

Pins are okay.

Important to solder TXD on Apple Ethernet pcb to RXD pcie pin to make it work

 

[bigguygeo]

****** INPUT ********


FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF1370F816060200010048314D98016E0001000380010508810000602A00000B820001400A00000000000E014170706C652C20496E632E002A025468756E646572626F6C7420746F20476967616269742045746865726E65742041646170746572001A3044544E363236373030343444574B48424D000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF


****** DECODING ********


13

******

70F8
160602000100

= UID = UID: 0x000100020616F870

******

48314D98016E00


******

0100

= Vendor ID: 0x1
******

0380

= Device ID: 0x8003

******

010508810000602A00000B820001400A00000000000E01

******

4170706C652C20496E632E
= ASCII = Vendor Name: Apple Inc.

******

002A02


******

5468756E646572626F6C7420746F20476967616269742045746865726E65742041646170746572
= ASCII = Device Name: Thunderbolt to Gigabit Ethernet Adapter
******

001A30
*******

44544E363236373030343444574B48424

= ASCII S\N = Apple Serial Number: DTN62670044DWKHBM

*******

D000000000000000000000000000000000000000000000000000000000000000000000000000000

 

[bigguygeo]

Logic Analyzing

The only problem: I don’t know how to decode uart data. What the speed and bits

 

[bigguygeo]

DECODING SIGNALS

TX Data
FE050690110A020260185753D8958C4F030000F5C1EDFE40FE05030460F2FE40FE050A01A6A1FE40FE817EFE807FFEA15EFEA05FFE817EFE807FFEA15EFEA05FFE817EFE807FFEA15EFEA05FFE817EFE807FFEA15EFEA05FFE817EFE807FFEA15EFEA05FFE817EFE807FFE817EFE827DFEA15EFEA05FFEA15EFEA05FFEA15EFEA05FFEA15EFEA05FFEA15EFEA05FFEA15EFEA05FFEA15EFEA05F

RX Data
FE040690008D15FE40FE0403044150502086C6FE40FE040A011F614EFE40FE817EFE807FFE817EFE807FFE817EFE807FFE817EFE807FFE817EFE807FFE817EFE807FFE817EFE807FFE817EFE827D


I2C Data

name ack address read data
I2C
I2C true 0x15 false
I2C true 0x0F
I2C
I2C true 0x15 true
I2C true 0x08
I2C true 0x00
I2C true 0x00
I2C false 0x00
I2C
I2C
I2C true 0x15 false
I2C true 0x0F
I2C
I2C true 0x15 true
I2C true 0x08
I2C true 0x00
I2C true 0x00
I2C false 0x00
I2C
I2C
I2C false 0x12 false
I2C
I2C
I2C false 0x13 false
I2C
I2C
I2C false 0x14 false
I2C
I2C
I2C true 0x15 false
I2C true 0x10
I2C true 0x57
I2C true 0x61
I2C true 0x6B
I2C true 0x65
I2C
I2C
I2C true 0x15 false
I2C true 0x0A
I2C
I2C true 0x15 true
I2C false 0x1F

The last signal to analyze is SPI from ARM to DSL2210

 

[bigguygeo]

How to dump cortex firmware? The cortex schematic show that it has internal flash rom

 

[4ts9v]

How to dump cortex firmware? The cortex schematic show that it has internal flash rom

I'm not certain at this moment but this is a very cool/neat project!

I'd love to help and this gives me ideas for some things we might work on together...

Do you have some Instant Messenger or something? PM me (I'm new) and I'll add you. I would happily fund/help out if it would expedite things for the current internal flash read... Actually I think I know how we can do that.

 

[bigguygeo]

interesting info:

eeprom.c source code [linux/drivers/thunderbolt/eeprom.c] - Codebrowser

Browse the source of linux v6.9-rc using KDAB Codebrowser which provides IDE like features for browsing C, C++, Rust & Dart code in your browser

code.woboq.org

never tested under linux, and that is interesting environment for research

 

[bigguygeo]

New soldering iron arrives and I continued research, and what I do know now:


Spi interface from arm to dsl2210 is quite, none data signals at any power states.





