Skip to main content
Additional info added to avoid confusion
Source Link

After a bit of investigation I discovered that this is a LCD direct drive (MCU command to COG driver/controller - not to think that MCU drives multiplexing).

After a bit of investigation I discovered that this is a LCD direct drive.

After a bit of investigation I discovered that this is a LCD direct drive (MCU command to COG driver/controller - not to think that MCU drives multiplexing).

Formatting
Source Link
winny
  • 18.1k
  • 6
  • 53
  • 74

I connected the logic analyzer and got the signals from 12 pins. Every four seconds signal from picture 1 is appearing with the new data. Highest frequency is 200khz200 kHz. When I touch sensors pin I am able to switch the menu to get more and different data. Every touch create communication from picture 1. No more, no less. Only different data.

  1. Could you point me to some reading material or video that shows professional approaches to reverse engineering where signal is present but lcdLCD is faulty and there is no info about the COG drivers.

  2. Could you recommend any display controller simulator (that uses popular communication protocols with matrix lcdLCD/tftTFT displays) that could run on the computer? I would like to test the data and pixel output before soldering the real replacement device... (For this case I figured out that the easiest solution is to write the D0-D8 directly as a matrix of characters with any programming language - e.g. python)

This communication is sending data right away after CS1 or CS2 is enabled and an short burst on PIN 7 (15us15 us later from 835us835 us of enabled state). Bit time is 6us6 us. 835/6 = ~139. 4 times this for CS1 and 4 for CS2. Let's say it is 128 columns x 8bits x 4 "pages" per chip. 256x64 could be confirmed.

I connected the logic analyzer and got the signals from 12 pins. Every four seconds signal from picture 1 is appearing with the new data. Highest frequency is 200khz. When I touch sensors pin I am able to switch the menu to get more and different data. Every touch create communication from picture 1. No more, no less. Only different data.

  1. Could you point me to some reading material or video that shows professional approaches to reverse engineering where signal is present but lcd is faulty and there is no info about the COG drivers.

  2. Could you recommend any display controller simulator (that uses popular communication protocols with matrix lcd/tft displays) that could run on the computer? I would like to test the data and pixel output before soldering the real replacement device... (For this case I figured out that the easiest solution is to write the D0-D8 directly as a matrix of characters with any programming language - e.g. python)

This communication is sending data right away after CS1 or CS2 is enabled and an short burst on PIN 7 (15us later from 835us of enabled state). Bit time is 6us. 835/6 = ~139. 4 times this for CS1 and 4 for CS2. Let's say it is 128 columns x 8bits x 4 "pages" per chip. 256x64 could be confirmed.

I connected the logic analyzer and got the signals from 12 pins. Every four seconds signal from picture 1 is appearing with the new data. Highest frequency is 200 kHz. When I touch sensors pin I am able to switch the menu to get more and different data. Every touch create communication from picture 1. No more, no less. Only different data.

  1. Could you point me to some reading material or video that shows professional approaches to reverse engineering where signal is present but LCD is faulty and there is no info about the COG drivers.

  2. Could you recommend any display controller simulator (that uses popular communication protocols with matrix LCD/TFT displays) that could run on the computer? I would like to test the data and pixel output before soldering the real replacement device... (For this case I figured out that the easiest solution is to write the D0-D8 directly as a matrix of characters with any programming language - e.g. python)

This communication is sending data right away after CS1 or CS2 is enabled and an short burst on PIN 7 (15 us later from 835 us of enabled state). Bit time is 6 us. 835/6 = ~139. 4 times this for CS1 and 4 for CS2. Let's say it is 128 columns x 8bits x 4 "pages" per chip. 256x64 could be confirmed.

Notice removed Canonical answer required by CommunityBot
Bounty Ended with no winning answer by CommunityBot
deleted 3 characters in body
Source Link

Another useful info: bits littlebig-endian and whole image is mirrored.

Another useful info: bits little-endian and whole image is mirrored.

Another useful info: bits big-endian and whole image is mirrored.

deleted 2 characters in body
Source Link
Loading
added 260 characters in body; edited title
Source Link
Loading
Notice added Canonical answer required by Vladimir Djuricic
Bounty Started worth 50 reputation by Vladimir Djuricic
added 719 characters in body
Source Link
Loading
added 719 characters in body
Source Link
Loading
added 719 characters in body
Source Link
Loading
deleted 29 characters in body
Source Link
Loading
deleted 29 characters in body
Source Link
Loading
added 157 characters in body
Source Link
Loading
edited title
Source Link
Loading
edited title
Link
Loading
added 23 characters in body
Source Link
Loading
deleted 75 characters in body
Source Link
Loading
added 79 characters in body
Source Link
Loading
added 96 characters in body
Source Link
Loading
added 549 characters in body
Source Link
Loading
Post Undeleted by Vladimir Djuricic
Post Deleted by Vladimir Djuricic
added 137 characters in body
Source Link
Loading