Sage SmartProbe FAQ


What's a Sage SmartProbe?

The Sage SmartProbe was a very spiffy "Hard ICE" CPU debugger, one of the few ever manufactured for use with modern (2010s) AMD x86-64 processors, and - as far as I'm aware - the only one ever sold on the mass market, rather than strictly to moneyed organizations (as e.g. Intel's and Arium's probe kits are.)

The SmartProbe makes it possible (given a supported motherboard) to debug a BIOS (including its early boot processes, e.g. RAM initialization); expansion ROMs; and any (not necessarily cooperative) operating system, running in any x86 CPU mode (16, 32, 64-bit); and is able to directly manipulate memory and I/O, including the PCI bus.

See previous articles,
A Complete Pill for the Sage SmartProbe.
The Care and Feeding of the Sage SmartProbe.


Where do I get a Sage SmartProbe?

Possibly here -- while supplies last. (Warning: I have no relation with this vendor and have no idea whether they still include the probe with "Gizmo 1" kit. I do know for a fact that their latest "Gizmo 2" product does not include it.)

SmartProbe is no longer made and at some point will only be available secondhand.


Update: I have a modest supply of SmartProbes and am willing to sell a few; the price is permanently set at 1 BTC per unit, regardless of current exchange rate. Probes will ship as found in the wild, uncured, buyer may apply the published pill at his own risk. You must be registered in the WoT to buy. Please contact me if seriously interested.


Who is selling devices comparable to SmartProbe ?

AFAIK nobody! Several vendors offer similar products but they do not support plain old GDB interface, and instead require you to buy multi-thousand-$ MS Windows closed shitware -- sometimes with a mandatory maintenance contract !


Why not build and sell a clone of the SmartProbe ?

A literal chip-for-chip PCB clone would be rather difficult to build in quantity, given as the microcontroller used in the original device is long out of print. It would be necessary to properly reverse AMD's HDT protocol and essentially reproduce the tool from scratch. The more serious problem, however, is that post-2014 AMD CPUs no longer permit the use of HDT without a magic signing key from AMD. The probe is only useful on pre-"Fritz Chip" AMD processors.


My SmartProbe self-destructed after xxx hours of use!

Most SmartProbes were sold in a demo mode, and expire after a certain interval. The purchaser was expected to pay the vendor to re-enable the device. However, the vendor is defunct. So if you want to use your probe, you will need to cure it with sage_pill.py.


Can anyone help me with sage_pill.py? When I run it, it gets through programming the FPGA, but then dies...

This is the correct behaviour. The probe resets itself after it is cured by the pill and your serial connection to it will break.


How do I verify that the pill worked?

screen /dev/ttyACM0
(Or wherever your probe is connected) and hit return key a few times. You will see the string SmartProbe: 3.2_3743 (the last firmware revision released before the manufacturer went out of business.) And your probe will no longer die after N hours of use.


Do you have a pill for the Sage EDK software?

The EDK is rubbish, Java shitware, forget about it; use plain old GDB.


I got GDB working with the probe, but I can't seem to get the probe to work with the board. If I plug in the probe to the board, the board hangs. If I try to continue I just get a bunch of ffffffs. If I do "monitor run" it says the probe is not connected ?

You plugged the cable into your motherboard backwards!


Help! GDB does strange things instead of working !

You must use version 7.8 of GDB or above, for the probe to work. Earlier versions had problems with the switches between 16, 32, and 64-bit modes of the AMD CPU.


Will Sage SmartProbe work with a PcEngines APU1 computer ?

Yes. Though you will have to solder the debug connector on yourself. (It is a 5 minute job. The header is a metric-spaced one, however, make sure to buy the right kind.)


Will Sage SmartProbe work with the recently-released PcEngines APU2 computer ?

No! on account of AMD's PSP NSA-mandated Fritz Chip.


Does the Sage SmartProbe work with Intel CPU and motherboard?

No.


Will you help me with Intel's XDP debugger for Intel CPU and motherboard?

No.


Why did Sage go out of business?

I don't know. But AMD's successful campaign of docs-withholding, stonewalling, and Fritz-chipping, to strangle Coreboot -- probably did not help Sage's life expectancy. Sage was a consultancy mainly specializing in Coreboot and custom third-party BIOS work.


Were you affiliated with Sage? Can you put me in touch with ex-Sage people ?

No. And no.


I have questions!

Try asking -- politely -- here.


This entry was written by Stanislav , posted on Sunday May 07 2017 , filed under Cold Air, Computation, Copyrasty, Hardware, NonLoper, Reversing, SoftwareArchaeology . Bookmark the permalink . Post a comment below or leave a trackback: Trackback URL.

6 Responses to “Sage SmartProbe FAQ”

  • JtagTest says:

    Do you think the Smatrprobe supports older processor like the Athlon xp ?
    There are old motherboards where you can solder a connector for the jtag port of the processor.
    They partly work with a Raven, but there are problems.

    • Stanislav says:

      Dear JtagTest,

      AFAIK the Athlons spoke a very similar protocol, but the connector had different (unknown to me) pinout, and IIRC also different signal voltage.

      Sage did not have built-in JTAG support for anything older than the 64-bit "G-series", so you'd be on your own with regards to the actual magic numbers, even if you were to build an adapter/level-shifter.

      Out of curiosity, what are you doing with 32-bit Athlons ?

      Yours,
      -S

      • JtagTest says:

        The pinout is the same as the one shown in the msi ms-6553 schematics you can find on the internet
        The voltage should be the vcore of the cpu
        Usually jtag probes have a levvel shifter that uses as input power supply the voltage from the jtag connector, with a bit of luck the adapter would just be made of 2 connectors wired in the right way

        I want to read the model specific registers values after reset, to use them in an emulator

        • Stanislav says:

          Dear JtagTest,

          Your best bet is probably a standard JTAG probe, if you already know the protocol. Though IIRC the Sage does have a level shifter, and you can force it into raw JTAG mode.

          You may be able to read the MSRs on reset using a modified Coreboot build, without even resorting to JTAG box.

          Yours,
          -S

  • JtagTest says:

    The protocol is completely undocumented.
    But i already have a motherboard where i have soldered the connector and connected a Raven (the one from the same company that made the Wiggler) to it but with its free software the athlonxp is not fully supported.

    That's why i asked the question.
    If the smartprobe supported the athlonxp i would make the required connection myself, if not there is no reason to risk breaking the one i have.

Leave a Reply

XHTML: You can use these tags: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong> <pre lang="" line="" escaped="" highlight="">


MANDATORY: Please prove that you are human:

117 xor 30 = ?

What is the serial baud rate of the FG device ?


Answer the riddle correctly before clicking "Submit", or comment will NOT appear! Not in moderation queue, NOWHERE!