Brother (possibly also some Bernina) embroidery machine memory cards - Page 1
Forum section: electronics / general

author: MarkMLl
author_rank: Frequent Contributor
timestamp: November 06, 2020, 10:32:51 am
content: Current Brother/Bernina domestic sewing and embroidery machines have a slot for a memory card, and a USB host connector into which a standard Flash stick can be plugged.Older machines only have a card slot, and transferring embroidery instructions from a PC (e.g. prepared using Inkscape/Inkstitch) to the machine relies on having a special memory card and a card writer... both of which are scarce and expensive.I have seen a number of questions before relating to these cards and readers, but it seemed that nobody made much progress. I now have a sacrificial card (not part of a burnt offering) over which I have been waving test probes and magnifier.The card is 40-pin, not 41-pin as sometimes reported. The connector is an AMP 175564 with 1mm pitch, it's comparable with a single row of a PCMCIA connector. One of the "ears" at the end is slightly thinner than the other, and this identifies pin 1.Most of the pins connect both to the chip (a die under an epoxy blob) and to tracks cut when the PCB was guillotined to size. The pin layout corresponds roughly to the die, i.e. it's either an ASIC or Brother selected a type of chip when they first specified the slot and has been able to continue sourcing it.I've not got an extender so so far at least haven't been able to tack testgear onto it, and without having done that I'm not going to guess which power connection is Vcc and which 0V.This is where I'm at with pin functions:Code:1 to pin 40 (presence detection?)2 power (also pin 39), copper fill on front of PCB3 power (also pin 38), copper fill on back of PCB4 n/c5 unpopulated R, other end off-board6 R, chip, off-board7 R, chip, off-board8 R, chip, off-board9 R, chip, off-board10 n/c11 R, chip, off-board12 R, chip, off-board13 R, chip, off-board14 R, chip, off-board15 R, chip, off-board16 R, chip, off-board17 n/c18 R, chip, off-board19 R, chip, off-board20 R, chip, off-board21 R, chip, off-board22 R, chip, off-board23 R, chip, off-board24 R, chip, off-board25 R, chip, off-board26 R, chip, off-board27 R, chip, off-board28 R, chip, off-board29 R, chip, off-board30 R, chip, off-board31 R, chip, off-board32 R, chip, off-board33 off-board34 R, chip, off-board35 R, chip, off-board36 R, chip, off-board37 R, chip, off-board38 power (also pin 3)39 power (also pin 2)40 to pin 1 (presence detection?)So that's about 29 logic connections plus power, which I think is compatible with there being an IDE controller (without DMA etc.) plus storage under the blob.Contributed in the hope that this is useful to somebody at some point.MarkMLl

author: amyk
author_rank: Super Contributor
timestamp: November 07, 2020, 03:09:35 am
content: Could you post some pictures?What's the approximate capacity of the card?If I were to take a wild guess, I would go with parallel NOR flash or even NAND flash (if capacities are high).Opening up the machine and seeing what traces go where would also help, as would the reader/writer.

author: james_s
author_rank: Super Contributor
timestamp: November 07, 2020, 04:15:27 am
content: IDE seems unlikely, I'd expect it to be some kind of bare ROM. My partner has a Bernina embroidery machine that belonged to my grandmother, I think it uses the same type of cards. I recall if we have the reader, we have the software but the dongle was lost somewhere in the process of cleaning out the house and dividing things up after she passed away. I'd love to find a crack for that, I'm not inclined to give Bernina more money when my grandmother already paid a fortune for it.

author: helius
author_rank: Super Contributor
timestamp: November 07, 2020, 04:30:43 am
content: Many of these old machines used BeeCards or JEIDA cards.

author: MarkMLl
author_rank: Frequent Contributor
timestamp: November 07, 2020, 09:02:20 am
content: Quote from: helius on November 07, 2020, 04:30:43 amWp shows the Beecard to have sliding contacts, and JEIDA is described as being variously 88 or 68 pins.MarkMLl

author: MarkMLl
author_rank: Frequent Contributor
timestamp: November 07, 2020, 09:12:20 am
content: Quote from: james_s on November 07, 2020, 04:15:27 amMy initial expectation was SPI or similar, with factory programming done using parallel connections via the PCB traces which were guillotined. However finding that all the traces that came off the die were in fact wired to the external connector argued against the interface being serial, and the fact that there aren't enough signals to provide addressing for a Flash device without surrounding glue logic argued against this being a trivial memory bus.Hence my working hypothesis that it's a small IDE device.MarkMLl

author: MarkMLl
author_rank: Frequent Contributor
timestamp: November 07, 2020, 09:23:13 am
content: Quote from: amyk on November 07, 2020, 03:09:35 amThis is a ROM with unknown capacity. I don't have- and don't need so won't be buying- a writer.As I've written in a different post, there are too many wired pins for this to be a serially-accessed memory device, and too few for it to be parallel-accessed unless there are lots of address latches on the die.I'm not opening the machine, unless somebody can provide a service manual (Brother Innovis 97E) so that I can see where the access screws are (and would be reluctant even then: it goes out on loan to various people with the intention of making money).I'll tack on photos of the card later, but I don't think we'll get much further unless I make up an extender (which isn't going to happen this week).Later: photo of front of card appended. Not brilliant I'm afraid (currently without a macro lens) but shows pin count and orientation.Can't append back of card, get "Your attachment has failed security checks and cannot be uploaded. Please consult the forum administrator."MarkMLl

author: amyk
author_rank: Super Contributor
timestamp: November 07, 2020, 11:52:45 pm
content: Is this a writable card, or is it purely read-only?NAND flash uses a multiplexed interface and would fit in the pin count you noted, as would a small parallel one.

author: MarkMLl
author_rank: Frequent Contributor
timestamp: November 08, 2020, 09:24:22 am
content: Quote from: amyk on November 07, 2020, 11:52:45 pmI've already said- in response to one of your messages- that it's a read-only card.MarkMLl

author: james_s
author_rank: Super Contributor
timestamp: November 08, 2020, 07:16:01 pm
content: I just took a look at the Bernina machine last night and the connector in the slot has 2 rows, it looks very much like PCMCIA. I have no idea if it's proprietary or used on other brands.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: November 08, 2020, 07:25:14 pm
content: PCMCIA memory cards are electrically compatible with CF cards - you can get adapters which I think have no active components inside. CF is basically IDE AFAIKThe guillotined-off section may just be for gold plating - some plating processes need all the copper to be electrically connected - it's common to see guillotined off or drilled tracks on consumer gear with blobbed-over chips on board

author: MarkMLl
author_rank: Frequent Contributor
timestamp: November 08, 2020, 07:25:55 pm
content: Quote from: james_s on November 08, 2020, 07:16:01 pmDefinitely not what I've got here then. I wonder whether some Bernina machines aren't made by Brother?Looking in through the Brother slot I can definitely only see a single row of pins. As I've said though I'm very reluctant to try disassembling it: I tried to take part of the cover off when I thought I'd got an intransigent bobbin-winder tangle and suspect that there might be hidden screws (i.e. under decorative panels).Later: I've found a picture on eBay of a card which is definitely PCMCIA, identified as "Bernina OESD Embroidery Magic Card 2 Rewritable Compatible w/ Deco Pfaff Arista".The other cards (1x40 pins) are typically something like "BROTHER: ULT2002D, ULT-2001, PC-8500, PC-8200, PC-7500, PC-7000, PC-6500, PE400D, PE-300, PE-200, PE180D, PE-150, PE-100, BERNINA DECO: 500, 600, & 650, BABYLOCK: E-60, Ellageo 1 & 2, ESE, ESE-2, ESi, ESi2, EM1, EM2, EAC-Accent, SIMPLICITY: SE1 SE2 & SE3, WHITE 3300Viking #1+, Rose, Iris, Scandinavia, orchidea". It's one of these that's the current topic of discussion.The file formats are well understood and there is no explicit size limitation, a program such as Ink/stitch can output a .pes file which can be used on anything from a small domestic machine to a big multi-needle commercial one.MarkMLl

author: MarkMLl
author_rank: Frequent Contributor
timestamp: November 08, 2020, 07:33:46 pm
content: Quote from: mikeselectricstuff on November 08, 2020, 07:25:14 pmYes, plating is a possibility that hadn't particularly occurred to me. Definitely not a physical CF connector though: this is 1x40 rather than 2x25.pinouts.ru doesn't have anything useful under 40-pin connectors.MarkMLl

