# Programming An Air Cooled DMOC645



## WolfTronix (Feb 8, 2016)

Not sure if anyone would be interested in this...

But here is a video playlist showing how I sniffed SPI EEPROM data, reverse engineered the CRC16, accidentally popped a microcontroller, read out the EEPROM, changed a byte, calculated the CRC16, wrote the data back to the EEPROM.

All so that the firmware would think that is was installed on a liquid cooled DMOC645, instead of an Air cooled DMOC645. 

Video playlist:
http://www.youtube.com/playlist?list...lR1qPrEtavoqkR

The whole endeavor is obsolete now, since there is a much easier software solution. 

But the steps could be used to get around some other hardware/firmware limitations in other devices. 

Enjoy, 
Wolf


----------



## CKidder (Dec 12, 2009)

Yeah, it was a very interesting set of videos. Certainly anyone who has an interest in reverse engineering should watch the videos even if just for informational purposes. The fact that that's an easier way is somewhat irrelevant because, as you said, the things demonstrated in the videos are applicable to many other circumstances. And, the videos did directly lead to the easier approach too. Sometimes it takes doing it the hard way to see the easier way.


----------



## adriftatsea (Oct 5, 2015)

WolfTronix said:


> The whole endeavor is obsolete now, since there is a much easier software solution.


Has this method been posted somewhere? 

I suppose the 'how' is using binwalk or strings on the firmware to look for a case_id or even all values of '18' (or whatever the caseid was). 

Anyways, awesome work.

And semi-ot, have you attempted other methods to remove the conformal coating other than a razor?


----------



## CKidder (Dec 12, 2009)

adriftatsea said:


> Has this method been posted somewhere?
> 
> I suppose the 'how' is using binwalk or strings on the firmware to look for a case_id or even all values of '18' (or whatever the caseid was).
> 
> ...


Full disclosure: I've talked to Wolf throughout the process and I was the first one to get the easier approach to work. But, it was still essentially his idea; I just tried it first.

I had considered changing the firmware to search for the different box ID but it seemed like a lot of work to trace down the exact spot where that check happens. Instead, CCShell was used to edit the box id. As wolf covered in his videos, ccshell is able to read from and write to the eeprom. So, with a little bit of editing of the CCS file used for the controller it is possible to convince CCShell that boxtype is a valid entry in the edit screen. Then ccshell does all the hard work for you. The bonus of this approach is that it works without having to open the DMOC at all. But, I still would as the things have god-awful 2/0 cabling that's way, way overkill for the power level of the controller. It'd be more appropriate to use something like 1ga wire for the three phase wiring.


----------

