I have taken a look at Dump Tool.
It enters into Mcu Mode by sending \r at the boot time and then once it gets 'Boot >'
and then a whole new set of commands become available.
'help' does not work.
Boot >help
Unknown command 'help' - try 'help'
This is used for dumping data
Boot >md
Usage:
md [.b, .w, .l] address [# of objects]
- Memory Display
Boot >md 0 100
0000-0000: 40110800 0000B0B1 000013C7 0000B0FD ...@▒▒..▒...▒..
0000-0010: 0000B10F 0000B121 0000B133 0000B145 .▒..!▒..3▒..E▒..
0000-0020: 0000B145 0000B145 0000B145 0000B157 E▒..E▒..E▒..W▒..
0000-0030: 0000B169 0000B145 0000B17B 0000183B i▒..E▒..{▒..;...
0000-0040: 0000B18F 0000B18F 00005B97 00006331 .▒...▒...[..1c..
0000-0050: 00006DFD 0000B18F 00002565 00001B03 ▒m...▒..e%......
0000-0060: 0000B18F 0000B18F 0000B18F 0000B18F .▒...▒...▒...▒..
0000-0070: 0000B18F 0000B18F 0000B18F 0000B18F .▒...▒...▒...▒..
0000-0080: 8009F3EF F3804770 47708809 8008F3EF ▒▒..pG.▒..pG▒▒..
0000-0090: F3804770 47708808 4770BA40 4770BAC0 pG.▒..pG@▒pG▒pG
0000-00A0: 8F2FF3BF 8011F3EF F3804770 47708811 ▒▒/.▒▒..pG.▒..pG
0000-00B0: 8010F3EF F3804770 47708810 8013F3EF ▒▒..pG.▒..pG▒▒..
0000-00C0: F3804770 47708813 8014F3EF F3804770 pG.▒..pG▒▒..pG.▒
0000-00D0: 47708814 88004881 0000F3C0 487F4770 ..pG.H..▒▒..pG.H
0000-00E0: F3C08800 47700040 8800487C 0080F3C0 ..▒▒@.pG|H..▒▒..
0000-00F0: 487A4770 F3C08800 477000C0 88004877 pGzH..▒▒▒.pGwH..
I have not checked, but I think loadx/loady - xmodem/ymodem is used to send the data and then flash to write them to the flash
Boot >flash
Usage:
flash
- flash - update flash 4KB partition info
1
aram load
2:data load
3:write flash
4:index select
5:set param - flag size newest_index p_num buf_addr
6:set partition - flag version p_addr r_addr p_size d_size
7:flash erase - addr sizCommand handler do not well, ret = -1
Boot >dbga
Debug Area(0x3B):
HOST SDIO MSG TMR IRQ
Boot >uploadb
Usage:
uploadb addr len - upload binary data over console from 'addr' with 'len'
- Upload binary data over console
Boot >loadb
Usage:
loadb addr len - load binary data over console from 'addr' with 'len'
- Load binary data over console
Boot >sd
Usage:
sd addr [value]
- Get/Set SD register
Boot >trace
Trace : Enable
Show DBGL: Enable
Show Time: Enable
Show DBGA: Enable
Boot >dbgl
Debug Level(2): Warn
Boot >stackchk
Stack checking...
P stack total size: 2048Byte, usage: 0Byte == %0
M stack total size: 14336Byte, usage: 664Byte == %4
Boot >mm
Usage:
mm [.b, .w, .l] dest_addr src_addr length
- Memory Move
Boot >checksum
Usage:
checksum type addr len - CRC 1, SHA1 2, MD5 3 CRC_DMA 4
- Calculate Checksum from 'addr' with 'len'
Boot >flashinfo
Partition addr:40100800
Find newest partition index:0, total:1, buf_addr:0x00100000, size:0x00000138
Partition[0] info
flag:00000001, version:rda5991h
p_address:00001000, r_address:00001000, psize_in_bytes:0x0007b000, dsize_in_bytes:503808
Boot >go
Usage:
go type addr - Auto 1, Custom 2
- start application at 'addr' with different type
Boot >usbstat
State: Default, Speed: ???, Addr: 0, Remote Wakeup: Disable
Boot >hoststat
Host curr interface: , buffer base: 0x40101000, size: 2048, num: 16
interface: un-ready, used buff: 0
Boot >decrypt
Usage:
decrypt type addr len - RC4 1, AES 2
- Decrypt from 'addr' with 'len'
Boot >flashtest
enter spi_flash_init
writedata == 12ab34cd
writedata == a30c6cee
writedata == 72b1df11
writedata == 8b467885
writedata == fc715f61
writedata == 7d8e0fc0
writedata == e552e7cf
writedata == aa02579f
writedata == dfddf53f
writedata == ee650189
140fe000 == 12ab34cd
140fe004 == a30c6cee
140fe008 == 72b1df11
140fe00c == 8b467885
140fe010 == fc715f61
140fe014 == 7d8e0fc0
140fe018 == e552e7cf
140fe01c == aa02579f
140fe020 == dfddf53f
140fe024 == ee650189
Boot >mw
Usage:
mw [.b, .w, .l] address value [count]
- Memory Write(fill)
Boot >loadx
## Ready for binary (xmodem) download to 0x18001000 at 921600 bps...
CC
Boot >loady
## Ready for binary (ymodem) download to 0x18001000 at 921600 bps...
CCCCCCCCCCTimed out
xyzModem - Cksum mode, 0(SOH)/0(STX)/0(CAN) packets, 20 retries
## Total Size = 0x00000000 = 0 Bytes
An example of a crash:
#E MemManage_Handler
[Hard Faults Report - all numbers in hex]
R0 = 0x40110800
R1 = 0x0000b0b1
R2 = 0x000013c7
R3 = 0x0000b0fd
R12 = 0x0000b10f
LR [R14] = 0x0000b121
PC [R15] = 0x0000b133
PSR = 0x0000b145
PRIMASK = 0, IRQ:Enable
FAULTMASK = 0x00000000
BASEPRI = 0x00000000
CONTROL = 0x00000000
BFAR = 0xe000ed38
CFSR = 0x00000000
HFSR = 0x00000000
DFSR = 0x00000000
AFSR = 0x00000000
SCB_SHCSR = 0x00070000
[Detail report]
APSR Flags: nzcv
ProcStack:0x00000000 MainStack:0x40110760
Memory Manage Faults
MM_FAULT_STAT:0x00
IACCVIOL:0x00 IACCVIOL:0x00
MUNSTKERR:0x00 MSTKERR:0x00
MLSPERR:0x00 MMARVALID:0x00
Bus Faults
BUS_FAULT_STAT:0x00
IBUSERR:0x00 PRECISERR:0x00
IMPRECISERR:0x00 UNSTKERR:0x00
STKERR:0x00 LSPERR:0x00
BFARVALID:0x00
Usage Faults
USG_FAULT_STAT:0x00
UNDEFINSTR:0x00 INVSTATE:0x00
INVPC:0x00 UFSR.NOCP:0x00
UNALIGNED:0x00 DIVBYZERO:0x00
[Report done]
Panic...