Do you love displays too?

It all started with the fact that when buying something at a flea market, I saw various nice displays from mobile phones at the seller, and not only for a small price. I decided to take for the company in the amount of three pieces – “it will come in handy somewhere.” Time passed, various projects were made, and the displays were peacefully waiting in the wings somewhere on a shelf. But then the day came when I got to them and decided to still revive them. However, here is the problem, almost nothing is known about this screen model … So reverse engineering is on the way. Interesting? Then let’s go.

To connect, probably, any display, you need to know 3 things: where is which output, the controller model and the switching sequence (power on sequence or init). So what do we know about the display? So far, only the phone model – a caring seller indicated it when selling. These screens are used in phones ZTE A36, ZTE A136, ZTE A136G. The first thought is to look at the characteristics of the display in the description of the phone – so that you know who we are dealing with. This is a color CSTN screen with a resolution of 128×128 pixels, a diagonal of 1.5″, a color depth of 16 bits (65536 colors). Not a lot, but at least something. There are a lot of articles on the net where guys connect displays from mobile devices to microcontrollers and other things. Maybe someone Already connected such?The search rather quickly disproved this assumption and the hope to connect this miracle without much difficulty did not materialize. I searched badly.

Will have to dig further. Have you also thought about the scheme of a mobile phone or a service manual? At the very first request, sites were found – some forums of repairmen – where there was a diagram, including on our phone. Excellent! Let’s download now. We register and … do not download – no reputation, points, messages, etc. Okay. We go to another site, then another one, then another … It feels like walking at a store window, you see what you need, but you can’t get it. It’s a pity, of course, but what to do, since without registration and SMS in any way. So the pinout will have to be found somehow differently.

We look at the matrix – a nice train with tracks and details sticks out, as if she is showing us her tongue, they say we won’t give up.

Search by inscription TSF8H0062FPC-B1-E on the loop did not give any useful information. But on the loop you can see how and where the tracks go. The easiest way is to determine the ground – it is on the landfills and calls among themselves, as well as the backlight – usually it comes in a separate loop. The anode and cathodes are even signed here. The cathodes appear to be connected in parallel. So much the better: it’s easier to power the backlight (no need for a dc-dc converter). At the polygons we have the 1st, 15th, 20th conclusions (count from left to right). They also call each other. Pin 16 also rings with them, but the track from it goes to resistors R4 and R3.

Resistor R4 has zero resistance and is connected between pin 16 and ground, and resistor R3 is not soldered at all and is connected between pin 16 and 17. Apparently the 17th pin is + power, and the 16th is most likely the LCD_ID pin, by which the phone determines the model display. This is also found on other mobile screens.

We see that the total number of pins is 20. This allows us to estimate which interface is used: it’s a bit too much for spi, which means the interface is parallel, most likely 8-bit. For 16 bits, there are no longer enough pins – three ground pins, 2 backlight pins, 15 remains. But you still need to find power, which often has 2 separate lines for displays. The interface is commonly used 8080. In datasheets for display controllers, another 6800 is found, but it is apparently used quite rarely. At least, in articles about other displays, I have not seen this, I also did not come across it. Let’s note what is already there. This is very easy to do in Excel. We write the name of the output in each new line of the first column. And in the second and other columns, you can make some comments. It is also convenient to mark the outputs with a color and quickly change it if necessary. But for clarity and so that it is not lost anywhere, I will do it in the picture:

Obviously, the conclusions from the second to the 14th are the lines D0 … D7, WR, RD, RS (DC), Reset and CS. That is, lines common to the 8080 interface. So right? Yes, not so. Remember the mark in the photo above near the capacitor and pin 14, which I haven’t said anything about yet? And what about the power lines (+) are often two? I thought that the 14th output is the second power line. True, then just one output for the control lines is missing. Although it is possible to put the select chip on the active level, this is probably done. In principle, this information is already enough to try to find similar pinouts on the Internet and choose one suitable one from them. I entered the request approximately as “tft lcd 20 pin”, “tft lcd 1.5 inch” and in this form in different versions. Next is image search. Usually, with such a request, you end up on aliexpress, where quite often the seller provides a pinout for the screen. It happens that the controller model also writes. In the end, I found this pinout:

