Jabe UD-1200 vs. Jabe UD-1200 PRO vs. JBC CD-2SQE - need Firmware for UD-1200 - Page 1
Forum section: electronics / general

author: JimKnopf
author_rank: Frequent Contributor
timestamp: August 14, 2023, 08:14:57 pm
content: Hello,i use a JBC CD-2SQE for years now which came with a T210 handle. Nice device, but for heavy parts like big heatsinks, transformer or heavy copper multi layer PCB i sometimes wished for more power at the tip. I compared some JBC clones and decided to buy the Jabe UD-1200 but failed at the order process on ali. There were two models, UD-1200 and UD-1200 PRO and i didn't realized that the PRO has a T210 handle. I saw the PRO offer with 3 extra tips and thought PRO must be better than not PRO version. I read about the bad T245 clone handles and bought the original JBC 245 handle and original C245 cardridges from a well known local distributor.Today the Jabe device arrived and to my surprise, there was a T210 handle. I thought no problem, i already got the T245 handle, just plugin and enjoy.The Jabe UD-1200 PRO heats up the original T245 handle to around 110 degree even if the device is set to 300 or more.I compared the PCB from my PRO version with images from UD-1200 or Best BST-933b device. The only difference i could find is this white multioptocoupler that some devices had but which is not assembled on all devices.I guess the Jabe UD-1200 uses the same hardware as the UD-1200 PRO but software is different. I could not change the power setting in the menu. It is set to 30W.I read some posts and watched some videos to learn, the original JBC uses pin 1,2,5 on the Hirose connector for T245 and the T210 additionally uses pin 6 (center pin) which is connected to pin 5, both grounded. If pin 6 is connected, the JBC provides 12V to the tip, if only pin 5 is connected, 24V are provided to the tip. I should have read that before buying the Jabe because the T245 handle works well with my JBC CD-2SQE. Using the T245 handle on this device makes it a CD-2BQE modell. Same specs, "E" controller board, same power etc. It seems i bought the Jabe UD-1200 PRO for nothing.Option A is, selling the Jabe as it's brandnew and unused (no fun factor).Option B is, turning the UD-1200 PRO into a UD-1200 version (to have some fun).I guess i need the firmware of a UD-1200 for that. Is there someone able and willing to grab the firmware from his Jabe device and provide it to me for educational purpose?BTW. The T210 handle from the Jabe UD-1200 PRO version uses another pinout. It doesn't use pin 6. It uses only pin 1,2,5. I guess i can turn the T210 clone on my original JBC into a glow stick because it will use 24V instead of 12V.Any help getting the T245 tip on the Jabe UD-1200 PRO working is welcome.

author: thm_w
author_rank: Super Contributor
timestamp: August 15, 2023, 10:58:18 pm
content: Google finds no information on the "UD-1200 pro" other than a single aliexpress listing with no information as to the differences.Maybe you can provide some more info or photos. Is there any included manual?https://www.eevblog.com/forum/reviews/jabe-ud-1200-soldering-station-nice-jbc-clone/

author: JimKnopf
author_rank: Frequent Contributor
timestamp: August 16, 2023, 10:58:31 am
content: @thm_w Yes there is a manual, i attach it as images. I also took some photos.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: August 16, 2023, 11:00:12 am
content: The device in comparison to my JBC one.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: August 16, 2023, 11:02:58 am
content: The board itself

author: JimKnopf
author_rank: Frequent Contributor
timestamp: August 16, 2023, 11:08:14 am
content: The connectors of the handle:1. left, T210 Jabe clone2. middle, T210 JBC original3. right, T245 JBC originalIMG_20230814_150459.jpg is the connector from inside the Jabe UD-1200 PRO.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: August 17, 2023, 01:27:13 pm
content: I have some readings on the transformer output while connector was plugged into the board.Handle connector has 7,61 V AC (RMS).Blue wire of the handle connector is connected straight to pin 3 of the transformer.Can someone confirm this measurements on a Jabe UD-1200 / Best BST 933b?

author: JimKnopf
author_rank: Frequent Contributor
timestamp: August 17, 2023, 03:57:26 pm
content: From STM32 manual, the STM32F103RB ARM Cortex M (128k/20k flash/ram memory) has a combined JTAG/SWD-DP.On the chip itself i could see a clock signal / data signals. The 2x10 pin row looks like a default JTAG port. So i tried to find JTAG signals there. No luck with the JTagulator.I will try flying wires next. I guess the ATMLH028(AT24C256C) 256KbitEdit: (AT24C08C) 1024 kbit I2C serial eeprom stores user setup data. I try to dump its data with a programmer.Interesting pins on the STM32F103RB are:31 VSS_1 GND60 Boot_0USART 141 PA 8 USART1_CK42 PA 9 USART1_TX43 PA 10 USART1_RX44 PA 11 USART1_CTS45 PA 12 USART1_RTSJTAG7 NRST NRST46 PA 13 JTMS / SWDIO49 PA 14 JTCK / SWCLK50 PA 15 JTDI55 PB 3 JTDO56 PB 4 JNTRST

author: JimKnopf
author_rank: Frequent Contributor
timestamp: August 17, 2023, 04:57:44 pm
content: I could read the ATML028_AT24C256 eeprom. But it doesn't look like firmware data.Edit: It's a AT24C08C eeprom. And this readout was wrong.

author: thm_w
author_rank: Super Contributor
timestamp: August 17, 2023, 09:11:18 pm
content: I asked the seller about the pro and they seemed clueless.Its possible to extract the firmware on a protected STM32F103. But yeah, without someone with a UD-1200 to compare the eeprom and firmware data too its going to be a bit difficult.SWD, SWCLK, and NRST is generally all thats used for programming.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: August 18, 2023, 05:49:52 am
content: Quote from: thm_w on August 17, 2023, 09:11:18 pm@thm_w I saw your thank you on a related older post about stm32f1 firmware extraction. Maybe you can give me some hints.I'm diving into that python extraction script. I think i can manage to get a used UD-1200 to do the task.I'm starting here:https://blog.zapb.de/stm32f1-exceptional-failure/https://github.com/doegox/stm32f1-firmware-extractorhttps://github.com/dmitrystu/sboot_stm32

author: JimKnopf
author_rank: Frequent Contributor
timestamp: August 26, 2023, 06:59:19 pm
content: @thm_w I added a used Jabe UD-1200 to my soldering station collection.I grabbed the data from the UD-1200 eeprom and compared it with the data from UD-1200-PRO. It is different.To dump the STM32F103 firmware i soldered pinheaders to both pcb and used the segger. I also tried my TIAO Tumpa board. But something was not proper set in the config file. I didn't want to spend time on SWD_EN setting in the tumpa.cfg so i used the segger and openodc for both devices.QuoteI dumped the data using stm32f1-firmware-extractor fromhttps://github.com/doegox/stm32f1-firmware-extractorQuoteBoth files have the same size of64KB128KB.The file command tells me:QuoteUnfortunally, the UD-1200 firmware SD-V3.02.01 is from 2020/01/03 . It's in english which is perfect. But it doesn't support the three temperature presets like the Jabe UD-1200-PRO with firmware version SD-V3.02.03 from 2021/07/26 and my original JBC.I now have the dump files. But i'm not sure if it's complete. If someone have a newer firmware version for UD-1200 feel free to send me a PM or leave a comment here. Before playing around with programming the STM32F103 i will dump the firmware again using another methode. I got a chipwhisperer husky in my shelf. I will try the gliching trick on the Jabe devices.Maybe @tv84 can assist me with firmware analysis?Edit: The STM32F103RB has 128KByte of Flash memory.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: August 27, 2023, 07:35:27 pm
content: I read the flash again because the STM32F103RB has 128KB and i compared all files. The 128KB dump files are filled with FF at the end. So no data is missing from memory size i guess.

author: DavidAlfa
author_rank: Super Contributor
timestamp: August 28, 2023, 12:17:15 am
content: And where are the dumps?

author: tv84
author_rank: Super Contributor
timestamp: August 28, 2023, 07:46:33 pm
content: Looking at the dumps, at first sight they seem consistent.BUT...The PRO dump doesn't contain valid ARM code... The non-PRO contains valid code but both contain bad data every 0x200 bytes.Look at the attached image. (I loaded the raw dump directly at 0x80000000)See the FF FF FF FF FF FF FF FF zone? It overwrites good code.

