Fremont Micro Devices - microcontroller programming - Page 1
Forum section: electronics / projects

author: socram
author_rank: Regular Contributor
timestamp: December 12, 2020, 05:16:52 pm
content: Hello, good evening everyone.I'm creating this thread to discuss about programming Fremont Micro Device's series of PIC clones, available atLCSCfor prices roughly the same of the awesomePadaukmicrocontroller lineup. For example, theFT60F211offers 1 Kword flash, 64 byte SRAM, 128 byte EEPROM for about 5 cents each by buying 150 units.These microcontrollers, just like Padauk's, have absolutely zero public documentation on how programming these work, and the manufacturer expects you to program them with either their standalone which isn't available on LCSC or any other reputable provider I've looked for, andgoes for about 40€ on AliExpress. I think, just as we did for the Padauk, we can do better.Now that we have fully reverse engineered Padauk's inner workings, have them supported in SDCC, and being cheaper than FMD's, one might wonder - what's the point?. Well, there's one advantage that FMD seems to offer vs Padauk's -how simple the programmer can get.After spending a couple hours looking online, I found the following valuable resources:Thanks toFMD's official programming manual, I found that these devices require only four wires: VCC, GND, clock and data. Unlike Padauk, there's no provisioning for Vpp that is complex to generate.Further looking online, I found that there are also what FMD calls "Link Bridge": a smaller, cheaper in-circuit programmer, which is available onAliExpress for 30€.This gets more interesting - not only we can clearly see that are no coils for elevating the voltage, but we can also see in one of the pictures the very IC they are using: an off-the-shelf STM32F103RB6T.Finally, looking deeper in FMD's programmer software, I found three files which looked suspiciously like ARM bytecode. These were:Ver1/AppUpdate.binVer3/AppUpdate.bin (load address 0x08008000)Ver3in1/AppUpdate.bin (load address 0x08004000)Thanks to the previous picture, I tried loading them under IDA using the asumption that they were STM32 firmwares and... oh boy they were:There are no debugging symbols. However, they're only about 50KB and are not obfuscated, meaning I've managed to manually and painstakingly decompile a good chunk of them.Thanks to all these sources, I'm glad to announce that I've found out how to:Enter the programming modeRead part of the flash contentsAnd the best thing of all: I've done it using an Arduino, with absolutely no extra hardware.SignalsFMD devices use four wires during programming:VCC, inside their normal operating rangeICSPDAT, the data pinICSPCLK, the clock pinGNDIf you have worked previously on Padauk, the signaling is pretty similar: the programmer always generates the clocking signal, and the data pin is shared and changes direction implicitly depending on the operation and the step they're into.For instance, sending 0xA3 would look like:Code:Sample: V V V V V V V V___ ___ ___ ___ ___ ___ ___ ___Clock: | | | | | | | | | | | | | | | |___| |___| |___| |___| |___| |___| |___| |___| |___________________ _______ _______Data: | | | | | |_| |_______________________| |_______| |__Data is sent and receivedleast significant first, and issampled at the falling edgeof the clock signal.Entering programming modeFor entering programming mode, all microcontrollers follow the same procedure:Code:def enter_prog():vcc_on()serial_write(data=0x1CA3, bits=16)delay_ms(70)There is no acknowledgement- the microcontroller will not reply with anything, and the only way to know it has entered successfully programming mode is to execute a command and check its return value.Programming opcodesThe programming protocol uses three different kind of opcodes:Implicit opcodeThey consist of a bare 5-bit opcode.Code:def op_execute(opcode):# Send opcodeserial_write(data=opcode, bits=5)Known such commands so far are:0x01: unknown meaning0x02: unknown meaning0x04: reset address counter0x05: increment address counter0x06: unknown meaning0x07: unknown meaningWrite opcodeThey consist of a 5-bit opcode, a 8-bit parameter, and an extra dummy 0 bit.Code:def op_write(opcode, parameter):# Send opcodeserial_write(data=opcode, bits=5)# Send the parameterserial_write(data=parameter, bits=8)# Dummy cycleserial_write(data=0, bits=1)Known such commands so far are:0x08: store parameter into LSB latch?0x09: store parameter into MSB latch?0x0A: change mode?Read opcodeThey consist of a 5-bit opcode, and the device replies with an 8-bit response, plus a dummy bit during which the device frees the data pin.Code:def op_read(opcode):# Send opcodeserial_write(data=opcode, bits=5)# Read responseresponse = serial_read(bits=8)# Dummy cycleserial_read(bits=1)return responseKnown such commands so far are:0x0C: read LSB from current position?0x0D: read MSB from current position?Programming sequencesUsing the opcodes explained above, the programmer defines the following sequences for programming the devices:Program memory readCode:def prog_read(word_count):# Set mode to 0x20, program flash readop_write(0xA, 0x20)# Reset address counterop_execute(0x4)words = []for i in range(word_count):# Read MSB and LSB. These two can be used in either ordermsb = op_read(0xD) & 0x7Flsb = op_read(0xC) & 0x7Fwords.append(msb << 7 | lsb)# Increment address counterop_execute(0x5)return wordsProgram memory writeCode:def prog_write(words):# ???op_write(0xA, 0x56);op_write(0xA, 0x20);op_write(0xA, 0x24);op_write(0x9, 0x1A);op_write(0x8, 0x00);op_execute(0x6);# Reset address pointerop_execute(0x4);# Iterate through words and write each onefor word in words:# Set into programming mode?op_write(0xA, 0x30)# Latch MSB and LSBop_write(0x9, (word >> 7) & 0x7F)op_write(0x8, word& 0x7F)# ???op_execute(0x1)op_execute(0x6)# Wait until the word is writtendelay_us(1500)# ???op_execute(0x7)# Increment address pointerop_execute(0x5);Program memory eraseCode:def prog_erase(words):# ???op_write(0xA, 0x20)op_write(0xA, 0x25)op_write(0x9, 0x1A)op_write(0x8, 0x08)op_execute(0x6)op_execute(0x4)op_write(0xA, 0x31)op_execute(0x2)# Wait until memory is eraseddelay_ms(50)# ???op_execute(0x7)TO-DOFigure out configuration flash commandsTry to make sense of the opcodes, maybe?Any help is welcome!

author: jmelson
author_rank: Super Contributor
timestamp: December 13, 2020, 11:34:10 pm
content: Quote from: socram on December 12, 2020, 05:16:52 pmThis is impossible, unless there is a bit-order reversing chip placed in the middle. It has to be one or the other.Jon

author: socram
author_rank: Regular Contributor
timestamp: December 14, 2020, 09:19:42 am
content: You are right, data is always sent LSB.I also found out how to read, write and erase main program memory. I'll edit the post once I got it fully understood and documented.

author: socram
author_rank: Regular Contributor
timestamp: December 15, 2020, 11:38:04 am
content: I have just updated the main post with how to erase, write and read the main program memory. There is still a considerable amount of work, though.