Yes, this is our display and there is, everything is like ours! Excellent…

But what to do with output 16? The pinout indicates Vdd, that is, + power, and in our case it calls with a minus. Something is wrong. But here is the controller model S6B3301. Download the datasheet, it might come in handy. I began to suspect that the controller is either this or from this family after I accidentally found another display for the ZTE A36 from the same seller from a flea market, but a little bit different:

And here there is already an interesting inscription “S6B33B6“Obviously, this is the controller model. True, the cable is slightly different and our display may have a different controller. I did not find a datasheet for S6B33B6. But I found similar s6b33b2, s6b33b0a, s6b33b3a, s6b33bl.

To summarize: the exact model of the controller is unknown, the exact pinout is also unknown, there is no init yet either. Having rummaged in the datasheet on s6b3301, I found the PowerON sequence there and decided to try to write an init. Just in case, I looked at the interface 8080:

Are you also confused by 2 chip select signals? CS2 and CS1B. Why there are 2, I don’t know. Let’s also recall here the capacitor from the 14th output to the ground (which, however, is not soldered). In general, I decided that this is most likely a second meal. Otherwise, why put a capacitor on the output of the select chip? Probably both select chips are tightly connected to the power pins so that the display is always active. But even if I’m wrong, nothing will burn.

We take stm32 and try to write init, functions for transferring data and commands, and outputting a test picture. For me it will be 3 stripes of primary colors. I chose Stm32 because of the logic levels of 3.3 V. I also looked through the previously downloaded datasheets of the controllers of this family and checked the maximum supply voltage – they all had more than 3.3 volts. So we will power the test subject from 3.3 V. As a basis, I took the pinout that I found earlier (in the picture above), only I did not apply anything to pin 16, and I applied +3.3 V to pin 14. We write the program, flash – the display is silent.

Then I decided that the information is not enough, and the display will go to the shelf for now. It’s still small, but there are larger ones. That’s all, let’s go.

About the benefits of communication or a logic analyzer to help

But it was not there. At the very moment when I had already packed everything in a bag, pasted a sticker and wrote that there was no exact information, I received a message from my friend (comrade, hello!) – we sometimes share current projects with each other – where he sends me a link on a similar, in his opinion, display on aliexpress. For some reason, the link did not open for me, but he completed his task – I decided: “Maybe I should look for more?” But what to do next? I even tried to sort out the controllers by the size of the chip – it is also given in the datasheet. It reminded me of a wonderful article I read a year ago. One could still look for some information on the Internet, but it takes a long time, and most importantly, it does not guarantee a result. Therefore, I decided not to “beat my head against the wall”, but to find the right phone at a flea market and finally buy a logic analyzer (I’ve been wanting it for a long time).

I still managed to find a working phone. DSLogic+ has arrived. Then it’s a matter of technology – we solder to the board:

Here I missed a little with the wires – they turned out to be so thin that the clips simply could not be securely fastened. There were trimmings of pins of output components at hand – they usually help out, so I don’t throw them away. We carefully straighten everything so that it doesn’t short out, we record the exchange.

I connected the analyzer channels in order from the first output, skipping the grounds. We see that the 0th line changes once – this is reset. The 13th line is connected to pin 16 (I connected it just in case), the 14th line is connected to pin 17. It can be seen that this is power. First, the display is reset, then some settings take place, then after a pause, a welcome picture appears on it. Then the power is turned off and all lines fall to zero. Decoding this manually is sooo long and fraught with errors and unnecessary fatigue. Therefore, we will connect the decoder. DSView (like Sigrok) contains many decoders, but none for the 8080 protocol. You can write your own, I started doing it and even the first successes appeared, but then I decided to focus on the display. Fortunately, I saw “parallel” in the list of decoders. Decided to try it. Let’s assume that the pinout found earlier is generally correct, and also carefully study the behavior of the lines

and compare it with the picture given in the datasheet for the 8080 interface (this picture has already been mentioned above). We see that the recording goes along the front of the signal WRand the signal CS1B is set to the inactive state only after the edge WR. Decoder parallel requires a data line and a sync line – choose 8 data lines and a line WR. That’s it, now you can write a sequence of commands, delays between them (especially large delays must be taken into account). Here, again, it is very convenient to work in Excel.