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: November 08, 2020, 08:44:32 pm
content: Quote from: MarkMLl on November 08, 2020, 07:33:46 pmI realise that - just mentioned it as PCMCIA memory cards are hard to find, but CF+adapter is a more available substitute if it did turn out to be PCMCIA.If there aren't enough pins to be a simple ROM., a possibility is something designed for 8051s, where the data and 8 bits of address were shared, using an 8-bit latch.Knowing the vintage of the machine - range of dates when it was manufactured, that would give some useful info, as it's almost certainly using a standard-ish part of the era

author: drussell
author_rank: Super Contributor
timestamp: November 08, 2020, 08:53:24 pm
content: Quote from: james_s on November 07, 2020, 04:15:27 amI have one of the early parallel-port dongles around here somewhere.I might well be able to reverse engineer it if I can dig it up around here at some point.

author: MarkMLl
author_rank: Frequent Contributor
timestamp: November 08, 2020, 09:24:31 pm
content: Quote from: mikeselectricstuff on November 08, 2020, 08:44:32 pmThe card format appears to have been used for quite a long time. This particular machine is an Innovis 97E (NV97E, 885-V55) and has both card slot and USB host (into which a thumb drive can be plugged), but the card goes back to machines which didn't have USB (hence various people's comments about a special writer). There's no FCC code which might have traced through to something useful, and no date that I can find in the manual, but I think it was still being retailed in 2017.The chip is a die under a blob of epoxy. However it's a very square blob of epoxy with a flat top and the PCB is sufficiently transparent that from the rear one can see that the connections are fairly evenly disposed, so I think it's a single die rather than multiple... I'm not sure whether that points to a combined IDE+Flash or argues against it.I don't particularly need an answer to this, I got a card specifically since I knew that the question had been asked before... quite possibly by people who didn't have as many channels on their logic analyser as I have (I'm not boasting, it's a clunker but I got it specifically for this type of job). I've got wire fine enough to solder into the vias, so rather than needing an extender I think I could probably build out the back of the card for test probes.MarkMLl

author: MarkMLl
author_rank: Frequent Contributor
timestamp: November 08, 2020, 09:28:34 pm
content: Quote from: drussell on November 08, 2020, 08:53:24 pmThat would be useful, but I think that the first thing to check is the pin layout in case there's multiple possibilities.I think the defining features of the card I'm looking at is a 1x40 connector, plus a logic signal for presence detection on either pin 1 or pin 40 (i.e. these are /not/ both power).MarkMLl

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: November 08, 2020, 10:13:43 pm
content: Quote from: MarkMLl on November 06, 2020, 10:32:51 amWith that many pins, a simple parallel ROM/EPROM/Flash is entirely possible 8 data + 19 address + select +r/w

author: drussell
author_rank: Super Contributor
timestamp: November 08, 2020, 10:19:41 pm
content: Quote from: mikeselectricstuff on November 08, 2020, 10:13:43 pmI expect that they're parallel ROM and EEPROM for the writable ones, as I'm pretty sure the original design is old enough that it predates FLASH.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: November 08, 2020, 10:30:29 pm
content: Quote from: drussell on November 08, 2020, 10:19:41 pmIf it is that old, then simple parallel rom/eprom is pretty much the only option available at the time. Should be easy enough to figure out with some scoping

author: james_s
author_rank: Super Contributor
timestamp: November 09, 2020, 12:36:28 am
content: Quote from: mikeselectricstuff on November 08, 2020, 10:13:43 pm64KB, not much by modern standards but probably more than enough for any reasonable embroidery pattern. A good start might be to find one of the files that would go on the card and see how big it is.

author: MarkMLl
author_rank: Frequent Contributor
timestamp: November 09, 2020, 08:00:25 am
content: Quote from: james_s on November 09, 2020, 12:36:28 amAccording to the manual, designs of up to 512Kb may be transferred into the machine. I notice some rewritable cards labelled as "4M" but it's unclear whether this is a size or just a model number.MarkMLl

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: November 09, 2020, 09:33:42 am
content: Quote from: james_s on November 09, 2020, 12:36:28 am19 address lines gives 512kbytes. And there may be more address lines that are not connected in that card,

author: MarkMLl
author_rank: Frequent Contributor
timestamp: November 09, 2020, 10:01:04 am
content: Quote from: mikeselectricstuff on November 09, 2020, 09:33:42 amGood shot sir! Although since there aren't any obvious spare pins that's probably the architectural limitation.A fairly complex crest or logo is say 20,000 stitches, and it's a fairly dense binary format... so I'd say that's reasonable.MarkMLl

author: james_s
author_rank: Super Contributor
timestamp: November 10, 2020, 05:57:44 pm
content: Quote from: mikeselectricstuff on November 09, 2020, 09:33:42 amAck! You're right of course, I have a habit of doing the bits to bytes conversion in my head when discussing EPROMs since they are typically sized in kbits, but of course each address reads out an entire byte.512 kbytes happens to be 4 megabits so I think it's a reasonable assumption that this is exactly what these cards are, 4Mbit parallel ROM. If that's the case then something like a 29F040 5V parallel flash chip ought to work.

author: MarkMLl
author_rank: Frequent Contributor
timestamp: November 19, 2020, 02:01:35 pm
content: Just in case this is useful to anybody: I had a "funny" a few days ago where a .pes file on a USB stick would not appear on the machine's LCD display: this turned out to be because it was bigger than 100mm square. Then I found it would appear on the display but that the machine would crash (apparently with a watchdog reset) when I loaded it: that appeared to be because there were pause commands in it which the machine (Innovis-97E) didn't support.To help diagnose that sort of problem, I've written a dump program which reads a PES file and dumps the content (verbosely!), finishing off with stitch counts etc. This only supports v1 files at the moment, and while it could easily be modified to also support a "naked" .pec file I've not done it on account of not having a test article.https://github.com/MarkMLl/pesdumpInstalling Brother's own PE-Design Plus software, I notice that it checks for "04f9:2100 Brother Industries, Ltd Card Reader Writer".A few days later: It looks as though having any USB device with the correct vid:pid doublet is sufficient to get the Brother card reader driver loaded, but not to get the app running (and nothing useful shows up in Wireshark). I've been using a Teensy 3.5 set up as a rawhid device, I'm not sure whether the type of device matters since I suspect I'm up against OS caching issues which muddy the water.MarkMLl

author: JuOOLs
author_rank: Contributor
timestamp: December 18, 2021, 01:19:26 pm
content: Hi Mark, your thread is really useful! I've just bought a Brother pe150 embroidery machine from Ebay and I've been struggling to find a card / reader etc; i've ordered what I think to be a 1M re-writable card, so when that arrives I will open that up and post some images. Do you have acess to a raw binary dump of a card file structure? as I'm planning to create my own card reader / writer.

author: MarkMLl
author_rank: Frequent Contributor
timestamp: December 21, 2021, 09:28:31 pm
content: Quote from: JuOOLs on December 18, 2021, 01:19:26 pmNoting what somebody said earlier about the card probably being a simple (E)PROM or EEPROM device, but I've not tried hooking it up to a programmer.The thing that brought me to a halt before was that the Brother writer functioned as a security "dongle" for the software. Now it /might/ be that the cards contain a recognisable filesystem and standard-format files, but I'd certainly not like to bet any substantial amount (of cash or hours) on that. I might give this a /bit/ more time tomorrow, but to be brutally honest you'd be much better off with a model that took a USB "thumb drive" etc.: try to offload the PE150 if you can find a sucker looking for an urgent present for his XYL.Two other things to bring the community up to date:I had problems with my Brother machine crashing (apparent watchdog timeout and reset) with certain instruction sequences, and in support of that wrotehttps://github.com/MarkMLl/pesdump. I've since updated that with an attempt at systematic patching, but with limited success.The Inkstitch plugin to Inkscape works, but (on Linux) I was experiencing a grievous delay before it would do anything useful. Purging a whole lot of non-Roman typefaces helped a little bit, but I was very discouraged by the fact that the authors were unable to suggest a way of debugging the monster that they had created......However I'm not one to stay discouraged for long, and have made a small amount of progress in re-packaging the execution environment (Python v2) in a form that might be somewhat more efficient and would have a decent development/debugging environmenthttps://forum.lazarus.freepascal.org/index.php/topic,52849.msg390379.html#msg390379Whether I put any significant amount of time into that depends entirely on whether anybody else is interested.Somewhat later: it looks as though the only way for me to progress this would be by making an extender, which will probably (assuming Chinese prices) be a modest financial expense but much more significant in terms of time... and I /do/ have to emphasise that this is something that I don't need myself, since my machine will take a USB thumb drive.The memory card connector appears to be 40-pin, 1.0mm pitch, single row, pin diameter unknown. I've not seen anybody selling premade extenders or adapters buthttps://www.aliexpress.com/item/1005003169118193.htmlandhttps://www.aliexpress.com/item/1005003169085557.htmllook about right. I'd also have to organise a PCB, solder the connectors flat rather than PTH, and partially disassemble the machine so I could sniff the pin functionality. And then do it again to fit the card into a generic programmer so I could recover the actual data.If anybody could find one of the pukka Brother programmers and use that as an investigation platform I think it would be far easier, but I'm game if it turns out that I'm the only person who can realistically do the reverse engineering required.MarkMLl

