Fremont Micro Devices - microcontroller programming

[DIMM-bl4]

support FT60F112A-RB ?

Added all MCUs from FMDProgrammer 5.3.6.9.
Next MCUs was tested:
- for STD core (F-series, E-series) at: FT61F133A, FT61F043A, FT60F211, FT60F011A, FT61E133A, FT60F123, FT60E023, FT61EC23, FT61F023, FT60F022, FT60E010A
- for ENH core (Enhanced F-series) at: FT64F0A3, FT61E145, FT61E143. [ADD] FT61FC43, FT61FC45

Most of them by myself.

[leo_koren]

Good day. I installed FMD IDE. Everything works, but the HEX file is not generated. What is the reason?

[DIMM-bl4]

leo_koren, my experience is:
ASM projects works fine.
C projects compiled without errors only with GCC compiler option, which must be installed too (separate executable).

[cwmadhan]

support FT60F112A-RB ?

Added all MCUs from FMDProgrammer 5.3.6.9.
Next MCUs was tested:
- for STD core (F-series, E-series) at: FT61F133A, FT61F043A, FT60F211, FT60F011A, FT61E133A, FT60F123, FT60E023, FT61EC23, FT61F023, FT60F022, FT60E010A
- for ENH core (Enhanced F-series) at: FT64F0A3, FT61E145, FT61E143

Most of them by myself.

Hello,

Can you share your DCProgrammer software and CH341 connection details please? i have an CH341 programmer with me. i will make a pcb for the balance part.

Thanks in advance.

Regards,
Madhan.

[cwmadhan]

Hello,

My version of adaptor PCB...

[Fazinur]

Is it possible to flash FT32F030RBAT7 microcontroller using BluePill?

[kalala]

Hello my friends, I need help with an EEPROM file DCProgrammer 0.9.5.3

With this hadwer  fx2lp 
The program has been tested.Postal 3 He works

[DIMM-bl4]

DCProgrammer 0.9.5.3

With this hadwer  fx2lp 

DCProgrammer needs different driver.
libusb0 must be installed for both: 'FX2LP No EEPROM Device' and 'FX2LP DCProg Interface' (after FW load)
FW and Zadig are included.

Your screenshot shows an old version. And it's off-topic in this thread.

[kalala]

Thanks DIMM-bl4 for the quick response.
How to get the latest version

[Fazinur]

I managed to read the firmware from FT32F030RBAT7 using a Chinese copy of ST-Link, the OpenOCD program, and the RESET button that clamped the NRST output to minus.

[Klommy]

hey

I have a otion detector that has a chip with the marking "FMD C4mLMDH"
any way to read and make changes in the program?

[DIMM-bl4]

a chip with the marking "FMD C4mLMDH"

Top side mark on FMD MCU gives none information. That is FT62F086E-TRB, for example (attach).

You can estimate MCU type by check routing of some critical wires: VCC, GND, ISP pins (good if present).

Next step, DCProgrammer has a Detect function (ID button), that read and check ICID of all supported FMD MCUs.

any way to read and make changes in the program?

And finally, your MCU may have read protection active.

[Klommy]

I have a programmer here TNM5000 but it doesnt seem to support and FMD chips

I do have a CH341A here as well. Where do i get DCProgrammer?

[mat079]

Could you please send me the DCProgrammer and the modifications to use with ch341?

[OhmBob]

This is fantastic work! It's really impressive to see someone diving deep into another obscure microcontroller family and making progress with just an Arduino. Reverse-engineering a programming protocol from a binary blob is no small feat.

Your findings so far are extremely valuable for the community. The fact that you've successfully entered programming mode and read flash using a simple Arduino setup proves that a complex, vendor-specific programmer is not necessary. This mirrors the Padauk story exactly and opens the door for open-source tools.

Based on what you've described, here are a few thoughts and suggestions for the next steps in your reverse-engineering process.