And in DSView it is very convenient to switch over decoded bytes. The first decoded command is 0x50 (not shown in the picture above). This is “Display OFF”. It is not clear why turn it off, it is turned off anyway. The main thing is that they received not nonsense, but the code of the command that was found in the datasheet. Decoding commands one by one, we filter out controllers that simply do not have such commands or have inconsistencies. Comparing the commands of the controllers s6b33b2, s6b33b0a, s6b33b3a, s6b33bl, we find that they are all the same. Somewhere the bits in the command parameters are slightly different. Therefore, there is no need to accurately determine the controller model.

Results

As a result, we get such an init
/* USER CODE BEGIN 2 */
//+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
//S6B33Bx init (poluchen s pomosh'u dslogic+ i datasheetov na S6B33Bx,)
	LCD_RST0;           // Reset 
	HAL_Delay(102);  //   wait 102 ms
	LCD_RST1;           // Release reset
	
	lcd_sendcmd(0x50);//0-Display OFF
  HAL_Delay(220);  //   wait 220 ms
	lcd_sendcmd(0x2C);//1-Standby Mode OFF
  HAL_Delay(220);  //   wait 220 ms
  lcd_sendcmd(0x02);//2-Oscillation Mode Set 
	lcd_sendcmd(0x01);//3-parameter OSC = 1: Internal oscillator ON
	HAL_Delay(110);//wait 110 ms
	lcd_sendcmd(0x20);//4-DC-DC Select
	lcd_sendcmd(0x03);//5-parameter DC1 x2 DC2 x1
	HAL_Delay(110);//wait 110 ms
	lcd_sendcmd(0x26);//6-DC-DC and AMP ON/OFF set 
	lcd_sendcmd(0x01);//7-parameter  Built-in 1’st Booster ON
	HAL_Delay(110);//wait 110 ms
	lcd_sendcmd(0x26);//8-DC-DC and AMP ON/OFF set 
	lcd_sendcmd(0x09);//9-parameter  Built-in OP-AMP ON,  Built-in 1’st Booster ON
	HAL_Delay(220);  //   wait 220 ms
	lcd_sendcmd(0x26);//10-DCDC and AMP ON/OFF set 
	
	lcd_sendcmd(0x0B);//11-parameter  Built-in OP-AMP ON,  Built-in 1’st Booster ON, Built-in 2’nd Booster ON
	HAL_Delay(324);  //   wait 324 ms
	lcd_sendcmd(0x26);//12-DC-DC and AMP ON/OFF set 
	lcd_sendcmd(0x0F);//13-parameter Built-in OP-AMP ON,  Built-in 1’st Booster ON, Built-in 2’nd Booster ON, Built-in 3’rd Booster ON
	HAL_Delay(110);//wait 110 ms
	lcd_sendcmd(0x28);//14-Temperature Compensation Set
	lcd_sendcmd(0x00);//15-parameter  TCS = 00 : 0.00%/degC 
	HAL_Delay(54);  //   wait 54 ms
	lcd_sendcmd(0x45);//16-RAM Skip Area Set 
	lcd_sendcmd(0x00);//17-parameter RAM Skip function ON/OFF RSK = 00 : No Skip
	lcd_sendcmd(0x53);//18-Specified Display Pattern Set 
	lcd_sendcmd(0x00);//19-parameter SDP = 00 : Normal display
	lcd_sendcmd(0x10);//20-DriverOutputMode set (This instruction sets the display direction.)
	lcd_sendcmd(0x03);//21-parameter ...
	