author: JuOOLs
author_rank: Contributor
timestamp: December 22, 2021, 05:26:20 pm
content: So my re-writable card came in the post today; online pictures I found of the card suggested it was a 1M card, so no surprises to see the AM28F010. but why the blob and the flash?When I inserted the card into my machine and powered it on the machines display just went blank and it bleeped forever!! I didn't expect that! it could be the card is dud or the machine card slot / machine is dud, or both, or the card isn't compatible with the PE150; either way - it's not looking too good!

author: MarkMLl
author_rank: Frequent Contributor
timestamp: December 22, 2021, 07:45:32 pm
content: I speculate that the card isn't formatted (Brother might have a proprietary term for the process) and the machine firmware doesn't like it. I hope the machine recovers when powered on with the card pulled out...74HC138 is a decoder commonly used to address different blocks of Flash, which is what's implementing your R/W storage. I suspect that on the other side of the board you'll see lines running horizontally between the Flash chip and (what's under the) blob... and I think this takes us back to that being a microcontroller driven by a proprietary protocol from the machine.Assuming that my tentative diagnosis is correct, it's interesting that your machine is intolerant of a card not prepared /precisely/ as it expects and mine (I believe a newer model) is intolerant of what should be legitimate commands in the embroidery file. It implies an attitude on the part of the manufacturer which isn't entirely to their credit and contravenes Postel's Rule ("Be liberal in what you accept, and conservative in what you send").Later:https://www.ebay.co.uk/itm/324884594164is a writer for £175, plus a non-working machine thrown in. From what I've seen in the past that's not an unreasonable price...MarkMLl

author: JuOOLs
author_rank: Contributor
timestamp: December 26, 2021, 12:47:40 pm
content: QuoteThis could well be the case! I found someinfobut i'm not sure if it all relates to the PE150, but if the card was used and the design/s on it are not in PES format, >4"x4", >30K stitches or wrong hoop size assigned (>4" x4"); then apparently it will bleep, or show a message.QuoteLuckily, yes it does recoverQuoteYes it's not a bad price!QuoteIt would be interesting to probe the lines or try reading the flash.

author: JuOOLs
author_rank: Contributor
timestamp: December 26, 2021, 12:58:13 pm
content: If anyone is interested I stripped my machine down to have a look and take some pics.

author: DavidAlfa
author_rank: Super Contributor
timestamp: December 26, 2021, 03:18:55 pm
content: Probably a simple parallel EEPROM, I bet you can find a lot of pins going to U4/U5.Data, address, WE, RD etc is shared, only needs a dedicated CE/CS pin.

author: MarkMLl
author_rank: Frequent Contributor
timestamp: December 26, 2021, 04:38:50 pm
content: Quote from: JuOOLs on December 26, 2021, 12:47:40 pmI get the impression that there were a lot more of those writers ("transfer boxes") on the market a year ago, but even then the price was going up. I don't think Brother are making them any more, and the final price was around $145... they're apparently now shipping a security dongle so that their PE-Design software runs.Unfortunately that machine etc. is collect-only, and in just about the worst possible place for me to get to... I'd probably be paying a couple of hundred quid for petrol.It's obviously also worth noting that it doesn't have the extension unit that contains the stepper motors etc to move the hoop under the needle. In fact looking at the foot controller and the collection of feet etc. it looks as though it's been used as a standard sewing machine, in which case I assume that the memory card can be used to load in fancy stitches rather than space-covering patterns.MarkMLl

author: MarkMLl
author_rank: Frequent Contributor
timestamp: December 26, 2021, 05:24:07 pm
content: Quote from: JuOOLs on December 26, 2021, 12:58:13 pmInteresting: it's largely paralleled with a position marked for a TC5316200... but I see that documented as a 42-pin device while the footprint on the board is either 40 or 44.Still, that tells us that the card is probably mapped into the memory space rather than being a comparatively low-bandwidth peripheral.I find myself wondering whether in this case the "blob" is actually the security dongle, with this actually being present on every card rather than in the USB-connected writer.The AMD Flash device will need a controlled 12V for the Vpp signal. Can the machine write to the card, or is that intended to be a function of the USB-connected card writer?The comment about limits on the Brother website tells us that it's probably expecting the same file format on the card as would be on a USB stick (or presumably a floppy). It doesn't however tell us anything about the filesystem on the memory card, I'd guess it to be FAT (pre-FAT32)... it might even be FAT12 with an MSX heritage.However, my experience with the machine being very picky about the content of a PES file suggests that it might be equally (or even more) picky about the filesystem, for example it might reject a card if the capacity of the root directory is wrong.MarkMLl

author: JuOOLs
author_rank: Contributor
timestamp: December 27, 2021, 12:14:49 pm
content: QuoteYes, I believe the machine can write to the card.

author: MarkMLl
author_rank: Frequent Contributor
timestamp: December 27, 2021, 12:59:14 pm
content: Quote from: JuOOLs on December 27, 2021, 12:14:49 pmI've found this which is worth getting into the record:Code:Full Speed device @ 2 (0x1B100000): ............................................. Composite device: "USB-WRITER"Device DescriptorDescriptor Version Number: 0x0100Device Class: 0 (Composite)Device Subclass: 0Device Protocol: 0Device MaxPacketSize: 8Device VendorID/ProductID: 0x04F9/0x2100 (Brother International Corporation)Device Version Number: 0x0100Number of Configurations: 1Manufacturer String: 1 "BROTHER"Product String: 2 "USB-WRITER"Serial Number String: 3 "E5G111616"Configuration DescriptorLength (and contents): 32Raw Descriptor (hex) 0000: 09 02 00 20 01 01 00 80 32 09 04 00 00 02 00 00Raw Descriptor (hex) 0010: 00 00 07 05 01 02 10 00 00 07 05 82 02 40 00 00Unknown Descriptor 0020:Number of Interfaces: 1Configuration Value: 1Attributes: 0x80 (bus-powered)MaxPower: 100 maInterface #0 - UnknownAlternate Setting 0Number of Endpoints 2Interface Class: 0 (Unknown)Interface Subclass; 0Interface Protocol: 0Endpoint 0x01 - Bulk OutputAddress: 0x01 (OUT)Attributes: 0x02 (Bulk no synchronization data endpoint)Max Packet Size: 16Polling Interval: 0 msEndpoint 0x82 - Bulk InputAddress: 0x82 (IN)Attributes: 0x02 (Bulk no synchronization data endpoint)Max Packet Size: 64Polling Interval: 0 msAlso mention of it being possible to format the card from the (Windows) "My Computer" icon without any special options, but that will almost certainly be relying on drive parameters returned by the hardware and/or custom Windows driver.There might, however, be more than one variant of card:https://help.brother-usa.com/app/answers/detail/a_id/68423/~/what-card-is-compatible-with-my-reader-writer-box%3F.https://community.annthegran.com/Forum/default.aspx?g=posts&t=2898I think that Brother is moving away from the proprietary card to USB, but it's patchy. Looking at photos on eBay, I see some models of Innovis which are USB device only, some which are USB device+host, and some which are USB device plus a proprietary card.MarkMLl

author: MarkMLl
author_rank: Frequent Contributor
timestamp: January 10, 2022, 03:27:14 pm
content: I've now got a "Great Notions" interface "Magic Box Elite" which uses the non-standard USB identifier 0dc0:0012. I've not investigated to any great depth but I suspect that this will look like a serial device, however lsusb on Linux doesn't give much away.Internally it's got an H8S-series chip and a Lattice chip that's presumably an FPGA. Two of the four card sockets are on a daughter board with the signals easily accessible.I'll buzz the connections, hang testgear on them and hopefully will be able to report back- although it won't be for at least a few days (apart from anything else, I envisage a bit of software which would make the job easier).MarkMLl

