Map stock firmware GPIO use from disassembly

Disassembled the SV1.3 app image and confirmed the shift-register
(HSPI 13/14 + latch 15), WS2812 (12), LDR (A0) and button pins, the
16-bit bit map and the tube order. The stock firmware has no I2C code
and drives a DFPlayer on UART0. Adds the ELF/xref helper tools.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
mangavalkandClaude Opus 5.5 committed 2026-10-25 20:42:56 +01:00
1 parent 9ffcfb95d2
commit 8efa810e4e
4 files changed
+598 -15

No files matched your search

+22 -15
View File
@@ -31,24 +31,31 @@ with ArduinoOTA and Home Assistant (MQTT) support.
- No pin numbers are visible as strings; confirming the pinout needs disassembly or the
bit-stepping test sketch.
## Pinout (from the 12 V v2 schematic, `docs/schematic_v2_12V.jpg`)
## Pinout
Not yet verified on this 5 V board. The stock firmware image is the same for both, which
suggests the GPIOs match.
From the 12 V v2 schematic (`docs/schematic_v2_12V.jpg`), checked against the stock firmware
by disassembly (`docs/stock-firmware-pins.md`, tools in `tools/`). "Binary" = confirmed in
the stock SV1.3 code; it has not yet been tested on the hardware.
| Function | GPIO |
|---|---|
| 74HC595 DATA / CLOCK / LATCH (OE tied to GND) | 13 / 14 / 15 (15 has 1k pull-down) |
| DS3231M RTC SDA / SCL | 4 / 5 |
| WS2812 data | 12 |
| Photoresistor (LDR, 10k to GND) | ADC (A0) |
| BTN1 / BTN2 (not fitted) | 0 / 2 |
| Function | GPIO | Source |
|---|---|---|
| 74HC595 DATA / CLOCK (OE tied to GND) | 13 / 14 = HSPI MOSI / SCK (hardware SPI, MSB first) | Binary |
| 74HC595 LATCH | 15, plain `digitalWrite` (has 1k pull-down) | Binary |
| WS2812 data | 12 (NeoPixel bit-bang, GRB 800 kHz; stock assumes 12 LEDs, 8 fitted) | Binary |
| Photoresistor (LDR, 10k to GND) | ADC (A0) | Binary |
| BTN1 / BTN2 (not fitted) | 0 / 2, INPUT_PULLUP. Stock: GPIO0 is a button, GPIO2 a motion/presence input that wakes the display | Binary |
| DFPlayer Mini (stock feature) | UART0: GPIO1 TX / GPIO3 RX, 9600 Bd | Binary |
| DS3231M RTC SDA / SCL | 4 / 5. **Stock firmware has no I2C code** (NTP only); if fitted, unknown | Schematic only |
Two chained 74HC595s make one 16-bit word, all bits active-high:
- U1 QA..QH = cathodes 0..7, U2 QA = cathode 8, QB = cathode 9 (via 2x ULN2003, shared by all tubes)
- U2 QC = P1 (neon dot 1), QD..QG = anodes A1..A4 (MMBTA42/92), QH = P2 (neon dot 2, and the decimal
point if jumper JP2 is closed)
- The display is multiplexed: one anode on at a time. Which physical tube is A1 is unknown.
Two chained 74HC595s make one 16-bit word, all bits active-high (confirmed from the binary;
the high byte is sent first and goes to U2):
- U1 QA..QH = cathodes 0..7 (bits 0..7), U2 QA = cathode 8 (bit 8), QB = cathode 9 (bit 9)
(via 2x ULN2003, shared by all tubes)
- U2 QC = P1 (neon dot 1, bit 10), QD..QG = anodes A1..A4 (bits 11..14, MMBTA42/92), QH = P2
(bit 15; neon dot 2, and the decimal point if jumper JP2 is closed)
- The display is multiplexed: one anode on at a time. **A1 = leftmost tube (hour tens),
A4 = rightmost (minute ones)**, from the stock digit order. Stock lights P1/P2 in only one
multiplex slot.
## Programming header