Fremont Micro Devices - microcontroller programming

[buttim]

Are you using an Arduino like the original poster did?
It would be actually interesting to see the unfinished code but I understand your desire to clean before publishing.
Just don't delete everything by mistake. As I did...

[gashtaan]

Are you using an Arduino like the original poster did?
It would be actually interesting to see the unfinished code but I understand your desire to clean before publishing.
Just don't delete everything by mistake. As I did...

Yes, I chose Arduino Nano for this project, but it doesn't really matter.
Even if I did delete the code, it's just few lines of the code, it wouldn't be a irreversible loss. Reverse engineering is the hard job here, so many thanks to @socram for valuable inspiration.

[buttim]

Yes I did the same. My code seemed to work at first but I have some problem reading the eprom. I'm eager to see your code (and use it too)

[buttim]

Would you mind sharing the code?

Sure, later when it'll be actually working code I'll put it to github

Hi gashtaan, did you manage to solve the issue?

[gashtaan]

Hi gashtaan, did you manage to solve the issue?

Not yet. I've ordered some FMD to experiment with, but it was from AliExpress, so this project is postponed for some weeks or even months... if I'm lucky and it'll be actually working IC.

[danymogh]

@gashtan

I don't have my programmer right now to check for the flash readout protection.

Could you by any chance discover if it's possible to protect the EEPROM as well?

I can't find any info on this anywhere. I'm only making assumptions they forgot to implement such protection.

Also, what is the difference between FT61F021 and FT61FC21?

their datasheet is almost identical besides very small differences in electrical characteristics.

On their new website, FMD also has a new part number (the E series) such as FT60E021 which is again identical to the F series. The only visible difference is the DROM (EEPROM) data endurance which is 100k compared to 1000k of F series. This is very strange, why did they manufacture a new product with less endurance?

I'm planning to manufacture large quantities of a small device for some time now and I need the EEPROM but still can't make a decision if the FMD is a good choice or not. Their price is super competitive.

[buttim]

@gashtan

I don't have my programmer right now to check for the flash readout protection.

Hi danymogh, would you be so kind (whenever you are again in possession of your programmer) to post here a logic analyzer capture  of the signals? (I'm assuming you have one...)
I have this strong feeling that the information provided in this thread is missing something crucial, since at least 2 of use have already tried and failed at replicating the results of the original poster.
That would be nice indeed!

[kkstun]

https://oshwhub.com/kktun/PICjian-rong-dan-pian-ji-xue-xi-

This is worked!

[buttim]

https://oshwhub.com/kktun/PICjian-rong-dan-pian-ji-xue-xi-

This is worked!

Interesting, but I can't download without registering, and cannot register without giving away my phone number. LOL

[danymogh]

https://oshwhub.com/kktun/PICjian-rong-dan-pian-ji-xue-xi-

This is worked!

This looks very good and very cheap to make. Such a shame our Chinese friends always restrict their content. you can't even signup using another country's phone number!

however, looking at just the screenshots of the PC software. it's a programmer-only version and does not have debugging features enabled. Yet it's very cheap (the PCB and components won't cost more than 3$) and nice to have.

I'm mainly interested in the .Net program. It'll help a lot in analyzing the programming sequence.

@buttim

I have 2 programmers. they are the old series. the yellow one is for batch production and does not support debugging.
the black one (Link) is used for programming and debugging however it doesn't support batch programming for production.

both work with FMD and Origin IDE.

I do not have a logic analyzer, unfortunately. (the only missing tool in my arsenal!)

I've been in possession of both for about 2 years now and let me tell you one thing. even though the ICs are super cheap and well-suited for small applications, the support, documentation, and everything else is a headache!
if you encounter a problem, it's highly unlikely you'll find documentation or help other than what is already available. also, keep in mind that the silicon of the ICs have had several revisions in just 3 years to fix whatever they messed up in previous revisions. This means unreliable production.

I've tried contacting FMD via email or even suppliers to ask for support and never got a response back! they even don't publish the IDE on their website and you'll have to get it from suppliers manually! the compiler is XC8 in the heart but they rebranded it as GCC! These are a lot of red flags in engineering, however, because of the cheap price people still consider them.

[gashtaan]

since at least 2 of use have already tried and failed at replicating the results of the original poster.

The FMD programmer support 73 distinct MCU types with various differences in communication. If one works OK it doesn't mean the other will work too. You should find out what type are ICs you are interested in (Setting.bd file) and look into the firmware code for details.

[buttim]

I do not have a logic analyzer, unfortunately. (the only missing tool in my arsenal!)

Do yourself a favor and buy a "24MHz 8 channels logic analyzer". They're dirty cheap and good enough for most tasks. For example: https://it.aliexpress.com/item/1005005357814678.html

I've been in possession of both for about 2 years now and let me tell you one thing. even though the ICs are super cheap and well-suited for small applications, the support, documentation, and everything else is a headache!
if you encounter a problem, it's highly unlikely you'll find documentation or help other than what is already available. also, keep in mind that the silicon of the ICs have had several revisions in just 3 years to fix whatever they messed up in previous revisions. This means unreliable production.

I've tried contacting FMD via email or even suppliers to ask for support and never got a response back! they even don't publish the IDE on their website and you'll have to get it from suppliers manually! the compiler is XC8 in the heart but they rebranded it as GCC! These are a lot of red flags in engineering, however, because of the cheap price people still consider them.

I know... I also tried to contact FMD to no avail. I'm mostly interested in reverse engineering and maybe rewriting firmware for devices containing an FMD MCU, not designing things. I think a very simple programmer would do.