	lcd_sendcmd(0x24);//22-DC-DC Clock Division Set  
	lcd_sendcmd(0x03);//23-parameter ...
	lcd_sendcmd(0x30);//24-Addressing Mode Set  
	lcd_sendcmd(0x0D);//25-parameter GSM=00 - 65536 color mode dsg=1 -dummy subgroup is one subgroup 
										//SGF=1: SG Frame inversion ON SGP=10:  Different phase by 2pixel-unit (Initial status) 
										//SGM= 1: SG inversion ON
	lcd_sendcmd(0x32);//26-ROWVectorModeSet 
	lcd_sendcmd(0x0E);//27-parameter 111 - Every sub-frame (initial status) 0 - - 0: R1->R2->R3->R4 -> R1… (Initial status) 
 
	lcd_sendcmd(0x40);//28-Entry Mode Set 
	lcd_sendcmd(0x80);//29-parameter ...
	lcd_sendcmd(0x42);//30-X-address Area Set
	
	lcd_sendcmd(0x00);//31-parameter ...
	lcd_sendcmd(0x7F);//32-0x7F = 127
	lcd_sendcmd(0x43);//33-Y-address Area Set
	lcd_sendcmd(0x00);//34-parameter ...
	lcd_sendcmd(0x7F);//35-0x7F = 127
	HAL_Delay(22);  //   wait 22 ms
	lcd_sendcmd(0x34);//36-N-lineInversionSet
	lcd_sendcmd(0x88);//37-parameter ...
	lcd_sendcmd(0x2A);//38-ContrastControl(1)
	lcd_sendcmd(0xC6);//39-parameter ...
	
	lcd_sendcmd(0x36);//40-FrameFrequen control 
	lcd_sendcmd(0x00);//41-parameter ...
	lcd_sendcmd(0x55);//42-Partial Display Mode Set
	lcd_sendcmd(0x00);//43-parameter ...

	lcd_sendcmd(0x51);//44- Display ON
	HAL_Delay(54);  //   wait 54 ms

The final pinout looked like this:

We leave the LCD_ID output unconnected, we supply 3.3 V to Vdd. And we connect the backlight to the power supply through a small resistor. As a controller, let’s take the popular blue pill scarf.

Whole code
/* Includes ------------------------------------------------------------------*/
#include "main.h"
#include "gpio.h"

/* Private includes ----------------------------------------------------------*/
/* USER CODE BEGIN Includes */
#include "stm32f1xx_ll_gpio.h"
/* USER CODE END Includes */

/* Private typedef -----------------------------------------------------------*/
/* USER CODE BEGIN PTD */

/* USER CODE END PTD */

/* Private define ------------------------------------------------------------*/
/* USER CODE BEGIN PD */
//  LCD_RST
#define LCD_RST1  HAL_GPIO_WritePin(GPIOA, GPIO_PIN_0,GPIO_PIN_SET);
#define LCD_RST0  HAL_GPIO_WritePin(GPIOA, GPIO_PIN_0,GPIO_PIN_RESET);
//   LCD_DC
#define LCD_DC1  HAL_GPIO_WritePin(GPIOA, GPIO_PIN_1,GPIO_PIN_SET);
#define LCD_DC0  HAL_GPIO_WritePin(GPIOA, GPIO_PIN_1,GPIO_PIN_RESET);
//   LCD_WR
#define LCD_WR1  HAL_GPIO_WritePin(GPIOA, GPIO_PIN_2,GPIO_PIN_SET);
#define LCD_WR0  HAL_GPIO_WritePin(GPIOA, GPIO_PIN_2,GPIO_PIN_RESET);
//   LCD_RD
#define LCD_RD1  HAL_GPIO_WritePin(GPIOA, GPIO_PIN_3,GPIO_PIN_SET);
#define LCD_RD0  HAL_GPIO_WritePin(GPIOA, GPIO_PIN_3,GPIO_PIN_RESET);
//  LCD_CS
#define LCD_CS1   HAL_GPIO_WritePin(GPIOA, GPIO_PIN_4,GPIO_PIN_SET);
#define LCD_CS0   HAL_GPIO_WritePin(GPIOA, GPIO_PIN_4,GPIO_PIN_RESET);

