Tuesday, March 24, 2009

Saleae Logic Analyzer

My Saleae logic analyzer arrived from Sparkfun today. For those of you who might be doing some reverse engineering for linux-dvb, figured I would share my initial experiences.

First off, the actual analyzer is actually alot smaller than I thought it would be. Here is the full kit unpacked (it comes with the carrying pouch, a USB cable, and the probes):

Since I bought this to debug the i2c implementation for the HVR-950q, I broke out an iron and soldered a couple of coupling wires onto the board, and then hooked everything up:

I downloaded and installed the software, which went smoothly. I needed to download Windows Installer 3.1 via Windows Update, and the Saleae installer automatically downloaded .NET 3.5 (which took far longer than the installer for the analyzer itself). Also worth mentioning that this is a PC that I use solely for reverse engineering so a typical PC would probably have both of these prerequisites already installed. But once those two things were done, I plugged in the device and started up a capture:

Here is a screenshot of the first capture:

The verdict? To my shock, it worked perfectly the first time. I started the capture, plugged in the device, waited for the firmware to finish uploading, and then stopped the capture. The user interface made it very simple to tell it to decode i2c (asking for which signals were for the clock and data pins), and I was able to drill down and see the actual traffic.

If you click on the above screenshot, you can see that the i2c clock is running at 29.4 KHz (which is pretty slow). When I did the analog support I had played around with the clock divider register until I had found a value that worked. Now that I can see how the clock divider register effects the actual clock, I can tune it to the proper value (around 100 KHz). Also, you see that huge gap between the bytes? That's the effect of of a pair of 500ns sleeps that occur in the current code. With the analyzer you can see that it has a huge effect on the overall firmware download time.

Long story short, the analyzer was worth every penny. I can see the effects of the code changes, and I should be able to get the 12 second firmware loading process down to around 1 second.

(just a quick addendum - after publishing this I noticed the screenshot looks like crap. The actual GUI looks much better and the dithering was just from the conversion to gif and livejournal's rescaling). Also, you have to click on the image twice to get it to show in full scale.