Kick a LEGO MINDSTORMS NXT p-Brick out of SAM-BA mode without writing new firmware?

Question

I recently received a LEGO MINDSTORMS NXT p-Brick which, surprisingly, still has the original retail V1.01 firmware on it.

My goal is to extract its current firmware image to a file while maintaining the original condition of the p-Brick, so I'm currently experimenting on a completely different p-Brick that already has V1.31 on it to get my procedure down first.

Since I'm on macOS, via Homebrew I've installed the Bossa tools (the BOSSA GUI app, bossac and bossash):

$ brew install bossa
#...

I can get the candidate into SAM-BA mode by press-and-holding the reset button for several seconds, plugging in a USB cable, and accessing it via the presented USBSerial port (Atmel Corp. at92sam SAMBA bootloader, vid:0x03e8, pid:0x6124):

$ ls -la /dev/tty.usb*
crw-rw-rw-  1 root  wheel   18,   4 26 Jan 11:16 /dev/tty.usbmodem14431301

$ bossac --port /dev/tty.usbmodem14431301 --read "V1.31.rfw"
Read 262144 bytes from flash
[==============================] 100% (1024/1024 pages)
Done in 3.838 seconds

$ bossac --port /dev/tty.usbmodem14431301 --boot=1 --reset
Set boot flash true

This works except that the p-Brick doesn't actually reboot into the LEGO firmware, it reboots into the SAM-BA boot loader again. It seems like SAM-BA doesn't honor the --boot flag until a new firmware image has been written because it will actually reboot into the LEGO firmware after I write one with the following:

$ bossac --port /dev/tty.usbmodem14431301 --unlock
Unlock all regions

$ bossac --port /dev/tty.usbmodem14431301 --erase --write LEGO-MINDSTORMS-NXT-Firmware-V1.31.rfw --verify
Erase flash

Done in 0.035 seconds
Write 262144 bytes to flash (1024 pages)
[==============================] 100% (1024/1024 pages)
Done in 15.709 seconds
Verify 262144 bytes of flash
[==============================] 100% (1024/1024 pages)
Verify successful
Done in 3.870 seconds

$ bossac --port /dev/tty.usbmodem14431301 --boot=1 --reset

The experience is the same when using bossash:

$ bossash
Press Ctrl-D or enter "exit" to end session.
Enter "help" to display a command list.
bossa> connect /dev/tty.usbmodem14431301
Connected to device on /dev/tty.usbmodem14431301
bossa> info
Device       : AT91SAM7S256
Version      : v1.4 Nov 10 2004 14:49:33
Address      : 0x100000
Pages        : 1024
Page Size    : 256 bytes
Total Size   : 256KB
Planes       : 1
Lock Regions : 16
Locked       : none
Security     : false
BOD          : false
BOR          : false
bossa> read V1.31.rfw
count:0 offset:0
Read 262144 bytes from flash
[==============================] 100% (1024/1024 pages)
Read successful
bossa> bootf true
Boot to flash flag set to true
bossa> reset
# ^ USBSerial disconnects here due to software reset

bossa> connect /dev/tty.usbmodem14431301
Connected to device on /dev/tty.usbmodem14431301
bossa> erase
Erase flash
Flash is erased
bossa> write LEGO-MINDSTORMS-NXT-Firmware-V1.31.rfw
Write 262144 bytes to flash (1024 pages)
[==============================] 100% (1024/1024 pages)
Write successful
bossa> verify LEGO-MINDSTORMS-NXT-Firmware-V1.31.rfw
Verify 262144 bytes of flash
[==============================] 100% (1024/1024 pages)
Verify successful
bossa> bootf true
Boot to flash flag set to true
bossa> reset

i.e.: the first reset after reading only boots into SAM-BA again, the second reset after erasing and writing actually boots into the LEGO firmware.

So my question: is there a trick to bypass the SAM-BA boot loader and manually reset the boot flag via bossash?

I imagine it could be done from bossash with the mwb or mww commands but I'm not familiar enough with the AT91SAM7S256 to know which memory-mapped register address(es) I need to poke.

Answer 1

Sadly, after experimenting with different official firmware versions on a sacrificial unit, I've determined that the SAM-BA boot loader and related client tools are not going to be suitable for the task of extracting an existing firmware image from a NXT p-Brick.

The --boot flag actually doesn't have anything to do the problem I was experiencing with because the NXT p-Brick is always in boot-to-flash mode.

Through trials of writing, reading and verifying firmware images before a --reset operation, followed by reading and verifying firmware images after re-entering SAM-BA mode, I've determined that the NXT p-Brick does something unexpected:

• After long-pressing the reset button on the NXT p-Brick the first 0x1200 bytes (0x0000-0x11ff) of flash memory get overwritten by a standard program. Maybe this is the SAM-BA boot loader copied from the mask ROM inside the AT91SAM7S256 itself.
• This destructive operation overwrites the beginning of any existing firmware image, e.g.: official LEGO MINDSTORMS NXT firmware.
• There's no recovering from this unless you can restore the first 0x1200 bytes of flash from another source, such as a previously captured firmware image.

This is why the --reset operation only worked after writing new firmware, because the program in the first 0x1200 bytes of flash memory itself gets overwritten by the new firmware image and the subsequent reboot starts executing user code again.

I'm glad I tried developing the procedure on a different p-Brick first!

I'll move on to investigate other options, such as finding a solder-free connection to the JTAG pads on the p-Brick's mainboard and using a debugger.