The FMD programmer support 73 distinct MCU types with various differences in communication. If one works OK it doesn't mean the other will work too. You should find out what type are ICs you are interested in (Setting.bd file) and look into the firmware code for details.

The original poster did the heavy lifting. I think we're just missing some tiny (but important!) detail. Restarting the original reverse engineering is overkill for me. If some of our chinese friends here wants to upload the CH552 firmware and .Net code, that would be great. Otherwise I'll just do something else

[gashtaan]

I'm mostly interested in reverse engineering and maybe rewriting firmware.
Restarting the original reverse engineering is overkill for me.

The programmer firmware is few kB of simple and straightforward code, the most of the know-how to begin with is already here. It just doesn't make a sense that you are interested in reverse engineering but at the same time you refuse to do any.

[buttim]

The programmer firmware is few kB of simple and straightforward code, the most of the know-how to begin with is already here. It just doesn't make a sense that you are interested in reverse engineering but at the same time you refuse to do any.

With your consent... It's me who decides what makes sense to do for me or not. I have no intention of reverse engineering the firmware of the devices (which would probably be protected anyway), but the hardware for eventually writing some alternative code. Reverse engineering the programmer (and the PC software controlling the programmer) is probably behind my capabilities and sure enough beyond my motivation.
If it was such a simple task it's so strange you equally failed at writing a programmer.

[gashtaan]

With your consent... It's me who decides what makes sense to do for me or not.

Sorry, it's up to you of course. But just to clarify, I have no need to write a programmer. I just wanted to download the firmware to reverse engineer some communication between FMD MCU and other IC, I failed to do it, because it's protected... but this is a completely different story. Though I did some changes to EEPROM, programming or erasing the flash is not much different.

[gashtaan]

But when I reading the flash memory the data seems somehow scrambled:
1F9F 3F9F 0F9F 0F9F 0FFF 0F9F 0FFF 0F9F 0FFF 1F9F 3F9F 1F9F 3F9F 2FBF 1F9F 3F9F
1F9F 0FBF 3FFF 1F9F 0FBF 3FFF 1F9F 0FBF 3FFF 1F9F 0FBF 2FFF 1F9F 0FDF 2F9F 0FDF

It's really some kind of flash memory protection. I finally got some spare FMD MCU, so I played with it a bit. When I erase it and then flash it, I read the same data as I wrote to it, so my communication with the chip is definitely OK. Although I don't yet know how to disable CPB bit of UCGF0 register to test it further... any thoughts where these bits are placed and/or how to change them?

[kkstun]

I get it for you

https://www.123pan.com/s/kEQbVv-KzSsH.html
提取码:bXgN

[kkstun]

I found that this fmd（ft6x）is not as cheap as that PDK（padauk），PFS122  just $0.04 ...

PFS122
1   adc 12bit x 12ch   io14    rom 2KW   ram 128   --   8bit x 2   CMP x 1   R-ADC


padauk-programmer here
https://www.eevblog.com/forum/blog/eevblog-1144-padauk-programmer-reverse-engineering

[gashtaan]

Although I don't yet know how to disable CPB bit of UCGF0 register to test it further... any thoughts where these bits are placed and/or how to change them?

Found it. When I enable flash protection with mentioned bit, it doesn't return all 0x3FFF, but data where almost all bits are set to 1 with few of them preserved. I guess in these MCUs the instructions are encoded in 12bits instead of all 14bits.

Original data:
2040 2244 2448 264C 2850 2A54 2C58 2E5C 3060 3264 3468 366C 3870 3A74 3C78 3E7C
0000 0204 0408 060C 0810 0A14 0C18 0E1C 1020 1224 1428 162C 1830 1A34 1C38 1E3C

Protected data:
2FDF 2FDF 2FDF 2FDF 2FDF 2FDF 2FDF 2FDF 3FFF 3FFF 3FFF 3FFF 3FFF 3FFF 3FFF 3FFF
0F9F 0F9F 0F9F 0F9F 0F9F 0F9F 0F9F 0F9F 1FBF 1FBF 1FBF 1FBF 1FBF 1FBF 1FBF 1FBF

[buttim]

Which was the solution for writing UCFG0?

[gashtaan]

Unsurprisingly, UCFG0 is stored in first word of PROM block like it's mentioned in datasheets. What is not mentioned is that there are also stored upper 4-bits of the flash checksum, so it's a bit misleading.

According the datasheet, this PROM content is copied to somewhere else after every reset, so I guess it could be prone to glitching... but I'm not going any further with these MCUs.

[buttim]

Unsurprisingly, UCFG0 is stored in first word of PROM block like it's mentioned in datasheets. What is not mentioned is that there are also stored upper 4-bits of the flash checksum, so it's a bit misleading.

And how can you read at a specified address? Socram only describes a "reset address pointer" operation, so that you always have to read the whole address space.

[danymogh]

I get it for you

https://www.123pan.com/s/kEQbVv-KzSsH.html
提取码:bXgN

The link is broken. can you reupload it, please?

Unsurprisingly, UCFG0 is stored in first word of PROM block like it's mentioned in datasheets. What is not mentioned is that there are also stored upper 4-bits of the flash checksum, so it's a bit misleading.

According the datasheet, this PROM content is copied to somewhere else after every reset, so I guess it could be prone to glitching... but I'm not going any further with these MCUs.

to make sense of the UCFG register , I think you need to reverse the IDE. if you pay attention to the address register and values generated by the IDE , you'll see that part is sort of obfuscated.

[gashtaan]

I think you need to reverse the IDE

I wanted to but all links to download it were already dead.

[kkstun]

https://www.123pan.com/s/kEQbVv-X3lsH.html提取码:gVis