Answers.Body: <p>Sadly, after experimenting with different official firmware versions on a sacrificial unit, I've determined that the SAM-BA boot loader and related client tools are not going to be suitable for the task of extracting an existing firmware image from a NXT p-Brick.</p>
  <p>The <code>--boot</code> flag actually doesn't have anything to do the problem I was experiencing with because the NXT p-Brick is always in boot-to-flash mode.</p>
  <p>Through trials of writing, reading and verifying firmware images before a <code>--reset</code> operation, followed by reading and verifying firmware images after re-entering SAM-BA mode, I've determined that the NXT p-Brick does something unexpected:</p>
  <ul>
  <li>After long-pressing the reset button on the NXT p-Brick the first 0x1200 bytes (0x0000-0x11ff) of flash memory get overwritten by a standard program. Maybe this is the SAM-BA boot loader copied from the mask ROM inside the AT91SAM7S256 itself.</li>
  <li>This destructive operation overwrites the beginning of any existing firmware image, e.g.: official LEGO MINDSTORMS NXT firmware.</li>
  <li>There's no recovering from this unless you can restore the first 0x1200 bytes of flash from another source, such as a previously captured firmware image.</li>
  </ul>
  <p>This is why the <code>--reset</code> operation only worked after writing new firmware, because the program in the first 0x1200 bytes of flash memory itself gets overwritten by the new firmware image and the subsequent reboot starts executing user code again.</p>
  <p>I'm glad I tried developing the procedure on a different p-Brick first!</p>
  <p>I'll move on to investigate other options, such as finding a solder-free connection to the JTAG pads on the p-Brick's mainboard and using a debugger.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2022-01-26T08:44:11.627Z
Answers.LastActivityDate: 2022-01-26T08:44:11.627Z
Answers.UserDisplayName: AlwaysLearning
Body: <p>I recently received a LEGO MINDSTORMS NXT p-Brick which, surprisingly, still has the original retail V1.01 firmware on it.</p>
  <p>My goal is to extract its current firmware image to a file while maintaining the original condition of the p-Brick, so I'm currently experimenting on a completely different p-Brick that already has V1.31 on it to get my procedure down first.</p>
  <p>Since I'm on macOS, via Homebrew I've installed the Bossa tools (the BOSSA GUI app, bossac and bossash):</p>
  <pre><code>$ brew install bossa
  #...
  </code></pre>
  <p>I can get the candidate into SAM-BA mode by press-and-holding the reset button for several seconds, plugging in a USB cable, and accessing it via the presented USBSerial port (Atmel Corp. at92sam SAMBA bootloader, vid:0x03e8, pid:0x6124):</p>
  <pre><code>$ ls -la /dev/tty.usb*
  crw-rw-rw-  1 root  wheel   18,   4 26 Jan 11:16 /dev/tty.usbmodem14431301
  
  $ bossac --port /dev/tty.usbmodem14431301 --read &quot;V1.31.rfw&quot;
  Read 262144 bytes from flash
  [==============================] 100% (1024/1024 pages)
  Done in 3.838 seconds
  
  $ bossac --port /dev/tty.usbmodem14431301 --boot=1 --reset
  Set boot flash true
  </code></pre>
  <p>This works except that the p-Brick doesn't actually reboot into the LEGO firmware, it reboots into the SAM-BA boot loader again. It seems like SAM-BA doesn't honor the <code>--boot</code> flag until a new firmware image has been written because it will actually reboot into the LEGO firmware after I write one with the following:</p>
  <pre><code>$ bossac --port /dev/tty.usbmodem14431301 --unlock
  Unlock all regions
  
  $ bossac --port /dev/tty.usbmodem14431301 --erase --write LEGO-MINDSTORMS-NXT-Firmware-V1.31.rfw --verify
  Erase flash
  
  Done in 0.035 seconds
  Write 262144 bytes to flash (1024 pages)
  [==============================] 100% (1024/1024 pages)
  Done in 15.709 seconds
  Verify 262144 bytes of flash
  [==============================] 100% (1024/1024 pages)
  Verify successful
  Done in 3.870 seconds
  