author: DavidAlfa
author_rank: Super Contributor
timestamp: August 28, 2023, 08:16:01 pm
content: OOB? Out of band area? It's a STM32, not nand memories.I loaded them into Ghidra, the code pointed by the reset vector address doesn't make sense.Lots of garbage everywhere! Maybe the output is corrupted?Do you have any blue pill where you could write a protected firmware, read it back, then compare?The non-pro has weird a pattern "07 00 00 20" repeating every 0x100 bytes starting at 0x14, repeating at 0x114, 0x214, 0x314... all along the file.

author: tv84
author_rank: Super Contributor
timestamp: August 28, 2023, 08:23:12 pm
content: Quote from: DavidAlfa on August 28, 2023, 08:16:01 pmI had corrected my post... Yes, the dump seems to have a consistent read error every 0x200 bytes. Maybe it has to do with the reading glitch script?

author: DavidAlfa
author_rank: Super Contributor
timestamp: August 28, 2023, 08:27:29 pm
content: No idea! BTW in my case I see bad data every 0x100 bytes, read my previous message.

author: tv84
author_rank: Super Contributor
timestamp: August 28, 2023, 08:28:58 pm
content: Quote from: DavidAlfa on August 28, 2023, 08:27:29 pmIn the PRO dump.The non-PRO seems 0x200.BTW, my rhetoric question was for Jim.Edit: You're right, both have an error area every 0x100 bytes. The probability of having this code:ROM:8000BC14 07 00 MOVS R7, R0ROM:8000BC16 00 20 MOVS R0, #0every 0x100 must be 0.Interesting to see that it's only a aprox. 0x30 bytes area every 0x100 that is wrong... The other 0xD0 bytes seem OK.And to make matters worse, the PRO dump starting at 0x2C40 must have all bytes bad... Something happened at that moment. Until then the behavior/problems were the same as in the non-PRO dump.Quote from: DavidAlfa on August 28, 2023, 08:16:01 pmThis would be the best action.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: August 29, 2023, 04:52:21 am
content: @DavidAlfa @tv84 Thank you guys for your effort. I compared the blue pill dev boards. The cheap ones seems to have chinese fake chips. Some reliable ones have a STM32F103C6 or C8 which come with 64KB flashmemory.Seehttps://www.st.com/en/microcontrollers-microprocessors/stm32f103.htmlThe Jabe devices using the RB version which has 128KB flashmemory.I ordered the ST NUCLEO-F103RB dev board, awaiting delivery on friday.

author: DavidAlfa
author_rank: Super Contributor
timestamp: August 30, 2023, 12:07:35 am
content: Try flashing a bluepill with this, use ST-Link utility to set RDP1.Bin file in Release folder.The program checksums a big text array, the on-board led (PC13) will blink slowly (1Hz or so) if ok, or very fast if wrong.Then read it back with the firmare extractor method and check what you got.Only the first 64KB are used.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: September 02, 2023, 06:41:07 pm
content: @DavidAlfa@tv84I now have a blue-pill board and a ST-nucleo here for testing. I flashed the mentioned file 103_test.bin to both devices and read it back.The blue-pill board was a bit tricky. I couldn't get it to work with the j-link. But a st-link-V2 clone did it (after adding a line to the cfg).For flashing the file and setting the RDP bit i used the ST Programming software. I read it back two times. One time without RDP and one more time with RDP enabled.To read it back i used again openocd and stm32f1-firmware-extractor-master.For the blue-pill:openocd -f interface/stlink.cfg -c "transport select hla_swd" -f board/stm32f103c8_blue_pill.cfgand in the other terminalpython3 ./main.py 0x00000000 --binary 32768 > bluepill+RDP_read-test.binFor the ST-nucleo:openocd -f interface/jlink.cfg -c "transport select swd" -f target/stm32f1x.cfgand in the other terminalpython3 ./main.py 0x00000000 --binary 32768 > ST-nucleo+RDP_read-test.binI had a lot of this messages:Quote

author: DavidAlfa
author_rank: Super Contributor
timestamp: September 02, 2023, 07:15:35 pm
content: And the most important part? Did the original file match with what you read back?

author: JimKnopf
author_rank: Frequent Contributor
timestamp: September 02, 2023, 08:29:05 pm
content: @DavidAlfa Seems the original file doesn't match to the files i read back. And there is also a difference between the blue-pill file with RDP on and RDP off. The St-nuclue files with RDP on/off match. Same md5sum. But they are different to the orig file.So something is wrong with the extraction tool. I will try my other option, grabbing the flashmemory with the chipwhisperer.Or do you have a hint how fix the extraction tool?

author: JimKnopf
author_rank: Frequent Contributor
timestamp: September 03, 2023, 12:58:46 pm
content: Even if it doesn't help with the actual problem with the stm32 firmware extractor. But I got the blue-pill to work with the j-link.I had to add "set _CPUTAPID 0" (instead of 0x1ba01477) in openocd/scripts/target/stm32f1x.cfg to suppress id error.Another thing i read in openocd manual is, HLA-SWD mode (HLA = High-level adapters) which openocd supports for j-link and ST-link V2 adapter, does not work with the stm32f1-firmware-extractor tool. Because the tool uses the command maskisr that is not supported by HLA-SWD mode. And last but not least, the ST-Nucleo board has an integrated debug port on the upper side that uses HLA. I changed the wiring, only using the lower side of the ST-Nucleo board. Only 4 wires are needed like on the blue-pill.Pinout for J-Link to ST-Nucleo boardJ-Link ST-Nucleo CN71 Vdd 3,3V 16 Vdd 3,3V4 GND 8 GND (or 19/20/22)7 SWDIO 13 PA13 (SWDIO after reset)9 SWCLK 15 PA14 (SWCLK after reset)I was able to flash both devices with the J-Link and set the RDP option byte in openocd.Now the readout for each device with or without RDP option byte matches but is different between blue-pill and ST-Nucleo and both are different to the original file. This is the actual main cause i'm stucked into. There has been no development in the stm32f1-firmware-extraction tool since the tool was released a few years ago.https://www.eevblog.com/forum/microcontrollers/dumping-stm32-protected-firmware/QuoteTo set option byte in openocd i used this commands (consider that RDP level 1 is option 0 and RDP level 2 is option 1 in openocd, both can be set with lock or unlock):openocd -f interface/jlink.cfg -c "transport select swd" -c "adapter speed 3500" -f target/stm32f1x.cfg# in the other terminaltelnet localhost 4444QuoteQuoteAfter unlocking RDP1, the flashmemory will be deleted.To flash it again in openocd i used this commands (while openocd still running).telnet localhost 4444QuoteThe read command (while openocd still running):Quotemd5sum *.binf4ee82421a72b1210870185930cfc3f8 103_test.bin8dbf03eeac65d567487ec8d0b63b4694 bluepill-noRDP_read-test_new3.bin8dbf03eeac65d567487ec8d0b63b4694 bluepill+RDP_read-test_new.bin668ce2d0bfb4a4abfd5a4fc92660020b ST-nucleo-noRDP_read-test_new_PA13_PA14.bin668ce2d0bfb4a4abfd5a4fc92660020b ST-nucleo+RDP_read-test_newPA13_PA14.binI will end this stm32f1-firmware-extractor chapter here and figure out the jupyter notebook stuff for the chipwhisperer. Maybe a solution like in this example will do the trickhttps://prog.world/read-secure-firmware-from-stm32f1xx-flash-using-chipwhisperer/

author: DavidAlfa
author_rank: Super Contributor
timestamp: September 03, 2023, 01:25:11 pm
content: If you had to hack the Tap ID, then it's a clone, so it makes no sense to attack it, you want to extract the fw from a genuine stm32.Maybe a glitch attack?https://github.com/CTXz/stm32f1-picopwnerEdit: I tried it. Had some baffling issues, which Igot around.When it finally worked, it gave me a perfect firmware dump.For this to work you'll likely need to modify the board, as the stm32 is powered by a Pico pin, you will need at least to remove all the capacitors and everything connected to VDD, otherwise the glitch will be filtered out or it might consume too much for the pico.The easiest would be to desolder the stm32 and put it into a breakout board.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: September 03, 2023, 06:36:24 pm
content: I ordered some pico H/WH devices and some breakout boards for 32 to 100 pin chips. The pico devices will arrive next week. Looks like a cheap and reliable solution. No need to use the chipwhisperer (maybe next time).

