Bus Pirate

From DP

Support this open source project, get a Bus Pirate v3' 'for $30, including worldwide shipping. Now also distributed by Adafruit Industries.

Read about the Bus Pirate v3 design and the v3b update.

The Bus Pirate is an open source hacker multi-tool that talks to electronic stuff. It's got a bunch of features an intrepid hacker might need to prototype their next project. This manual is an effort to link all available Bus Pirate information in one place.

PLEASE READ:v4 bootloader upgrade and v4 firmware.

Contents 1 Introduction 2 Reference 2.1 User terminal mode 2.2 Binary scripting mode 2.3 Various probe cable pinouts 3 Feature guides 3.1 Deprecated 4 Firmware upgrades 4.1 Bootloader v4 4.2 Bootloader upgrades 5 Hardware documentation 5.1 Mods 5.2 Known Defects 6 Source 7 Application guides 7.1 Apps that support the Bus Pirate 7.2 Utilities 8 Chip demonstrations 9 I/O header pin descriptions 10 User interface 10.1 Configuration menus 10.2 Bus interaction syntax 10.3 Macros 11 License

[edit] Introduction

• Features overview (original)
• Bus Pirate 101 tutorial (original)
• Bus Pirate 102 tutorial (original)
• Connecting with Mac OS X
• Bus Pirate forum
• Latest firmware download
• Beta firmware download

[edit] Reference

[edit] User terminal mode

The Bus Pirate is accessed from a command line in a serial terminal. The Bus Pirate always starts in high impedance mode (Hi-Z), a safe mode with all outputs disabled. It's intended to protect any connected devices from conditions beyond their specifications. From there, a bus mode can be selected to use the Bus Pirate with a specific protocol.

• Bus Pirate menu options guide
• HEX/DEC/BIN number entry and output display
• Bus modes: 1-Wire, UART, I2C, SPI, JTAG, raw 2-wire, raw 3-wire, PC keyboard, HD44780 LCDs, MIDI
• BASIC script engine reference

[edit] Binary scripting mode

The Bus Pirate has a binary access mode that can be used with software or scripts. There's example scripts in C, Python, Perl, and more in the SVN repository.

Binmode protocol pages: SPI, I2C, UART, 1-Wire, and raw-wire.

[edit] Various probe cable pinouts

• Common Bus Pirate cable pinouts
• User contributed pin reference labels

[edit] Feature guides

• Self-test guide (original)
• Practical guide to Bus Pirate pull-up resistors (original)
• Mixed voltage interfacing with pull-up resistors
• Mixed voltage interfacing with the Bus Pirate
• Logic analyzer mode (original)
• LCD library and adapter
• STK500 v2 AVR programmer clone (original)
• OpenOCD JTAG support
• Bus Pirate BASIC script reference

[edit] Deprecated

These features have been temporarily removed.

• JTAG (user terminal mode only, see OpenOCD support above)

[edit] Firmware upgrades

[edit] Bootloader v4

• Pirate-Loader console upgrade application (Linux, Mac, Windows) (original)
• ds30 Loader GUI (original) (Mono/.NET)

[edit] Bootloader upgrades

• v4.x to v4.3 upgrade (original)
• v2 to v4 upgrades (original)

Bus Pirate firmware change history

[edit] Hardware documentation

• Bus Pirate schematic and partlist
• USB Bus Pirates: v3(a), v3b, v2a & v2go
• Serial port Bus Pirates: v1a, v0a
• SparkFun's Bus Pirate
• Probe cable
• PIC24FJ64GA002 datasheet
• PIC24FJ family reference manual

[edit] Mods

• User created cases
• 2K ohm MOSI pull-up resistor mod
• Modify the FTDI EEPROM, change serial name on OSX
• Create /dev/bus_pirate on Linux

[edit] Known Defects

• Bus Pirate v3 preorder 2 & 3 dead MODE LED fix
• Bus Pirate v2go preorder 2 shipped with v2 bootloader only

[edit] Source

• Google Code page and SVN repository
• Compile the Bus Pirate firmware (original)
• Spanish, Italian translations

[edit] Application guides

• Program multiple AVRs with AVRDUDE
• Bus Pirate OpenOCD walk-through
• Bus Pirate JTAG with OpenOCD

[edit] Apps that support the Bus Pirate

• AVRDude AVR programmer
• OpenOCD JTAG debugger
• flashrom bios/flash programmer (Latest Windows compile from forum)

[edit] Utilities

• Binary SPI sniffer utility

[edit] Chip demonstrations

Here's a comprehensive list of Bus Pirate chip demonstrations. It includes Ian's old demonstrations from Hack a Day, and the most recent demos from Dangerous Prototypes. Tutorials are arranged by Bus Pirate hardware version.