author: rameshd
author_rank: Newbie
timestamp: December 15, 2020, 01:44:19 pm
content: More Info:From the demo code we see that the FT60Fxx and FT62Fxx are PIC compatible with 16F684 or 16F685 and use the H-Tech C compiler version 9.83 which is actually XC8 1.00 Microchip compiler.Versions of Hi-Tech C are available on the Microchip site, but require an account signin. Older versions of XC8 are available on the same page:hxxps://www.microchip.com/development-tools/pic-and-dspic-downloads-archiveFollowing the link on the programmer board, we see that the companywww.origin-gd.com(Shenzhen Origin Tech Co.) produces similar chips and in fact their MS80Fxx and MS81Fxx are exactly the same as the Fremont Micro above named parts(Probably the other parts are also the same).Origin Tech has lot more documenttation including the IDE as well as demo video showing the PIC compatibility of their chips. They actually Use MPLAB to program their chips.Origin Tech's online shopping pointer page has lot more interesting info, where are they are claiming the PIC compatibility and the corresponding PIC parts.See: hxxps://yueyd.world.taobao.com/In the demo examples, we see the compatible PIC chip numbes.We see that the MDT part MS80F0801A, claiming same as 12F508/509, is priced at 0.21 yuan(about 3 cents).Also on the Origin Tech's site, they list MDT as their associate site. MDT's parts, available on LCSC, are not as cheap but still around $0.10 to 0.20.MDT's HMC1509 (~ same as 12F509) is listed at 0.30 yuan on Taobao.MDT also claim compatibility with the older PIC chips.@socram: If you own the red programmer board, could you post a hi-res version image of the front and the back.Ramesh

author: socram
author_rank: Regular Contributor
timestamp: December 15, 2020, 02:38:15 pm
content: Quote from: rameshd on December 15, 2020, 01:44:19 pmNow that's pretty interesting, good find. I tried looking for the equivalent parts but I couldn't find anything.For scientific research, I tried programming the Fremont parts using my MiniPro programmer and it failed with an overcurrent protection error. I have no clue about what is the original programming protocol in Microchip PICs, so I don't know if it resembles this one and it's just failing because MiniPro uses the high-voltage mode and these only support programming in low voltage mode, or if they are entirely different beasts.Quote from: rameshd on December 15, 2020, 01:44:19 pmHello Rameshd. I do not own those programmers sadly. The pictures are from Taobao listings I found.Marcos

author: amyk
author_rank: Super Contributor
timestamp: December 15, 2020, 02:45:44 pm
content: PIC programming specifications are readily available - take a look and see if you can find any similarities.

author: socram
author_rank: Regular Contributor
timestamp: December 15, 2020, 02:52:38 pm
content: http://ww1.microchip.com/downloads/en/DeviceDoc/40001204J.pdfDoesn't seem to be compatible. Microchip uses 6-bit commands with optional 14-bit parameters, while these Fremont devices use 5-bit commands with optional 8-bit parameters.

author: ali_asadzadeh
author_rank: Super Contributor
timestamp: December 15, 2020, 03:21:07 pm
content: Nice 8-bit CPU wars at low prices

author: rameshd
author_rank: Newbie
timestamp: December 15, 2020, 09:09:13 pm
content: Programming the FMD devices is not straightforward. I assumed you had already seen some related docs.Here are two Google translated docs. There is some info in those.NOTE: The second is from origin-GD, but the programmer is the same.

author: spth
author_rank: Regular Contributor
timestamp: December 16, 2020, 11:48:54 am
content: SDCC does support PIC. But the PIC backends are currently unmaintained, and not in the best state (clearly worse than pdk, stm8, z80, mcs51, etc). Any help would be welcome.

author: spth
author_rank: Regular Contributor
timestamp: December 16, 2020, 01:06:12 pm
content: Quote from: spth on December 16, 2020, 11:48:54 amAlso, SDCC uses gputils assembler / linker for the PIC backends. gputils is AFAIK also unmaintained. And the Debian package also hasn't been updated in a while (the packaged gputils version is 1.4.0 from 2014, while there were some releases after that, the latest being 1.5.0 in 2016).So there is plenty of work for someone wanting to keep the free toolchain for PIC working.

author: spth
author_rank: Regular Contributor
timestamp: December 16, 2020, 01:11:35 pm
content: Quote from: socram on December 15, 2020, 02:52:38 pmWikipedia says ELAN Microelectronics also makes PIC-"clones" with 13-bit istructions, some of which (e.g. addlw and retlw) fit your description:https://en.wikipedia.org/wiki/PIC_instruction_listingsThough that page also claims that Padauk are PIC-like, which IMO, they aren't.

author: socram
author_rank: Regular Contributor
timestamp: December 16, 2020, 07:21:38 pm
content: Quote from: spth on December 16, 2020, 01:11:35 pmNo no, I was talking about the programming commands, the ones sent to the device via the ISP. The device themselves do seem to use standard 14-bit PIC instructions, which would make it possible to run a 1:1 PIC program in one of these.

author: spth
author_rank: Regular Contributor
timestamp: December 17, 2020, 10:25:10 am
content: Quote from: socram on December 16, 2020, 07:21:38 pmOk, so it looks we can just use the existing SDCC/gputils toolchain. How about the I/O? Is it the same as some PIC? Will we need new headers for these devices?

author: retiredfeline
author_rank: Frequent Contributor
timestamp: December 20, 2020, 04:17:37 pm
content: Quote from: spth on December 16, 2020, 01:06:12 pmWas there a reason why gputils was chosen instead of aspic from the asxxxx family? Aspic came after the choice was made?

author: spth
author_rank: Regular Contributor
timestamp: December 21, 2020, 10:12:14 am
content: Quote from: retiredfeline on December 20, 2020, 04:17:37 pmI don't know. AFAIK, the pic ports existed before any of the current SDCC developers joined the project.

author: tim_
author_rank: Regular Contributor
timestamp: January 05, 2021, 06:50:15 pm
content: This is quite interesting. I am a bit confused about your examples. They seem to use python pseudocode, yet you state that you use an Arduino? How does your set up work?Were you able to successfully write a device? I received some from LCSC now, still not sure what to do with them(Btw, the 6 pin FT60F210-URT is now also available)

author: danymogh
author_rank: Regular Contributor
timestamp: February 03, 2021, 05:36:54 pm
content: I've been monitoring the PDK and then found this thread.I was looking for an extremely cheap MCU with almost 1k flash and 128 bytes RAM and EEPROM.first I found PDK and it looked fantastic, however, there was a problem and that was their IDE which doesn't support ANSI C. after a while I found out about free-PDK and then SDCC. so it all seemed to be coming together. I build the Free-Paduak programmer with no problem and was about to start the development that I found out that the SDCC doesn't fully support pdk13 yet and also it's buggy and doesn't fully support ANSI-C (yes there are some restrictions)I had read about other low cents MCUs like the MS80 that are pic clones however when I asked a distributer he said they are not 1:1 compatible until I read this post. I think It all makes sense now.IMO the FMD and MS80s (origin-gd) are way more superior than the PDK now because of the following:Feature ----------------------- PDK -------- FMD(other PIC clones)=============================================Price ---------- >0.05$ ----- >0.05$Core ------------ FPPA -------- PICEEPROM ------------- NO -------- YESStandard Compiler ------------- NO --------- YEScheap programmer ------------ YES --------- NO (not yet!)I first thought that by PIC-clone they meant only the CORE is cloned and other peripherals might be different. but now I see that there are some series that are actually a clone and a 1:1 binary clone is possible. the only problem so far is the programmer which is a bit expensive. even that uses STM32 and it seems @socram has already got a dump of it. so why build another programmer and have the hassle of the PDK programmer? i think it's way easier and cheaper to just clone the existing programmer!the IDE is HI-TECH compiler and I believe for the 1:1 chips we can even use MP-LAB and the XC8 compilers already!does anyone have a dump of the STM32 on the programmer?also why isn't there any file in the IDE section of FMD ?

