CuVoodoo

the sorcery of copper

User Tools

Site Tools

Trace:
dump_spi_flash

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
Next revisionBoth sides next revision
dump_spi_flash [2021/04/12 17:48] – [CH341A] kingkevindump_spi_flash [2021/04/13 18:14] – [BX48] kingkevin
Line 19: Line 19:
 The difference between models is mainly the size (obviously), and features (i.e. speed). The difference between models is mainly the size (obviously), and features (i.e. speed).
  
- +{{:spi_flash:flash-soic.jpg?0x200|}} 
-{{:spi_flash:soic.png?0x250|}} +{{:spi_flash:soic.png?0x200|}} 
-{{:spi_flash:pinout_soic.png?0x250|}} +{{:spi_flash:pinout_soic.png?0x200|}} 
-{{:spi_flash:pinout_bga.png?0x250|}}+{{:spi_flash:pinout_bga.png?0x200|}}
  
 ====== dumping tools ====== ====== dumping tools ======
Line 35: Line 35:
 The cheapest, and crudest, way to read/write SPI flash is using a CH341A based programmer. The cheapest, and crudest, way to read/write SPI flash is using a CH341A based programmer.
 You can find them for less than $3. You can find them for less than $3.
 +
 +{{:spi_flash:ch341_prog.jpg?0x200|}}
 +
  
 Solder the SPI flash to a DIP-8 adapter board, and place it in the ZIF socket (Zero-Insertion-Force). Solder the SPI flash to a DIP-8 adapter board, and place it in the ZIF socket (Zero-Insertion-Force).
Line 40: Line 43:
 To avoid soldering the chip on an adapter board, use sockets with spring contacts (the contacts need to be clean for it to work well). To avoid soldering the chip on an adapter board, use sockets with spring contacts (the contacts need to be clean for it to work well).
 Be sure the jumper shorts pin 1 and 2 on the side (shorting pins 2 and 3 switched the CH341A to UART mode). Be sure the jumper shorts pin 1 and 2 on the side (shorting pins 2 and 3 switched the CH341A to UART mode).
 +
 +{{:spi_flash:soic-dip-board.jpg?0x200|}}
 +{{:spi_flash:ch341a-adapter.jpg?0x200|}}
 +{{:spi_flash:ch341a-socket.jpg?0x200|}}
  