author: Kolargol00
author_rank: Newbie
timestamp: February 17, 2022, 08:26:24 pm
content: Hi MarkMLI,Were you able to read or write the card with that "Magic Box"? I also got one of these on eBay and I can't figure out how to use that device. On Linux, only the USB vendor ID 0x0dc0 is known to libusb, no other module recognises this thing (no usb_serial, for example). I've also tried plugging it into a Win10 machine, but it fails to recognise it.Cheers,Kolargol00

author: Kolargol00
author_rank: Newbie
timestamp: February 19, 2022, 05:11:39 pm
content: There is an old version of the Magic Box software available on archive.org athttps://archive.org/details/magic-boxso I gave a try in Wine. Windows drivers are also available at the same location, however they are of use to Wine (it doesn't load drivers). Unfortunately, web.archive.org doesn't have more than the front page forhttp://embroideryonlinesupport.custhelp.com/where software downloads were once hosted (this URL appears in the manual provided on the CD image). I'd have tried a more recent version otherwise.In order to give Wine access to the Magic Box, I loaded Linux's generic "usbserial" module (assumingthis device actually uses the serial interface)Code:$ sudo modprobe -v usbserial vendor=0x0dc0 product=0x0012insmod /lib/modules/5.4.0-100-generic/kernel/drivers/usb/serial/usbserial.ko vendor=0x0dc0 product=0x0012relevant kernel log (dmesg):Code:[Sat Feb 19 14:47:57 2022] usb 3-2: new full-speed USB device number 10 using xhci_hcd[Sat Feb 19 14:47:57 2022] usb 3-2: New USB device found, idVendor=0dc0, idProduct=0012, bcdDevice= 1.00[Sat Feb 19 14:47:57 2022] usb 3-2: New USB device strings: Mfr=0, Product=0, SerialNumber=0[Sat Feb 19 16:02:29 2022] usbcore: registered new interface driver usbserial_generic[Sat Feb 19 16:02:29 2022] usbserial: USB Serial support registered for generic[Sat Feb 19 16:02:29 2022] usbserial_generic 3-2:1.0: The "generic" usb-serial driver is only for testing and one-off prototypes.[Sat Feb 19 16:02:29 2022] usbserial_generic 3-2:1.0: Tell linux-usb@vger.kernel.org to add your device to a proper driver.[Sat Feb 19 16:02:29 2022] usbserial_generic 3-2:1.0: generic converter detected[Sat Feb 19 16:02:29 2022] usb 3-2: generic converter now attached to ttyUSB0then I configured Wine to bind its COM1 port to /dev/ttyUSB0 using `wine regedit` (instructions athttps://wiki.winehq.org/Wine_User's_Guide#Serial_and_Parallel_Ports) and ran `wine ~/.wine/drive_c/OESD/MagicBox/MagicBox.exe`. The program says it cannot access the card. I tried various baud rates in the options, to no avail.A capture of USB bus packets didn't reveal much. Capture setup with (note that I could have used interface `usbmon3` to select only bus 3 where the device was connected):Code:$ lsusb...Bus 003 Device 011: ID 0dc0:0012 G7 Solutions (formerly Great Notions)$ sudo modprobe -v usbmoninsmod /lib/modules/5.4.0-100-generic/kernel/drivers/usb/mon/usbmon.ko$ sudo dumpcap --list-interfaces1. eno12. lo (Loopback)3. any4. docker05. bluetooth-monitor6. nflog7. nfqueue8. usbmon09. usbmon110. usbmon211. usbmon312. usbmon4$ sudo dumpcap --interface usbmon0Capturing on 'usbmon0'File: /tmp/wireshark_usbmon0_20220219163132_SNuZNd.pcapngPackets captured: 3730Packets received/dropped on interface 'usbmon0': 3730/0 (pcap:0/dumpcap:0/flushed:0/ps_ifdrop:0) (100.0%)Wireshark display filter `usb.bus_id == 3 && usb.device_address == 11`. There is one request/response at the beginning, then two bulk in followed by many bulk out exchanges, but all responses from the device are empty (data length 0).Code:No.TimeSourceDestinationProtocolLengthInfo32510.856502host3.11.0USB64GET STATUS Request32610.8565583.11.0hostUSB66GET STATUS Response32910.856625host3.11.1USB64URB_BULK in33010.856630host3.11.1USB64URB_BULK in33110.857374host3.11.2USB65URB_BULK out33210.8574123.11.2hostUSB64URB_BULK out...That's where I stand with my exploration of this device. Of course, the generic usbserial module may not be the correct one, but no other module picks up the vendor/product ID. I also wonder why the software's options show COM ports and baud rates when I have a USB device. Screenshots of that window in the PDF manual don't have these UI elements for the USB version. Maybe version 3.6 is too old for the USB Magic Box...

author: MarkMLl
author_rank: Frequent Contributor
timestamp: February 19, 2022, 09:18:26 pm
content: I've spent some time over the last few days buzzing through the internals of the box, in preparation for hooking it onto my logic analyser. It's for jobs like this that I bought an old instrument with /lots/ of channels, but I'm still working on support software to implement generalised tracing: in the interim I can generate a .vcd compatible with GTKWave.I've not yet settled down with the software, but will try do do so over the next couple of days. A cursory inspection of the manual suggested that it wasn't intended to look like a serial device, and while I've had some success in the past mapping arbitrary devices onto Qemuhttps://wiki.freepascal.org/Qemu_and_other_emulators#USB_for_Qemuthat sort of thing rather cramps Wine's style.[Week later] The software installs on XP, but registration is mandatory and the publishers' server no longer exists. It will run for ten days which should give me time to look at the signals... apart from that it's not much use since while it reads a card it crashes before saving files locally.MarkMLl

author: amyk
author_rank: Super Contributor
timestamp: March 01, 2022, 03:56:49 am
content: Quote from: MarkMLl on February 19, 2022, 09:18:26 pmIf you need more than 10 days, or want to analyse the software in some parts, let me know.

author: MarkMLl
author_rank: Frequent Contributor
timestamp: March 02, 2022, 05:25:02 pm
content: I'm definitely going to need more than ten days, but for the moment am working on the assumption that wiping the software and all traces of anything relevant from the registry will allow me to start over (am I wrong in that?).Looking at what I've got here, I'm disturbed. This is the nastiest possible combination: a chunk of hardware which is sold, no protocol documentation, a chunk of software which is licensed, mandatory registration, and a company which doesn't make sure that their registration servers continue running after they've shut up shop.MarkMLl

author: AeroX2
author_rank: Newbie
timestamp: March 16, 2022, 06:53:44 am
content: Hey everyone,I'm so glad I found this thread, I recently got my hands on a PE200 but really wanted to do some custom designs, unfortunately looks like the card readers and writers are quite rare.I've sacrificed one of the (read-only) cards that came with the machine, don't know if it helps but here are some pictures.I'm also going to try and figure out what the chip is and if I can read it but don't expect too much, here's hoping.

author: dl6lr
author_rank: Frequent Contributor
timestamp: March 16, 2022, 07:04:53 am
content: Quote from: AeroX2 on March 16, 2022, 06:53:44 amThat one is a usual Flash memory chip with 4MBit in TSOP48, organised as 512Kx8 (or 256Kx16). If it is used as a read only card, the machine is not supposed to write to it, so I assume the write enable !WE (Pin 11 on the TSOP) is fixed to Vcc.