  $ bossac --port /dev/tty.usbmodem14431301 --boot=1 --reset
  </code></pre>
  <p>The experience is the same when using <code>bossash</code>:</p>
  <pre><code>$ bossash
  Press Ctrl-D or enter &quot;exit&quot; to end session.
  Enter &quot;help&quot; to display a command list.
  bossa&gt; connect /dev/tty.usbmodem14431301
  Connected to device on /dev/tty.usbmodem14431301
  bossa&gt; info
  Device       : AT91SAM7S256
  Version      : v1.4 Nov 10 2004 14:49:33
  Address      : 0x100000
  Pages        : 1024
  Page Size    : 256 bytes
  Total Size   : 256KB
  Planes       : 1
  Lock Regions : 16
  Locked       : none
  Security     : false
  BOD          : false
  BOR          : false
  bossa&gt; read V1.31.rfw
  count:0 offset:0
  Read 262144 bytes from flash
  [==============================] 100% (1024/1024 pages)
  Read successful
  bossa&gt; bootf true
  Boot to flash flag set to true
  bossa&gt; reset
  # ^ USBSerial disconnects here due to software reset
  
  bossa&gt; connect /dev/tty.usbmodem14431301
  Connected to device on /dev/tty.usbmodem14431301
  bossa&gt; erase
  Erase flash
  Flash is erased
  bossa&gt; write LEGO-MINDSTORMS-NXT-Firmware-V1.31.rfw
  Write 262144 bytes to flash (1024 pages)
  [==============================] 100% (1024/1024 pages)
  Write successful
  bossa&gt; verify LEGO-MINDSTORMS-NXT-Firmware-V1.31.rfw
  Verify 262144 bytes of flash
  [==============================] 100% (1024/1024 pages)
  Verify successful
  bossa&gt; bootf true
  Boot to flash flag set to true
  bossa&gt; reset
  </code></pre>
  <p>i.e.: the first reset after reading only boots into SAM-BA again, the second reset after erasing and writing actually boots into the LEGO firmware.</p>
  <p>So my question: is there a trick to bypass the SAM-BA boot loader and manually reset the boot flag via <code>bossash</code>?</p>
  <p>I imagine it could be done from <code>bossash</code> with the <code>mwb</code> or <code>mww</code> commands but I'm not familiar enough with the AT91SAM7S256 to know which memory-mapped register address(es) I need to poke.</p>
  
Tags: <nxt>
Title: Kick a LEGO MINDSTORMS NXT p-Brick out of SAM-BA mode without writing new firmware?
UserDisplayName: AlwaysLearning
ThreadText: # Kick a LEGO MINDSTORMS NXT p-Brick out of SAM-BA mode without writing new firmware?
  
  (Asked by: username_0 on 2022-01-26)
  
  I recently received a LEGO MINDSTORMS NXT p-Brick which, surprisingly, still has the original retail V1.01 firmware on it.
  My goal is to extract its current firmware image to a file while maintaining the original condition of the p-Brick, so I'm currently experimenting on a completely different p-Brick that already has V1.31 on it to get my procedure down first.
  Since I'm on macOS, via Homebrew I've installed the Bossa tools (the BOSSA GUI app, bossac and bossash):
  $ brew install bossa
  #...
  
  I can get the candidate into SAM-BA mode by press-and-holding the reset button for several seconds, plugging in a USB cable, and accessing it via the presented USBSerial port (Atmel Corp. at92sam SAMBA bootloader, vid:0x03e8, pid:0x6124):
  $ ls -la /dev/tty.usb*
  crw-rw-rw-  1 root  wheel   18,   4 26 Jan 11:16 /dev/tty.usbmodem14431301
  
  $ bossac --port /dev/tty.usbmodem14431301 --read "V1.31.rfw"
  Read 262144 bytes from flash
  [==============================] 100% (1024/1024 pages)
  Done in 3.838 seconds
  
  $ bossac --port /dev/tty.usbmodem14431301 --boot=1 --reset
  Set boot flash true
  
  This works except that the p-Brick doesn't actually reboot into the LEGO firmware, it reboots into the SAM-BA boot loader again. It seems like SAM-BA doesn't honor the --boot flag until a new firmware image has been written because it will actually reboot into the LEGO firmware after I write one with the following:
  $ bossac --port /dev/tty.usbmodem14431301 --unlock
  Unlock all regions
  
