Potential DS1996 support?

Adding DS1996 support to Flipper seems to be a good idea and should not take much effort. Emulation is also suggested.

Quick overview of DS1996 (header 0x0C) and it’s uses:
DS1996 is an iButton with 64kbits (8KBytes) of EEPROM storage (256 pages, each 32 bytes). One of the primary uses for DS1996 (in Russia) is for data transfer between systems. In the case of a system being replaced, moving data to a DS1996 is available in the case of the memory chip on the PCB not being readable (example: ELTIS DP-3/4XX, EEPROM fuse bits are locked from factory). Having the ability to read (or even have) a DS1996 chip is unlikely due to the rarity and high prices compared to other iButton devices (on average $15-$25 compared to $0.5 (DS1990A)).

Adding the format:
This message contains a datasheet for the DS1996 chip: DS1996.pdf (466.4 KB). The main point is the command 0xF0 (Read memory) which takes 2 arguments: offset and address to read from.

An example memory read will look like:
TX R //reset pulse
RX P //device responds
TX CC //0xCC command means “Skip ROM (serial number)”
TX F0 //0xF0 as stated is Read Memory
TX 00 //0x00 - Page offset is 0/F (one offset is 2 bytes long)
TX 00 //0x00 - Page number is 0/FF

The read memory can be then either be sent to a PC in the form of a .bin or saved on the SD for later use.

Emulation of DS1996, while possible, is difficult. DS1996 has a “scratchpad”, which can be referred to as “RAM” of its kind. Data that will be written to the EEPROM must be first written to the scratchpad, and only then from the scratchpad to the memory. Scratchpad interaction has 3 commands: 0F (write scratchpad); AA (read scratchpad); 55 (copy scratchpad to memory).

An example write to the 167/256th page, bytes 3 and 4 should look like (addr 14C1/1FEF):
TX C1 //Offset 1/F. I did not understand this part in the datasheet, someone please correct me
TX 14 //Page 166/255 (0-255).
TX 3A44 //Send data, 2 bytes

TX AA //Obtain the necessary end+flag data to run 0x55 command
RX 14
RX 02 //This should be right. This is the end and flags information that the DS1996 chip sends which we have to use later.
RX 3A44 //The AA command can also be used for verification.

TX 55 //Copy scratchpad to memory
TX C1 //Transmit offset
TX 14 //Transmit page offset
TX 02 //Transmit end+flags

Memory can be read for verification with the F0 command: F0 C1 14.

Waiting to hear your opinion on this idea.

1 Like

Hope that someone do make an app to implement this as iButton support aparently is “abandoned” by the dev team that didn’t even implenment writing to cyfral/metakon … If someone can make an app using the posted intructions to manage DS1996 that would be fantastic !

1 Like

Well, implementing support for writing TM2002 and DC2000A’s is impossible. Those are hardcoded from factory.

Sure, re-encoding exists (its based on how keys are stored) but it’s not officially supported so you’re stuck with entering the code manually.
There are 4 ways of re-encoding Cyfral and 2 ways of re-encoding metakom keys.
Cyfral 1: 01 C2 C1 01 00 00 00 CR
Cyfral 2, 3, 4: unknown. Cyfral 2 is likely 01 C1 C2 01 00 00 00 CR

Metakom 1: 01 C4 C3 C2 C1 00 00 CR
Metakom 2: 01 C1 C2 C3 C4 00 00 CR

1 Like

Thanks for the info !!!

If you’re curious, I figured out Cyfral-3 reencoding.

I suppose you already know that Cyfral gets encoded in quarternary: 0b1110 for 0, 0b1101 for 1, 0b1011 for 2, 0b0111 for 3. Cyfral-3 basically encodes them for powers of 2 and inversed.

An example is 22D9 1110 1011 1110 1011 0111 1101 1011 1101 - C3 supposedly gives 82822414, key word supposedly because 0111 ≠ 1011…

Thanks for sharinh this info !!!