Found the 10/27 and 11/08 autotune firmwares didn't have their test data obfuscated like in the 11/25 and 11/29 versions. More data to try to reverse engineer the asic fw programming process. They also used a different version of single-board-test for both 10/27 and 11/08, looks like they were an early work in progress when they were released.
Still have two bad boards, the controller can communicate with the PICs but they fail all of the tests. Once the fw fails to restore them a dozen times it fails over to bmminer and starts with no boards online in the GUI.
The hash_s8_app.txt appears to have the software for the PIC, it's 3200 lines and the restore process is 3200 blocks.
Looks like all of the autotune versions use the exact same hashboard firmware code, 10/27, 11/08, 11/25, and 11/29.
If I can find a way to pull that code from one of the good pre autotune hash boards I might be able to rewrite it to the failed boards and get them running again. But they didn't come with that code in their firmware.
Might be a lost cause, too many dark tunnels of obfuscated code that they are keeping secret. Rather than sending these boards in for repair I'd rather spend the money on an Avalon or something else down the road. Bitmain devices seem to be terribly flaky and poorly designed. But as long as I have them to play with I will.
If anyone has any autotune firmwares before 10/27 please let me know! I'd love to have a copy for my work.
(UPDATE)
Renaming hash_s8_app.txt causes the single-board-test to NOT restore the firmware a trillion times, but it still does all the other steps. Not useful for me, but really a time saver and interesting.
All I want is a little program with full R/W access to the hashboard memory and PIC, that can't be too much to ask can it? Unfortunately the tools to do that are all locked up in the single-board-test binary and associated bits with no source code available.