author: tim_
author_rank: Regular Contributor
timestamp: February 03, 2021, 06:02:46 pm
content: Your list does not exactly reveal why the FMD devices would be superiorThe older PICs are still a horrible architecture, PDK14/15 is much nicher to be honest. Also consider that Microchip may object cloning of their devices. They actually sued MDT for doing the same.However, being able to program the FMD devices with a low voltage programmer would be a huge plus. I have not been able to look into this myself so far, I am hoping there will be some progress on that.

author: danymogh
author_rank: Regular Contributor
timestamp: February 03, 2021, 08:36:06 pm
content: Quote from: tim_ on February 03, 2021, 06:02:46 pmsuperior in the sense of low-end MCUs. I have never heard that the older PICs were horrible. I'm not talking about the technology of the MCU core, I'm talking about its robustness. PIC core was designed by a US company and it has been in the market long enough. It's correct they may sue for cloning their IP but hey it's china! the worst that can happen to them is being added to the list of sanctions. but they'd still be able to sell their product one way or another.another important aspect is the compiler. SDCC is not mature while HI-TECH and XC8 are heavily maintained. the EEPROM is also another plus which non of the PDK series have. to interface an external EEPROM at least 1 pin is needed, let alone the burden of code to read and write to it! in small flash size, such things are very important.

author: danymogh
author_rank: Regular Contributor
timestamp: February 07, 2021, 06:07:30 pm
content: I just tried compiling the same program for a PMS154C and MS80F0801A MCUthe results are interesting:apart from device-specific startup code and initialization the rest of the program was the same. since my code doesn't fit for the PDK I now have to switch to the MS80.Device PMS154C MS80F0801A===============================Flash Size 2KW 1KWFlash usage >2KW 736byteswords!RAM (bytes) 124 56Compiler SDCC HI-TECHlet alone the fact that MS80 has 128 bytes of EEPROM which I need and the pdk doesn't have any.the major difference for me is the RAM usage! that is a huge difference! my program only has 32 bytes of global data and the rest are the variables for functions that should go on the stack. I have no idea why SDCC gobbles that much memory. once again the PIC core is more robust and the compilers are way more mature.edit: according to HI-TECH manual the only Divergence from ANSI C it has is the lack of support for reentrant functions whereas SDCC has a lot more limitations!

author: danymogh
author_rank: Regular Contributor
timestamp: February 08, 2021, 06:07:42 pm
content: Quote from: socram on December 15, 2020, 11:38:04 amThere are 3 update .bin files inside the Origin writer folder:Ver3in1Ver3Ver1have you figured out which file is for which programmer?I think 1 should be for the one with the LCD which is used for batch programming.another one should be for the Link Bridge programmer.I suppose there is another programmer out there? BTW both programmers are much cheaper on taobao.

author: LovelyA72
author_rank: Regular Contributor
timestamp: February 15, 2021, 07:27:57 pm
content: I am getting a Fremont ICE and programmer (they're not expensive so I picked them up while purchasing my padauk ICE and writer). I can provide some high res photos and capture some programming sequences with my FX2LP logic analyzer. Do you guys want to see a specific IC's sequence or any IC will do?

author: tim_
author_rank: Regular Contributor
timestamp: March 04, 2021, 08:35:14 am
content: Quote from: LovelyA72 on February 15, 2021, 07:27:57 pmMaybe some of the cheaper ones like FT60F211 or FT60F210.

author: tim_
author_rank: Regular Contributor
timestamp: March 04, 2021, 08:36:37 am
content: Btw, it looks like the programmer uses an STM32F103 and only few additional devices. Are the schematics available anywhere and the firmware? Maybe it is easily possible to clone the programmer with a bluepill.

author: LovelyA72
author_rank: Regular Contributor
timestamp: March 06, 2021, 02:19:18 pm
content: Quote from: tim_ on March 04, 2021, 08:36:37 amUnfortunately, the sch is not available anywhere. The firmware is available with their IDE or writer software.

author: danymogh
author_rank: Regular Contributor
timestamp: April 15, 2021, 10:21:01 pm
content: I am in possession of both programmers now.I tested the MCUs and boy they get the job done! much better than the Padauk.another interesting fact is that there's also another company named hqwtech.com that has another series of these MCUs with different part numbers. in my opinion, there should be a parent company that is selling the chips to the other companies and they just rebrand them. the architecture is all the same. my MS80x doesn't have any print on them while the FMDs do. FMD has its own IDE which is a clone of origin-gd IDEThere are 2 types of programmers for these MCUs.one that is the red board and is called the bridge (mine [bought from hqwtech] has a black solder mask and is versioned 2.6 and the components are a little different) and works with all the IDEs of the companies. it's capable of debugging and programming via the IDE only.the other programmer is used for batch programming and doesn't do debugging. can be run offline and has a couple of features like burning FLASH, EEPROM, OSC calibration, checking, rolling code (where part of the EEPROM is modified and the value is incremented sequentially which I believe is mostly used for serial numbering and HCS3xx cloning). also has a Rx,Tx interface where you can send commands to the programmer via serial for things like flash and EEPROM modification on the fly for every MCU before programming it.

author: danymogh
author_rank: Regular Contributor
timestamp: April 20, 2021, 12:51:35 pm
content: update:the FMD IDE and ORIGIN IDE are basically the same. you can burn and load HEX files produced by both IDES to both chips.if you look at the datasheets of MS8x and FMD you'll see that they're basically the same, (on page 8 of the MS81x series datasheet you'll see that Origin even forgot to change some FMD register names! )however the unlike the PICs it's not possible to put "#pragma config xxx" and it seems that the IDE doesn't let you config them by code and it put's it's own special coding in the HEX file. hence there's some kind of obfuscation involved. if you see the HEX file produced by the IDE and you look at the one before the last line you'll see the config options there. as opposed to what says in the datasheet, the config is written starting at address 0x4000 (instead of 0x2000), and I think the programmer will detect that and apply the correct address when programming.I wanted to test the features the config options provide, and to my surprise, the EEPROM section has no protection and there's no config to protect it. since these chips are clones of the PICs, I thought the manufacturer might be hiding some features but looking at the fusebits of PICs, I noticed that the UCFG0 mapping is different. however, some bitfields are left as preserved while they could actually do something that's not stated in the datasheet, (like the case in padauk MCUs). Chinese datasheets are very horrible and usually, there are always some parts left out and not explained.long story short, to test the preserved bits in the config (UCFGx) section, the HEX file must be edited manually but it's not a straightforward process and it seems some additional work is required.in case anyone's interested here is my finding on the cryptic config options that the IDE produces.in the HEX file you'll see something like this. on the one before the last line which is the standard intel HEX format.Code:+-----+------+------+-----------------------------------+----------+| len | addr | type | data | checksum |+-----+------+------+-----------------------------------+----------+| 0D | 4000 | 00 | D4 03 E0 09 F6 05 FF 0D0102000108 | E0 |+-----+------+------+-----------------------------------+----------+the data part changes according to the options you select in the IDE, this option also includes the ones in the project -> properties menu like number of programming , etc. the bytes are scattered like this:Code:+-------+------+-------+------+-------+------+------------------+| UCFG0 | UNK0 | UCFG1 | UNK1 | UCFG2 | UNK2 | rest of data |+-------+------+-------+------+-------+------+------------------+| D4 | 03 | E0 | 09 | F6 | 05 | FF 0D0102000108 |+-------+------+-------+------+-------+------+------------------+I could only observe that the UCFG0-2 positions like the table above and the other parts remain unknown and also if the UCFG0 part changes some other part may change as well so it's not possible to manually modify the UCFG's and try out different options because the programmer will detect this as error (not tested).the UNK0 and UNK1 seem to remain constant on all mixture of configurations but UNK2 changes. also the UNK values differ in each MS8x or FT6x series. the above table is for MS81 series.if anyone has any clue I'm interested to try things out.