author: MarkMLl
author_rank: Frequent Contributor
timestamp: March 16, 2022, 02:25:19 pm
content: That photo's actually very useful, since it's the first time that anybody (at least in this forum) has posted a photo of a card that doesn't have half the tracks obfuscated by a black epoxy blob (and the microcontroller it's hiding).I think it's reasonable to assume that Brother hasn't shuffled the address and data signals in an attempt at encryption.If that assumption is valid, and knowing that pin 1 is at the top-right of the photo, it should be possible to fill in the bulk of the signals on that 40-pin connector.Trivial inspection already suggests that connector pin 38 runs to chip pin 11 which is WE/, which presumably identifies it as Vcc pulling the signal high (inactive).I'll try to take a more methodical look later, but this might suggest digging into graphics software or possibly KiCAD... both of which I use infrequently so I always have to claw laboriously up the learning curve.I've partly buzzed through the internal connectors of my Magic Box Plus, but at present my logic analyser (plus all the grabbers etc.) is set up for something different which I'd rather get to a stable state before getting back into this one.Later same day:Code: (text)1 to pin 40 (presence detection?)2 Chip pin 46 (Vss), copper fill on PCB hence also pin 393 Chip pin 37 (Vcc), hence also pin 384 n/c5 Chip pin 16 (marked N/C on datasheet) via unpopulated R6 Chip pin 26 (/CE) via R7 Chip pin 29 (DQ0) via R8 Chip pin 31 (DQ1) via R9 Chip pin ? (?) via R10 Chip pin 11 (/WE?) via R11 Chip pin ? (?) via R12 Chip pin ? (?) via R13 Chip pin 23 (A2) via R14 Chip pin ? (?) via R (guess: DQ2)15 Chip pin ? (?) via R (guess: DQ3)16 Chip pin ? (?) via R (guess: DQ4)17 Chip pin ? (?) via R (guess: DQ5)18 Chip pin ? (?) via R (guess: DQ6)19 Chip pin ? (?) via R (guess: DQ7)20 Chip pin ? (?) via R (guess: A?)21 Chip pin ? (?) via R (guess: A?)22 Chip pin ? (?) via R (guess: A?)23 Chip pin ? (?) via R (guess: A?)24 Chip pin ? (?) via R (guess: A?)25 Chip pin ? (?) via R (guess: A?)26 Chip pin ? (?) via R (guess: A?)27 Chip pin ? (?) via R (guess: A?)28 Chip pin ? (?) via R (guess: A?)29 Chip pin ? (?) via R (guess: A?)30 Chip pin ? (?) via R (guess: A?)31 Chip pin ? (?) via R (guess: A?)32 Chip pin 45 (DQ15/A1) via R33 Chip pin ? (?) via R34 Chip pin ? (?) via R35 Chip pin 1 (A15) via R36 Chip pin 2 (A14) via R37 Chip pin 3 (A13) via R38 Vcc (also pin 3)39 Vss (also pin 2)40 to pin 1 (presence detection?)The /WE signal appears to be associated with at least two pins, I suspect so that a nominal ROM may be written via the standard connector but possibly also so that the host can determine whether the R that allows writes is installed.Apart from that I've made a few guesses based on the approximate direction signals appear to be heading, but the only way to progress this will be by buzzing through with a suitable low-voltage meter.MarkMLl

author: amyk
author_rank: Super Contributor
timestamp: March 17, 2022, 04:38:56 am
content: Here's the datasheet for reference:https://pdf1.alldatasheet.com/datasheet-pdf/download/74499/MCNIX/29F4000.htmlHere's my guesses so far... along with an attached composite of both sides that might help.1 <> 402 GND3 38 CE 6(via R) /WE(via R) 9(via R) A0(?) 10(via R)4 (not connected)5 NC6 (see net 3)7 Q08 Q19 (see net 3)10 (see net 3)11 Q2(?)12 A1(?)13 A233 NC

author: AeroX2
author_rank: Newbie
timestamp: March 17, 2022, 08:00:19 am
content: So took a little bit of time and went at it with a multimeter and this is what I got, haven't double checked it or anything but it seemed to have all the necessary pins for the chip. EDIT: (Looking at amyk, net 3, I think it is a more complete picture of my probing on pins for WE/CE/etc, I'll double check on my side but it looks correct)Going to try and wire it up and get some values out but couldn't really find any connectors that matched the AMP175564, probably will just have to solder directly to the board :| If anyone knows of a connector that is roughly 40pins, 1mm pitch and the pins are roughly 0.5mm in diameter, let me know!Code:1 to pin 40 (presence detection?)2 power (also pin 39), copper fill on front of PCB -> GND3 power (also pin 38), copper fill on back of PCB -> VCC4 n/c5 unpopulated R, other end off-board6 R, chip, off-board -> CE#7 R, chip, off-board -> Q08 R, chip, off-board -> Q19 R, chip, off-board -> OE#10 not nc on my board -> WE#11 R, chip, off-board -> A012 R, chip, off-board -> A113 R, chip, off-board -> A214 R, chip, off-board -> A315 R, chip, off-board -> Q216 R, chip, off-board -> Q317 not nc on my board -> RY/BY#18 R, chip, off-board -> Q419 R, chip, off-board -> Q520 R, chip, off-board -> A421 R, chip, off-board -> A522 R, chip, off-board -> A623 R, chip, off-board -> A724 R, chip, off-board -> A1725 R, chip, off-board -> A826 R, chip, off-board -> A927 R, chip, off-board -> A1028 R, chip, off-board -> A1129 R, chip, off-board -> A1230 R, chip, off-board -> Q631 R, chip, off-board -> Q732 R, chip, off-board -> Q15/A-133 off-board -> nc34 R, chip, off-board -> A1635 R, chip, off-board -> A1536 R, chip, off-board -> A1437 R, chip, off-board -> A1338 power (also pin 3) -> CE#39 power (also pin 2)40 to pin 1 (presence detection?)

author: MarkMLl
author_rank: Frequent Contributor
timestamp: March 17, 2022, 08:50:43 am
content: Quote from: amyk on March 17, 2022, 04:38:56 amNicely done composite. I did one which was rather less neat and crudely traced the tracks on both sides, but there's a lot of detail under the chip that doesn't show up clearly.MarkMLl

author: MarkMLl
author_rank: Frequent Contributor
timestamp: March 17, 2022, 09:00:22 am
content: Quote from: AeroX2 on March 17, 2022, 08:00:19 amWell done and thanks from everybody.Note that my revised table no longer claims that some of the copper areas are Vcc.I can't remember whether I ever found a "good enough" connector on AliExpress etc., but if I did I didn't bookmark it. I think that I noted a part number when I was examining a stripped-down card, but from the "Magic Box" writer I see it identified as AMP 175758-1 (40-pin male right-angle PTH).MarkMLl

author: AeroX2
author_rank: Newbie
timestamp: March 22, 2022, 06:30:37 am
content: So it took me quite a while but I managed to wire up the board and after a bunch of tinkering I got some actual readable output!Code:Copyright by brother industries LTD.external 4M bit ROMsewing pattern created by M.K & T.F LCD font created by M.I ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ“ÿÿÿÿÿÿÿÿÿÿÿÿ ÝG@ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿñÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿDRAGON3 Projectÿ1.0 versionÿÿÿ1999/08/04 dateÿbrother_sewingUnfortunately a breadboard isn't the best interface and so there is quite a bit of noise on the lines, going to try a few things and see where I get.

author: MarkMLl
author_rank: Frequent Contributor
timestamp: March 22, 2022, 11:30:30 am
content: Creditable progress. Any chance of a hex dump of at least the 512 bytes, so that if it's formatted as a floppy we can see the layout?MarkMLl

author: amyk
author_rank: Super Contributor
timestamp: March 23, 2022, 01:27:55 am
content: Slow down the signals as much as you need to get a repeatable read. Parallel async ROM has no minimum frequency.

author: AeroX2
author_rank: Newbie
timestamp: March 23, 2022, 07:14:00 am
content: Yep I initially tried slowing down the signal to the point where it was taking 50ms per read :/ so I left this overnight but even after leaving it overnight it still wasn't done, so I was wondering what was going on and realized now that Arduino uses 16bits for its int's and so was just overflowing my address counterNot wanting to run it overnight, I lowered the read to 3ms and fiddled with the wires and it seemed to give a reliable result (at least the Brother text is readable) but hard to tell, I've attached the trimmed output of that run here.I also ran it through binwalk to see if there was anything obvious but no luck maybe you guys will have better luck in identifying how this thing is laid out.

