A little more progress on the NVEM board over a long weekend. I still cannot get the original firmware to talk with Mach3 again. I was hoping to be able to sniff the serial connection to the MPG to try and figure out the serial payload protocol. The only other way to do this would be to decompile the firmware.
Opening up the MPG to find that it too has an STM32 chip. The MCU is a STM32F103RCT6 with a 25Mhz crystal (which is strange). The TFT display module is an XYL2221 module using a parallel ILI9225 driver.
This was my first attempt at trying to reverse engineer from a binary so a bit of a learning curve on how to use the Ghidra software.
After finding what looked like the main() function there were only two other function calls in the main loop. The first being a call to what looks like the TFT update function and the other doing something with the interrupt controller. Looks like timer interrupts are used to poll of data and read button presses etc.
In the TFT_update function there are references to array positions that contain data for the display values. Enough info to start mapping out the payload structure.
There is a header of two bytes. This was found by looking for a UART receive function. These two header bytes are used to sync the data and then to transfer a further 51 following bytes into a data array. This same function also sends a reply if a second header structure is received. No data is updated so this must be used for checking that the MPG is connected.
The button press codes were straight forward to capture using Realterm.
I built a protocol simulator in Excel to test it out. I can update the display as needed!
Next step is to write a LinuxCNC component that can encode the 51 byte payload and a Remora module to go into the NVEM board to send the data to the MPG.
Baudrate = 115200 8N1
[protocol simulator is attached to save others from the work]
