Extract real FX2 firmware from I2C EEPROM

Browse source

Previous RAM dumps via 0xA0 vendor request turned out to be live FIFO
data, not firmware - the Genpix FX2 firmware overrides the standard
0xA0 handler. Discovered that I2C_READ (0x84) with wValue=0x51 and
wIndex=offset reads the boot EEPROM directly.

EEPROM contents (Cypress C2 format):
- VID:PID 09C0:0203, config 0x40 (400kHz I2C)
- 9,472 bytes of 8051 firmware in 10 load records
- Code range 0x0000-0x24FF, entry at LJMP 0x188D
- Ghidra auto-analysis finds 61 functions

Tools: eeprom_dump.py (full dump), eeprom_probe.py (I2C protocol discovery)

...

This commit is contained in:

Ryan Malloy 2026-02-11 05:08:20 -07:00

parent 757da08987

commit ba37105e2a

5 changed files with 352 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

BIN

firmware-dump/skywalker1_eeprom.bin Normal file

View file

Binary file not shown.

BIN

firmware-dump/skywalker1_eeprom_flat.bin Normal file

View file

Binary file not shown.

BIN

firmware-dump/skywalker1_eeprom_full64k.bin Normal file

View file

Binary file not shown.