//Connect d0...d7  Reset DC WR  RD  CS
//     to b3...b10 A0    A1 A2  A3  A4

#define lcd_width 128
#define lcd_heigth 128

/* USER CODE END PD */

/* Private macro -------------------------------------------------------------*/
/* USER CODE BEGIN PM */

/* USER CODE END PM */

/* Private variables ---------------------------------------------------------*/

/* USER CODE BEGIN PV */

/* USER CODE END PV */

/* Private function prototypes -----------------------------------------------*/
void SystemClock_Config(void);
/* USER CODE BEGIN PFP */

/* USER CODE END PFP */

/* Private user code ---------------------------------------------------------*/
/* USER CODE BEGIN 0 */
void lcd_sendbyte(uint8_t byte)//8080 8 bit parallel protocol
{
	LCD_CS0;
	LCD_RD1;//write
	LCD_WR0;
	//lcd d0 connected to pin b3, d1 to d4, that is why byte shifted by 3	 ...
	LL_GPIO_WriteOutputPort(GPIOB, byte<<3);
	LCD_WR1;//The display writes D[17:0] lines when there is a rising edge of WRX
	LCD_CS1;
}
void lcd_sendcmd(uint8_t cmd)
{
	LCD_DC0;//command
	lcd_sendbyte(cmd);
}
void lcd_senddata(uint8_t data)
{
	LCD_DC1;//data
	lcd_sendbyte(data);
}
void lcd_draw_pixel(uint8_t x, uint8_t y, uint16_t color)
{
	lcd_sendcmd(0x43);//Row adress set
	lcd_sendcmd(y);//Y start address 
	lcd_sendcmd(y+1);//Y end address
	
	lcd_sendcmd(0x42);//Column adress set
	lcd_sendcmd(x); //X start address 
	lcd_sendcmd(x+1); //X end address 
			
	lcd_senddata((color & 0xFF00)>>8);//higher byte
	lcd_senddata(color & 0x00FF);//lower byte
}
/* USER CODE END 0 */

/**
  * @brief  The application entry point.
  * @retval int
  */
int main(void)
{
  /* USER CODE BEGIN 1 */

  /* USER CODE END 1 */

  /* MCU Configuration--------------------------------------------------------*/

  /* Reset of all peripherals, Initializes the Flash interface and the Systick. */
  HAL_Init();

  /* USER CODE BEGIN Init */

  /* USER CODE END Init */

  /* Configure the system clock */
  SystemClock_Config();

  /* USER CODE BEGIN SysInit */

  /* USER CODE END SysInit */

  /* Initialize all configured peripherals */
  MX_GPIO_Init();
  /* USER CODE BEGIN 2 */
//+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++	
	//S6B33Bx init (poluchen s pomosh'u dslogic+ i datasheetov na S6B33Bx,)
	LCD_RST0;           // Reset 
	HAL_Delay(102);  //   wait 102 ms
	LCD_RST1;           // Release reset
	
	lcd_sendcmd(0x50);//0-Display OFF
  HAL_Delay(220);  //   wait 220 ms
	lcd_sendcmd(0x2C);//1-Standby Mode OFF
  HAL_Delay(220);  //   wait 220 ms
  lcd_sendcmd(0x02);//2-Oscillation Mode Set 
	lcd_sendcmd(0x01);//3-parameter OSC = 1: Internal oscillator ON
	HAL_Delay(110);//wait 110 ms
	lcd_sendcmd(0x20);//4-DC-DC Select
	lcd_sendcmd(0x03);//5-parameter DC1 x2 DC2 x1
	HAL_Delay(110);//wait 110 ms
	lcd_sendcmd(0x26);//6-DC-DC and AMP ON/OFF set 
	lcd_sendcmd(0x01);//7-parameter  Built-in 1’st Booster ON
	HAL_Delay(110);//wait 110 ms
	lcd_sendcmd(0x26);//8-DC-DC and AMP ON/OFF set 
	lcd_sendcmd(0x09);//9-parameter  Built-in OP-AMP ON,  Built-in 1’st Booster ON
	HAL_Delay(220);  //   wait 220 ms
	lcd_sendcmd(0x26);//10-DCDC and AMP ON/OFF set 
	
