I bought a OBDII HUD from Aliexpress:
And decided to open it to see which Microcontroller it is using:
To my surprise it wasn’t using any MCU that I know, look that TC M184QC 540399-n4 G3F4 447 chip.
Searching for it also didn’t reveal any details, only a Japanese post where someone opened another HUD display and found the same chip:
https://minkara.carview.co.jp/userid/247129/car/3488166/7488748/note.aspx
The guy suspected it was a STM32F103, but I connected a STLinkV2 to have SWD header pins at top left corner of image about and tried to read it with OpenOCD:
aasdfasd
asdf
$ openocd -f interface/stlink.cfg -f target/stm32f1x.cfg -c "init" -c "reset halt" -c "flash write_image erase nuttx.bin 0x08000000" -c "reset run"
Open On-Chip Debugger 0.11.0+dev-gcf314db1f-dirty (2025-05-17-16:09)
Licensed under GNU GPL v2
For bug reports, read
http://openocd.org/doc/doxygen/bugs.html
Info : 18 1 transport.c:279 jim_transport_select(): auto-selecting first available session transport "hla_swd". To override use 'transport select <transport>'.
Info : 27 2 target.c:6310 target_create(): The selected transport took over low-level target control. The results might differ compared to plain JTAG/SWD
Info : 39 2 target.c:5477 target_configure(): DEPRECATED target event trace-config; use TPIU events {pre,post}-{enable,disable}
Info : 49 2 adapter.c:111 adapter_init(): clock speed 1000 kHz
Info : 67 5 stlink_usb.c:1438 stlink_usb_version(): STLINK V2J17S4 (API v2) VID:PID 0483:3748
Info : 69 6 stlink_usb.c:1474 stlink_usb_check_voltage(): Target voltage: 3.274766
Warn : 76 108 hla_interface.c:106 hl_interface_init_target(): UNEXPECTED idcode: 0x0bb11477
Error: 77 108 hla_interface.c:108 hl_interface_init_target(): expected 1 of 1: 0x1ba01477
User : 79 108 command.c:623 command_run_line():
User : 81 108 command.c:623 command_run_line(): Then I searched copied stm32f1x.cfg to m184.cfg and changed the idcode to 0x0bb11477 and discovered it is a Cortex-M0:
$ openocd -f interface/stlink.cfg -f target/m184.cfg
Open On-Chip Debugger 0.11.0+dev-gcf314db1f-dirty (2025-05-17-16:09)
Licensed under GNU GPL v2
For bug reports, read
http://openocd.org/doc/doxygen/bugs.html
Info : 18 1 transport.c:279 jim_transport_select(): auto-selecting first available session transport "hla_swd". To override use 'transport select <transport>'.
Info : 27 2 target.c:6310 target_create(): The selected transport took over low-level target control. The results might differ compared to plain JTAG/SWD
Info : 39 2 target.c:5477 target_configure(): DEPRECATED target event trace-config; use TPIU events {pre,post}-{enable,disable}
Info : 40 2 server.c:359 add_service(): Listening on port 6666 for tcl connections
Info : 41 2 server.c:359 add_service(): Listening on port 4444 for telnet connections
Info : 51 2 adapter.c:111 adapter_init(): clock speed 1000 kHz
Info : 69 6 stlink_usb.c:1438 stlink_usb_version(): STLINK V2J17S4 (API v2) VID:PID 0483:3748
Info : 71 6 stlink_usb.c:1474 stlink_usb_check_voltage(): Target voltage: 3.273164
Info : 84 110 cortex_m.c:2325 cortex_m_examine(): [stm32f1x.cpu] Cortex-M0 r0p0 processor detected
Info : 114 114 cortex_m.c:2440 cortex_m_examine(): [stm32f1x.cpu] target has 4 breakpoints, 2 watchpoints
User : 115 114 target.c:777 target_examine_one(): [stm32f1x.cpu] Target successfully examined.
Info : 123 117 gdb_server.c:4825 gdb_target_start(): starting gdb server for stm32f1x.cpu on 3333
Info : 124 117 server.c:359 add_service(): Listening on port 3333 for gdb connections
The core #0 listens on 3333.
ICEman is ready to use.Cool!!! I tried to read the flash content and it didn’t work. Searching for that idcode I discovered it is used on STM32F030F4, so it is a F030 clone, not F103.
Lets try JLink now:
$ JLinkExe -if swd
SEGGER J-Link Commander V8.10f (Compiled Nov 6 2024 16:11:03)
DLL version V8.10f, compiled Nov 6 2024 16:09:58
Connecting to J-Link via USB...O.K.
Firmware: J-Link V11 compiled Dec 4 2024 17:53:35
Hardware version: V11.00
J-Link uptime (since boot): 0d 00h 03m 29s
S/N: 51005404
License(s): GDB
USB speed mode: High speed (480 MBit/s)
VTref=3.335V
Type "connect" to establish a target connection, '?' for help
J-Link>con
Please specify device / core. <Default>: STM32F030F4
Type '?' for selection dialog
Device>
Specify target interface speed [kHz]. <Default>: 4000 kHz
Speed>
Device "STM32F030F4" selected.
Connecting to target via SWD
InitTarget() start
SWD selected. Executing JTAG -> SWD switching sequence.
DAP initialized successfully.
Active read protection detected.
Skipping unsecure.
InitTarget() end - Took 23.1s
Found SW-DP with ID 0x0BB11477
DPIDR: 0x0BB11477
CoreSight SoC-400 or earlier
Scanning AP map to find all available APs
AP[1]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x04770021, ADDR: 0x00000000)
Iterating through AP map to find AHB-AP to use
AP[0]: Core found
AP[0]: AHB-AP ROM base: 0xE00FF000
CPUID register: 0x410CC200. Implementer code: 0x41 (ARM)
Found Cortex-M0 r0p0, Little endian.
FPUnit: 4 code (BP) slots and 0 literal slots
CoreSight components:
ROMTbl[0] @ E00FF000
[0][0]: E000E000 CID B105E00D PID 000BB008 SCS
[0][1]: E0001000 CID B105E00D PID 000BB00A DWT
[0][2]: E0002000 CID B105E00D PID 000BB00B FPB
Memory zones:
Zone: "Default" Description: Default access mode
Cortex-M0 identified.
J-Link>JLink detected that the chip was protected and offered to remove the protection executing a mass erase, but I opted to not do it. Because I want to read the content.