author: DavidAlfa
author_rank: Super Contributor
timestamp: September 03, 2023, 07:30:44 pm
content: I tested it with a J-Link V8 clone from aliexpress, which seem to use a relabeled CKS32F103 (CPUTAPID = 0x2ba01477).It also worked! But I had to apply the patch, addingset CPUTAPID 0totarget/stm32f1x.cfg.In my case the openocd folders lived in/usr/share/openocd/scripts.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: September 03, 2023, 08:21:44 pm
content: @DavidAlfa And how did you do that? Can you provide the secrets?

author: DavidAlfa
author_rank: Super Contributor
timestamp: September 03, 2023, 08:45:24 pm
content: I mean I extracted the firmware from the Jlink clone using this same attack.

author: DavidAlfa
author_rank: Super Contributor
timestamp: September 05, 2023, 08:13:58 pm
content: JimKnopf, regarding your PM, did you follow the fixes I made here? (Posted in an earlier message).https://github.com/CTXz/stm32f1-picopwner/issues/2Buepill boards normally have two jumpers for boot0/boot1.For boot0, remove the jumper and connect the cable in the pin at the middle of the 3.For Boot1, don't use any resistor, just place the jumper to "1" position.Just like shown in the github repo (Click for larger pic):

author: JimKnopf
author_rank: Frequent Contributor
timestamp: September 06, 2023, 04:03:46 pm
content: @DavidAlfaIt's wired up correcly. The blue-pill is powered by the pico. I can set/unset RDP and programm the blue-pill with the ST-Link V2 clone.Each device is recognized, config files are present, openocd works, every thing is fine and should work.The only thing is, it doesn't work. I didn't remove any component from pico/blue-pill. I added a 10k resistor to the blue-pill boot1/3,3V pin. I guess it's more software related. I also tried external powered USB hub.I'm running the stm32f1-picopwner on a Arch system which means it's a rolling release.openocd-git 0.12.0.r73.g1998b1e5a-1python 3.11.5-1python-pyserial 3.5-5I got an error each time i execute the dump.py script:Please select the USART used by the STM32F1 target to dump firmware1: USART1 - RX: PA10 TX: PA9)2: USART2 - RX: PA3 TX: PA2)3: USART3 - RX: PB11 TX: PB10)Enter 1, 2 or 3: 1Press enter to load the target exploit firmware to the SRAMQuoteIt's the first time i use a RP pico board. I just pressed the button and connected to usb port. It show up as drive. I put the attack.uf2 file on it which leads to a reboot of the pico. Seems it works as expected.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: September 06, 2023, 04:41:45 pm
content: Tried the ST-Nucleo board as target. It gave me this errors:Quote

author: DavidAlfa
author_rank: Super Contributor
timestamp: September 06, 2023, 04:42:31 pm
content: The problem is clear:openocd output: Error: Invalid command argumentSomething might have changed in newer versions of Openocd.Try Ubuntu 20, boot a live system and try there.It seems to me your Linux it's too new. Like always happens.In your last case, I had the same error.I repeat, did you modify the dump.py script as I explained?EDIT: It turns out OpenOCD 0.10 and 0.12 have some differences.My fixshould notbe applied for OpenCD 0.12!You can make some tests. Connect the STlink to the target (BluePill / STM32 Nucleo):In one window, run:openocd -f interfaces/stlink.cfg -f target/stm32f1x.cfgShould start a debug session. Now open another window:telnet localhost 4444And you should be in the openocd shell.Try running these commands:initreset haltstm32f1x options_read 0Code:> init> reset halt[stm32f1x.cpu] halted due to debug-request, current mode: ThreadxPSR: 0x01000000 pc: 0x08000200 msp: 0x20005000> stm32f1x options_read 0option byte register = 0x3fffffewrite protection register = 0xffffffffread protection: onwatchdog: softwarestop mode: no reset generated upon entrystandby mode: no reset generated upon entryuser data = 0xffff

author: JimKnopf
author_rank: Frequent Contributor
timestamp: September 06, 2023, 06:18:16 pm
content: @DavidAlfaThere was no need to change dump.py. I got the stlink.cfg in place. Works great if i start openocd with stlink v2 clone manually. I can flash the blue-pill and read RDP status in openocd:QuoteAs you can see, the original typing "read protection: on" from dump.py is correct in my case (for my openocd version).I tried the openocd commands by hand and compared the response message from openocd.The command from dump.py line 266:Quoteshould give the output "pc: 0x20000" used in line 270.When i do this manually in openocd i get this:QuoteCould this cause the error?

author: DavidAlfa
author_rank: Super Contributor
timestamp: September 06, 2023, 06:28:31 pm
content: pc: 0x08000200 means it's booting from flash, so BOOT1 is set wrong. Forget the resistor. Just:- Set BOOT1 jumper to 1.- Remove BOOT0 jumper, connect to pico GPIO5.- Press reset button on the Bluepill / Nucleo board.And try the openOCD test again.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: September 06, 2023, 06:43:00 pm
content: @DavidAlfaQuoteNow it matches to dump.py.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: September 06, 2023, 07:16:31 pm
content: Loading the image file works.QuoteSomething must be wrong with lineQuoteI have a blank in the path name which i had to escape when loading the file manually in openocd.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: September 06, 2023, 07:26:37 pm
content: Oh noooo. The path was causing the error. I moved the whole directory to my home dir and started again. No longer a blank in the path name let me start the process.Quote

author: JimKnopf
author_rank: Frequent Contributor
timestamp: September 06, 2023, 07:39:09 pm
content: @DavidAlfaThe dump.bin matches your 103_test.bin file until the last few bytes.

author: DavidAlfa
author_rank: Super Contributor
timestamp: September 06, 2023, 07:40:54 pm
content: I could replicate the issue, seems to happen sometimes when connecting the STLink VDD to the target board.But only happened few times. No idea otherwise. Maybe loose wires.And never connect the debugger unless you're told to do so.Now, for the nucleo board, there must be a jumper somewhere to isolate VDD, you should open it.Quote from: JimKnopf on September 06, 2023, 07:39:09 pmIt's fine. The original file doesn't use the entire 64KB, so the rest is padded with FF.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: September 07, 2023, 07:04:54 pm
content: @DavidAlfaToday i tried the trick with the Jabe UD-1200 PRO board. At the moment, i get this error:QuoteWhen connecting the ST-Link V2 clone (Vcc included), i can read the RDP status. To me it looks like the pico can't power the target board. This is one of the mentioned issues on github project page:QuoteI connected external 3,3V to the board Vcc pin1 on the JTAG pin-header and powersupply GND to the pico GND. I swapped the pico-GND connector from UD-122 Pro board to the Emiter pin of a BD139 NPN transistor, pico GP2 (Vcc) pin via 10k resistor to BD139 base pin and it's collector pin to GND on the UD-1200 PRO board. I also connected the ST-Link V2 clone GND to the pico GND.With this NPN transistor as a switch, i get the same error.Edit: I added one connection from 3,3V via 1k resistor to pin 28/PB2 that is not visible in the image.

author: DavidAlfa
author_rank: Super Contributor
timestamp: September 07, 2023, 08:11:18 pm
content: Are you sure BOOT0 isn't connected directly to gnd? I see that a lot.But yeah, the problem is probably the capacitance.Even if you add a transistor, the problem remains, the capacitors will filter out the ultra short power cut.Better you transfer it to the breakout board.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: September 16, 2023, 04:22:05 pm
content: @DavidAlfa Boot0 was indeed connected to GND. I ordered some breakout boards and placed the STM on it and wired up the connection to the pico and ST-Link probe. I first tried only VDD_1/VSS_1. Then i connected the other VDD_2/VSS_2 to VDD_4/VSS_4 pins to power the STM32F103.SWDIO is connected to PA13/Pin46 and SWCLK to PA14/Pin49. Dump.py is waiting for debug probe to be connected. Light on ST-LinkV2 is on, not flashing. Something is missing i guess.I tried to connect via openocd directly without the pico. But openocd tellingQuoteDo i need additional connections on the STM32F103? Never used to run a chip off the board.