	lcd_sendcmd(0x0B);//11-parameter  Built-in OP-AMP ON,  Built-in 1’st Booster ON, Built-in 2’nd Booster ON
	HAL_Delay(324);  //   wait 324 ms
	lcd_sendcmd(0x26);//12-DC-DC and AMP ON/OFF set 
	lcd_sendcmd(0x0F);//13-parameter Built-in OP-AMP ON,  Built-in 1’st Booster ON, Built-in 2’nd Booster ON, Built-in 3’rd Booster ON
	HAL_Delay(110);//wait 110 ms
	lcd_sendcmd(0x28);//14-Temperature Compensation Set
	lcd_sendcmd(0x00);//15-parameter  TCS = 00 : 0.00%/degC 
	HAL_Delay(54);  //   wait 54 ms
	lcd_sendcmd(0x45);//16-RAM Skip Area Set 
	lcd_sendcmd(0x00);//17-parameter RAM Skip function ON/OFF RSK = 00 : No Skip
	lcd_sendcmd(0x53);//18-Specified Display Pattern Set 
	lcd_sendcmd(0x00);//19-parameter SDP = 00 : Normal display
	lcd_sendcmd(0x10);//20-DriverOutputMode set (This instruction sets the display direction.)
	lcd_sendcmd(0x03);//21-parameter ...
	
	lcd_sendcmd(0x24);//22-DC-DC Clock Division Set  
	lcd_sendcmd(0x03);//23-parameter ...
	lcd_sendcmd(0x30);//24-Addressing Mode Set  
	lcd_sendcmd(0x0D);//25-parameter GSM=00 - 65536 color mode dsg=1 -dummy subgroup is one subgroup 
										//SGF=1: SG Frame inversion ON SGP=10:  Different phase by 2pixel-unit (Initial status) 
										//SGM= 1: SG inversion ON
	lcd_sendcmd(0x32);//26-ROWVectorModeSet 
	lcd_sendcmd(0x0E);//27-parameter 111 - Every sub-frame (initial status) 0 - - 0: R1->R2->R3->R4 -> R1… (Initial status) 
 
	lcd_sendcmd(0x40);//28-Entry Mode Set 
	lcd_sendcmd(0x80);//29-parameter ...
	lcd_sendcmd(0x42);//30-X-address Area Set
	
	lcd_sendcmd(0x00);//31-parameter ...
	lcd_sendcmd(0x7F);//32-0x7F = 127
	lcd_sendcmd(0x43);//33-Y-address Area Set
	lcd_sendcmd(0x00);//34-parameter ...
	lcd_sendcmd(0x7F);//35-0x7F = 127
	HAL_Delay(22);  //   wait 22 ms
	lcd_sendcmd(0x34);//36-N-lineInversionSet
	lcd_sendcmd(0x88);//37-parameter ...
	lcd_sendcmd(0x2A);//38-ContrastControl(1)
	lcd_sendcmd(0xC6);//39-parameter ...
	
	lcd_sendcmd(0x36);//40-FrameFrequen control 
	lcd_sendcmd(0x00);//41-parameter ...
	lcd_sendcmd(0x55);//42-Partial Display Mode Set
	lcd_sendcmd(0x00);//43-parameter ...

