Problems erasing LPC2103 flash

Development Boards MicroMod
1

I’m using OpenOCD to try to re-program an LPC2103-based photo frame, details are here: http://linux-adm5120.sourceforge.net/lpc2103/.

At the moment I seem to be getting nowhere fast. I have got myself a config file that lets me dump the flash:

#daemon configuration
telnet_port 4444
gdb_port 3333

#interface
interface parport
parport_port /dev/parport0
parport_cable wiggler
jtag_speed 0

#use combined on interfaces or targets that can't set TRST/SRST separately
reset_config trst_and_srst srst_pulls_trst

#jtag scan chain
#format L IRC IRCM IDCODE (Length, IR Capture, IR Capture Mask, IDCODE)
# Always this for ARM7
jtag_device 4 0x1 0xf 0xe

#target configuration
daemon_startup reset

#target arm7tdmi <reset mode> <chainpos> <endianness> <variant>
target arm7tdmi little run_and_init 0 arm7tdmi-s_r4
working_area 0 0x40000000 0x2000 nobackup

#flash configuration
flash bank lpc2000 0x0 0x8000 0 0 0 lpc2000_v2 12000 calc_checksum

I have tried to blank the flash memory with the following script:

reset
poll
flash protect 0 0 7 off
flash erase_sector 0 0 7

But when I read back the flash and disassemble with

arm-elf-objdump -D --target=binary -marm blanked.bin

I get this:

       0:       e59f4034        ldr     r4, [pc, #52]   ; 0x3c
       4:       e3a05002        mov     r5, #2  ; 0x2
       8:       e5845000        str     r5, [r4]
       c:       e3a05003        mov     r5, #3  ; 0x3
      10:       e5845004        str     r5, [r4, #4]
      14:       e59f201c        ldr     r2, [pc, #28]   ; 0x38
      18:       e3a03000        mov     r3, #0  ; 0x0
      1c:       e1020093        swp     r0, r3, [r2]
      20:       e2822028        add     r2, r2, #40     ; 0x28
      24:       e1021093        swp     r1, r3, [r2]
      28:       e3c03007        bic     r3, r0, #7      ; 0x7
      2c:       e5023028        str     r3, [r2, #-40]
      30:       e51ff004        ldr     pc, [pc, #-4]   ; 0x34
      34:       7fffe174        swivc   0x00ffe174
      38:       e002c014        and     ip, r2, r4, lsl r0
      3c:       e01fc000        ands    ip, pc, r0
      40:       ffffffff        swinv   0x00ffffff
      44:       ffffffff        swinv   0x00ffffff

With the rest of the memory 0xffffffff.

So how to I overwrite those vectors? Can it be done with OpenOCD? I presume that’s needed before I can run the led blink example code because the generated main.bin seems to start with some vectors.

Note: The board only has a JTAG. I don’t know if there is a bootloader, and there appears to be no access to any serial console. I have no idea if the thing is in arm or thumb mode or how to find out which is in use.

thanks for any help,

biff.