author: DavidAlfa
author_rank: Super Contributor
timestamp: September 16, 2023, 05:25:43 pm
content: First connect vdd and gnd directly to power. Then try making the stlink talk to it.It should really work like that.Make sureyou're connecting SWD to the right pins!

author: JimKnopf
author_rank: Frequent Contributor
timestamp: September 17, 2023, 06:55:38 pm
content: @DavidAlfa OK, i added VBAT and VDDA to VDD pins. Still no luck with pico/stm32f1-picopwner.QuoteBut, if i connect the STLinkV2 without the pico, i could start openocd and read the readprotection status (NRST and VDD connected to STLinkV2, GND and VDD disconnected from pico).QuoteSmall progress, chip seems to work. I was afraid i could have burned the chip during desoldering. I will try another breakout board with 64 pins. This one is for up to 100 pins. I double checked the wires. But maybe the board has an issue.

author: DavidAlfa
author_rank: Super Contributor
timestamp: September 17, 2023, 07:01:06 pm
content: The automatic debugger detection might mess things up, it does a closed loop checking for the debugger, waiting for 1 second between, but a check migh run while you're still messing with the wires and fail in the next step.Try this code at line 411:Original:Code:# Wait for debug probe to be connected to the STM32F1 targetprint("Waiting for debug probe to be connected...")wait_dbg_probe_connect()print("Debug probe connected to STM32F1 target")Modified:Code:# Wait for debug probe to be connected to the STM32F1 targetinput("Connect the debugger and press Enter")wait_dbg_probe_connect()print("Debug probe connected to STM32F1 target")So you must press enter to continue after connecting the debugger, the connection will be solid.Or, adding a delay after the debugger was detected to ensure everything is properly connected already:Code:# Waits until the debug probe is connecteddef wait_dbg_probe_connect():while not debug_probe_connected():time.sleep(1) # Wait for 1 second before retryingtime.sleep(2) # Wait for 2 second after detected

author: JimKnopf
author_rank: Frequent Contributor
timestamp: September 18, 2023, 07:47:50 pm
content: @DavidAlfa All the dump.py tweaks doesn't help. The problem seems to be in another direction. I swapped the chip to the 64pin breakout-board, wired up all connections. Same story. Then i tried this:1. Started dump.py2. Connected pico to USB3. Removed NRST from pico GPIO4 (yellow wire) and connected it to the STLinkV2 RST4. Connected the STLinkV2 to USBand the script started.When ordered to remove the STLinkV2 from target, i reconnected NRST to the pico first before removing the wires from STLinkV2.QuoteI compared voltage level on NRST pin, connected to pico vs. STLinkV2.NRST to STLinkV2 i read 3,26V whereas the pico has 1,17V. A bit too low i guess. But i don't know why. I tried another pico. Same voltage on this pin. Strange behavior.

author: DavidAlfa
author_rank: Super Contributor
timestamp: September 18, 2023, 08:01:49 pm
content: Mine sits at 2.7V, consuming 63uA. This is indeed very strange.Edit: It seems the Pico sets the inputs in pull-down mode by default. So this might explain it. Whe have the STM32 pullup fighting the Pico pulldown.Quick fix: Add a 1K pullup resistor between nRST and VDD. STM32's VDD, not PICO's! Otherwise it'll affect the voltage glitching.Proper fix:Correct this in code. But setting up the toolchain, fixing the usual 1834 errors to compile, which indeed happened, so f***m it I'm going to sleep, just use the resistor!

author: JimKnopf
author_rank: Frequent Contributor
timestamp: September 19, 2023, 04:29:53 pm
content: @DavidAlfa I added the two lines to attack.c and rebuild it. No errors during build (Arch linux).I tried both variants. With the pull-up resistor in place (tried 1k and 10k) it runs the script but fails at dump state with a timeout.QuoteUsing the fix with the two lines in attack.c, i get the same error. Even if i use both, attack.c fix and pull-up resistor, i get alway the timeout error. Only the voltage level varies. Maybe it's time to replace the chip to the Jabe board to test if it's still alive.

author: DavidAlfa
author_rank: Super Contributor
timestamp: September 19, 2023, 04:42:56 pm
content: Well, at least now nRST sits at 3.3V, right?I tried building in Ubuntu 23, cloning pico sdk, installing gcc-arm-none-eabi.I had to force the compiler or it wouldn't find it.Code:CC=arm-none-eabi-gcc CXX=arm-none-eabi-g++ makeNow all I get is missing _exit entry error.As I don't really need this, I refused to go further, I could see the usual Linux can of worms from miles away.Not another entire afternoon fixing stupid things missed by someone else!Are you sure the uart connection is ok and not reversed?If you have any usb-serial dongle, force boot0=1, connect vdd and check if stm32CubeProg detects the mcu in bootloader mode.It shouldn't erase anything!

author: JimKnopf
author_rank: Frequent Contributor
timestamp: September 19, 2023, 05:08:38 pm
content: @DavidAlfa Maybe you want to try my attack.uf2 file.

author: DavidAlfa
author_rank: Super Contributor
timestamp: September 19, 2023, 05:18:55 pm
content: As expected, CubeProg detects it and shows a readout protection warning.The new attack fw works perfect, now nRST idles at 3.3V as it should.Hmm... are you also connecting BOOT1 to VDD through a 1-10K resistor?BOOT1 is PB2, pin 20 (48-pin package) or pin 28 (64-pin).

author: JimKnopf
author_rank: Frequent Contributor
timestamp: September 20, 2023, 05:28:51 pm
content: @DavidAlfa I tried stm32cubeprogrammer with a UART debugger. It detects the chip and show up the same msg like in your example.I then connected oscilloscope probes to Boot0, NRST and TX to watch whats going on in the very moment i hit enter to dump the firmware. Colors are Boot0 = yellow, NRST = violett, TX = blue. It is possible, that TX logic level 0 is not as low as it needs to be to get accurate readings. There is a 0,78 V offset to 0 level.

author: DavidAlfa
author_rank: Super Contributor
timestamp: September 20, 2023, 05:53:19 pm
content: There's TX activity so it's definitely working!You're getting only timeout? Not even a byte read back?Are your sure TX and RX aren't swapped?GPIO0 goes to to STM32 pin 58, GPIO1 goes to 59.Also, did you join all the 5 VDD/VDDA and VSS/VSSA groups?There's a lot of noise, try adding a 100nF cap to STM32's VDD.Post a proper picture showing all the connections and setup!

author: JimKnopf
author_rank: Frequent Contributor
timestamp: September 20, 2023, 05:56:20 pm
content: @DavidAlfa Same story with another pico.

author: DavidAlfa
author_rank: Super Contributor
timestamp: September 20, 2023, 06:06:02 pm
content: Nah I don't think it's the pico! Must be something with the connections.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: September 20, 2023, 07:36:38 pm
content: @DavidAlfa Wait...what? USART1 pin 58/59? Thats not the default config and it's not in the dump.py instruction.I only tried this combination :USART1pico GPIO0 TX green to Pin43_PA10 RX stm32pico GPIO1 RX orange to Pin42_PA9 TX stm32orUSART2pico GPIO0 TX green to Pin17_PA3 RX stm32pico GPIO1 RX orange to Pin16_PA2 TX stm32orUSART3pico GPIO0 TX green to Pin30_PB11 RX stm32pico GPIO1 RX orange to Pin29_PB10 TX stm32Pin 58_PB6 / 59_PB7 didn't work.

author: DavidAlfa
author_rank: Super Contributor
timestamp: September 20, 2023, 08:43:50 pm
content: Ahh sorry I counted it wrong!PA9/PA10 pin numbers are 30/31 for 48-pin package, and 42/43 for 64-pin.I just noticed the picture in the repo is backwards! Should be:STM32 RX=PA10 (43) TX=PA9(42)GPIO0-->PA10 GPIO1-->PA9

author: JimKnopf
author_rank: Frequent Contributor
timestamp: September 21, 2023, 06:34:32 am
content: @DavidAlfa To me, this imagehttps://www.eevblog.com/forum/reviews/jabe-ud-1200-vs-jabe-ud-1200-pro-vs-jbc-cd-2sqe-need-firmware-for-ud-1200/?action=dlattach;attach=1879867;imageillustrates the finish of step 3, the end of stage 1 and the start of stage 2 described on github project page:https://github.com/CTXz/stm32f1-picopwner#step-3-exploit-firmware---stage-1The chip is recognized, rdp mode is detected, the target board exploit firmware is uploaded, the glitch is done and the chip is booting from flash because boot0 is low.I will paste a high resolution picture of the VDD and GND wires later. Maybe the last point of the troubleshooting listhttps://github.com/CTXz/stm32f1-picopwner#troubleshootingis the problem.The Jabe UD-1200 PRO board is from 2021.I will wire up a second breakout board and test the chip from older UD-1200 (non PRO) device.