	lcd_sendcmd(0x51);//44- Display ON
	HAL_Delay(54);  //   wait 54 ms
	
	
	/*
	lcd_sendcmd(0x43);//45-Y-address Area Set

	lcd_sendcmd(0x00);//46-y start
	lcd_sendcmd(0x7F);//47- y end 0x7F = 127
	lcd_sendcmd(0x42);//48-X-address Area Set
	lcd_sendcmd(0x00);//49-x start
	lcd_sendcmd(0x7F);//50- x end 0x7F = 127
	
	
	lcd_sendcmd(0x43);//51-Y-address Area Set
	
	lcd_sendcmd(0x00);//52-y start
	lcd_sendcmd(0x7F);//53- y end 0x7F = 127
	lcd_sendcmd(0x42);//54-X-address Area Set
	lcd_sendcmd(0x04);//55-x start
	lcd_sendcmd(0x83);//56- x end 0x83 = 131
	*/
	
//+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++	
	
	uint16_t color; //GREEN 
	uint8_t y;
  uint8_t x;
	
  for (y=0;y<lcd_heigth;y++)
	{
     for (x=4;x<132;x++)
		 {
        
        if (y<40) color=0xF800; //RED
        else if (y<80) color=0x07E0; //GREEN
				else color=0x001F; //BLUE 
				
        lcd_draw_pixel(x, y, color);
     }	
	}
	HAL_Delay(3000);  //   wait 3 s
	
	/*
	//++++++++++++++++++clear LCD++++++++++++
	color = 0x00;
	lcd_sendcmd(0x43);//51-Y-address Area Set
	
	lcd_sendcmd(0x00);//52-y start
	lcd_sendcmd(0x7F);//53- y end 0x7F = 127
	lcd_sendcmd(0x42);//54-X-address Area Set
	lcd_sendcmd(0x04);//55-x start
	lcd_sendcmd(0x83);//56- x end 0x83 = 131
	
	for (y=0;y<lcd_heigth;y++)
	{
     for (x=0;x<lcd_width;x++)
		 {
			 lcd_senddata((color & 0xFF00)>>8);//higher byte
	     lcd_senddata(color & 0x00FF);//lower byte
		 }
	}
	
	*/
	
	
	
  /* USER CODE END 2 */

  /* Infinite loop */
  /* USER CODE BEGIN WHILE */
  while (1)
  {
    /* USER CODE END WHILE */

    /* USER CODE BEGIN 3 */
  }
  /* USER CODE END 3 */
}

/**
  * @brief System Clock Configuration
  * @retval None
  */
void SystemClock_Config(void)
{
  RCC_OscInitTypeDef RCC_OscInitStruct = {0};
  RCC_ClkInitTypeDef RCC_ClkInitStruct = {0};

  /** Initializes the RCC Oscillators according to the specified parameters
  * in the RCC_OscInitTypeDef structure.
  */
  RCC_OscInitStruct.OscillatorType = RCC_OSCILLATORTYPE_HSE;
  RCC_OscInitStruct.HSEState = RCC_HSE_ON;
  RCC_OscInitStruct.HSEPredivValue = RCC_HSE_PREDIV_DIV1;
  RCC_OscInitStruct.HSIState = RCC_HSI_ON;
  RCC_OscInitStruct.PLL.PLLState = RCC_PLL_ON;
  RCC_OscInitStruct.PLL.PLLSource = RCC_PLLSOURCE_HSE;
  RCC_OscInitStruct.PLL.PLLMUL = RCC_PLL_MUL9;
  if (HAL_RCC_OscConfig(&RCC_OscInitStruct) != HAL_OK)
  {
    Error_Handler();
  }
  /** Initializes the CPU, AHB and APB buses clocks
  */
  RCC_ClkInitStruct.ClockType = RCC_CLOCKTYPE_HCLK|RCC_CLOCKTYPE_SYSCLK
                              |RCC_CLOCKTYPE_PCLK1|RCC_CLOCKTYPE_PCLK2;
  RCC_ClkInitStruct.SYSCLKSource = RCC_SYSCLKSOURCE_PLLCLK;
  RCC_ClkInitStruct.AHBCLKDivider = RCC_SYSCLK_DIV1;
  RCC_ClkInitStruct.APB1CLKDivider = RCC_HCLK_DIV2;
  RCC_ClkInitStruct.APB2CLKDivider = RCC_HCLK_DIV1;

  if (HAL_RCC_ClockConfig(&RCC_ClkInitStruct, FLASH_LATENCY_2) != HAL_OK)
  {
    Error_Handler();
  }
}