  $ bossac --port /dev/tty.usbmodem14431301 --erase --write LEGO-MINDSTORMS-NXT-Firmware-V1.31.rfw --verify
  Erase flash
  
  Done in 0.035 seconds
  Write 262144 bytes to flash (1024 pages)
  [==============================] 100% (1024/1024 pages)
  Done in 15.709 seconds
  Verify 262144 bytes of flash
  [==============================] 100% (1024/1024 pages)
  Verify successful
  Done in 3.870 seconds
  
  $ bossac --port /dev/tty.usbmodem14431301 --boot=1 --reset
  
  The experience is the same when using bossash:
  $ bossash
  Press Ctrl-D or enter "exit" to end session.
  Enter "help" to display a command list.
  bossa> connect /dev/tty.usbmodem14431301
  Connected to device on /dev/tty.usbmodem14431301
  bossa> info
  Device       : AT91SAM7S256
  Version      : v1.4 Nov 10 2004 14:49:33
  Address      : 0x100000
  Pages        : 1024
  Page Size    : 256 bytes
  Total Size   : 256KB
  Planes       : 1
  Lock Regions : 16
  Locked       : none
  Security     : false
  BOD          : false
  BOR          : false
  bossa> read V1.31.rfw
  count:0 offset:0
  Read 262144 bytes from flash
  [==============================] 100% (1024/1024 pages)
  Read successful
  bossa> bootf true
  Boot to flash flag set to true
  bossa> reset
  # ^ USBSerial disconnects here due to software reset
  
  bossa> connect /dev/tty.usbmodem14431301
  Connected to device on /dev/tty.usbmodem14431301
  bossa> erase
  Erase flash
  Flash is erased
  bossa> write LEGO-MINDSTORMS-NXT-Firmware-V1.31.rfw
  Write 262144 bytes to flash (1024 pages)
  [==============================] 100% (1024/1024 pages)
  Write successful
  bossa> verify LEGO-MINDSTORMS-NXT-Firmware-V1.31.rfw
  Verify 262144 bytes of flash
  [==============================] 100% (1024/1024 pages)
  Verify successful
  bossa> bootf true
  Boot to flash flag set to true
  bossa> reset
  
  i.e.: the first reset after reading only boots into SAM-BA again, the second reset after erasing and writing actually boots into the LEGO firmware.
  So my question: is there a trick to bypass the SAM-BA boot loader and manually reset the boot flag via bossash?
  I imagine it could be done from bossash with the mwb or mww commands but I'm not familiar enough with the AT91SAM7S256 to know which memory-mapped register address(es) I need to poke.
  
  **Tags:** nxt
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2022-01-26. Score: 2
  
  Sadly, after experimenting with different official firmware versions on a sacrificial unit, I've determined that the SAM-BA boot loader and related client tools are not going to be suitable for the task of extracting an existing firmware image from a NXT p-Brick.
  
  The `--boot` flag actually doesn't have anything to do the problem I was experiencing with because the NXT p-Brick is always in boot-to-flash mode.
  
  Through trials of writing, reading and verifying firmware images before a `--reset` operation, followed by reading and verifying firmware images after re-entering SAM-BA mode, I've determined that the NXT p-Brick does something unexpected:
  
  * After long-pressing the reset button on the NXT p-Brick the first 0x1200 bytes (0x0000-0x11ff) of flash memory get overwritten by a standard program. Maybe this is the SAM-BA boot loader copied from the mask ROM inside the AT91SAM7S256 itself.
  * This destructive operation overwrites the beginning of any existing firmware image, e.g.: official LEGO MINDSTORMS NXT firmware.
  * There's no recovering from this unless you can restore the first 0x1200 bytes of flash from another source, such as a previously captured firmware image.
  
  This is why the `--reset` operation only worked after writing new firmware, because the program in the first 0x1200 bytes of flash memory itself gets overwritten by the new firmware image and the subsequent reboot starts executing user code again.
  
  I'm glad I tried developing the procedure on a different p-Brick first!
  
  I'll move on to investigate other options, such as finding a solder-free connection to the JTAG pads on the p-Brick's mainboard and using a debugger.
  
  
  ---
  
  