My first step with all products is a detailed, online search for documentation, firmware, images, and so on. Although in isolation it is rare for these to provide anything really juicy, it all builds up a picture that can help us find a hole. Sometimes silly things like source code end up on open sites.

The CSL website itself has a number of useful documents and utilities.

The manual is fairly standard. It tells us a little about the displays and error codes. It also mentions being able to read and write settings from the NVM using software called CS0054.

Interestingly, there is also a firmware available on the site – “Dualcom v353.hex”. This looks like it is a normal Intel HEX file used to update firmware on an embedded system. Later we can examine this file or even disassemble it to see what the system is doing.

There is also a downloadable package of utilities called CS0054_setup.msi. This looks to contain 4 distinct utilities used to program different CSL communicators.

Looking further into the site, on the installer shop, we can find a number of high resolution images of the board (1, 2, 3, 4).

There are also high resolution images of the programmer used to update firmware (1, 2, 3, 4). This is a Renesas Minicube2, the debug/programming device for use with the 78K0R processor. This is promising – it likely means the HEX file is not obfuscated or encrypted, and normal Renesas tools can be used to update the board.

Having a further look about on Google, it appears that the CSL Dualcom boards have a lot in common  communicators made by another company called Dycon – specifically the Dycon D2300. I can’t see any information on the Dycon site that I haven’t already seen on the CSL Dualcom site. Question is, who actually makes the boards? What is the relationship between the two companies?

Dycon D2300

Google site search and basic directory exploration on the CSL Dualcom site hasn’t yielded anything further.