author: DavidAlfa
author_rank: Super Contributor
timestamp: September 21, 2023, 08:39:40 am
content: But until the very last step, everything is done by the ST-Link, not using the uart pins

author: JimKnopf
author_rank: Frequent Contributor
timestamp: September 21, 2023, 05:11:30 pm
content: @DavidAlfa I got the dataI don't know why, i put the pico into a breadboard, reconnected wires and...it just worked like expected.Thank you again for your help and patience.

author: DavidAlfa
author_rank: Super Contributor
timestamp: September 21, 2023, 05:41:05 pm
content: Hurray! But... it's very likely that the fw is using more than 64KB, there's data until the very last byte.The target sram firmwarewill always read 64KB, it's hardcoded!So we need to recompile for 128KB, or patch the binaries...

author: JimKnopf
author_rank: Frequent Contributor
timestamp: September 21, 2023, 05:44:54 pm
content: Oh, so i just have to change it to 128? I modified all three 64u parts in main.c and recompiled.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: September 21, 2023, 05:59:01 pm
content: Done.

author: DavidAlfa
author_rank: Super Contributor
timestamp: September 21, 2023, 05:59:28 pm
content: Great!Edit:Humm for some reason DBGMCU_ID reads 0 when reading it from the target firmware so flash detection is not working.Edit2:However Flash Size Register does work, so I made a new PR.Flash size detectionTested working!Alsoadding a delay in the probe detectionmakes it work much better.I would have all kind of errors after connecting the debugger, like unknown RDP status, etc, because "sleep(1)" delay could end*now*, when you're still connecting the wires, making enough contact to detect it, but instantly fail in the next step because you're still moving them.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: September 21, 2023, 08:07:12 pm
content: I tried the 512u change in main.c and was waiting until now. I just watched the filesize. Around 3 MB now, it was still running. I stopped the process.

author: DavidAlfa
author_rank: Super Contributor
timestamp: September 21, 2023, 08:08:28 pm
content: Haha, ignore that previous crappy test. See my previous message with the updates.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: September 22, 2023, 07:38:17 am
content: @DavidAlfa Your changes working great. The only thing is, my wiring sometimes results in timeouts. I will use short dupont wires next time instead of the 30 cm antennas i use at the moment.Filesize 131072 bytes, FF's at the end. Looks pretty good.

author: DavidAlfa
author_rank: Super Contributor
timestamp: September 22, 2023, 07:46:31 am
content: Radio aficionados must be wondering why they're getting so much noise lately!Probably not problem for the 9600baud UART, but might with the SWD.Next step is to make the target fw compute and send a checksum, also dump.py, and compare both to ensure data is good.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: September 22, 2023, 08:05:25 am
content: Oh, yes the content is the same.I did it this time on another device (Chuwi LarkBox with Ubuntu on it), not on my Arch Notebook.Quote

author: JimKnopf
author_rank: Frequent Contributor
timestamp: September 22, 2023, 08:01:29 pm
content: I put another breakoutboard together with the second STM32F103RB6 from Jabe UD-1200 non-Pro device.This time i didn't use dupont wires to the pico but 7cm silicone flex wires, directly soldered to the board and pinheaders.No more timeouts and lower noise. 100% success rate at dumping.The only thing is, it does not stop at 131072 bytes. It reads more FF's and blow up the output file with this zeros. I stopped the process and cut the file after 128k.@DavidAlfa Did you do changes in targets.zip file on github? I just downloaded the file to test on my Arch Notebook.What can cause the not-stopping reading?

author: DavidAlfa
author_rank: Super Contributor
timestamp: September 22, 2023, 10:59:54 pm
content: It reads the size the STM32 reports! Can't read the picture, is it really a RB? Not RC or RE?Leave it running, it might be a 256 or 512KB part. Worry if you get more than 512KB!Yeah, the signals look much cleaner nowand nope!, I made no more changes since then.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: September 23, 2023, 05:50:31 am
content: @DavidAlfaI was probably too impatient. The chinese made RB type STM32F103 MCU seems not matching ST's specs.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: September 23, 2023, 06:50:40 am
content: Looks like a large block of data is identical in both firmwares at the beginning.At the end, the Pro has slightly more data. But not that much.

author: DavidAlfa
author_rank: Super Contributor
timestamp: September 23, 2023, 07:19:11 am
content: Doesn't seem fake, perhabs ST sold the same die as RB at certain moment.Now time to write the non-pro fw into the pro station!Even having the fw backup, I'd preserve the original stm32s, just in case, getting a new STM32F103RB for testing.If data after 128K is FF all the way to the end, trimming to 128K will probably work just fine.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: September 23, 2023, 09:04:04 am
content: I wanted to see if there is anything interesting in the code. I loaded the bin file into ghidra using the svd loader for stm32f103. It seems, if you represent the knowledge for reverse engineering on one single meter, i'm stuck at the second mm. I thought i could find text from menu or something else. Nothing obvious to see to me.@DavidAlfa I will look in my shelf if i have any spareparts with a STM32F103RB. If not, i will just flash the MCU from Pro device.No risk, no fun.

author: DavidAlfa
author_rank: Super Contributor
timestamp: September 23, 2023, 09:13:01 am
content: Also did I. I got the main function for both fw, but that was all.Ghidra didn't recognize some pointers automatically, that's why it doesn't make sense at first.Symbol Tree->Functions->there you have main.I'm not really interested in reverse-engineering the entire thing, I don't even own a Jabe!

author: JimKnopf
author_rank: Frequent Contributor
timestamp: September 23, 2023, 07:31:53 pm
content: I resoldered both STM32F103 to their boards. Both devices were working as expected with original firmwares and RDP still on.I used the JLink to disable RDP and to programm the Jabe UD-1200 PRO first. Quite easy with the 2x10 pinheader.QuoteAfter that, the device turned on and showed only the welcome screen. System doesn't start up. I tried all combinations on the buttons while starting the device, without success.I then tried to flash quick and dirty the eeprom in the PRO version with data from non-PRO Version using a pomona clamp. Unfortunately, this didn't work.I had to desolder the eeprom and programm with adapter instead of the easy way using a pomona clamp.The PRO then started, and i had english language.But i couldn't use the OK button. The OK button did the same as the down button. I was not able to use the menu.After reflashing both, eeprom and STM32f103 the PRO startet and i was able to use the OK button to use the menu. Picking up the T245 handle i could change temp. To my surprise, the device had the same temp limit on the tip like i had with the original firmware when using a T245 handle. Remember, the PRO came with T210 handle.So far, no luck with my idea just swapping the firmware and use the PRO with a T245 handle.The UD1200 non-PRO was my next victim. While the PRO showed me the welcome screen after flashing, the UD-1200 did nothing.Usually there is a beep when turning on the device. It was just dead. I also desoldered the eeprom like i did on the PRO. I programmed the eeprom with data from PRO eeprom.After that, the non-PRO device turned on and showed me the welcome screen but failed to start the system. The PRO firmware does not work on the non-PRO device. I reflashed the non-PRO firmware (while the eeprom still had it's data from PRO version) and the device starts as expected. Temperature on display matches the temp on the tip.The only thing was, the counter had zeros.Flashing is very easy once the RDP is turned off.If there is any brave UD-1200 owner with a newer firmware that supports the three temperature presets and is willing to extract the firmware and eeprom content please contact me.

author: yangzs
author_rank: Newbie
timestamp: September 26, 2023, 11:53:43 am
content: It's an honor to download your program. It would be even better if you could manually set the firmware length.Can designing such a circuit board work properly?

author: yangzs
author_rank: Newbie
timestamp: September 26, 2023, 12:07:49 pm
content: Can you make your project support the GD32F103 chip? Where do I need to modify to read the firmware of GD32F103?