The signaling protocol you've decoded (LSB first, sampled on falling edge) is a great start. Since you've successfully entered programming mode with the 0x1CA3 sequence, the next logical step is to fully map the command set.

For the implicit opcodes, you might try a systematic approach to uncover their functions. For commands like 0x04 (reset address counter) and 0x05 (increment address counter), you can try reading data after executing them to see how the address pointer behaves. For the unknown opcodes (0x01, 0x02, 0x06, 0x07), try sending them and then attempting a read or write operation to see if they prepare the chip for a specific action, like erasing a page or writing to a configuration memory area.

Since you found that the protocol is similar to Padauk, look for commands that might read or write data. There might be an opcode that expects a following data payload or one that returns data from the current address. The fact that you got a valid read is a huge clue; try to correlate the data you read with the known opcode sequence you used.

Your discovery that the official programmer uses a generic STM32 part is very encouraging. It means the protocol timing isn't ultra-critical and can be handled by common microcontrollers. Your Arduino proof-of-concept is the best evidence for this. The next step could be to package your findings into a simple Python script or an Arduino library that others can help test and expand upon.

You are absolutely right about the advantage of a simpler hardware setup compared to Padauk. Eliminating the need for a high-voltage VPP generator is a significant win for homebrew programmers. Keep up the excellent work! The community greatly benefits from efforts like yours to open up these ultra-low-cost parts. Looking forward to your next update.

[DIMM-bl4]

mat079, sent to PM, please check.

unknown opcodes (0x01, 0x02, 0x06, 0x07)

0x01 - latch data to buffer
0x02 - start erase of selected area
0x06 - start write from buffer to selected area
0x07 - end write or erase (disable HV)

But it's much, much more complicated than just these opcodes.
For example, there is SFR read operation (some hi-level functions are made over SFR access):

Code: [Select]

function FMD_SEND_READ_SFR_Single(iclist: byte; Addr: word): byte;         // +5.3.6.9
begin
  //set page?
  case iclist of
  1..7,9..12,20..23,25..27,45,51,52,56,59,60,62,64..70,74,78,82:
    begin
      if Addr SHR 8 = 0
        then FMD_SEND_A24_91A_OR_9FA_8R0_6(iclist,0)
        else FMD_SEND_A24_91A_OR_9FA_8R0_6(iclist,$40);
    end;
  8,13..19,28..44,46,47,55,61,63,71:
    FMD_SEND_A24_9FB_8R0_6(Addr SHR 7);
  //NEW 13, 19,21
  24,73,75,76, 79,81,83..85,87,88:
    FMD_SEND_A24_91A_OR_9FA_8R0_6(iclist,Hi(Addr) SHL 6);
  72,77,80,86:
    FMD_SEND_A51_9R0_8R1_6($F3,Hi(Addr));
  end;
  //read SFR
  FMD_op_write($A,$52);
  FMD_op_write($9,Lo(Addr));
  result := FMD_op_read($D);
end;

protocol timing isn't ultra-critical

Time-critical is only enter programming mode part. For it must be used HW delay routine. Software delays on PC-side have not enough accuracy.
Communication speed I've tested from 20 to 500 kHz. Selectable in software.

package your findings into a simple Python script or an Arduino library

Was made ready-to-use application instead. Not open-sourced, but free.
Some people (from this thread too) test and use it.
Added some functions, that are not present in original FMDProgrammer (detect of unknown MCU, FCFG operations)
FMD MCU support was made for next HW: CH341, FT232H, FX2LP, PostalAVR, CH552 (EZP20xx/MinProI).