author: HoangAnh
author_rank: Newbie
timestamp: November 18, 2021, 10:04:35 am
content: Hi everyone,I replied on this topic (But I don't understand why I'm banned. Sorry if I doing something wrong, please let me know if I'm wrong).I found this MCU MS80F0601A on the Taobao. But I'm confusing about which programmer should I have to buy?I found aboard, but I'm not sure that it correctly what I want.And I have another question, this MCU can be re-programming?Thank all.

author: Evgeni61
author_rank: Newbie
timestamp: April 03, 2022, 02:01:06 pm
content: Hello friends. I can't find the FMD-IDE software. Can you help me? Thanks

author: Evgeni61
author_rank: Newbie
timestamp: April 03, 2022, 04:46:32 pm
content: How can I find out the compatibility of FMD chips with PIC chips? Does anyone have a table?

author: Davor
author_rank: Contributor
timestamp: April 04, 2022, 05:58:07 pm
content: Interestig thread on wrong subforum, should be moved here:https://www.eevblog.com/forum/microcontrollers/

author: Kukaz
author_rank: Newbie
timestamp: June 22, 2022, 07:56:35 am
content: Quote from: LovelyA72 on March 06, 2021, 02:19:18 pm

author: buttim
author_rank: Contributor
timestamp: August 16, 2022, 11:05:55 am
content: Hi socram. Is your Arduino code available somewhere? I'm trying to identify an MCU with erased markings that might be from Fremont Micro.Thanks!

author: Bikkel
author_rank: Newbie
timestamp: August 16, 2022, 11:23:06 am
content: The peripherals look the same. There one thing they differ on is the interrupt handling. It seems they use a single interrupt in which you must decide what causes the interrupt. I am still pulling the Chinese data sheets through google translate.

author: tongdaren
author_rank: Newbie
timestamp: August 20, 2022, 11:25:45 am
content: Programmer need bootloader

author: gashtaan
author_rank: Regular Contributor
timestamp: March 05, 2023, 09:59:45 am
content: Hi,anyone knows how FMD MCUs with flash protection enabled behave? I'm playing with FT61F043* (probably, no part number printed on IC, but pinout suggests it) used in some power meter. When I read IC ID, it responses with seemingly correct data:0444 3F12 030A 3F12 010A 0510 194A 29D0 18B1 3FFF 3FFF 3FFF 3FFF 3FFF 3FFF 3FFF(the programmer firmware checks the fist byte to 0x04 to validate it)But when I reading the flash memory the data seems somehow scrambled:1F9F 3F9F 0F9F 0F9F 0FFF 0F9F 0FFF 0F9F 0FFF 1F9F 3F9F 1F9F 3F9F 2FBF 1F9F 3F9F1F9F 0FBF 3FFF 1F9F 0FBF 3FFF 1F9F 0FBF 3FFF 1F9F 0FBF 2FFF 1F9F 0FDF 2F9F 0FDF...I guess the reason is enabled flash protection, although I expected reading just 0x0000 or 0x3FFF in such case.

author: buttim
author_rank: Contributor
timestamp: March 06, 2023, 03:28:30 pm
content: Did you manage to download the Fremont IDE gashtaan? It seems the download is disabled...

author: Davor
author_rank: Contributor
timestamp: March 06, 2023, 10:55:40 pm
content: Link for FMD IDE 3.0.9E:https://we.tl/t-BWLkoqhfch

author: buttim
author_rank: Contributor
timestamp: March 06, 2023, 10:59:11 pm
content: Thanks a lot! May I ask you how did you get it?

author: Davor
author_rank: Contributor
timestamp: March 06, 2023, 11:07:04 pm
content: No problem, it was posted here:https://www.eevblog.com/forum/microcontrollers/fmd-ide-(fremont-micro-devices)-i-cant-find-and-download-it/msg4569175/#msg4569175

author: buttim
author_rank: Contributor
timestamp: March 06, 2023, 11:37:03 pm
content: One more question: have you (or anybody else) figured out how to read the FMD chips markings?My FT60F211-RB read "B2H7CKH"...

author: gashtaan
author_rank: Regular Contributor
timestamp: March 07, 2023, 07:27:23 am
content: Quote from: buttim on March 06, 2023, 03:28:30 pmNo, I looked only into the programmer firmware and that is free to download.

author: danymogh
author_rank: Regular Contributor
timestamp: March 07, 2023, 04:11:26 pm
content: Quote from: gashtaan on March 05, 2023, 09:59:45 amif I enable Flash protection the programmer reads 0xFFF for all bytes. so maybe you have faulty wiring? or some other setup or chips?could you enable EEPROM protection by any chance?

author: gashtaan
author_rank: Regular Contributor
timestamp: March 07, 2023, 05:34:36 pm
content: Quote from: danymogh on March 07, 2023, 04:11:26 pmAre you sure it reads 0xFFF not 0x3FFF?I doubt the faulty wiring is the problem. I would expect some randomness it such case, but I got the same data every time, even for various clock timing (15ns vs 150ns).The problem is that I have no clue what data should I expect to be read. Here are other readings:UCFG data:09A4 07D2 02F3 03C0 0508 02FF 02FF 07F8 0FFF 0FFF 00FF 00FF 3FFF 3FFF 3FFF 3FFF...EEPROM:40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00...Attaching scope photo of one sequence of reading data from flash (0x0D command, read value, 0x0C command, read value, 0x05 command). Blue signal is the data, green the clock and yellow is just to show, when the data are transmitted from the FMD.

author: buttim
author_rank: Contributor
timestamp: March 07, 2023, 05:37:53 pm
content: Data, clock and... ?

author: gashtaan
author_rank: Regular Contributor
timestamp: March 07, 2023, 05:41:32 pm
content: Quote from: buttim on March 07, 2023, 05:37:53 pmYellow is generated by me for clarity, its high when I set ISPDAT to input, the blue data signal is generated by FMD at that time.

author: buttim
author_rank: Contributor
timestamp: March 07, 2023, 05:43:26 pm
content: I realized only now you're using your own programmer. Am I right?Would you mind sharing the code?

author: gashtaan
author_rank: Regular Contributor
timestamp: March 07, 2023, 05:48:54 pm
content: Quote from: buttim on March 07, 2023, 05:43:26 pmSure, later when it'll be actually working code I'll put it to github

author: buttim
author_rank: Contributor
timestamp: March 07, 2023, 05:51:17 pm
content: Are you using an Arduino like the original poster did?It would be actually interesting to see the unfinished code but I understand your desire to clean before publishing.Just don't delete everything by mistake. As I did...

