Hardware Hacking Projects for Geeks

88

Part I: Basic Hacks, Tools, and Techniques

If you need a reference to the 8051 Instruction Set with details, take a look

here:

ftp://download.intel.com/design/MCS51/applnots/01502a01.pdf

If the 8051 is new to you and you wish to start with a basic tutorial, take

a look here:

http://www.pjrc.com/tech/8051/

Like most things on the Web, these links can change. If you cannot locate them,

simply do a web search at http://www.google.com to find their latest locations.

A Quick Overview of Assembly Language

and C for the Hacked Furby

The hacked Furby can be programmed in C and assembly language. We’ll

step through how to do this now.

If you want to program your newly modified Furby in C, a set of APIs will

allow you to control most of the basic functions of the hacked Furby. The

code for these APIs is at http://www.appspec.net/index.html.

Learning 8051 assembler code

The mlasm51.exe download mentioned earlier is a self-installing executable

for Windows. When you run it, it unpacks the free assembler and an excel-

lent manual, as well as code samples and figures. Print them all out and

read them to learn 8051 assembler. If you have any assembler knowledge,

8051 is not hard; it just takes an investment of time. The CPU does have

one or two architectural curiosities, and is limited by its 8-bit architecture.

On the other hand, those provide some simplifications too. The 8051 in

the new Furby rips along at 20 MHz, more than four times faster than the

original IBM PC (4.77 MHz).

Coding in C

This is perhaps the simplest solution for most people, though it doesn’t

allow you the most efficient use of the Furby’s resources. It does, however,

allow you to use the nice little C API that handles most of the basic func-

tionality you’ll want out of your Furby.

A good C compiler for the 8051 is the Small Device C compiler or SDCC;

it’s available at http://sdoc.sourceforge.net. Follow the instructions included

with SDCC for its operation. A treatment of its general usage is beyond

the scope of this chapter; reference the Temic documentation for the

T89C51RD2.

Assembly Language and C

ch05_furby.indd 88

1/21/2002 12:33:04 PM

89

Chapter 5, How to Hack a Furby (and Other Talking Toys)

Preparing code for download

Make sure you have downloaded and installed your chosen development

tool, either an 8051 assembler or SDCC. Once you have written your code,

compile or assemble the source file according to the directions given for

that particular package. That generates a .hex file from your source. The

.hex file is an ASCII file in S-record format, which is a printable ASCII

format consisting of an optional header, any number of data records (each

representing a start address and any number of content words), and a trailer

record.

You will also want to bin2hex any sound samplings. See the example under

Sound files for your Furby.

You can use either of the simulators to test or step through your code before

you download it into Furby. Of course, you cannot check that sounds or

movements play correctly until you run on the actual hardware.

Downloading and using the software

You will be downloading an ASCII file of hex content into the hacked

Furby’s flash memory using the WinISP software. WinISP transmits a file

from the serial port of your Windows PC into the hacked Furby’s flash

PROM. Plug the adapter cable from the kit into the hacked Furby’s socket

at one end and into the serial port of your PC at the other. Plans are in the

works for a freeware, open source version of the ISP program. (It should be

an easy task with something like Perl.)

Make sure you have downloaded and installed the WinISP program

onto your PC. You can find it at http://www.temic-semi.com/upload/dev_

tools39dd839562c61.zip.

Start WinISP

The software requires three parameters. Consult the table below for the

appropriate value to be entered into each. Use the values in this table for

the following three parameters on this screen.

Parameter Value

Chip P89C51RD2

Port COM1 (or whatever PC port you are using)

Osc (MHz) 20 (this is the MHz speed of the CPU)

If all is well, the status display will read “Comm Port Opened (19200 bps).”

Initial code loads and debugging are done via the serial port at a speed

of 19.2K bps. The impatient will love the high-speed downloads, while

Unix fans will be thoroughly at home with the character-oriented console

access.

Assembly Language and C

ch05_furby.indd 89

1/21/2002 12:33:04 PM