firmware reverse engineering

[ardera]

Hey,

good work on this! I actually am trying to do the exact same thing with my Dedica EC685, and I'm currently reverse engineering the firmware hexdump you uploaded. Turns out Ghidra actually has PIC16 support, so I'm using that right now; and I've found quite some interesting things:

• I've identified a lot of functions, e.g. eeprom write/read procedures, (lots of) timers, some GPIO output controls, GPIO input routines (seem to be connected to the buttons, maybe the water sensor, at least they're being debounced in firmware)
• Analog Input handling (might be the temperature sensor?)
• a debug protocol on the UART port. Allows you to output some of the internal state, flags, eeprom values, also overwrite some eeprom values (not sure if persistent)

Currently trying to disassemble my dedica so I can see what the PIC pins are actually connected to; and maybe what the Oscillator frequency is.

This is my ghidra project: pic16.zip