Also I soldered dsl pcie wires to pcie slot female, insert there working Ethernet (second part of dongle) which was soldered to pcie male and nothing happened. I check everything few times and electrically it should work but actually not.





I measured voltages of pcie lanes and seems Ethernet ic is not responding. Okay that means that ic trx wont transmit.





Okay I connected that to pc pcie and everything is working. Solder dsl wires directly to Ethernet ic (second part of dongle) and all working again.





So I solder dsl2210 pcie wires directly to pcie male and it still won’t work.





Why Apple engineers used covered wires ( with gnd isolated)?





Maybe signals from dsl2210 have no filters and they are dirty enough to be unrecognizable by Ethernet ic.





Hate those tiny wires soldering...








The next step: connect dsl2210 pcie wires to additional same wires to see if pcie signals will work correctly.





Anyway that dsl2210 isn’t good for creating of something like pcie adapter. Even if I will cut half of the oem wire it could not work...

 

[bigguygeo]

Actually there is no data or clock at spi:


Then how this two ics are communicating?

 

[bigguygeo]

That’s how it should be



Tried long cable ( two wires covered by ground. Results: no initialization


Directly connected to pcie card. Result: no initialization but ic stars because of pcireset

So that’s the long wire or whitelist



Low light but LED affects

I will try to cut wire for 60%. If that’s not work, then that’s whitelist. For solving that need FireWire firmware to unlock proper device id

 

[bigguygeo]

other firmware apple updates 1.2 from apple

 

[bigguygeo]

Spi captured data 70% of data is important to boot. 30% data is ... maybe for os recognazion (cosmetics)

FFFFFF

========================================================================================
========BOOTLOADER:

4A0004670149150021800500008003092C418F045353515100006D800010A01B24000000000000002E000000000000002727B800000000000000000000000000082D2B2D2D2DAAAA80000000400000010300D00808187822B126042A6A0002206B215F227C2335240025002600270E281C000010A01110130000010448080F0A2A0B7B100E00E1751479101245B9DB00E0E0A300F01B500000010100D0910500F025400000000000000000000000000000000000000000000000000000000000000000000000000000000000004000F3A050A1F1A888603D611962406314A50000F0402000012E5700112E5700212E5700312E570000010300020D03077A0000010100F38BFFD3090000000000F140E8410300F174A7753200F160010002083909C400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800F001030002040000050A8E00F00101FFFFFFFFFFFFFFFF

========================================================================================
=======THUNDERBOLT FIRMWARE (DOUBLE TIMES):

8200410200100000800C0500800908F07F0702F01006A25C92050230F20A234CFE070230F80A234CFE070A30F40A234CFE0704006406280F86031050070510A436050400800986F40008040080094E8CDE070230F80A374CFE072030F40A314CFE070800A4002230F40A374CFE070A00A4000430F80A4F4CFE072030F40A4F4CFE07050080091010A20004006406280F86030000A600021F360A0400800986F4000804006406280F860386F4000874022A200000800C688CDE070230F80A694CFE072030F40A634CFE070800A4002230F40A694CFE070A00A40004F064060400FA01EAF400087C0237300000800C0430F80A774CFE070410AA00A0F53F0718F5000848023D400000800C1500800900F010062250930500F030060430F80A8F4CFE071030F20A8F4CFE070450070504F056061400800992F40008C4034A50F8F07307F6F060010030F00AA33CFE071000A00971F040088AF7000808FF7F07810080099400A00902F05006045C1A0500783A0510008E065400AC0008F171070408A20004005206280F800304005606280F8003800080098AF700082D006160FEFFA109F8F0E002F6F0E002F8F07307B8F47F0702F05006F8F0EA024000A00910008E065CF000082E026B701A30F20AE54CFE07F8F06001F6F0E0020800A0090800A400DAF5000828F60008760073800000800CF6F0600100

