Brother (possibly also some Bernina) embroidery machine memory cards

[bezmi]

Hi Guys, first post on the forums. I stumbled upon here when doing my own research on this and decided to base my work off Aero's. Here is a link to my github repo: https://github.com/bezmi/brother_embroidery_card_experiments. At the moment, I am using a utility written by another github user to emulate a vikant card and write to it using the old free software that vikant provides.

I have also been digging through the image dumps a fair bit and you can see my notes on reverse engineering the file format here: https://github.com/bezmi/brother_embroidery_card_experiments/blob/main/notes.org. I am waiting on a replacement ribbon cable after I broke one in the machine, but once that arrives I will put these notes to the test in trying to write a utility to write to the device without needing to use PED basic or the Vikant software.

[MarkMLl]

Hi Guys, first post on the forums. I stumbled upon here when doing my own research on this and decided to base my work off Aero's.

Welcome to the forum and discussion :-)

I've got very limited time to put into this at the moment ("real life" issues) but I'm still hoping at some point to get a logic analyser and disassembler hooked up to monitor the transfers... which will almost certainly echo the excellent work done by others (but I did have a lot of fun writing support code for my old HP kit :-)

By way of xref, https://github.com/MarkMLl/pesdump might interest: it's fairly good at parsing files but rather less good at patching them.

MarkMLl

[maehw]

Hi all,

thanks for your helpful posts and insights! After about a year of silence, I'd like to join in. It seems that I fell into the same rabbit hole...

First, I'll start with a summary of my understandings - this might help others, at least it will help me if I come here again. You can also correct me if I am wrong and help me fix my understandings.

• The Brother memory cards used for embroidery machines have 40 pins in a single row with a 1mm pitch, likely using an AMP 175564 connector.
• There are machine models from other vendors (Baby Lock, White, Bernina Deco, Simplicity, Husqvarna, Viking) that are reported to be compatible.
• Thanks to opened cards and visible chip markings, we know that up to 4 Mbit of parallel flash memory can be addressed.
• The pinout seems to be verified as some of you have connected a card to an Arduino via a breadboard or even own PCBs.
• There are 19 address bus pins resulting in 2¹⁹ = 524288 addresses = 512k addresses.
• There are 8 data bus pins resulting in 512k addresses * 8 bit/address = 4 Mbits or 512 kBytes usable memory.
• The other pins on the connector are for VCC (5V), chip enable (CE), output enable (OE), write enable (WE).
• Some of you have been able to dump the whole 512 kByte memory of the chips.
• The memory layout still seems unknown, it's unlikely that they contain a "file system"... at least not a known standard one.
• The binary does not only seem to contain stripped(!) PES data but also preview images. (Where are they located? How can they be viewed? What format are they in?)
• The binary does not only seem to contain stripped(!) PES data but also preview images. (Where are they located? How can they be viewed? What format are they in?)

To me, the following is not quite clear yet ...

• if all cards are writeable because they really need to be writeable by the embroidery machines - or only those "blank" cards that have been sold to write them by a PC.
• if there are cards that have a program input voltage (VPP) which is different than VCC. (I've read about chips requiring 12.0 Volts).
• what the commands in the code in the git repositories brother_embroidery_card_experiments or brother-cart-emulator/ is based on? Are those vendor-specific or do they comply with some standard (CFI, JEDEC, ...)? (Edit: Both seem to have used the SST39SF040-55-4I-WHE device which has "software command sequences" such as the magics 0x5555, 0x2AAA, etc in its datasheets as well as manufacturer ID (0xBF). Not sure though if the former that's standardized or Microchip-specific.)
• does the Brother embroidery machine only accept only certain flash memories? e.g. only from a few vendors?
• has someone tested if the Brother PED Basic and those 3rd party card readers/writers (Magic Box OESD, The Magic Box, Vikant Ultimate Box, EmbCard, ...) accept only certain flash memories? e.g. only from a few "expected vendors/models"? e.g. from the same chip vendor they included in their cards?
• are there any new findings about the layout of the binary/ card's flash memory?
• other methods than "hooking" into some Windows DLL (CardIO.dll) or executable or serial connection to get a properly formatted binary file?
• any new efforts in reverse engineering those card readers?
• has anyone tried to reverse engineer the firmware from one of those machines?
• how did you visualize the binary and find the preview bitmaps in there? I've tried with Gimp and was not successful with 1-bit aka monochrome raw image data imports.