author: gashtaan
author_rank: Regular Contributor
timestamp: March 07, 2023, 06:11:10 pm
content: Quote from: buttim on March 07, 2023, 05:51:17 pmYes, I chose Arduino Nano for this project, but it doesn't really matter.Even if I did delete the code, it's just few lines of the code, it wouldn't be a irreversible loss. Reverse engineering is the hard job here, so many thanks to @socram for valuable inspiration.

author: buttim
author_rank: Contributor
timestamp: March 07, 2023, 08:31:56 pm
content: Yes I did the same. My code seemed to work at first but I have some problem reading the eprom. I'm eager to see your code (and use it too)

author: buttim
author_rank: Contributor
timestamp: March 22, 2023, 10:21:02 pm
content: Quote from: gashtaan on March 07, 2023, 05:48:54 pmHi gashtaan, did you manage to solve the issue?

author: gashtaan
author_rank: Regular Contributor
timestamp: March 23, 2023, 04:43:05 am
content: Quote from: buttim on March 22, 2023, 10:21:02 pmNot yet. I've ordered some FMD to experiment with, but it was from AliExpress, so this project is postponed for some weeks or even months... if I'm lucky and it'll be actually working IC.

author: danymogh
author_rank: Regular Contributor
timestamp: April 08, 2023, 05:51:19 pm
content: @gashtanI don't have my programmer right now to check for the flash readout protection.Could you by any chance discover if it's possible to protect the EEPROM as well?I can't find any info on this anywhere. I'm only making assumptions they forgot to implement such protection.Also, what is the difference between FT61F021 and FT61FC21?their datasheet is almost identical besides very small differences in electrical characteristics.On their new website, FMD also has a new part number (the E series) such as FT60E021 which is again identical to the F series. The only visible difference is the DROM (EEPROM) data endurance which is 100k compared to 1000k of F series. This is very strange, why did they manufacture a new product with less endurance?I'm planning to manufacture large quantities of a small device for some time now and I need the EEPROM but still can't make a decision if the FMD is a good choice or not. Their price is super competitive.

author: buttim
author_rank: Contributor
timestamp: April 08, 2023, 09:14:44 pm
content: Quote from: danymogh on April 08, 2023, 05:51:19 pmHi danymogh, would you be so kind (whenever you are again in possession of your programmer) to post here a logic analyzer capture of the signals? (I'm assuming you have one...)I have this strong feeling that the information provided in this thread is missing something crucial, since at least 2 of use have already tried and failed at replicating the results of the original poster.That would be nice indeed!

author: kkstun
author_rank: Newbie
timestamp: April 09, 2023, 01:53:32 am
content: https://oshwhub.com/kktun/PICjian-rong-dan-pian-ji-xue-xi-This is worked!

author: buttim
author_rank: Contributor
timestamp: April 09, 2023, 07:55:37 am
content: Quote from: kkstun on April 09, 2023, 01:53:32 amInteresting, but I can't download without registering, and cannot register without giving away my phone number. LOL

author: danymogh
author_rank: Regular Contributor
timestamp: April 11, 2023, 10:56:46 am
content: Quote from: kkstun on April 09, 2023, 01:53:32 amThis looks very good and very cheap to make. Such a shame our Chinese friends always restrict their content. you can't even signup using another country's phone number!however, looking at just the screenshots of the PC software. it's a programmer-only version and does not have debugging features enabled. Yet it's very cheap (the PCB and components won't cost more than 3$) and nice to have.I'm mainly interested in the .Net program. It'll help a lot in analyzing the programming sequence.@buttimI have 2 programmers. they are the old series. the yellow one is for batch production and does not support debugging.the black one (Link) is used for programming and debugging however it doesn't support batch programming for production.both work with FMD and Origin IDE.I do not have a logic analyzer, unfortunately. (the only missing tool in my arsenal!)I've been in possession of both for about 2 years now and let me tell you one thing. even though the ICs are super cheap and well-suited for small applications, the support, documentation, and everything else is a headache!if you encounter a problem, it's highly unlikely you'll find documentation or help other than what is already available. also, keep in mind that the silicon of the ICs have had several revisions in just 3 years to fix whatever they messed up in previous revisions. This means unreliable production.I've tried contacting FMD via email or even suppliers to ask for support and never got a response back! they even don't publish the IDE on their website and you'll have to get it from suppliers manually! the compiler is XC8 in the heart but they rebranded it as GCC! These are a lot of red flags in engineering, however, because of the cheap price people still consider them.

author: gashtaan
author_rank: Regular Contributor
timestamp: April 11, 2023, 02:30:25 pm
content: Quote from: buttim on April 08, 2023, 09:14:44 pmThe FMD programmer support 73 distinct MCU types with various differences in communication. If one works OK it doesn't mean the other will work too. You should find out what type are ICs you are interested in (Setting.bd file) and look into the firmware code for details.

author: buttim
author_rank: Contributor
timestamp: April 11, 2023, 06:02:22 pm
content: Quote from: danymogh on April 11, 2023, 10:56:46 amDo yourself a favor and buy a "24MHz 8 channels logic analyzer". They're dirty cheap and good enough for most tasks. For example:https://it.aliexpress.com/item/1005005357814678.htmlQuote from: danymogh on April 11, 2023, 10:56:46 amI know... I also tried to contact FMD to no avail. I'm mostly interested in reverse engineering and maybe rewriting firmware for devices containing an FMD MCU, not designing things. I think a very simple programmer would do.Quote from: gashtaan on April 11, 2023, 02:30:25 pmThe original poster did the heavy lifting. I think we're just missing some tiny (but important!) detail. Restarting the original reverse engineering is overkill for me. If some of our chinese friends here wants to upload the CH552 firmware and .Net code, that would be great. Otherwise I'll just do something else

author: gashtaan
author_rank: Regular Contributor
timestamp: April 11, 2023, 06:15:46 pm
content: Quote from: buttim on April 11, 2023, 06:02:22 pmThe programmer firmware is few kB of simple and straightforward code, the most of the know-how to begin with is already here. It just doesn't make a sense that you are interested in reverse engineering but at the same time you refuse to do any.

author: buttim
author_rank: Contributor
timestamp: April 11, 2023, 06:23:09 pm
content: Quote from: gashtaan on April 11, 2023, 06:15:46 pmWith your consent... It's me who decides what makes sense to do for me or not. I have no intention of reverse engineering thefirmwareof the devices (which would probably be protected anyway), but thehardwarefor eventually writing some alternative code. Reverse engineering the programmer (and the PC software controlling the programmer) is probably behind my capabilities and sure enough beyond my motivation.If it was such a simple task it's so strange you equally failed at writing a programmer.

author: gashtaan
author_rank: Regular Contributor
timestamp: April 11, 2023, 06:55:29 pm
content: Quote from: buttim on April 11, 2023, 06:23:09 pmSorry, it's up to you of course. But just to clarify, I have no need to write a programmer. I just wanted to download the firmware to reverse engineer some communication between FMD MCU and other IC, I failed to do it, because it's protected... but this is a completely different story. Though I did some changes to EEPROM, programming or erasing the flash is not much different.

