op1 dumps
Anything to replace the processor or the flash chip in your TE OP-1
- Hardware mod
- Stable
- High brick risk
- Not reversible
This project hasn't been claimed by its maintainer yet, so its details come from the community. Is it yours? Claim it
Before you start
- How hard is it?
- ExpertMeans opening the device, soldering or special hardware.
- What you need
- A computer
- Tools to open the case
- Can it break my device?
- Could leave your device unusable.
- Can I undo it?
- Not easily. Treat it as permanent.
Did it work for you?
Did op1 dumps work on your Teenage Engineering OP-1?
No reports yet.
One-tap reports from owners. Bricked reports are checked before they count.
Compatibility
Devices: Teenage Engineering OP-1.
No compatibility information yet.
Getting started
From the project's README ("OTP write details"):
Here's patched te-boot file to read and write a page to OP-1 OTP memory: te-boot-otp-ops-2.28-10.ldr. Use op1repacker to create a op1 firmware package to write from te-boot. Then enter to te-boot (press COM button during boot) and press 7 to read OTP memory (it's very fast, use a slow-motion camera to read it) or connect 7V to VPPOTP and press 2 to write it. Press button 2 several times until the menu is redrawn (it won't get any worse). You must write page by page (about 12 pages total) by making changes to this file at the following addresses:
0x2d4d0-0x2d4df - contains OTP data to write (little-endian)
0xa642 - contains OTP page to write
Note that the system uses little endian, so you need to rearrange the bytes accordingly.
For example, here's a page readed from OTP:
0xdf 20 45 47 41 4e 45 45 54 52 45 45 4e 49 47 4e 45
Here it is in device memory (IDA LDR addressing):
DATA1:FF8059D0 db 0x54 # T DATA1:FF8059D1 db 0x45 # E DATA1:FF8059D2 db 0x45 # E DATA1:FF8059D3 db 0x4E # N DATA1:FF8059D4 db 0x41 # A DATA1:FF8059D5 db 0x47 # G DATA1:FF8059D6 db 0x45 # E DATA1:FF8059D7 db 0x20
DATA1:FF8059D8 db 0x45 # E DATA1:FF8059D9 db 0x4E # N … …
Risk and recovery
- Brick risk
- High
- Reversible
- No
- Requires opening the device
- Yes
From the project's README ("OTP write details"):
Here's patched te-boot file to read and write a page to OP-1 OTP memory: te-boot-otp-ops-2.28-10.ldr. Use op1repacker to create a op1 firmware package to write from te-boot. Then enter to te-boot (press COM button during boot) and press 7 to read OTP memory (it's very fast, use a slow-motion camera to read it) or connect 7V to VPPOTP and press 2 to write it. Press button 2 several times until the menu is redrawn (it won't get any worse). You must write page by page (about 12 pages total) by making changes to this file at the following addresses:
0x2d4d0-0x2d4df - contains OTP data to write (little-endian)
0xa642 - contains OTP page to write
Note that the system uses little endian, so you need to rearrange the bytes accordingly.
For example, here's a page readed from OTP:
0xdf 20 45 47 41 4e 45 45 54 52 45 45 4e 49 47 4e 45
Here it is in device memory (IDA LDR addressing):
DATA1:FF8059D0 db 0x54 # T DATA1:FF8059D1 db 0x45 # E DATA1:FF8059D2 db 0x45 # E DATA1:FF8059D3 db 0x4E # N DATA1:FF8059D4 db 0x41 # A DATA1:FF8059D5 db 0x47 # G DATA1:FF8059D6 db 0x45 # E DATA1:FF8059D7 db 0x20
DATA1:FF8059D8 db 0x45 # E DATA1:FF8059D9 db 0x4E # N … …