Or has everybody just given up or bought the old, expensive hardware?

Those old "original" re-writeable cards and card readers/writers seem very expensive (probably because "rare") these days (card readers ˜100-200 €/USD, cards ˜80-120 €/USD). And for some only 32-bit machines seem to be supported. I am not sure if I really want to spend ˜80-120 €/USD for a used, old, pretty standard memory chip+PCB+connector that's maybe worth only ˜5-10 €/USD.

[amyk]

• if there are cards that have a program input voltage (VPP) which is different than VCC. (I've read about chips requiring 12.0 Volts).

Someone posted a picture of a card with an AM29F010, and another posted one with a MX29F400. Those are both 5V-only.

• what the commands in the code in the git repositories brother_embroidery_card_experiments or brother-cart-emulator/ is based on? Are those vendor-specific or do they comply with some standard (CFI, JEDEC, ...)? (Edit: Both seem to have used the SST39SF040-55-4I-WHE device which has "software command sequences" such as the magics 0x5555, 0x2AAA, etc in its datasheets as well as manufacturer ID (0xBF). Not sure though if the former that's standardized or Microchip-specific.)

The SST39SF040 is also 5V-only and all the ones found so far seem to follow the standard parallel NOR flash commands, although I'm not sure which JEDEC standard it is.

• does the Brother embroidery machine only accept only certain flash memories? e.g. only from a few vendors?
• has someone tested if the Brother PED Basic and those 3rd party card readers/writers (Magic Box OESD, The Magic Box, Vikant Ultimate Box, EmbCard, ...) accept only certain flash memories? e.g. only from a few "expected vendors/models"? e.g. from the same chip vendor they included in their cards?

Given that there's an ID function and part of that determines the capacity, I suspect that is the case.

[maehw]

Thanks for sharing the bear's binary file. I've tried to reproduce the export and visualization of PEC data.

However, I've experimented with the start offset as 0x2F327 something seems missing:

See attached bear_0x2F327.png.

With a different (earlier) start offset, I can see more of the bear: bear_0x2F023.png -- however, this may go too far into memory regions that are not PEC yet.

Unfortunately, I could not find neither PES nor PEC headers (based on https://edutechwiki.unige.ch/en/Embroidery_format_PES and https://edutechwiki.unige.ch/en/Embroidery_format_PEC).

Two code snippets; the first using Linux command line tool `dd` to extract the binary snippet out of the whole file (which goes by putty.txt here) as a new .pec file, the second one is a Python script importing the .pec file and storing the stitch data as PNG image file:

Code: [Select]

#/bin/bash
binary_name="bear"
start_offset=0x2F023  # 0x2F327  # Starting byte offset
end_offset=0x321E7    # Ending byte offset
skip=$((start_offset))  # Number of bytes to skip
count=$((end_offset - start_offset + 1))  # Number of bytes to copy
dd if=${binary_name}.bin of=${binary_name}.pec bs=1 skip=$skip count=$count


Code: [Select]

import pyembroidery
import os

file_name="bear"
pec_file_name=file_name+".pec"
file_size=os.stat(pec_file_name).st_size
print(f"PEC file size: {file_size} bytes")
pattern = pyembroidery.read_pec(pec_file_name)
print(f"number of stitches: {len(pattern.stitches)}")
print(f"number of items in threadlist: {len(pattern.threadlist)}")
pyembroidery.write(pattern, file_name+".png")

Other things I could not get working: the Vikant card emulator (another Python script)... or rather I could not get it working with the "Ultimate Explorer for Brother" (Serial port version). Even though I created virtual COM ports with com0com, only the Python side connected... and Vikant's Ultimate Explorer didn't want to open or even find the COM port. So this approach currently won't work for me to write own card binaries from PES files.


Edit: Bear beared out, see bears_preview.png -- however, seems to be some kind of mirrored.