author: JimKnopf
author_rank: Frequent Contributor
timestamp: September 26, 2023, 01:45:08 pm
content: @yangzs Your circuitQuotelooks perfect. It will work.A circuit design like in this pictureQuotecould be used for 48 and 64 pin together in one board.

author: yangzs
author_rank: Newbie
timestamp: September 26, 2023, 02:02:17 pm
content: If it can support GD32F103, it would be even more perfect. Can you give me some guidance?

author: DavidAlfa
author_rank: Super Contributor
timestamp: September 26, 2023, 02:09:50 pm
content: Quote from: JimKnopf on September 23, 2023, 07:31:53 pmI guess you''ll have to reverse engineer the schematic. Initially it might look similar, but have very different connections in the end.Perhabs a simple pullup resistor tells it to behave like a pro/non-pro.Go figure!

author: JimKnopf
author_rank: Frequent Contributor
timestamp: September 26, 2023, 02:51:00 pm
content: @yangzs The GD32F103 is pin compatible. Flashmemory has same start address. Flash memory size is bigger. Just try it. You may open a new thread in Microcontroller section if you need further advice.

author: yangzs
author_rank: Newbie
timestamp: October 05, 2023, 01:48:24 pm
content: The waveform is like this, and it can only read 2 bytes. What's wrong with this?

author: DavidAlfa
author_rank: Super Contributor
timestamp: October 05, 2023, 02:04:04 pm
content: What's going on? Last messages make no sense. Are you guys talking through PM?

author: yangzs
author_rank: Newbie
timestamp: October 05, 2023, 02:14:47 pm
content: It's already evening nowOnly two bytes can be read outI should do this

author: JimKnopf
author_rank: Frequent Contributor
timestamp: October 05, 2023, 02:15:51 pm
content: @DavidAlfa No PM. He tries to hijack the thread or focus on STM32F103 comparable chips. Has nothing to do with the Jabe topic. I recommended to @yangzs to open a new thread in Microcontroller for further advice.

author: DavidAlfa
author_rank: Super Contributor
timestamp: October 05, 2023, 02:30:52 pm
content: Hah! Unbelievable.yangzsgo ask elsewherewhere they talk about GD32, or make your own thread!Spamming a random STM32 thread asking for this makes no sense at all.

author: yangzs
author_rank: Newbie
timestamp: October 05, 2023, 03:01:39 pm
content: @JimKnopf I mentioned it's also TM32F103RE，sleep_ms(15); Change to 30 Everything Okay。

author: DavidAlfa
author_rank: Super Contributor
timestamp: October 05, 2023, 04:42:46 pm
content: Ah,ok, soit was related, attacking a GD32 . My apologies.Yeah GD32 load the firmware from the external flash so it takes longer to boot.

author: balu.2019@gmail.com
author_rank: Newbie
timestamp: January 08, 2024, 09:51:33 am
content: Hi Jim,I was struckup in the below step after transferring IC (STM32F103C8) to the breakout board.Info : STLINK V2J42S7 (API v2) VID:PID 0483:3748Info : Target voltage: 3.213132Error: init mode failed (unable to connect to the target)i tried the connectios as per attahced, but still no luck.Could you please help me on the connectionsRegards,Balakrishna

author: JimKnopf
author_rank: Frequent Contributor
timestamp: January 08, 2024, 11:16:51 am
content: Have a look at my posthttps://www.eevblog.com/forum/reviews/jabe-ud-1200-vs-jabe-ud-1200-pro-vs-jbc-cd-2sqe-need-firmware-for-ud-1200/?action=dlattach;attach=1881895In the top right corner you can see the connection to the ST-Link adapter. Be aware you have to connect the all GND pins together and also connect all Vcc pins to 3,3V as shown in my picture.

author: balu.2019@gmail.com
author_rank: Newbie
timestamp: January 09, 2024, 06:00:06 pm
content: Hi Jim,Thanks for the info, I have connected as per you suggestion (connected all GND pins together and also connected all Vcc pins to 3,3V)howerver I am gettingTimeout : No data recieved from Target.Could you please help on this.Regards,Balakrishna

author: JimKnopf
author_rank: Frequent Contributor
timestamp: January 09, 2024, 09:01:14 pm
content: Did you notice the two pull-up resistors? If i remember correctly, the value was 10k.

author: balu.2019@gmail.com
author_rank: Newbie
timestamp: January 10, 2024, 10:05:12 am
content: Hi Jim,Yes, I have used 1K resistors, but still same errorTimeout : No data recieved from Target..for Vcc pins I am using the STLink v2 power (3.3v) , but getting only 2.7v to the IC pins, will it be the issue?Regards,Balakrishna

author: JimKnopf
author_rank: Frequent Contributor
timestamp: January 10, 2024, 11:15:30 am
content: Scroll through the messages on page 2. I had same error until i used a pullob resistor on nrsthttps://www.eevblog.com/forum/reviews/jabe-ud-1200-vs-jabe-ud-1200-pro-vs-jbc-cd-2sqe-need-firmware-for-ud-1200/msg5047624/#msg5047624

author: alexgubanow
author_rank: Newbie
timestamp: February 18, 2024, 09:54:41 pm
content: hello everyone, i do have jabe ud-1200 for already few years, bought from banggood with English firmware.Recently it has switched to Chinese on it is own and i have no idea how to switch it back...Any ideas? What are the chances of language setting being stored in eeprom?

author: JimKnopf
author_rank: Frequent Contributor
timestamp: February 19, 2024, 06:09:38 am
content: @alexgubanowI'm pretty sure the settings are stored in Eeprom. Can you share a dump of your eeprom?What firmwareversion does your UD-1200 has? Can you post the service manual? Is there an option for language settings?

author: balu.2019@gmail.com
author_rank: Newbie
timestamp: February 21, 2024, 10:45:02 am
content: Hi,I am able to get the bin file for F103, can i use same for STM32F2 series as wellThanks & Regards,Bala

author: JimKnopf
author_rank: Frequent Contributor
timestamp: February 21, 2024, 11:07:16 am
content: @balu.2019@gmail.com Please respect the forum rules and create a new topic in microcontroller section.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: April 02, 2024, 08:10:40 pm
content: After a while, i reviewed the PCB's and just found the different between the two PCB'S, the UD-1200 and the UD-1200 Pro. It's resistor R41, 2,2 kOhm (222 top marking).R41 is present at the UD-1200 PCB. The pads are unpopulated on the UD-1200 Pro PCB.After placing a 2,2 kOhm resistor to the Pro PCB, flashing the UD-1200 firmware, it starts as a UD-1200 with full temperature on T-245 handle. The T-210 handle is not recognized when R41 is soldered.

author: DavidAlfa
author_rank: Super Contributor
timestamp: April 02, 2024, 10:37:06 pm
content: So it's possible after all?

author: JimKnopf
author_rank: Frequent Contributor
timestamp: April 10, 2024, 05:51:06 pm
content: @DavidAlfa Sorry for my late response. I managed to burn Q12 somehow. It's a PNP transistor (2F marking). I was waiting for the part. Q12 switches negativ voltage to the two LM358. Has something to do with detecting a tool plugged in and temperature adjustment for the tip. After replacing Q12 i could make an image.To answer the question, yes, it works. Both devices are now fully working UD-1200 with T245 handles at full heat.Now i just need a newer firmware. I'm in contact with someone willing to grab the firmware from his newer UD-1200.

author: Vasil78
author_rank: Contributor
timestamp: September 07, 2024, 06:31:26 am
content: Good day forum members! Tell me how to fix the breakdown of jabe ud 1200. It hangs on, welcome and I can’t do anything. Can you tell me where to get the firmware for this device? Thank you.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: September 07, 2024, 07:02:27 am
content: @Vasil78 What is the Firmwareversion of your UD 1200?I would suggest desoldering the Eproms, readout/save the content for backup and clear the Eprom. Try to start the device with an empty Eprom.Usually you can't corrupt the data inside the STM32F103 because the MCU is write protected.

author: Vasil78
author_rank: Contributor
timestamp: September 07, 2024, 08:34:49 am
content: I don't know what firmware version it isThank you, I'll just try and see what will happen if I clear EEPROM?

author: JimKnopf
author_rank: Frequent Contributor
timestamp: September 07, 2024, 10:13:12 am
content: @Vasil78 First you have to save a backup before clearing the Eprom. You know what admins tell you? No backup? No pity!