author: gashtaan
author_rank: Regular Contributor
timestamp: April 13, 2023, 03:22:32 pm
content: Quote from: gashtaan on March 05, 2023, 09:59:45 amIt's really some kind of flash memory protection. I finally got some spare FMD MCU, so I played with it a bit. When I erase it and then flash it, I read the same data as I wrote to it, so my communication with the chip is definitely OK. Although I don't yet know how to disable CPB bit of UCGF0 register to test it further... any thoughts where these bits are placed and/or how to change them?

author: kkstun
author_rank: Newbie
timestamp: April 14, 2023, 01:56:37 am
content: I get it for youhttps://www.123pan.com/s/kEQbVv-KzSsH.html提取码:bXgN

author: kkstun
author_rank: Newbie
timestamp: April 14, 2023, 02:05:16 am
content: I found that this fmd（ft6x）is not as cheap as that PDK（padauk），PFS122 just $0.04 ...PFS1221 adc 12bit x 12ch io14 rom 2KW ram 128 -- 8bit x 2 CMP x 1 R-ADCpadauk-programmer herehttps://www.eevblog.com/forum/blog/eevblog-1144-padauk-programmer-reverse-engineering

author: gashtaan
author_rank: Regular Contributor
timestamp: April 14, 2023, 05:56:37 am
content: Quote from: gashtaan on April 13, 2023, 03:22:32 pmFound it. When I enable flash protection with mentioned bit, it doesn't return all 0x3FFF, but data where almost all bits are set to 1 with few of them preserved. I guess in these MCUs the instructions are encoded in 12bits instead of all 14bits.Original data:2040 2244 2448 264C 2850 2A54 2C58 2E5C 3060 3264 3468 366C 3870 3A74 3C78 3E7C0000 0204 0408 060C 0810 0A14 0C18 0E1C 1020 1224 1428 162C 1830 1A34 1C38 1E3CProtected data:2FDF 2FDF 2FDF 2FDF 2FDF 2FDF 2FDF 2FDF 3FFF 3FFF 3FFF 3FFF 3FFF 3FFF 3FFF 3FFF0F9F 0F9F 0F9F 0F9F 0F9F 0F9F 0F9F 0F9F 1FBF 1FBF 1FBF 1FBF 1FBF 1FBF 1FBF 1FBF

author: buttim
author_rank: Contributor
timestamp: April 14, 2023, 10:46:43 pm
content: Which was the solution for writing UCFG0?

author: gashtaan
author_rank: Regular Contributor
timestamp: April 15, 2023, 04:43:25 am
content: Unsurprisingly, UCFG0 is stored in first word of PROM block like it's mentioned in datasheets. What is not mentioned is that there are also stored upper 4-bits of the flash checksum, so it's a bit misleading.According the datasheet, this PROM content is copied to somewhere else after every reset, so I guess it could be prone to glitching... but I'm not going any further with these MCUs.

author: buttim
author_rank: Contributor
timestamp: April 15, 2023, 09:37:50 am
content: Quote from: gashtaan on April 15, 2023, 04:43:25 amAnd how can you read at a specified address? Socram only describes a "reset address pointer" operation, so that you always have to read the whole address space.

author: danymogh
author_rank: Regular Contributor
timestamp: May 04, 2023, 06:01:49 pm
content: Quote from: kkstun on April 14, 2023, 01:56:37 amThe link is broken. can you reupload it, please?Quote from: gashtaan on April 15, 2023, 04:43:25 amto make sense of the UCFG register , I think you need to reverse the IDE. if you pay attention to the address register and values generated by the IDE , you'll see that part is sort of obfuscated.

author: gashtaan
author_rank: Regular Contributor
timestamp: May 04, 2023, 06:32:52 pm
content: Quote from: danymogh on May 04, 2023, 06:01:49 pmI wanted to but all links to download it were already dead.

author: kkstun
author_rank: Newbie
timestamp: May 15, 2023, 08:06:41 am
content: https://www.123pan.com/s/kEQbVv-X3lsH.html提取码:gVis

author: buttim
author_rank: Contributor
timestamp: May 15, 2023, 09:42:16 am
content: Quote from: kkstun on May 15, 2023, 08:06:41 am*** WARNING! ***Both Google and Microsoft report malware in the downloaded file. Beware

author: kkstun
author_rank: Newbie
timestamp: June 07, 2023, 12:45:59 am
content: Misjudgment.You can run in sandbox .

author: coromonadalix
author_rank: Super Contributor
timestamp: June 07, 2023, 04:43:27 pm
content: instead of posting theses kind of link can some one download it and share it elsewhere

author: danymogh
author_rank: Regular Contributor
timestamp: September 15, 2023, 06:50:36 pm
content: latest FMD IDE 3.1.1.3https://mega.nz/file/hx50XK6A#I1PEoT1RJTD9Ifqt290umfxOprflcOLVQWQSgMdT3NM

author: user1234
author_rank: Newbie
timestamp: November 02, 2023, 10:32:07 pm
content: Quote from: kkstun on May 15, 2023, 08:06:41 amThe link is broken. can you reupload it, please?

author: Kukaz
author_rank: Newbie
timestamp: December 27, 2023, 02:27:50 pm
content: Hi, guysCan anyone send me a good quality photo of the back side of this board?Very much so grateful !

author: hassana
author_rank: Newbie
timestamp: December 29, 2023, 07:05:13 am
content: is it possible to test code of FMD using proteus?I want to use FT60E211 to measure pulse width range between 200us ~ 30mshow to do it?

author: zulea1
author_rank: Newbie
timestamp: May 23, 2024, 08:00:38 am
content: HiHere is attached FMD-Link V2.7 schematics and firmware (full and boot only).Tested using STM32F103CBT6 and work well with FMDIDE 3.1.1.3For FMDProgrammer need some older version, I have only 5.3.6.5 and this not support this "old" FMD-Link hardware.I have FMD-Link v4.7 hardware in preparation, already hacked firmware and extracted boot, but waiting for FT32F072 ICs to arrive.They (FMD) used "own made" ones version of F072, and this have different USB peripheral architecture than reglular STM32F072 (different registers addresses for entire USB peripheral).ZuleaP.S. If somebody have some older versions of FMDIDE and/or FMDProgrammer please share somehow. Thanks in advance.

author: grinux
author_rank: Newbie
timestamp: June 17, 2024, 08:12:33 pm
content: Hi guys. Short question. I have Aliexpress motorcycle dashboard based on ft62f0g. Currently, i'm an arm\cortex guy and never dealt with PIC before. I do not want to go too deep right now and just wish to know is it possible to reset the chip to unlock it to be able to write and debug my own firmware using FMD tools?Don't want to spend on FMD-Link if finally need to solder a new chip due to not being able to load and debug code in the original one.

author: gashtaan
author_rank: Regular Contributor
timestamp: June 18, 2024, 04:36:42 am
content: Quote from: grinux on June 17, 2024, 08:12:33 pmDo you have a datasheet for it? It should be mentioned there, look for the UCFG registers. I have no experience with FT62F0G specifically, but AFAIK, the flash protection fuse can be reset by full chip erase.

author: grinux
author_rank: Newbie
timestamp: June 18, 2024, 06:39:18 am
content: Quote from: gashtaan on June 18, 2024, 04:36:42 amYes, i have one from the official site. Will take a closer look. Thanks for the tip.

author: Kukaz
author_rank: Newbie
timestamp: June 18, 2024, 07:29:03 am
content: Hello zulea1For the FMDLink version, firmware 3in1 should be suitable.But, it is necessary that pin C9 be float...