Change log, with FMD-related positions only:
 

Code: [Select]

v 0.9.3.0
- [CH341A]: add FMD 8-bit MCU support (Fremont Micro Devices, Origin-gd Tech)

v 0.9.4.1
- [FMD]: test support for F-18 Series (FT62F0Gx, FT62F0Cx)
- [FMD]: get Delays from MCU, other minor changes

v 0.9.4.2
- [FMD]: add new MCUs from FMDProgrammer 5.3.6.9 (need test)
- [FMD]: add one more byte for ICID check

v 0.9.6.3
- [FX2LP]: add support for FMD and S3F MCUs

v 0.9.6.7
- [PostalAVR]: add Nuvoton, FMD and S3F 8-bit MCU support
- add invert options for VDD and VPP control pins

v 0.9.6.8
- [FT232H]: add AVR, Nuvoton, FMD and S3F 8-bit MCU support
- [FMD]: add 'Locked' warning at UCFG read
- fixed bug with Blank Check in auto-write mode

v 0.9.7.1
- [CH55x]: new FW, added all supported functions
- [FMD]: speed up and clock selection (PICWriteRead rework)
- [FMD]: add Read/Erase/Write of FCFG area (service)
- [FMD]: add FCFG CheckSumm check and update
- [FMD]: add manual Fosc calibration
- [FMD]: FCFG backup/verify/restore at Erase/Write

v 0.9.7.2
- [FMD]: fixed bug in UCFG area read for FT61F08x/FT62F08x

[DIMM-bl4]

Members of last untested FMD MCU family (F18-Series) have arrived.

There is much errors present for that family's protocol, I've started to fix.
One of bugs was fundamental, and related to other families too - was used wrong CLK edge for data write (in topic's first post error too).
Other families worked fine, probably, because of more 'slow' OCD/ISP logic onboard. But of course, corrected edge should increase stability also for that MCUs.

[DIMM-bl4]

Update is finished, F-18 Series support and other improvements:

Code: [Select]

v 0.9.7.2
- [FMD]: fixed bug in UCFG area read for FT61F08x/FT62F08x
- [FMD]: fixed floating MCLRB issue
- [FMD]: changed CLK edge in protocol for all supported HW (MCU sample on rising edge)
- [FMD]: fixed errors for F-18 series MCU (FT62F0Gx tested)
- [FMD]: add parse of FMD IDE hex-file, check MCU type, calculate HW CS (MCSUMEB issue)
- [FT232H]: added value ft100us in settings.xml to fine tune time delays (temporary fix)
- [SPI-NAND]: extend ONFi page detection
- [SPI-NAND]: auto check of Internal ECC use, default mode set to active
Correct CLK edge:


Test of F-18 series (FT62F0Gx):


New detect function, all start sequences included:


Small parser of UCFG area in files from FMD IDE:

[mudrat]

Does anyone here know if there is an english version of the IDE?

[DIMM-bl4]

english version of the IDE?

There is the english translation present, except description of the configuration items.

[mudrat]

Yes, I have English selected there, but there is still 'Chinese (Simplified)' showing in the popup windows. And you can not select it to paste into Google translate. Have been poking around in the installed files to try and find if there are some sort of language overlay, to no success. Did find a lot of Microchip PIC references....

BTW: There does not seem to be any help files, when I select Help, Topics, nothing happens.

[DIMM-bl4]

still 'Chinese (Simplified)' showing in the popup windows

The only popup I struggled with was the error message when selecting the wrong compiler. GCC work fine (separate installer).

And you can not select it to paste into Google translate

I've translated it over Google translate via phone camera.

find a lot of Microchip PIC references....

Of course...

[manish12]

looking for this file but from https://www.fremontmicro.com/en/#/support/6

FT62F0Gx_Demo_SOP28_V1.2.zip

downloaded as 0kbs, any one plz upload it

[thisiseth]

mat079, sent to PM, please check.

DIMM-bl4 i'd like to try the programmer too if possible! have some FT60E021's i want to experiment on, and the CH341 2$ thing

[DIMM-bl4]

Added test support for newest MCUs from FMDProgrammer 5.3.9.0.

There are two new additional start sequences for FT62FDCx/FT64FDCx and FT60FC1x/FT62FC1x pairs.
If someone has access to that new MCUs, and want (and can) test - please welcome.