author: Vasil78
author_rank: Contributor
timestamp: September 07, 2024, 12:06:25 pm
content: eeprom counted but can't erase flash drive

author: JimKnopf
author_rank: Frequent Contributor
timestamp: September 07, 2024, 12:41:26 pm
content: Did you desolder the eprom and read it with external eprom reader like T56 or RT809H? Show me an image of the eprom (to read the marking).

author: Vasil78
author_rank: Contributor
timestamp: September 08, 2024, 04:41:04 am
content: I read it TL866 2 plusI can't attach a file, it gives an error

author: JimKnopf
author_rank: Frequent Contributor
timestamp: September 08, 2024, 05:26:52 am
content: @Vasil78 An image should not exceed the limit for a single file of 8 MB or up to 10 images and 8 MB for all the images. If you wan't to upload a bin file, rename it to .txt extension.

author: Vasil78
author_rank: Contributor
timestamp: September 08, 2024, 05:43:49 am
content: Here it is

author: JimKnopf
author_rank: Frequent Contributor
timestamp: September 08, 2024, 06:21:39 am
content: @Vasil78I guess the Eprom is a ATMLHxxx 08CM?Did you read out as AT24C08C?When erasing, what voltage to you have on WP Pin-7?

author: Vasil78
author_rank: Contributor
timestamp: September 08, 2024, 06:58:18 am
content: I guess the Eprom is a ATMLHxxx 08CM? yes, that's rightDid you read out as AT24C08C? flashed as AT24C256B it seems to be an analogue of EEPROM my programmer can not determine the name of the chipWhen erasing, what voltage to you have on WP Pin-7? when rewriting there is nothing 0but eeprom is overwritten without error

author: JimKnopf
author_rank: Frequent Contributor
timestamp: September 08, 2024, 07:23:36 am
content: @Vasil78 0 V on WP is ok, should be pulled down to GND for write operation. The manual says 08C only uses A2. A0 and A1 are ignored and can be connected to GND.

author: Vasil78
author_rank: Contributor
timestamp: September 08, 2024, 07:32:03 am
content: That's right, that's what I do

author: Vasil78
author_rank: Contributor
timestamp: September 08, 2024, 07:53:08 am
content: What to do next?

author: JimKnopf
author_rank: Frequent Contributor
timestamp: September 08, 2024, 10:44:16 am
content: @Vasil78 I attach my Eprom readout (2 files). You can try that.I would start with the ATMLH028_AT24C256_readout_Jabe_UD-1200_20230924-T56.BINTry flashing that content and resolder the Eprom. I would inspect boot process with a Logicanalyzer/Oscilloscope on the Eprom if data is read properly during boot process.Did you try to start with the tool disconnected? A message should appear on Display "No tool found".

author: Vasil78
author_rank: Contributor
timestamp: September 08, 2024, 11:11:07 am
content: your firmware does not flash, it gives an error, although it reads the native one from my EEPROM and also flashes it without errors, it’s somehow strange.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: September 08, 2024, 11:14:04 am
content: I assume the content just remains on your Eprom. You wrote earlier that you can't erase the content. Can you provide a logfile from flashing process? What are the steps that are sucessfully done by your TL866II+?

author: Vasil78
author_rank: Contributor
timestamp: September 08, 2024, 11:27:06 am
content: Yes, it is true that it does not erase the flash, but the erase button is not active.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: September 08, 2024, 11:31:49 am
content: @Vasil78 seems the AT24C08C is not supported by the TL866II+http://www.xgecu.com/MiniPro/TL866II_List.txtIt is supported by RT809H. I checked on my T56, and it is also not in the supported device list. I remember that i tried different programmers.

author: Vasil78
author_rank: Contributor
timestamp: September 08, 2024, 11:49:42 am
content: It's clear that the problem is with the programmer. It looks like tomorrow I'll try to borrow a T56 from a friend. We'll think about it further. Thank you very much for your time. I'll write tomorrow.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: September 08, 2024, 11:55:34 am
content: As far is i know, the RT809 (F or H) is very common in your country. Maybe you find someone near you. Otherwise, just buy a new AT24C08C and try starting with a empty one.

author: DavidAlfa
author_rank: Super Contributor
timestamp: September 08, 2024, 11:07:30 pm
content: Quote from: JimKnopf on September 08, 2024, 05:26:52 amJust zip the file instead wasting forum space.

author: Vasil78
author_rank: Contributor
timestamp: September 11, 2024, 03:33:37 am
content: Good afternoon, I bought a new eeprom and installed it, no results, everything is the same

author: JimKnopf
author_rank: Frequent Contributor
timestamp: September 11, 2024, 03:54:11 am
content: @Vasil78 Can you provide an image of the new Eprom marking?

author: Vasil78
author_rank: Contributor
timestamp: September 11, 2024, 04:12:53 am
content: Exactly like this

author: JimKnopf
author_rank: Frequent Contributor
timestamp: September 11, 2024, 04:14:42 am
content: @Vasil78 Did you try to flash/burn my content i mentioned some posts earlier?

author: Vasil78
author_rank: Contributor
timestamp: September 11, 2024, 04:19:01 am
content: Yes, I tried the same thing, it doesn’t work, but I flashed it with my programmer and haven’t found another one yet

author: Solid_snake
author_rank: Newbie
timestamp: January 19, 2025, 01:20:20 pm
content: Hi, @jimKnopf I made same mistake I bought the c210 station mine is XZZ FX-210 wich is the same as the jabe pro versionIt is frustrating to be limited to 30wI would really appreciate if you could share the ud 1200 firmware so I can reprogram my station.Thanks

author: JimKnopf
author_rank: Frequent Contributor
timestamp: January 19, 2025, 02:45:40 pm
content: @Solid_snake I send you a link via PM. Please check your Inbox.Good luck. Please make a backup of your Eeprom and firmware first.You know what the Admins say: No backup, no pity.

author: Solid_snake
author_rank: Newbie
timestamp: January 19, 2025, 03:12:13 pm
content: thx u much respect

author: DavidAlfa
author_rank: Super Contributor
timestamp: January 22, 2025, 12:20:08 pm
content: Hi, did you try placing R41 with the Pro firmware?We have a FX-210 at work we don't use (We need C245 power), I opened it and it seems the same as your Pro model, with R41 unpopulated.Now I wonder if all it needs is R41 to work, or also the full firmware?Edit: The temperature works (It's much lower without R41) but it's still limiting the power, so I'll flash it with the 1200 fw.Edit2: I can't find the jabe 1200 fw anywhere in this thead?

author: JimKnopf
author_rank: Frequent Contributor
timestamp: January 22, 2025, 07:28:38 pm
content: @DavidAlfa Please check your PM.

author: DavidAlfa
author_rank: Super Contributor
timestamp: January 22, 2025, 11:20:40 pm
content: Thanks!Are these eeproms ok for it?Quote from: JimKnopf on September 08, 2024, 10:44:16 am

author: JimKnopf
author_rank: Frequent Contributor
timestamp: January 23, 2025, 05:04:44 am
content: @DavidAlfa Please first try with your original Eeprom and show the results.If that fails, then try the content from my file you mentioned in your last post.Good luck.

author: DavidAlfa
author_rank: Super Contributor
timestamp: January 23, 2025, 08:58:52 am
content: Hey, your EEPROM dumps are wrong, it's a 24C08, not 24c256, can be clearly seen in the original pictures.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: January 23, 2025, 09:51:16 am
content: @DavidAlfa You're right. The ATMLH028 08CM is a 24C08CFilesize should be 1k not 32k (00000000 to 000003F0). I can't remember how i did that mistake. In my notes, i onced wrote 24C256C.I have 2 1k files from early last year. I will read the eeproms later this day again.

author: DavidAlfa
author_rank: Super Contributor
timestamp: January 23, 2025, 11:10:34 am
content: The 24C256 uses 2 bytes for addressing, the 24c08 only one, thus reading the 08 as a 256 will lead to bad data for sure.Otherwise, reading a small chip as a larger model (Both with same addressing mode) will rollover and repeat the data, but give good data after all.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: January 23, 2025, 03:24:58 pm
content: @DavidAlfa Here is the readout from UD-1200 Eeprom. I did it with the RT809H programmer because the 24C08C was listed in the supported chip db. The Batronix BX48 II and the T56 only have 24C08, 24C08A or 24C08B. I don't know if that makes any different. The data looks like the same i read before. So i guess there is only variable temp setting or somthing stored on the eeprom.

