SDbus Reverse Engineering

This is a prelude to getting SDBus to do things it was never meant to do. But first, we must RE.

Sniffing

I need to see whats on the wire(s) with a normalish SDCard. This SparkFun interposer is known to not work with SDBus protocol (SPI only) but if one adds some 220Ω resistors, perhapse that will prevent the reflections.

This works. It negiotiates at 400KHz and then switches (CMD6) to 50MHz and sends LBA0 in 4 bit mode D[3:0]. I now know what a normal start-up looks like.

The blip you see in the center is CMD17 (READ_SINGLE_BLOCK) with an arg of 0 The blips you see on the right on D[3:0] are the contents of LBA 0 the MBR (Master Boot Record in DOS parlance) and yes I checked. Anyway the DUT seems to bo okay with it (I can read and write).

First Attempt

A jig for the SD card, I may have to redo this with coax cables, like the ones one might find in a WiFi AP.

For now the goal is to use this to connect to an orangecrab on a breadboard.

Stop laughing! Yes the leads are awfully long and the breadboard is not exactly enhancing my signal integrity but it does a CMD6 to 50MHz and sends LBA 0... and... and... it stops and I think I detect some suspicious looking clock pulses. Digital isn't a thing in the real world, it's all analogue and a scope shows something closer to the truth than a logic analyzer.

Second Attempt

This time with shorter leads. There is hope for this as the scope shows my signals are cleaner than I expected -- this is just a proof of concept people!

If this doesn't work I'll try twisted pair

Anybody else remember the old LVDS SCSI cables, even looks like something out of a dream... 'cause nobody's seen it in 20 years! That'll be fun to solder. :-)