Bus Pirate v2&v3

• 3EEPROM explorer board (original), DS2431 (1wire), 24AA (I2C), 25AA (SPI)
• Wii Nunchuck quick guide (original) (I2C)
• Nokia 3310 LCD (binary SPI)
• iButton serial number (original) (1-Wire)
• 2AA02E48 EEPROM with MAC address (original) (I2C)
• HD44780 character LCD adapter (original) (LCD)
• DS1307 real time clock (original) (I2C)
• NA204SD02 Futaba VFD character display (raw2wire)
• SLE4442 (FedEx Kinko's) smart card update (original) (raw2wire)
• 25AA/25LC serial EEPROM (SPI)
• ShiftBrite with A6281 3 channel LED driver (SPI)
• PCF8563 real time clock calendar (I2C)
• Sure LED matrix (original) (raw3wire)
• AT45DB041D 4Mbit flash memory (original) (SPI)
• HMC6352 digital compass (original) (I2C)
• Parallax RFID reader (original) (UART)
• KS0074 serial LCD (original) (SPI)
• SURE DE-DP014 character matrix (raw3wire)

Bus Pirate v1a

• LTC2640 digital to analog converter (SPI, raw3wire)
• LTC2631A digital to analog converter (I2C)
• PC keyboard (PC Keyboard)
• DS1807 audio volume potentiometer (I2C)
• 23K256 32K serial SRAM memory (SPI)
• SparkFun 4×4 RGB button pad controller (raw3wire)
• DS1801 audio volume potentiometer (SPI)
• MCP6S26 programmable gain amplifier (raw3wire)

Bus Pirate v0a

• 24LC1024 EEPROM (I2C)
• EM406 GPS (UART)
• SLE4442 (FedEx Kinko’s) smart card (raw2 wire)
• DS1077 133MHz programmable oscillator (I2C)
• XC9572XL CPLD (JTAG)
• DS1822 temperature sensor (1-Wire)
• PCF8574 IO Expander (I2C)
• DS2431 1K EEPROM (1-Wire)
• SHT1x/7x humidity and temperature sensor (raw2wire)
• TC74 temperature sensor (I2C)

[edit] I/O header pin descriptions

This table displays the Bus Pirate pinout in various modes. The Bus Pirate I/O pins try to be consistent across all libraries, the same pins are used for similar functions. Unused pins are usually in a safe high-impedance state.

Modes not shown in the above diagram are similar to other libraries: MIDI=UART; raw2wire=HD44780=PC keyboard=I2C; raw3wire=SPI. All bus pins output at 3.3volts, but tolerate up to 5volts (5.5volts maximum). Pins are named as they pertain to the Bus Pirate, not necessarily how they connect to the target device. 'In bus sniffer modes each pin becomes an input for the same signal usually assigned to that pin.

Master-out slave-in (MOSI) is the primary data pin, it's used for bi-directional data transfer in protocols like I2C and 1-Wire, and as data-out from the Bus Pirate in uni-directional protocols like SPI and asynchronous serial (UART). In bus sniffer modes each pin becomes an input for the same signal usually assigned to that pin.

Clock is always a clock-out signal from the Bus Pirate, except in the PC keyboard library where the keyboard provides a clock signal to the Bus Pirate.

Master-in slave-out (MISO) is used with protocols that have a dedicated data-input, such as SPI and UART.

Chip select (CS) is an output used to activate the serial interface in SPI-like protocols. Use the auxiliary pin config menu (c) to get manual control of the CS pin through the auxiliary pin commands (a, A, @).

The auxiliary pin (AUX) can be used as an output or input from the Bus Pirate terminal interface with the A, a, and @ commands. It's useful for protocols that require an additional signal, such as a reset.

Pin name	Description (Bus Pirate is the master)
MOSI	Master data out, slave in (SPI, JTAG), Serial data (1-Wire, I2C, KB), TX* (UART)
CLK	Clock signal (I2C, SPI, JTAG, KB)
MISO	Master data in, slave out (SPI, JTAG) RX (UART)
CS*	Chip select (SPI), TMS (JTAG)
AUX	Auxiliary IO, frequency probe, pulse-width modulator
ADC	Voltage measurement probe (max 6volts)
Vpu	Voltage input for on-board pull-up resistors (0-5volts).
+3.3v	+3.3volt switchable power supply
+5.0v	+5volt switchable power supply
GND	Ground, connect to ground of test circuit

Notes: * TX moved from CS to MOSI in firmware v0g.

[edit] User interface

Talk to the Bus Pirate from a serial terminal set to 115200bps, 8/N/1.

* Syntax error, type ? for help
HiZ>

Press enter to show the command prompt if your terminal is blank.

HiZ>m <<<set mode command
1. HiZ
...
10. LCD
(1) ><<<press enter to select default option (1)
Mode selected
HiZ>

Most configuration and option prompts have a default value shown in (). Press enter to select the default option.

Read more in the Bus Pirate 101 tutorial.

[edit] Configuration menus

Menu options are single character commands that configure the Bus Pirate. Type a letter, followed by <enter>, to access the menu. Some options are unavailable in some modes and on some hardware.

[edit] Bus interaction syntax

A simple syntax is used to interact with chips. Syntax characters have the same general function in each bus mode, such as 'R' to read a byte of data.

[0x31 r:5]

This example syntax sends a bus start , the value 0x31, and then reads 5 bytes, followed by bus stop. Up to 4000 characters of syntax may be entered into the Bus Pirate terminal at once, press enter to execute the syntax.

[edit] Macros

I2C>(0)
0.Macro menu
1.7bit address search
2.I2C sniffer
I2C>(1)

Macros perform complex actions, like scanning for I2C addresses, interrogating a smart card, or probing a JTAG chain. Macros are numbers entered inside (). Macro (0) always displays a list of macros available in the current bus mode.

Bus Pirate menu options guide

[edit] License

• PCB art: CC-0
• Bootloader: GPL (from ds30 Loader project)
• Firmware: CC-0

----

The Bus Pirate pinout, menu, and command tables are released into the public domain. Based on the public domain Bus Pirate documentation at Hack a Day.