author: DavidAlfa
author_rank: Super Contributor
timestamp: January 23, 2025, 04:29:19 pm
content: Thanks!As far as I know there's no difference in protocol or capacity, maybe lower power consumption, faster speed, different working voltage, temperature range...The data looks pretty different fromthese dumps...

author: DavidAlfa
author_rank: Super Contributor
timestamp: January 24, 2025, 06:40:31 am
content: I noticed that the station randomly booted in chinese and english when using the wrong EEPROM , so definitely the languages can be changed somehow.With your last dump it's always in chinese?

author: JimKnopf
author_rank: Frequent Contributor
timestamp: January 24, 2025, 06:52:35 am
content: My UD-1200 has an english menu.

author: DavidAlfa
author_rank: Super Contributor
timestamp: January 24, 2025, 07:45:11 am
content: The solution: just erase the eeprom, it'll load the default settings and boot in English.It only holds the menu settings.Your last eeprom dump seems wrong too?Mine starts with "AA 55" (Also did the UD1200 after erasing the EEPROM) , yours is missing the first byte and lacking the last one in the data block.If you group the data in 2 bytes you'll see they're 16-bit integers containing the menu data, max power, max temp, etc.There's a newer UD-1200 with v3.02.02 firmware, it's the same thing but adds fast temperature switching/presets.The 210s have much newer fw, I wonder if I can overcome the power limit by modifying the fw.Also, I tried modifying the EEPROM data.Power limit is byte at 0x0B, it's set to 0x1E(30 decimal) in 210 stations and 0x83(130 decimal) in 245 ones.Setting this byte to 0x82 in 210 fw effectively unlocks all the power!There's a catch, if you lower the power in the menu or perform a factory reset you'll lose it.I'll try to patch the firmware to unlock the power!This 210 has 2022/06/23 SD-v3.02.04 fw.Did your 1200 pro and non-pro came with the same fw version?If so, it should very easy to perform a diff of them and see the differences!

author: JimKnopf
author_rank: Frequent Contributor
timestamp: January 24, 2025, 07:49:36 am
content: @DavidAlfa Does the T245 handle work with full heat now?

author: DavidAlfa
author_rank: Super Contributor
timestamp: January 24, 2025, 09:43:18 am
content: Yes (But needs R41 obviously)

author: JimKnopf
author_rank: Frequent Contributor
timestamp: January 24, 2025, 12:04:13 pm
content: @DavidAlfaUD-1200 has SD-V3.02.01, Date 2020/01/03UD-1200 Pro has SD-V3.02.03, Date 2012/07/26

author: DavidAlfa
author_rank: Super Contributor
timestamp: January 24, 2025, 01:16:01 pm
content: I'd say we upload all the firmwares here.After all, it can only be used in these stations!

author: DavidAlfa
author_rank: Super Contributor
timestamp: January 24, 2025, 11:31:07 pm
content: I found the way to switch the language!Hold both arrow buttons down, turn on the station, count 2 seconds, then quickly release the buttons and hold OK until the screen shows up.FYI, the screen uses the same command set as a PCF8814.I also found the logo locations and format! There're two of them (For each language).They can be found by searching these patterns (Use HxD):English:Code:00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 E0 E0 20 E0 E0 20 E0Chinese:Code:00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 A0 A0 20 20 20Note down the offsets where the pattern starts.Make a 128x64 monochrome BMP in Paint or whatever, then upload it here:https://javl.github.io/image2cpp/- Tick "Invert image colors".- Draw mode: "Vertical - 1bit per pixel".- Click "Download as binary".You should get a file sized exactly 1KB.Open it in HxD, copy everything, open the fw file, go to the offset position, right-click over it and press Control+B (Paste writing).Save and flash!

author: DavidAlfa
author_rank: Super Contributor
timestamp: January 25, 2025, 03:32:30 am
content: Got it! It's hardcoded in a cpu instruction, after patching it effectively unlocks 130W.I spent about 8 hours reverse-engineering this, so I'll post the Ghidra project for everyone, it would be a waste to simply forget it.It has plenty of functions and variables identified, I also added the entire memory map by hand!The menu has also been analyzed and commented.Everything is made of pure bitmaps, there aren't text strings anywhere.Limit patch:Defaults patch:Attaching the firmwares, it includes original 245, 210 and modded 210 for 130W (Newer FW version).If you flash this: The EEPROM is not important, if you're having issues simply erase it.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: January 25, 2025, 06:43:18 am
content: @DavidAlfa Fantastic!You are great! I am very impressed. Very cool.

author: DavidAlfa
author_rank: Super Contributor
timestamp: January 25, 2025, 10:33:43 am
content: The v3.02.04 fw is included in the file, so give it a try!Can you post a image comparing the transformers?Because the one from the 210 has a a very obvious "30W" label on it!I know, you won't put that power for more than 10-20 seconds at most, it'll be in the stand or flying in the air most of the time, 130W is only applied for very short peaks.Finally: There's no need to remove the stm32, I connected it like this and I could perform the attack, extract the firmware and program without issues.It was solely powered by the Rpi Zero pin.Quote from: JimKnopf on April 02, 2024, 08:10:40 pmIt did for me, using the UD-1200 FW.I accidentally plugged the 210 instead the 245 and went peach orange in just 3 seconds...Are you 100% sure R41 is 2K2?I didn't try with the 210 fw.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: January 25, 2025, 08:11:33 pm
content: @DavidAlfa I should have weighed the two devices at the beginning. They look almost the same inside. However, the UD-1200 is 197 grams heavier than the UD-1200 Pro. If you look closely, you can see the windings on the transformer of the UD-1200 (left one). They are not visible on the UD-1200-Pro (right one with the 220V sticker). They end at the edge of the metal core. The transformer of the UD-1200 has a little more copper on it. The Ohm and Henry values are very similar.

author: DavidAlfa
author_rank: Super Contributor
timestamp: January 25, 2025, 09:30:26 pm
content: Hmm so not that good after all.I wonder how it'll do in the medium-long term.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: January 25, 2025, 09:33:20 pm
content: @DavidAlfa R41 is the same value as R42, 222 marking code which is a 2.2k Ohm resistor.

author: DavidAlfa
author_rank: Super Contributor
timestamp: January 25, 2025, 10:58:52 pm
content: Thanks.Could you measure the voltages on the secondaries?I wonder how different they are.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: January 26, 2025, 06:22:05 pm
content: @DavidAlfa The differenz is very small. I would say it's nearly the same. Both with the T245 handle plugged in at 350°C. Temp measurement with the RST FG-100 was the same 344°C on both devices which depends on my Tip.

author: DavidAlfa
author_rank: Super Contributor
timestamp: January 27, 2025, 07:39:25 am
content: Thanks! If the transformer was really struggling the voltage would drop a lot.Will have a more detailed look laterEdit: did you check under load?

author: JimKnopf
author_rank: Frequent Contributor
timestamp: January 27, 2025, 12:06:33 pm
content: @DavidAlfa Yes, i tested with a hot tip at 350° both (under load).

author: Solid_snake
author_rank: Newbie
timestamp: February 02, 2025, 05:19:14 pm
content: thank again guys for your researchit worked well by flashing the fw and placing R41

author: JimKnopf
author_rank: Frequent Contributor
timestamp: March 31, 2025, 07:31:10 pm
content: I received from a UD-1200 the firmware 3.02.02 from a brave member who answered to my initial question for this firmware. Thanks to the image from @DavidAlfa, he was able to do download the file without desoldering the Chip. He did it on WSL (Ubuntu).I flashed it and tested it. Works fine on both devices.@DavidAlfa I was asked, if the trick will work on a STM32F0 or AT32f421. These MCU are used on a Atten ST-862D Hotair Station. I have the STM32F0 version, one of the first devices in the market i guess. The brave board member has a AT32f421 in his device. Seems pin compatible. I will start a new topic for that:https://www.eevblog.com/forum/reviews/atten-st-862d-firmware-(st32f0-and-at32f421-version)/

author: DavidAlfa
author_rank: Super Contributor
timestamp: March 31, 2025, 09:41:19 pm
content: Totally different mxu and firmware, so no, it won't.Also, you need to read the original firmware first, which might not be possible if the mcu is locked.