author: DIMM-bl4
author_rank: Contributor
timestamp: June 27, 2024, 01:20:25 pm
content: Hi, everyone.I've also tryed to made simple and cheap solution for FMD MCU programming.Instead of copying their hardware programmer, I just take its firmware, reverse it, and ported functions to CH341 hardware.There is much differences for two big group of MCUs - Standart and Enhanced (termins from FMDIDE).Both protocols tested: FT61F133A for Standart F-Series, and FT64F0A3 for Enhanced F-Series.Not say that was easy, and want to thanks to this topic: to TSsocramfor great start information, togashtaanfor helpful posts, and tokkstunfor his specific solution.As addition hardware, I use handmade PIC-adapter (two pair of npn+pnp trasistors for VPP and VDD control, TxD and RxD pins respectively).Of course, for FMD we need only VDD part (RxD high = VDD On).Or, even VDD of MCU can be directly feed from RxD pin, if CH341 fed from 5V. It is not recommended, and can only feed single MCU (without board), but that was tested too.Software not yet ready for public, but if someone has different MCUs and want to make some tests - write PM.

author: DIMM-bl4
author_rank: Contributor
timestamp: June 29, 2024, 10:50:18 am
content: Quote from: rez on June 29, 2024, 07:55:30 amSent in PM, please check.But I don't see this message anywhere in my profile, maybe because of newbie at this forum...Solved.

author: DIMM-bl4
author_rank: Contributor
timestamp: July 20, 2024, 10:15:11 am
content: Quote from: gashtaan on April 15, 2023, 04:43:25 amgashtaan, probably, you found it too? And stopped all further work with that MCUs because of it...

author: hassana
author_rank: Newbie
timestamp: November 11, 2024, 07:49:44 pm
content: I have FT60E211 want and example code for blink ledthe issue I faced with delay routine how to make?

author: hassana
author_rank: Newbie
timestamp: November 12, 2024, 09:06:56 am
content: Code:void DelayUs(unsigned char Time){unsigned char a;for(a=0;a<Time;a++){NOP();}}it just accept value as 512but if have variable value as 12000unsigned int count = 12000Delayus(count);it is not workinghow to do it?

author: hassana
author_rank: Newbie
timestamp: November 12, 2024, 06:50:27 pm
content: FT60E211 timer2 is it 16bit counter or 8 bit?I have high pulse width via PA3 (300us to 18ms) want to measure it by let Timer2 start counting when detect high state then when low state then stop Timer2 and put value of Timer2 counting inside another variable

author: gashtaan
author_rank: Regular Contributor
timestamp: November 13, 2024, 04:48:08 am
content: Quote from: hassana on November 11, 2024, 07:49:44 pmCan you please create another topic for it? This is a topic about programming the flash using ISP.

author: elechi
author_rank: Newbie
timestamp: November 18, 2024, 05:52:36 am
content: My Background : have been developing uC projects as hobby, comfortable with STM (both 8/32), RP2040, AVR. I had worked on PIC 16F84 and 12C508 long back. I am comfortable coding by C or ASM for PICI recently found this FT60E010A. I guess this is a PIC clone. I did setup the compiler and all. now I am able to compile example programs available on FMD sitemy next problem is downloading the program into the controller. I see you are using some programmer (DCProgrammer?) is this your own program?the update firmware (Ver1 or Ver3in1), can I burn them into a blue-pill and use it with FMDProgrammer? If you have managed to port to CH341, could you share the project, if you are okay with it?

author: Ali-R3
author_rank: Newbie
timestamp: November 19, 2024, 05:37:59 pm
content: Is there anyone here who can write a simple code example for FMD-IDE here?For those who just want to start programming this ICStep by step please

author: Kukaz
author_rank: Newbie
timestamp: November 27, 2024, 07:40:41 pm
content: Take a look at the manufacturer's website - there are plenty of examples there, you can find the type you are interested in.https://www.fremontmicro.com/en/#/support/6

author: danymogh
author_rank: Regular Contributor
timestamp: March 06, 2025, 06:49:48 am
content: Quote from: DIMM-bl4 on June 27, 2024, 01:20:25 pmThis DCprogrammer , is this your own invention? cause Chinese websites mention your username.can it be made or should it be purchased?also can you implement debugging ?

author: DIMM-bl4
author_rank: Contributor
timestamp: March 08, 2025, 05:50:25 am
content: Quote from: danymogh on March 06, 2025, 06:49:48 amRead your PM.Software is free.Hardware is near-free: CH341 (~2$) or FX2LP (~5$); + VCC control adapter - pair of npn+pnp transistors.Quote from: danymogh on March 06, 2025, 06:49:48 amFor the moment I can read SFR/RAM area, and STACK table.Of course, it is not enough for functional debugger.

author: rez
author_rank: Newbie
timestamp: March 11, 2025, 06:02:47 am
content: hello DIMM-bl4. DCProgrammer 0.9.4.0 support FT60F112A-RB ?

author: DIMM-bl4
author_rank: Contributor
timestamp: March 11, 2025, 06:22:26 am
content: Quote from: rez on March 11, 2025, 06:02:47 amAdded all MCUs from FMDProgrammer 5.3.6.9.Next MCUs was tested:- for STD core (F-series, E-series) at: FT61F133A, FT61F043A, FT60F211, FT60F011A, FT61E133A, FT60F123, FT60E023, FT61EC23, FT61F023, FT60F022, FT60E010A- for ENH core (Enhanced F-series) at: FT64F0A3, FT61E145, FT61E143.  FT61FC43, FT61FC45Most of them by myself.

author: leo_koren
author_rank: Newbie
timestamp: March 21, 2025, 08:18:01 am
content: Good day. I installed FMD IDE. Everything works, but the HEX file is not generated. What is the reason?

author: DIMM-bl4
author_rank: Contributor
timestamp: March 21, 2025, 07:17:10 pm
content: leo_koren, my experience is:ASM projects works fine.C projects compiled without errors only with GCC compiler option, which must be installed too (separate executable).

author: cwmadhan
author_rank: Newbie
timestamp: April 18, 2025, 10:20:00 am
content: Quote from: DIMM-bl4 on March 11, 2025, 06:22:26 amHello,Can you share your DCProgrammer software and CH341 connection details please? i have an CH341 programmer with me. i will make a pcb for the balance part.Thanks in advance.Regards,Madhan.

author: cwmadhan
author_rank: Newbie
timestamp: April 25, 2025, 05:21:35 pm
content: Hello,My version of adaptor PCB...

author: Fazinur
author_rank: Newbie
timestamp: May 02, 2025, 04:41:09 pm
content: Is it possible to flash FT32F030RBAT7 microcontroller using BluePill?

author: kalala
author_rank: Newbie
timestamp: May 02, 2025, 07:59:06 pm
content: Hello my friends, I need help with an EEPROM file DCProgrammer 0.9.5.3With this hadwer fx2lpThe program has been tested.Postal 3 He works

author: DIMM-bl4
author_rank: Contributor
timestamp: May 02, 2025, 09:11:33 pm
content: Quote from: kalala on May 02, 2025, 07:59:06 pmDCProgrammer needs different driver.libusb0 must be installed for both: 'FX2LP No EEPROM Device' and 'FX2LP DCProg Interface' (after FW load)FW and Zadig are included.Your screenshot shows an old version. And it's off-topic in this thread.