FFFFFF

8200410200100000800C0500800908F07F0702F01006A25C92050230F20A234CFE070230F80A234CFE070A30F40A234CFE0704006406280F86031050070510A436050400800986F40008040080094E8CDE070230F80A374CFE072030F40A314CFE070800A4002230F40A374CFE070A00A4000430F80A4F4CFE072030F40A4F4CFE07050080091010A20004006406280F86030000A600021F360A0400800986F4000804006406280F860386F4000874022A200000800C688CDE070230F80A694CFE072030F40A634CFE070800A4002230F40A694CFE070A00A40004F064060400FA01EAF400087C0237300000800C0430F80A774CFE070410AA00A0F53F0718F5000848023D400000800C1500800900F010062250930500F030060430F80A8F4CFE071030F20A8F4CFE070450070504F056061400800992F40008C4034A50F8F07307F6F060010030F00AA33CFE071000A00971F040088AF7000808FF7F07810080099400A00902F05006045C1A0500783A0510008E065400AC0008F171070408A20004005206280F800304005606280F8003800080098AF700082D006160FEFFA109F8F0E002F6F0E002F8F07307B8F47F0702F05006F8F0EA024000A00910008E065CF000082E026B701A30F20AE54CFE07F8F06001F6F0E0020800A0090800A400DAF5000828F60008760073800000800CF6F0600100

========================================================================================
=======THUNDERBOLT FUNCTIONALITY??? (Look like pci initialization or hardcoded instructions):

30F00AF33CFE071000A00971F0400872F30008
FFFFFF
86804915
FFFFFF
00003000
FFFFFFFFFFFFFFFFFFFF
001CA000
FFFFFF86804915FFFFFF
001CA000
FFFFFF
00000100
FFFFFF
3C04A000
FFFFFF
50090080
FFFFFF
421DA000
FFFFFF
39000000
FFFFFF
431DA000
FFFFFF
00000004
FFFFFF
3A402800
FFFFFF
00041100
FFFFFF
32003000
FFFFFF
C0040000
FFFFFF
34003000

 

[bigguygeo]

some new. cant map code to decompiler

============================================================================
============================================================================
*************** HEX DATA OF ROM (WHOLE)
============================================================================
============================================================================

4A0004670149150021800500008003092C418F045353515100006D800010A01B24000000000000002E000000000000002727B800000000000000000000000000082D2B2D2D2DAAAA80000000400000010300D00808187822B126042A6A0002206B215F227C2335240025002600270E281C000010A01110130000010448080F0A2A0B7B100E00E1751479101245B9DB00E0E0A300F01B500000010100D0910500F025400000000000000000000000000000000000000000000000000000000000000000000000000000000000004000F3A050A1F1A888603D611962406314A50000F0402000012E5700112E5700212E5700312E570000010300020D03077A0000010100F38BFFD3090000000000F140E8410300F174A7753200F160010002083909C400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800F001030002040000050A8E00F00101FFFFFFFFFFFFFFFF8200410200100000800C0500800908F07F0702F01006A25C92050230F20A234CFE070230F80A234CFE070A30F40A234CFE0704006406280F86031050070510A436050400800986F40008040080094E8CDE070230F80A374CFE072030F40A314CFE070800A4002230F40A374CFE070A00A4000430F80A4F4CFE072030F40A4F4CFE07050080091010A20004006406280F86030000A600021F360A0400800986F4000804006406280F860386F4000874022A200000800C688CDE070230F80A694CFE072030F40A634CFE070800A4002230F40A694CFE070A00A40004F064060400FA01EAF400087C0237300000800C0430F80A774CFE070410AA00A0F53F0718F5000848023D400000800C1500800900F010062250930500F030060430F80A8F4CFE071030F20A8F4CFE070450070504F056061400800992F40008C4034A50F8F07307F6F060010030F00AA33CFE071000A00971F040088AF7000808FF7F07810080099400A00902F05006045C1A0500783A0510008E065400AC0008F171070408A20004005206280F800304005606280F8003800080098AF700082D006160FEFFA109F8F0E002F6F0E002F8F07307B8F47F0702F05006F8F0EA024000A00910008E065CF000082E026B701A30F20AE54CFE07F8F06001F6F0E0020800A0090800A400DAF5000828F60008760073800000800CF6F060010030F00AF33CFE071000A00971F0400872F30008FFFFFFFFFFFFFFFFFFFFFFFFFFFFFF8680491500003000FFFFFFFF001CA00086804915001CA000000001003C04A00050090080421DA00039000000431DA000000000043A4028000004110032003000C004000034003000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF184000003720280000000000220030004D0000002100300080000000220030002A00000023003000900000002500300008000000230030001000000025003000530000002300300010000000250030006C00000023003000100000002500300065000000230030001000000025003000700000002300300050000000250030000000000025003000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF84D0B37A010200010045CFB3E9016E0001000380010508810000602A00000B820001400A00000000000E014170706C652C20496E632E002A025468756E646572626F6C7420746F20476967616269742045746865726E65742041646170746572001A3044544E333235323033325344574B48424B000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF


============================================================================
============================================================================
*************** DECODING
============================================================================
============================================================================




============================================================================
============================================================================
*************** BOOTLOADER
============================================================================
============================================================================



1001010000000000000010001100111000000010100100100010101000000000010000110000000000001010000000000000000100000000000001100001001001011000100000110001111000001000101001101010011010100010101000100000000000000000110110110000000000000000001000010100000000110110010010000000000000000000000000000000000000000000000000000000000001011100000000000000000000000000000000000000000000000000000000000100111001001111011100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000010110100101011001011010010110100101101101010101010101010000000000000000000000000000000010000000000000000000000000000010000001100000000110100000000100000001000000110000111100000100010101100010010011000000100001010100110101000000000000000100010000001101011001000010101111100100010011111000010001100110101001001000000000000100101000000000010011000000000001001110000111000101

0000001110000000 - tb Device ID: 0x8003

0000000000000010000101000000001000100010000000100110000000000000000000000010000010001001000000010000000111100001010001010100000101101111011000100

0000001110000000 - tb Device ID: 0x8003

00111000010111010100010100011110010001000000010010010001011011100111011011000000001110000011100000101000110000000011110000000110110101000000000000000000000000000100000001000000001101000010010001000001010000000011110000001001010100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000001111001110100000010100001010000111110001101010001000100001100000001111010110000100011001011000100100000001100011000101001010010100000000000000001111000001000000001000000000000000000001001011100101011100000000000100010010111001010111000000000010000100101110010101110000000000110001001011100101011100000000000000000000000100000011000000000000001000001101000000110000011101111010000000000000000000000001000000010000000011110011100010111111111111010011000010010000000000000000000000000000000000000000111100010100000011101000010000010000001100000000111100010111010010100111011101010011001000000000111100010110000000000001000000000000001000001000001110010000100111000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000001111000000000001000000110000000000000010000001000000000000000000000001010000101010001110000000001111000000000001000000011111111111111111111111111111111111111111111111111111111111111111


============================================================================
============================================================================
*************** TB FIRMWARE (LOADED 2 Times)
============================================================================
============================================================================


100000100000000001000001000000100000000000010000000000000000000010000000000011000000010100000000100000000000100100001000111100000111111100000111000000101111000000010000000001101010001001011100100100100000010100000010001100001