 As software we will use [[https://github.com/setarcos/ch341prog|ch341prog]]. As software we will use [[https://github.com/setarcos/ch341prog|ch341prog]].
Line 65: Line 72:
   * slow speed (128 kbyte/s)   * slow speed (128 kbyte/s)
   * no power supply protection (if you insert the chip the wrong way around, you will fry it since VCC and GND/VSS get switched)   * no power supply protection (if you insert the chip the wrong way around, you will fry it since VCC and GND/VSS get switched)
-  * operating voltage is 5V (you can [[https://eevblog.com/forum/repair/ch341a-serial-memory-programmer-power-supply-fix/|modify it]] to 3.3V by lifting top right pin 28, put tape over the pad, connect pin to C4 on the bottom and middle pin of voltage regulator AMS1117). Most flash chip operate at 3.3V, and while 5V is outside of the maximum rating, they still seem to support it (at least for a short time)+  * operating voltage is 5V (you can [[https://eevblog.com/forum/repair/ch341a-serial-memory-programmer-power-supply-fix/|modify it]] to 3.3V by lifting top right pin 28, put tape over the pad, connect pin to C4 on the bottom and middle pin of voltage regulator AMS1117). Most flash chip operate at 3.3V, and while 5V is outside of the maximum rating, they still seem to support it (at least for a short time, and it is still not recommended)
   * to support 1.8V flash chips, interpose an adapter board with level shifter   * to support 1.8V flash chips, interpose an adapter board with level shifter
 +
 +{{:spi_flash:ch341a-mod.jpg?0x150|}}
 +{{:spi_flash:adapter_1.8v.jpg?0x150|}}
 +
 +==== MiniPRO ====
 +
 +The [[http://autoelectric.cn/EN/TL866_main.html|TL866A]] (aka. MiniPRO) is the next step up, and still cheap (< $30).
 +
 +{{:spi_flash:tl866a.jpg?0x200|}}
 +
 +Advantages:
 +
 +  * supports 3.3-6.5V VCC, allowing to properly power 3.3V and 5.0V flash
 +  * has over-current protection, in case you inserted the chip wrongly
 +  * does signature checking (this is just a software check though)
 +  * supports up to 21V VPP and has flexible pin configuration, allowing plenty of other EEPROM chips or MCU to be flashed
 +
 +Disadvantages:
 +
 +  * does not support 1.8V (you can still use the same adapter as for the CH341A). the newer TL866II+ claims to support 1.8V, but from the [[https://github.com/radiomanV/TL866/raw/master/docs/TL866II.pdf|schematic]] I don't see how they do this properly
 +  * also slow (~ 100 kbyte/s)
 +
 +For more information about the device (including reversed schematic), see [[https://proghq.org/wiki/index.php/TL866|this wiki]] or [[https://github.com/radiomanV/TL866|this repo]].
 +
 +To dump SPI flash, we will use [[https://gitlab.com/DavidGriffith/minipro/|minipro]].
 +
 +<code>
 +# search for the right part using the top marking on the chip
 +minipro --search 25q32bv
 +
 +Found TL866A 03.2.86 (0x256)
 +W25Q32BV
 +W25Q32BV@WSON8
 +W25Q32BV@SOIC8
 +W25Q32BV@SOIC16
 +W25Q32BV(OTP)
 +W25Q32BV(OTP)@WSON8
 +W25Q32BV(OTP)@SOIC8
 +W25Q32BV(OTP)@SOIC16
 +
 +
 +# read the device ID to be sure the connection work (it's not get_id as in the help, but read_id)
 +minipro --device 'W25Q32BV@SOIC8' --read_id
 +Found TL866A 03.2.86 (0x256)
 +Chip ID OK: 0xEF4016
 +
 +
 +# alternatively, let it find which 25xx SPI 8-pin flash it is
 +minipro --auto_detect 8
 +
 +Found TL866A 03.2.86 (0x256)
 +Autodetecting device (ID:0xEF4016)
 +S25FL032K@SOIC8
 +W25Q32@MLP8
 +W25Q32(OTP)@MLP8
 +W25Q32BV
 +W25Q32BV@WSON8
 +W25Q32BV@SOIC8
 +W25Q32BV(OTP)
 +W25Q32BV(OTP)@WSON8
 +W25Q32BV(OTP)@SOIC8
 +W25Q32FV
 +W25Q32FV@WSON8
 +W25Q32FV@SOIC8
 +W25Q32FV(OTP)
 +W25Q32FV(OTP)@WSON8
 +W25Q32FV(OTP)@SOIC8
 +W25Q32V@MLP8
 +W25Q32V(OTP)@MLP8
 +17 device(s) found.
 +
 +
 +# now read the memory
 +minipro --device 'W25Q32BV@SOIC8' --read spi.bin
 +
 +Found TL866A 03.2.86 (0x256)
 +Chip ID OK: 0xEF4016
 +Reading Code...  40.53Sec  OK
 +</code>
 +
 +==== BX48 ====
 +
 +The [[https://www.batronix.com/shop/programmer/BX48/index.html|Batronix BX48 Batego]] is my high end programmer.
 +
 +{{:spi_flash:bx48.jpg?0x200|}}
 +
 +Yes, it is expensive (> $500), but the hardware is good, and what you pay for is the support.
 +And I have to say that it is excellent.
 +Is a chip missing?
 +Just ask them and they will swiftly add support for it.
 +
 +Note: This device is obsolete now, replaced by the [[https://www.batronix.com/shop/programmer/BX48/batego-II.html|BX48 Batego II]].
 +The main difference is that the Batego I does not support VPP > 15V (only required by very old NMOS EPROM).
 +It still seems to be supported though.
 +
 +The software is [[https://www.batronix.com/shop/software/prog-express/index.html#tabs-4|Prog-Express]], and there is even support for Linux (a bit lagging the Windows release).
 +There is an auto-detect function, but I am too concerned it accidentally damages the chip.
 +Therefor I still select the target chip by hand.
 +
 +On my setup it is not able to open the file dialog to allow me setting where I want to load/save the file (using version 3.8.8).
 +To circumvent the issue I open the built-it hex-editor.
 +There I can save read/write the data content, and save/load it.
 +
 +To get the latest chip database (particularly if the Linux release it lagging), here how I update it:
 +
 +<code>
 +wget https://www.batronix.com/downloads/ChipDBUpdate/ChipDB.zip
 +unzip ChipDB.zip
 +sudo mv /usr/lib/prog-express/ChipDB.db3 /usr/lib/prog-express/ChipDB.db3.bak
 +sudo mv ChipDB.db3 /usr/lib/prog-express/ChipDB.db3
 +rm ChipDB.zip
 +</code>
dump_spi_flash.txt · Last modified: 2024/01/07 17:49 by 127.0.0.1