author: MarkMLl
author_rank: Frequent Contributor
timestamp: March 23, 2022, 07:56:15 am
content: My initial thought was that if that is a text file it will probably have lost zero bytes etc. and that it might be better redone as hex.However looking at it with xxd it does appear to have 0x00, 0xff etc. scattered liberally, and I notice content transitions on neat binary boundaries e.g.Code: (none)...0002eff0: ffff ffff ffff ffff ffff ffff ffff ffff ................0002f000: 00f1 42e6 2143 284c f5f8 8343 f5bc 434e ..B.!C(L...C..CN...which suggests that it is in fact undamaged.Having said that, other than the obligatory copyright notice at the beginning there is nothing recognisable in there, in particular no #PES or #PEC strings which would be expected if we were looking at straight pattern files (seehttps://github.com/MarkMLl/pesdumpetc.).I suspect that what that actually is is literally a ROM extension with a binary header at 0x0080, in the same way that PCs (used to) have BIOS extensions. The fact that it has an explicit copyright for an LCD font would appear to reinforce this.MarkMLl

author: amyk
author_rank: Super Contributor
timestamp: March 24, 2022, 01:17:36 am
content: It does not look like machine instructions to me. The entropy is far too low. I'm not really familiar with embroidery pattern formats, but if it's anything like bitmap graphics, the texture of the data agrees.

author: MarkMLl
author_rank: Frequent Contributor
timestamp: March 24, 2022, 08:05:36 am
content: Quote from: amyk on March 24, 2022, 01:17:36 amWell of course there's stitch data in there... that's the whole idea. But that doesn't prevent it from being a ROM extension formatted according to some private SDK: it's definitely not one of the standard file types, and doesn't appear to be "filesystem-like".MarkMLl

author: AeroX2
author_rank: Newbie
timestamp: March 24, 2022, 02:00:54 pm
content: Still quite a ways off but I was digging around inside of PED-Basic and noticed some interesting strings, along with some functions that seemed to be appending those strings.Going to dive a little deeper on the weekend, I'm hoping that maybe this software reads a PES file, converts it and then sends it to a EEPROM writer but lets find out.

author: AeroX2
author_rank: Newbie
timestamp: March 28, 2022, 02:14:32 pm
content: So after taking a look into the software, it looks like the header of the PES file is stripped and the raw PES stitch data is embedded onto the EEPROM.My previous putty.txt still has a bit of noise so I've reuploaded a newer version which should have less noise.Using the offset of 0x2f327 for the stitch data I was able to read out this bear!I've also found the function responsible for creating the rom data and I can probably just extract out this data and put it on a new EEPROM, however it would be nice to create my own program for doing that,So still looking at how the data is arranged and how the offsets are calculated and hoping to create my own program!

author: DavidAlfa
author_rank: Super Contributor
timestamp: March 28, 2022, 03:02:44 pm
content: 3ms per read is a lot, you shouldn't need so much, also use a thicker wire for gnd.As you're not using multiple addressing neither writing (for now) you can get rid of some bus signals:CE -> GNDWE -> VCCBYTE -> VCCRST ->10K to VCC, 100nF to GND (self-resets on power-on)RY/BY can be ignored as you're not doing any write operations and the data set-up time is like 100ns.10us delay should be enough, even in bad boards, unless there's a faulty/weak connection.Example loop:Code:Write addressWait 10uSSet OE lowWait 10usRead dataSet OE highWait 10usLast year I did the same to read a 29F800 using a STM32, dumping the contents into a usb drive.To save IO pins I used four 74HC373 latches and enabled Byte mode, taking only 13 pins instead of almost 40.The 4 latches were configured as:- Data 0:7- Addr 0:7- Addr 8:15- Addr 16:18, A-1, E, G, WThe signaling was a little more complex but worked well.Few capacitors and proper grounding made it much easier than using breadboard, was able to greatly reduce the toggling delays to ~100ns, dumping the 512KB into the flash drive in ~25 seconds.The code was as follows, you can ignore the latch handling, just read the comments.Code:// GPIO toggling delay#define delay() asm("nop\nnop\nnop\nnop\nnop\nnop\nnop\nnop\nnop")// Configure Data port direction. 1= input, 0=outputvoid setDataDir(bool input){GPIOA->MODER = input ? (GPIOA->MODER & 0xFFFF0000) : (GPIOA->MODER & 0xFFFF0000) | 0x5555;}// Make a low-active pulse on the specified GPIO pinvoid pulse(GPIO_TypeDef *GPIOx, uint32_t pin){// Set pin lowGPIOx->BSRR=pin;delay();// Set pin highGPIOx->BSRR=pin<<16;}// Read Data from latchuint8_t read(void){// Set Data port as inputsetDataDir(1);delay();// Enable Data latch OutputOE_DATA_GPIO_Port->BSRR = OE_DATA_Pin<<16;// Pulse latch loadpulse(LE_DATA_GPIO_Port, LE_DATA_Pin);// Read datauint8_t data = GPIOA->IDR & 0xFF;// Disable Data latch OutputOE_DATA_GPIO_Port->BSRR = OE_DATA_Pin;delay();// Set Data port as outputsetDataDir(0);return data;}// Fill buffer, starts reading at the specified address with "size" number of 16-bit reads.void fillBuffer(uint32_t address, uint8_t* buffer, uint32_t size){ // Size = number of 16-bit readswhile(size--){// Load address with A-1=0 (lower byte)GPIOA->ODR = address & 0xFF;pulse(LE_ADR0_GPIO_Port, LE_ADR0_Pin);GPIOA->ODR = (address>>8) & 0xFF;pulse(LE_ADR1_GPIO_Port, LE_ADR1_Pin);GPIOA->ODR = ((address>>16) & 0xFF) | A_1_EN;pulse(LE_ADR2_GPIO_Port, LE_ADR2_Pin);// Enable CEGPIOA->ODR = ((address>>16) & 0xFF) | (A_1_EN & E_EN);pulse(LE_ADR2_GPIO_Port, LE_ADR2_Pin);// Enable GGPIOA->ODR = ((address>>16) & 0xFF) | (A_1_EN & E_EN & G_EN);pulse(LE_ADR2_GPIO_Port, LE_ADR2_Pin);// Read lower byte*buffer++=read();// Deselect GGPIOA->ODR = ((address>>16) & 0xFF) | (A_1_EN & E_EN);pulse(LE_ADR2_GPIO_Port, LE_ADR2_Pin);// Deselect EGPIOA->ODR = ((address>>16) & 0xFF) | (A_1_EN);pulse(LE_ADR2_GPIO_Port, LE_ADR2_Pin);// Disable A-1 (read higher byte)GPIOA->ODR = ((address>>16) & 0xFF) | CTRL_DIS;pulse(LE_ADR2_GPIO_Port, LE_ADR2_Pin);// Enable EGPIOA->ODR = ((address>>16) & 0xFF) | E_EN;pulse(LE_ADR2_GPIO_Port, LE_ADR2_Pin);// Enable GGPIOA->ODR = ((address>>16) & 0xFF) | (E_EN & G_EN);pulse(LE_ADR2_GPIO_Port, LE_ADR2_Pin);// Read higher byte*buffer++=read();// Deselect GGPIOA->ODR = ((address>>16) & 0xFF) | E_EN;pulse(LE_ADR2_GPIO_Port, LE_ADR2_Pin);// Deselect EGPIOA->ODR = ((address>>16) & 0xFF) | CTRL_DIS;pulse(LE_ADR2_GPIO_Port, LE_ADR2_Pin);address++;count-=2;}}

author: MarkMLl
author_rank: Frequent Contributor
timestamp: March 29, 2022, 09:05:12 am
content: Quote from: AeroX2 on March 28, 2022, 02:14:32 pmI suspect that the bear is in bitmap format to be presented on the LCD, rather than being stitch data which would be needle-movement commands.MarkMLl

author: JuOOLs
author_rank: Contributor
timestamp: April 02, 2022, 11:52:07 am
content: Quote from: MarkMLl on March 29, 2022, 09:05:12 amReally nice work AeroX2 !! the DLL code might elude to how the LCD preview image is stored, my guess it's some sort of colour format as the preview of the default designs on my PE-150 (similar to your PE-200) show an image of each of the indivdual colours and it looks like the outline colour (last colour used) is perhaps used as the main preview image.How many colors are in that bear 4, do you have a photo of how that bear preview looks on your machine?