1110010000010100 - Vendor Id - Broadcom - 0x14E4

010001101001100111111100000011100000010001100001111100000001010001000110100110011111110000001110000101000110000111101000000101000100011010011001111111000000111000001000000000001100100000001100010100000001111100001100000001100010000010100000000011100000101000100001010010000110110000001010000010000000000100000000000100110000110111101000000000000001000000001000000000010000000000010010100111010001100110111100000011100000010001100001111100000001010001101110100110011111110000001110010000000110000111101000000101000110001010011001111111000000111000010000000000010100100000000000010001000110000111101000000101000110111010011001111111000000111000010100000000010100100000000000000010000110000111110000000101001001111010011001111111000000111001000000011000011110100000010100100111101001100111111100000011100000101000000001000000000001001000100000001000010100010000000000000010000000000011001000000011000101000000011111000011000000011000000000000000010100110000000000000001000011111001101100000101000000100000000001000000000001001100001101111010000000000000010000000010000000000011001000000011000101000000011111000011000000011100001101111010000000000000010000111010000000010001010100010000000000000000000001000000000001100011010001000110011011110000001110000001000110000111110000000101001101001010011001111111000000111001000000011000011110100000010100110001101001100111111100000011100001000000000001010010000000000001000100011000011110100000010100110100101001100111111100000011100001010000000001010010000000000000001001111000001100100000001100000010000000000111110100000000111101010111101000000000000001000011111000000001000110111001100000000000000000000100000000000110000000100001100001111100000001010011101110100110011111110000001110000010000010000101010100000000010100000111101010011111100000111000110001111010100000000000010000100100000000010001111010100000000000000000000001000000000001100000101010000000010000000000010010000000011110000000100000000011000100010010100001001001100000101000000001111000000110000000001100000010000110000111110000000101010001111010011001111111000000111000100000011000011110010000010101000111101001100111111100000011100000100010100000000011100000101000001001111000001010110000001100001010000000000100000000000100110010010111101000000000000001000110001000000001101001010010100001111100011110000011100110000011111110110111100000110000000000001000000000011000011110000000010101010001100111100111111100000011100010000000000001010000000001001011100011111000001000000000010001000101011110111000000000000100000001000111111110111111100000111100000010000000010000000000010011001010000000000101000000000100100000010111100000101000000000110000001000101110000011010000001010000000001111000001110100000010100010000000000001000111000000110010101000000000010101100000000000000100011110001011100010000011100000100000010001010001000000000000001000000000001010010000001100010100000001111100000000000001100000100000000000101011000000110001010000000111110000000

0000001110000000 - tb Device ID: 0x8003 ?????

000000001000000000001001100010101111011100000000000010000010110100000000011000010110000011111110111111111010000100001001111110001111000011100000000000101111011011110000111000000000001011111000111100000111001100000111101110001111010001111111000001110000001011110000010100000000011011111000111100001110101000000010010000000000000010100000000010010001000000000000100011100000011001011100111100000000000000001000001011100000001001101011011100000001101000110000111100100000101011100101010011001111111000000111111110001111000001100000000000011111011011110000111000000000001000001000000000001010000000001001000010000000000010100100000000001101101011110101000000000000100000101000

1111011000000000 - Subsystem ID: 0x00f6 ?????

000010000111011000000000011100111000000000000000000000001000000000001100111101101111000001100000000000010000000000


110000111100000000101011110011001111001111111000000111000100000000000010100000000010010111000111110000010000000000100001110010111100110000000000001000





============================================================================
============================================================================
*************** END OF FILE
============================================================================
============================================================================




111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111





============================================================================
============================================================================
*************** Some instructions - very looking same as PCIe Initialization
============================================================================
============================================================================






======== *** yes, loaded in one sequence - (out of binary-note only) 10000110100000000100100100010101

1000011010000000 - Intel Device ID - 0x8086

0100100100010101 - Suspect DSL 2210 Device Id = 0x1549 ?????

00000000000000000011000000000000


11111111111111111111111111111111

00000000000111001010000000000000

1000011010000000 - Intel Device ID - 0x8086

0100100100010101 - Suspect DSL 2210 Device Id = 0x1549 ????


00000000000111001010000000000000

000000000000000000000001000000000011110000000100101000000000000001010000000010010000000010000000010000100001110110100000000000000011100100000000000000000000000001000011000111011010000000000000000000000000000000000000000001000011101001000000001010000000000000000000000001000001000100000000001100100000000000110000000000001100000000000100000000000000000000110100000000000011000000000000







============================================================================
============================================================================
*************** END OF FILE
============================================================================
============================================================================




1111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111




============================================================================
============================================================================
*************** Looking close to ARM instructions
============================================================================
============================================================================



