CH32V20x/30x bootloader dump - Page 1
Forum section: electronics / general

author: HwAoRrDk
author_rank: Super Contributor
timestamp: September 09, 2024, 05:38:48 am
content: Does anyone have a WCH CH32V20x or CH32V30x that they could dump the factory bootloader from for me?The bootloader can be dumped just by reading out the flash from 0x1FFF8000 to 0x1FFFEFFF.There's something I want to investigate, but I don't have any and it'd be preferable if I didn't have to wait 2-3 weeks for a dev board to arrive. (By the way, WTF is the deal with WCH's official AliExpress store? Seems like every other time I look at it, it haszeroproducts listed on it - just completely empty, nada, zilch.)

author: SiliconWizard
author_rank: Super Contributor
timestamp: September 09, 2024, 05:59:25 am
content: Aliexpress has a lot of third-party boards for the CH32V307 if you want to experiment, like this one:https://www.aliexpress.com/item/1005004350410929.htmlI have a few of these boards myself (although I bought them from another store, but this one is cheaper.)Since I have a few (and also a couple CH32V305 boards), I can do that. When I get around to it.I mainly use the wlink command-line tool with these and I don't remember if it directly allows reading Flash at any address (I think so but will have to check). If so, that'll be a very quick job. If not, that will require a bit of programming.

author: mean00
author_rank: Newbie
timestamp: September 09, 2024, 06:15:35 am
content: This is the bootloader for CH32V303, dumped with swindle

author: SiliconWizard
author_rank: Super Contributor
timestamp: September 09, 2024, 07:12:38 am
content: wlink did work fine. Attached is the dump.The command line was:Code:wlink dump -o CH32V307_Bootlader.bin 0x1FFF8000 28672The chip:Code: Attached chip: CH32V30X  (ChipID: 0x30700528)

author: SiliconWizard
author_rank: Super Contributor
timestamp: September 09, 2024, 07:21:36 am
content: I compared my dump with that of mean00 and they seem identical (probably not too surprisingly). mean00's binary file is just one byte shorter, but I guess they (or their tool) missed the length by one byte when dumping. Not that it really matters as I don't think the end of the area contains anything useful.

author: HwAoRrDk
author_rank: Super Contributor
timestamp: September 09, 2024, 07:48:59 am
content: Thanks mean00 and SiliconWizard.That's just what I need.Yes, they are both identical. I believe the entire '20x and '30x range will have identical bootloaders.Seems the latter ~20KB is unused. Curious they chose to fill it with repeating pattern of 0x39E3. Not sure whether that's a value of any significance.

author: SiliconWizard
author_rank: Super Contributor
timestamp: September 09, 2024, 09:03:43 am
content: Quote from: HwAoRrDk on September 09, 2024, 07:48:59 amI don't know about that, would have to be checked. But there are different versions of the bootloader, I believe. I have another CH32V307 board for which the USB bootloader was not working properly, while it was for other boards. I suspected a different version of the bootloader in different batches of CH32V307. I haven't dumped the bootloader on this problematic chip but out of curiosity, I will.Quote from: HwAoRrDk on September 09, 2024, 07:48:59 amDunno. It doesn't seem to be a valid RISC-V instruction, if you're wondering. Maybe that's the point? (To make the chip reset if the bootloader ever goes into abnormal territory?

author: HwAoRrDk
author_rank: Super Contributor
timestamp: September 09, 2024, 09:50:28 am
content: Quote from: SiliconWizard on September 09, 2024, 09:03:43 amAh, yes that would be interesting to see if there are actually multiple versions out in the wild, and whether there's any different behaviour (as opposed to just bug fixes). You should be able to check the version the bootloader reports by usingwchisp(or, indeed, the official WCHISPTool software) and querying the chip with the 'info' command.Quote from: SiliconWizard on September 09, 2024, 09:03:43 amBut then so is FFFF, so...

author: mean00
author_rank: Newbie
timestamp: September 09, 2024, 09:55:38 am
content: If my memory is correct 0x39E3 is the value of the flash when it is erased(not the usual 0xffff)

author: mean00
author_rank: Newbie
timestamp: September 09, 2024, 10:00:08 am
content: confirmed:7) To erase the standard page continuously, you can repeat steps 3-5 to end erasing and clear the PEG bit to 0.Note: After erasing is successful, word read - 0xe339e339, half word read - 0xe339, even address byte read -0x39, odd address read 0xe3.

author: abyrvalg
author_rank: Frequent Contributor
timestamp: September 09, 2024, 01:53:56 pm
content: Quite unusual. Have they inserted inverters on half of data bus bits, so FFFF reads like that? Scrambling against having many similar adjacent bits affecting neighbor cells, like it is done in modern high-density NANDs?

author: mean00
author_rank: Newbie
timestamp: September 09, 2024, 05:48:00 pm
content: My guess is that it is not actual NOR flash but something else (MRAM ? Nand ?) and that value is the value the translation layer is returning when it detects that line is erased. Might be it is just not worth fixing it rather than on purpose.

author: GromBeestje
author_rank: Frequent Contributor
timestamp: September 09, 2024, 05:53:21 pm
content: Since the forum doesn't allow .bin files, I have made a 7zip archive. In the archive are:ch32v203c8t6_bootrom.binch32v307vct6_bootrom.binThe CH32V203C8T6 was purchased from LCSC and soldered to a board of my own design.The CH32V307VCT6 is on an eval board.I have used the wlink tool suggesed by SiliconWizard, as my openocd build is outdated. I admit I haven't touched it in a while.

author: SiliconWizard
author_rank: Super Contributor
timestamp: September 09, 2024, 08:49:47 pm
content: Quote from: GromBeestje on September 09, 2024, 05:53:21 pmYour bootloader for the CH32V307VCT6 is the same as ours.The one for the CH32V203C8T6 has a lot of differences. I didn't disassemble them, so I haven't checked what these differences are all about. But the 2 and 3 series are different, with a (slightly) different CPU core and probably different memory layout.

author: HwAoRrDk
author_rank: Super Contributor
timestamp: September 10, 2024, 05:04:37 am
content: Quote from: mean00 on September 09, 2024, 10:00:08 amOh, yes, I see that in the reference manual now. Thanks.I wonder if this is anything to do with the flash being aseparate die?Quote from: SiliconWizard on September 09, 2024, 08:49:47 pmYes, it is significantly different, and in fact much larger - ~14KB vs ~8KB. My theory that '20x and '30x are the same is obviously wrong.I notice it contains some strings mentioning "WCH32 Virtual COM Port", so I wonder if it implements USB CDC or something.