ESP8266 Community Forum

- Fri Sep 05, 2014 4:44 pm #219 This may be useful
AT+RST

OK

ets Jan 8 2013,rst cause:4, boot mode:(3,7)

wdt reset
load 0x40100000, len 24236, room 16
tail 12
chksum 0xb7
ho 0 tail 12 room 4
load 0x3ffe8000, len 3008, room 12
tail 4
chksum 0x2c
load 0x3ffe8bc0, len 4816, room 4
tail 12
chksum 0x46
csum 0x46

- Fri Sep 05, 2014 7:11 pm #220 Hi everyone,

I have successully dumped the I-ROM at 0x40000000-0x4000FFFF; I've put the binary dump at http://df.lth.se/~kongo/esp8266.bin. Disassembling it might give some hints at what the bootloader does, and if there are any hidden commands not implemented in XTCOM_API. I have at this time not verified whether the ROM is 64KiB or larger, but the dump have a few hundred bytes zero-padding at the end so it is reasonable to believe that the dump is complete.
I will probably release my python XTCOM replacement/library and protocol documentation as soon as I have had the time to polish it a bit, got my modules a couple of hours ago

EDIT:
This dump was corrupt, I'm so sorry. Further reading: viewtopic.php?f=6&t=39&p=327#p327

Last edited by kongo on Sun Sep 07, 2014 3:17 pm, edited 1 time in total.

- Sat Sep 06, 2014 2:25 am #232 How did you do it?

- Sat Sep 06, 2014 2:32 am #233 Just FYI, here are the (more or less) meaningful strings in the binary:

Code: Select allets_unpack_flash_code
 ets %s,rst cause:%d, boot mode:(%d,%d)
Jan  8 2013
wdt reset
ets_main.c
unknown reset
user code done
waiting for host
load 0x%08x, len %d, room %d
flash read err, %s
tailtail
chksum 0x%02x
csum 0x%02x
csum err
ho %d tail %d room %d
sp %p
sf_dump[%d] a0: 0x%08x  a1: 0x%08x  a2: 0x%08x  a3: 0x%08x
epc1=0x%08x, epc2=0x%08x, epc3=0x%08x, excvaddr=0x%08x, depc=0x%08x
Fatal exception (%d):
eprintf no bno b0123456789
<null>
ets_timer.c
bootup , addr 0x%08x
no rds
sip bogus rx done
rx done unknown
sip bogus tx
seq %u, %u ds %p
tx unknown
rxiq_get_mis: s_pwr=%lld, %d-%d,
stagstag: CGAIN=%d FGAIN=%d, DC_OS=(%d,%d), DAC=(%d,%d)
pwctrl: rate_i=%d, target_power=%d, detect_power=%d
num_k=%d, power_out=%d,
reg_i=%d, indata=%d
txiq: tone_atten=%d
txiq_gain=%d
txiq_phase=%d
bt:

Seems like the AT-stuff is implemented in flash memory, yay!