000110000100000000000000000000000011011100100000001010000000000000000000000000000000000000000000001000100000000000110000000000000100110100000000000000000000000000100001000000000011000000000000100000000000000000000000000000000010001000000000001100000000000000101010000000000000000000000000001000110000000000110000000000001001000000000000000000000000000000100101000000000011000000000000000010000000000000000000000000000010001100000000001100000000000000010000000000000000000000000000001001010000000000110000000000000101001100000000000000000000000000100011000000000011000000000000000100000000000000000000000000000010010100000000001100000000000001101100000000000000000000000000001000110000000000110000000000000001000000000000000000000000000000100101000000000011000000000000011001010000000000000000000000000010001100000000001100000000000000010000000000000000000000000000001001010000000000110000000

0000001110000000 - tb Device ID: 0x8003

0000000000000000000000010001100000000001100000000000001010000000000000000000000000000001001010000000000110000000000000000000000000000000000000000000000100101000000000011000000000000




============================================================================
============================================================================
*************** END OF FILE
============================================================================
============================================================================


1111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111



============================================================================
============================================================================
*************** Cosmetics? Apple, Inc.*Thunderbolt to Gigabit Ethernet Adapter DTN3252032SDWKHBK, UUID, Etc
============================================================================
============================================================================



10000100110100001011001101111010000000010000001000000000000000010000000001000101110011111011001111101001000000010110111000000000

0000000100000000 - tb Vendor ID: 0x1

0000001110000000 - tb Device ID: 0x8003

0000000100000101000010001000000100000000000000000110000000101010000000000000000000001011100000100000000000000001010000000000101000000000000000000000000000000000000000

0000001110000000 - tb Device ID: 0x8003

0101000001011100000111000001101100011001010010110000100000010010010110111001100011001011100000000000101010000000100101010001101000011101010110111001100100011001010111001001100010011011110110110001110100001000000111010001101111001000000100011101101001011001110110000101100010011010010111010000100000010001010111010001101000011001010111001001101110011001010111010000100000010000010110010001100001011100000111010001100101011100100000000000011010001100000100010001010100010011100011001100110010001101010011001000110000001100110011001001010011010001000101011101001011010010000100001001001011000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000



============================================================================
============================================================================
*************** END OF FILE
============================================================================
============================================================================


1111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111

 

[bigguygeo]

_Ethernet_ArmCode.bin
_Ethernet_Bootloader.bin
_Ethernet_PcieINIT.bin
_Ethernet_ThunderboltFirmware.bin



In that parts, disassemblers can open code

 

[bigguygeo]

Interesting Card

https://h20195.www2.hp.com/v2/getpdf.aspx/4AA7-6445ENW.pdf

 

[bigguygeo]

I wasn't here for a long time, and sharing the materials never post before, that was used for analyze of this wonderful dongle. I am not 100% sure that everything there is correct, as it was my first study project, so...

 

[bigguygeo]

View attachment 227487

AT24C512C Datasheet:​

https://ww1.microchip.com/downloads/en/DeviceDoc/20006161B.pdf

AT24C512C Datasheet(PDF)

Part #: AT24C512C. Download. File Size: 928Kbytes. Page: 23 Pages. Description: I2C-Compatible (2-wire) Serial EEPROM. Manufacturer: ATMEL Corporation.

www.alldatasheet.com

 

[bigguygeo]

BQA, BQ8 STEP-DOWN 3.3V to 1.05V is TPS62510

 

[bigguygeo]

That is how SPI rom is read when dongle is connected to MBP. Interesting here is that DSL2210 never reads this code:

184000003720280000000000220030004D0000002100300080000000220030002A00000023003000900000002500300008000000230030001000000025003000530000002300300010000000250030006C00000023003000100000002500300065000000230030001000000025003000700000002300300050000000250030000000000025003000

@7 ("0M!0"0*#0%0#0%0S#0%0l#0%0e#0%0p#0P%0%0

1370F816060200010048314D98016E0001000380010508810000602A00000B820001400A00000000000E014170706C652C20496E632E002A025468756E646572626F6C7420746F20476967616269742045746865726E65742041646170746572001A3044544E363236373030343444574B48424D000000000000000000000000000000000000000000000000000000000000000000000000000000


pøH1Mn`*@
Apple, Inc.*Thunderbolt to Gigabit Ethernet Adapter0DTN62670044DWKHBM

 

[bigguygeo]

Some OC PCIe code from Apple