author: AeroX2
author_rank: Newbie
timestamp: April 03, 2022, 02:14:02 pm
content: QuoteI don't quite think that is the case, considering the library I'm using should be interpreting the PES/PEC commands. At least that is how I'm reading it, also I think it would be more than a little weird to store a bitmap in this format.The library I'm using is pyembroidery along with embroidepy, making a modification to the PecReader.py you can get it to read the file at the offset. (picture 1 attached)QuoteThanks, took me a while to get there and I'm really hoping this all pays off in the end.Yep, there seems to be some additional processing being done to the image file for a preview...maybe? It is kindof hard to tell since there is a lot of small memcpy commands that seem to be doing different things under different conditions, but there are small sections that change with more files added and much larger sections that change with more files.For those interested, CardIO.dll (offset: 0x6ac8), is the function that seems to create the final rom file which gets sent to the EEPROM writer.QuoteUnfortunately not, that would have probably been the smart move to make but the bear should be the same one on the cover, (picture 2 attached)There seems to be 4 color change commands, for a total of 5 threads, which seems to line up the the picture.I've ordered some parts and planning on hooking the sewing machine up to a microcontroller, so I can get a much more complete picture and hopefully get it to sew something other than bears but those parts are going to take a while to arrive and then assemble so I'll have to see how that goes.

author: SaberDT
author_rank: Newbie
timestamp: July 29, 2022, 03:52:46 pm
content: I recently obtained a Bernina Deco 650. Seems to be manufactured by Brother with the wonderfully obscure 40 pin port. I took some pictures of the internals. Will any of these be helpful?

author: SaberDT
author_rank: Newbie
timestamp: July 29, 2022, 03:53:46 pm
content: Second Image due to post rules.

author: MarkMLl
author_rank: Frequent Contributor
timestamp: August 03, 2022, 11:23:07 am
content: Thanks for the nice clear photos which are always useful, but I think that by now most of the physical stuff has been cracked.I've still got to find time to look at the FPGA-based reader I've got here, which turns out to be "problematic" without the appropriate Windows-only drivers. I've been down a rabbit-hole of writing a specification language to decode a VCD file extracted from my HP logic analyser: it will now disassemble x86 states so I think that getting it to decode Flash memory (which might or might not have some sort of filesystem structure) should be no problem...MarkMLl

author: AeroX2
author_rank: Newbie
timestamp: September 04, 2022, 11:07:20 am
content: Long time no see but finally got some time to play around with this again and got some fantastic results.As you can see in the images below, the embroidery machine is finally accepting a custom embroidery design,I'm not very good at making a custom design and I think my machine needs some tuning but nevertheless the design is recognizable.I was correct in my idea that CardIO.dll is storing the card data and you can just extract this data from memory and burn it on a EEPROM, in this case I used SST39SF040-55-4I-WHE which after figuring out how to write to the thing worked perfectly.

author: localghost
author_rank: Newbie
timestamp: October 03, 2022, 07:26:09 pm
content: Hihi, I got one of those " Ultimate Box" card programmers form my mom with a working Bernina Deco 650 machine and a 1MB card a long tie ago and captured the serial interaction between the card and the programing software.This ultimate box is a Serial model so no PID/VID or usb transfer shenanigans,I'll dig it out again ( we moved house ) and put up some pictures of the internals.. for now, I have a serial capture of the "Card read" action in the Ultimate Explorer software. ( I cannot remember what was on the card when I did the dump )Baud : 57600When I dig it out Ill upload a .PES ( V4 ) file to the card and dump the card again if anyone wants to figure out how the file is stored on the card, then supply both the .PES, read and Write dumps if anyone is interested

author: localghost
author_rank: Newbie
timestamp: October 03, 2022, 08:12:10 pm
content: Finding the box of sewing stuff was quicker than I thought...( I used an old design - will do an EEVBLOG thing at some pont and submit the machine files so Dave can make Caps or something...The following is the output form the Vikant UltimateExplorer application popup, the PES, write and Read Serial monitors are attachedupon opeing the port :——————————————————————————————————————————Trying to open the port... OK!Looking for the UltimateBox™... Found!hardware [UltimateBox 1000]firmware [UltimateBox Rev 1000]Embroidery card has been detected!Identifying the card... OK!The card has been recognized as:«Vikant UltimateCard™ Type I»[AMD Am29F080B]Writing the attached PES file to the card:UltimateExplorer v1.00k__________________________________________________The card has been recognized as:«Vikant UltimateCard™ Type I»[AMD Am29F080B]In order to write new data to the cardall current card content has to be erased.Erasing the card... OKWriting 1024Kb... OKTransferred 1024KbTime elapsed: 0 min and 36 sec.—————————————————————————————————————————————————Press  button to continue...Restarting the application and reading the card again :——————————————————————————————————————————————————The card has been recognized as:«Vikant UltimateCard™ Type I»[AMD Am29F080B]Reading 1024Kb... OKTransferred 1024KbTime elapsed: 6 min and 21 sec.—————————————————————————————————————————————————Press  button to continue...The Read happens in Blocks but Write seems to happen in one continuous stream.That might be specific to this Card reader/Writer and version of the software

author: MarkMLl
author_rank: Frequent Contributor
timestamp: October 11, 2022, 05:21:41 pm
content: Thanks for the contribution, I'll try to take a look at that at some point.I ended up by getting into a rabbit hole working out how to capture a dump from my old HP logic analyser, and convert it into something useful. I got to the point of being able to convert its HPIB data to a VCD file, and then to postprocess that... so while I can now disassemble 8088/V20 opcodes I'm no further forward with the card reader :-)MarkMLl

author: flez1966
author_rank: Newbie
timestamp: October 19, 2022, 08:46:45 pm
content: Wow I cant believe I have found a thread on these old odd cards, I have the PE software on floppy, and I'm sure a serial connected card reader and a card, from when i bought a machine in 2013 that only worked a month before getting a mechanical issue that I would fix when i have the time.....I dont what I can do to help or how much help I can be, or if any help is needed, but i'm here 'if'.Lez

author: MarkMLl
author_rank: Frequent Contributor
timestamp: November 02, 2022, 11:23:27 am
content: It's certainly a valuable focal point for techies interested in this facet of CNC equipment :-)Funnily enough, I was just discussing the "questionable" performance of the InkStitch software with somebody yesterday. I notice that there have been a couple of releases since I last tried it, I really do need to have another shot and possibly dust off my attempt at improving things.MarkMLl

author: GerryG
author_rank: Newbie
timestamp: November 16, 2022, 09:26:02 pm
content: Hi all.So I nominally lucked out by getting this machine on the cheap, and I'm having a bear of a time interfacing with the memory card. Unfortunately, I'm nowhere near as electronically-minded as you guys: I'm a CNC programmer, but more mechanically oriented, so this is all a bit beyond me in places.To make things singularly more irritating, I bought a card reader for this thing, which was one of the Simplicity SmartBox units. Of course, my PC doesn't recognise the USB device (that'd be far too useful). It presents a PID and VID and all that jazz, but I can't find a driver for it (unless I shell out £50 for some CD-ROM from the US, because copying the abandonware to the internet is too much like communism, I guess).I see that you guys have had some success with getting an arduino to talk to the card directly - has anyone managed to figure a way to use an Arduino as a proper reader/writer for it? If it's workable, I have precisely zero compunctions about ripping the reader I've got apart for the laughably obsolescent AMP socket that everyone was scratching their heads about for a bit to do a semi-proper job of things.However, before I do tear it apart, I figure you guys might be interested in the contents.It's marked up as "Great Notions Rev A 04/24/2002, Small Blackbox_AVR_USB3"The only chips of interest on there that I can see are a Xilinx XC95144XL TQL44BMN0225 F1222764A 10C, an ATMEL AT43USB320A 0227 55618E RH1B2934 and an ATMEL AT49F1025 55JC 0107Bear in mind that when it comes to bare metal electronics, I'm a simpleton (and that's being charitable)I'm comfortable enough getting into the guts of most things, but with this, I need a fair bit of guidance

author: AeroX2
author_rank: Newbie
timestamp: November 29, 2022, 03:38:33 pm
content: Thought I would chime in and say that I've uploaded the PCB, image dumper and image writer to Github, which I'm sure someone can improve on.(Pretty sure my clock lines for the flash chip are too close to my other lines and so I had to write at a pretty slow speed)https://github.com/AeroX2/brother-cart-emulatorThe final result is that I got this working, although I give no warranties since I only really tested this once with the Kirby embroidery but I'm pretty confident it should work with other PES files.

author: JuOOLs
author_rank: Contributor
timestamp: December 31, 2022, 05:39:20 pm
content: Really nice work AeroX2!! I managed to create an image.bin from a .pes design from your script!