author: kalala
author_rank: Newbie
timestamp: May 03, 2025, 11:40:13 am
content: Thanks DIMM-bl4 for the quick response.How to get the latest version

author: Fazinur
author_rank: Newbie
timestamp: May 05, 2025, 05:15:50 pm
content: I managed to read the firmware from FT32F030RBAT7 using a Chinese copy of ST-Link, the OpenOCD program, and the RESET button that clamped the NRST output to minus.

author: Klommy
author_rank: Newbie
timestamp: September 04, 2025, 03:08:01 am
content: heyI have a otion detector that has a chip with the marking "FMD C4mLMDH"any way to read and make changes in the program?

author: DIMM-bl4
author_rank: Contributor
timestamp: September 04, 2025, 08:58:48 am
content: Quote from: Klommy on September 04, 2025, 03:08:01 amTop side mark on FMD MCU gives none information. That is FT62F086E-TRB, for example (attach).You can estimate MCU type by check routing of some critical wires: VCC, GND, ISP pins (good if present).Next step, DCProgrammer has a Detect function (ID button), that read and check ICID of all supported FMD MCUs.Quote from: Klommy on September 04, 2025, 03:08:01 amAnd finally, your MCU may have read protection active.

author: Klommy
author_rank: Newbie
timestamp: September 05, 2025, 03:00:46 pm
content: I have a programmer here TNM5000 but it doesnt seem to support and FMD chipsI do have a CH341A here as well. Where do i get DCProgrammer?

author: mat079
author_rank: Newbie
timestamp: September 08, 2025, 05:43:50 pm
content: Could you please send me the DCProgrammer and the modifications to use with ch341?

author: OhmBob
author_rank: Newbie
timestamp: September 09, 2025, 01:17:34 am
content: This is fantastic work! It's really impressive to see someone diving deep into another obscure microcontroller family and making progress with just an Arduino. Reverse-engineering a programming protocol from a binary blob is no small feat.Your findings so far are extremely valuable for the community. The fact that you've successfully entered programming mode and read flash using a simple Arduino setup proves that a complex, vendor-specific programmer is not necessary. This mirrors the Padauk story exactly and opens the door for open-source tools.Based on what you've described, here are a few thoughts and suggestions for the next steps in your reverse-engineering process.The signaling protocol you've decoded (LSB first, sampled on falling edge) is a great start. Since you've successfully entered programming mode with the 0x1CA3 sequence, the next logical step is to fully map the command set.For the implicit opcodes, you might try a systematic approach to uncover their functions. For commands like 0x04 (reset address counter) and 0x05 (increment address counter), you can try reading data after executing them to see how the address pointer behaves. For the unknown opcodes (0x01, 0x02, 0x06, 0x07), try sending them and then attempting a read or write operation to see if they prepare the chip for a specific action, like erasing a page or writing to a configuration memory area.Since you found that the protocol is similar to Padauk, look for commands that might read or write data. There might be an opcode that expects a following data payload or one that returns data from the current address. The fact that you got a valid read is a huge clue; try to correlate the data you read with the known opcode sequence you used.Your discovery that the official programmer uses a generic STM32 part is very encouraging. It means the protocol timing isn't ultra-critical and can be handled by common microcontrollers. Your Arduino proof-of-concept is the best evidence for this. The next step could be to package your findings into a simple Python script or an Arduino library that others can help test and expand upon.You are absolutely right about the advantage of a simpler hardware setup compared to Padauk. Eliminating the need for a high-voltage VPP generator is a significant win for homebrew programmers. Keep up the excellent work! The community greatly benefits from efforts like yours to open up these ultra-low-cost parts. Looking forward to your next update.

author: DIMM-bl4
author_rank: Contributor
timestamp: September 09, 2025, 09:26:44 am
content: mat079, sent to PM, please check.Quote from: OhmBob on September 09, 2025, 01:17:34 am0x01 - latch data to buffer0x02 - start erase of selected area0x06 - start write from buffer to selected area0x07 - end write or erase (disable HV)But it's much, much more complicated than just these opcodes.For example, there is SFR read operation (some hi-level functions are made over SFR access):Code:function FMD_SEND_READ_SFR_Single(iclist: byte; Addr: word): byte; // +5.3.6.9begin//set page?case iclist of1..7,9..12,20..23,25..27,45,51,52,56,59,60,62,64..70,74,78,82:beginif Addr SHR 8 = 0then FMD_SEND_A24_91A_OR_9FA_8R0_6(iclist,0)else FMD_SEND_A24_91A_OR_9FA_8R0_6(iclist,$40);end;8,13..19,28..44,46,47,55,61,63,71:FMD_SEND_A24_9FB_8R0_6(Addr SHR 7);//NEW 13, 19,2124,73,75,76, 79,81,83..85,87,88:FMD_SEND_A24_91A_OR_9FA_8R0_6(iclist,Hi(Addr) SHL 6);72,77,80,86:FMD_SEND_A51_9R0_8R1_6($F3,Hi(Addr));end;//read SFRFMD_op_write($A,$52);FMD_op_write($9,Lo(Addr));result := FMD_op_read($D);end;Quote from: OhmBob on September 09, 2025, 01:17:34 amTime-critical is only enter programming mode part. For it must be used HW delay routine. Software delays on PC-side have not enough accuracy.Communication speed I've tested from 20 to 500 kHz. Selectable in software.Quote from: OhmBob on September 09, 2025, 01:17:34 amWas made ready-to-use application instead. Not open-sourced, but free.Some people (from this thread too) test and use it.Added some functions, that are not present in original FMDProgrammer (detect of unknown MCU, FCFG operations)FMD MCU support was made for next HW: CH341, FT232H, FX2LP, PostalAVR, CH552 (EZP20xx/MinProI).Change log, with FMD-related positions only:Code:v 0.9.3.0- : add FMD 8-bit MCU support (Fremont Micro Devices, Origin-gd Tech)v 0.9.4.1- : test support for F-18 Series (FT62F0Gx, FT62F0Cx)- : get Delays from MCU, other minor changesv 0.9.4.2- : add new MCUs from FMDProgrammer 5.3.6.9 (need test)- : add one more byte for ICID checkv 0.9.6.3- : add support for FMD and S3F MCUsv 0.9.6.7- : add Nuvoton, FMD and S3F 8-bit MCU support- add invert options for VDD and VPP control pinsv 0.9.6.8- : add AVR, Nuvoton, FMD and S3F 8-bit MCU support- : add 'Locked' warning at UCFG read- fixed bug with Blank Check in auto-write modev 0.9.7.1- : new FW, added all supported functions- : speed up and clock selection (PICWriteRead rework)- : add Read/Erase/Write of FCFG area (service)- : add FCFG CheckSumm check and update- : add manual Fosc calibration- : FCFG backup/verify/restore at Erase/Writev 0.9.7.2- : fixed bug in UCFG area read for FT61F08x/FT62F08x

author: DIMM-bl4
author_rank: Contributor
timestamp: October 05, 2025, 09:25:25 am
content: Members of last untested FMD MCU family (F18-Series) have arrived.There is much errors present for that family's protocol, I've started to fix.One of bugs was fundamental, and related to other families too - was used wrong CLK edge for data write (in topic's first post error too).Other families worked fine, probably, because of more 'slow' OCD/ISP logic onboard. But of course, corrected edge should increase stability also for that MCUs.