/* USER CODE BEGIN 4 */

/* USER CODE END 4 */

/**
  * @brief  Period elapsed callback in non blocking mode
  * @note   This function is called  when TIM2 interrupt took place, inside
  * HAL_TIM_IRQHandler(). It makes a direct call to HAL_IncTick() to increment
  * a global variable "uwTick" used as application time base.
  * @param  htim : TIM handle
  * @retval None
  */
void HAL_TIM_PeriodElapsedCallback(TIM_HandleTypeDef *htim)
{
  /* USER CODE BEGIN Callback 0 */

  /* USER CODE END Callback 0 */
  if (htim->Instance == TIM2) {
    HAL_IncTick();
  }
  /* USER CODE BEGIN Callback 1 */

  /* USER CODE END Callback 1 */
}

/**
  * @brief  This function is executed in case of error occurrence.
  * @retval None
  */
void Error_Handler(void)
{
  /* USER CODE BEGIN Error_Handler_Debug */
  /* User can add his own implementation to report the HAL error return state */

  /* USER CODE END Error_Handler_Debug */
}

#ifdef  USE_FULL_ASSERT
/**
  * @brief  Reports the name of the source file and the source line number
  *         where the assert_param error has occurred.
  * @param  file: pointer to the source file name
  * @param  line: assert_param error line source number
  * @retval None
  */
void assert_failed(uint8_t *file, uint32_t line)
{
  /* USER CODE BEGIN 6 */
  /* User can add his own implementation to report the file name and line number,
     tex: printf("Wrong parameters value: file %s on line %d\r\n", file, line) */
  /* USER CODE END 6 */
}
#endif /* USE_FULL_ASSERT */

/************************ (C) COPYRIGHT STMicroelectronics *****END OF FILE****/

At first, I did not quite understand how to send the address to the display, in the end I got not the expected three stripes, but colored snow.

This is also good – it means the display accepts commands and performed “DisplayON”. In the process of debugging and step-by-step execution, I checked that the display is turned off exactly until this command is sent. I slightly corrected the pixel drawing function, and, thank God, everything worked (“the whole code” is already corrected and working code).

Later I found library on S6B33BG from kbiva and an article about a similar display. I did not write a spectacular demo, since the goal was precisely to conduct reverse engineering. If necessary, all this can be added.

Approximately 2 days passed from the moment the analyzer and the phone arrived until the appearance of three bars on the display. I collected information a little longer. As you can see, the logic analyzer greatly speeds up the process. Also, probably, the analysis of the firmware of the phone itself can help. There you can find lines of the form (an example for the FLY E160 phone):

LCD_BlockWrite_HX8347D: startx=%d, starty=%d, endx=%d, endy=%d 0 custom\drv\LCD\TINNO35_09A_LCM\lcd_HX8347D.c IsLcd_HX8347D.. data:%x LCD_BlockWrite_ILI9325: startx=%d, starty=%d , endx=%d, endy=%d 0 custom\drv\LCD\TINNO35_09A_LCM\lcd_ILI9325.c IsLcd_ILI9325.. data:%x LCD_BlockWrite_ILI9328: startx=%d, starty=%d, endx=%d, endy=%d 0 custom\drv\LCD\TINNO35_09A_LCM\lcd_ILI9328.c IsLcd_ILI9328.. data:%x LCD_Init_R61580() %d 0 custom\drv\LCD\TINNO35_09A_LCM\lcd_R61580.c IsLcd_R61580 data”

Bold marked the controller model. I cite this information for reference, I myself have not tried to look for it in the firmware yet. If there is something wrong with the firmware of the phone, please correct it in the comments.

In the end, I want to express my gratitude to my friend, because the article appeared, among other things, thanks to him. I hope it was interesting and helps someone. Successful projects.

Similar Posts

Leave a Reply