author: bezmi
author_rank: Newbie
timestamp: March 10, 2023, 04:50:14 am
content: Hi Guys, first post on the forums. I stumbled upon here when doing my own research on this and decided to base my work off Aero's. Here is a link to my github repo:https://github.com/bezmi/brother_embroidery_card_experiments. At the moment, I am using a utility written by another github user to emulate a vikant card and write to it using the old free software that vikant provides.I have also been digging through the image dumps a fair bit and you can see my notes on reverse engineering the file format here:https://github.com/bezmi/brother_embroidery_card_experiments/blob/main/notes.org. I am waiting on a replacement ribbon cable after I broke one in the machine, but once that arrives I will put these notes to the test in trying to write a utility to write to the device without needing to use PED basic or the Vikant software.

author: MarkMLl
author_rank: Frequent Contributor
timestamp: March 10, 2023, 09:34:54 pm
content: Quote from: bezmi on March 10, 2023, 04:50:14 amWelcome to the forum and discussion :-)I've got very limited time to put into this at the moment ("real life" issues) but I'm still hoping at some point to get a logic analyser and disassembler hooked up to monitor the transfers... which will almost certainly echo the excellent work done by others (but I did have a lot of fun writing support code for my old HP kit :-)By way of xref,https://github.com/MarkMLl/pesdumpmight interest: it's fairly good at parsing files but rather less good at patching them.MarkMLl

author: maehw
author_rank: Newbie
timestamp: August 11, 2024, 08:26:04 pm
content: Hi all,thanks for your helpful posts and insights! After about a year of silence, I'd like to join in. It seems that I fell into the same rabbit hole...First, I'll start with a summary of my understandings - this might help others, at least it will help me if I come here again. You can also correct me if I am wrong and help me fix my understandings.The Brother memory cards used for embroidery machines have 40 pins in a single row with a 1mm pitch, likely using an AMP 175564 connector.There are machine models from other vendors (Baby Lock, White, Bernina Deco, Simplicity, Husqvarna, Viking) that are reported to be compatible.Thanks to opened cards and visible chip markings, we know that up to 4 Mbit of parallel flash memory can be addressed.The pinout seems to be verified as some of you have connected a card to an Arduino via a breadboard or even own PCBs.There are 19 address bus pins resulting in 219= 524288 addresses = 512k addresses.There are 8 data bus pins resulting in 512k addresses * 8 bit/address = 4 Mbits or 512 kBytes usable memory.The other pins on the connector are for VCC (5V), chip enable (CE), output enable (OE), write enable (WE).Some of you have been able to dump the whole 512 kByte memory of the chips.The memory layout still seems unknown, it's unlikely that they contain a "file system"... at least not a known standard one.The binary does not only seem to contain stripped(!) PES data but also preview images. (Where are they located? How can they be viewed? What format are they in?)The binary does not only seem to contain stripped(!) PES data but also preview images. (Where are they located? How can they be viewed? What format are they in?)To me, the following is not quite clear yet ...if all cards are writeable because they really need to be writeable by the embroidery machines - or only those "blank" cards that have been sold to write them by a PC.if there are cards that have a program input voltage (VPP) which is different than VCC. (I've read about chips requiring 12.0 Volts).what the commands in the code in the git repositoriesbrother_embroidery_card_experimentsorbrother-cart-emulator/is based on? Are those vendor-specific or do they comply with some standard (CFI, JEDEC, ...)? (Edit: Both seem to have used the SST39SF040-55-4I-WHE device which has "software command sequences" such as the magics 0x5555, 0x2AAA, etc in its datasheets as well as manufacturer ID (0xBF). Not sure though if the former that's standardized or Microchip-specific.)does the Brother embroidery machine only accept only certain flash memories? e.g. only from a few vendors?has someone tested if the Brother PED Basic and those 3rd party card readers/writers (Magic Box OESD, The Magic Box, Vikant Ultimate Box, EmbCard, ...) accept only certain flash memories? e.g. only from a few "expected vendors/models"? e.g. from the same chip vendor they included in their cards?are there any new findings about the layout of the binary/ card's flash memory?other methods than "hooking" into some Windows DLL (CardIO.dll) or executable or serial connection to get a properly formatted binary file?any new efforts in reverse engineering those card readers?has anyone tried to reverse engineer the firmware from one of those machines?how did you visualize the binary and find the preview bitmaps in there? I've tried with Gimp and was not successful with 1-bit aka monochrome raw image data imports.Or has everybody just given up or bought the old, expensive hardware?Those old "original" re-writeable cards and card readers/writers seem very expensive (probably because "rare") these days (card readers ˜100-200 €/USD, cards ˜80-120 €/USD). And for some only 32-bit machines seem to be supported. I am not sure if I really want to spend ˜80-120 €/USD for a used, old, pretty standard memory chip+PCB+connector that's maybe worth only ˜5-10 €/USD.

author: amyk
author_rank: Super Contributor
timestamp: August 17, 2024, 03:37:36 am
content: Quote from: maehw on August 11, 2024, 08:26:04 pmSomeone posted a picture of a card with an AM29F010, and another posted one with a MX29F400. Those are both 5V-only.Quote from: maehw on August 11, 2024, 08:26:04 pmThe SST39SF040 is also 5V-only and all the ones found so far seem to follow the standard parallel NOR flash commands, although I'm not sure which JEDEC standard it is.Quote from: maehw on August 11, 2024, 08:26:04 pmGiven that there's an ID function and part of that determines the capacity, I suspect that is the case.

author: maehw
author_rank: Newbie
timestamp: August 17, 2024, 03:07:11 pm
content: Thanks for sharing the bear's binary file. I've tried to reproduce the export and visualization of PEC data.However, I've experimented with the start offset as 0x2F327 something seems missing:See attached bear_0x2F327.png.With a different (earlier) start offset, I can see more of the bear: bear_0x2F023.png -- however, this may go too far into memory regions that are not PEC yet.Unfortunately, I could not find neither PES nor PEC headers (based onhttps://edutechwiki.unige.ch/en/Embroidery_format_PESandhttps://edutechwiki.unige.ch/en/Embroidery_format_PEC).Two code snippets; the first using Linux command line tool `dd` to extract the binary snippet out of the whole file (which goes by putty.txt here) as a new .pec file, the second one is a Python script importing the .pec file and storing the stitch data as PNG image file:Code:#/bin/bashbinary_name="bear"start_offset=0x2F023 # 0x2F327 # Starting byte offsetend_offset=0x321E7 # Ending byte offsetskip=$((start_offset)) # Number of bytes to skipcount=$((end_offset - start_offset + 1)) # Number of bytes to copydd if=${binary_name}.bin of=${binary_name}.pec bs=1 skip=$skip count=$countCode:import pyembroideryimport osfile_name="bear"pec_file_name=file_name+".pec"file_size=os.stat(pec_file_name).st_sizeprint(f"PEC file size: {file_size} bytes")pattern = pyembroidery.read_pec(pec_file_name)print(f"number of stitches: {len(pattern.stitches)}")print(f"number of items in threadlist: {len(pattern.threadlist)}")pyembroidery.write(pattern, file_name+".png")Other things I could not get working: the Vikant card emulator (another Python script)... or rather I could not get it working with the "Ultimate Explorer for Brother" (Serial port version). Even though I created virtual COM ports with com0com, only the Python side connected... and Vikant's Ultimate Explorer didn't want to open or even find the COM port. So this approach currently won't work for me to write own card binaries from PES files.Edit: Bear beared out, see bears_preview.png -- however, seems to be some kind of mirrored.

author: MarkMLl
author_rank: Frequent Contributor
timestamp: September 25, 2024, 09:34:15 am
content: I've updated my PES-reader program athttps://github.com/MarkMLl/pesdumpafter another user checked it and highlighted some compiler-version problems (my fault: I'd reverted to an old compiler and made some changes, then hadn't tested it with the most recent).Discussion athttps://github.com/MarkMLl/pesdump/pull/2has thisQuoteI've not yes attempted to follow the new file format up. If anybody finds themselves needing it then please speak up.MarkMLl

author: maehw
author_rank: Newbie
timestamp: January 28, 2025, 10:29:54 am
content: Hi all,this may be slightly off topic, but... it is still related to machine embroidery (and teaching) and some of yous might be interested in it:Do you know about TurtleStitch?QuoteUnfortunately, the project does not natively support the Brother/PES file format. I'd like to change that. Hence, I've forked the repository and tried to add the support. But, I am stuck at the moment and am seeking for support.. maybe also some of you are more familiar with the PEC/PES file format and could take a look here?https://github.com/backface/turtlestitch/pull/139Kind regards