MSP430F437: Decode a mcu unit

Hi Mahmoud,

In short, not really. You can get the hexcode, but it isn't really compatible for moving to the IDE.

Here's a thread that talks about the process for getting the hexcode though: Retrieving Stored Code

Regards,

Luke

Hi Luke

Many Thanks for your reply. The thread you sent me is really helpful. 

I know it looks a little bit silly. But, is there any documents that describes how to connect the mcu to pc for be able to use the tool? 

Regards

Mahmoud 

This is how the Mcu is connected to the board and I want to know if there is anyway to connect it directly from their to the pc. 

Mahmoud Al.Gendy said:

This is how the Mcu is connected to the board and I want to know if there is anyway to connect it directly from their to the pc. 

It looks like JP1 is intended to connect to JTAG on the MCU, but it is a non-standard 10 pin connector rather than the standard 14-pin layout used on a MSP-FET. If you trace the connections on the PCB you should be able to determine how to connect a MSP-FET to read out the device content, assuming the device protection fuse hasn't been blown.

Mahmoud Al.Gendy said:

I have a Pcb board used for water meters based on MSP430F437 mcu. I want to know if it possible to decode the firmware from the mcu to modify some parameters.

I curious to know why you need to do that. Have you lost the programmed firmware?

I double checked the board for any other connections to the mcu but no clue. It looks like this is the only way to get the mcu connected. But, yes it is not a standard connector and I'm sure that the board has access to the mcu to reprogram it. Is there any 10 pin to 14 pin cable? 

This board came from a water meter from a Chinese manufacturer. We have some of them and we lost connection with them and no one know how we can replace this board if it got damaged. We need to find a way to clone the board to make a spare parts for the faulty ones.

The device used to reprogrammed on demand. So, I think the manufacturer was able to get it connected and uploaded a new firmware to it. Does this mean that the fuse is not blown and we still can get the firmware.?

Hi Mahmoud,

There isn't an easy way to do this, which is good on a security standpoint. If the fuse is blown there isn't much you can do, you can see if the fuse is blown by trying to access the JTAG. You can even just get some small clips to hook onto the device pins if there is no specific JTAG section on the board, but if they had programmed it with JTAG there should be a block. 

Here is the MSP430 Programming with JTAG guide which helps detail the JTAG process, you can find the x4xx family in there which is the family for the MSP430F437.

Once you get the hex or binary it will take a large effort to decode it if you want to modify the exact code. Binary/Hex code isn't really human friendly and you would need to use the instruction set to translate to assembly code, then you can convert the assembly code to C code. This takes a lot of effort, it would be simpler if you could reestablish connection with the manufacturer. It might even be faster just to code your own version of the device rather than try to decode the hex.

Regards,

Luke