Brother (possibly also some Bernina) embroidery machine memory cards

[bezmi]

Hi Guys, first post on the forums. I stumbled upon here when doing my own research on this and decided to base my work off Aero's. Here is a link to my github repo: https://github.com/bezmi/brother_embroidery_card_experiments. At the moment, I am using a utility written by another github user to emulate a vikant card and write to it using the old free software that vikant provides.

I have also been digging through the image dumps a fair bit and you can see my notes on reverse engineering the file format here: https://github.com/bezmi/brother_embroidery_card_experiments/blob/main/notes.org. I am waiting on a replacement ribbon cable after I broke one in the machine, but once that arrives I will put these notes to the test in trying to write a utility to write to the device without needing to use PED basic or the Vikant software.

[MarkMLl]

Hi Guys, first post on the forums. I stumbled upon here when doing my own research on this and decided to base my work off Aero's.

Welcome to the forum and discussion :-)

I've got very limited time to put into this at the moment ("real life" issues) but I'm still hoping at some point to get a logic analyser and disassembler hooked up to monitor the transfers... which will almost certainly echo the excellent work done by others (but I did have a lot of fun writing support code for my old HP kit :-)

By way of xref, https://github.com/MarkMLl/pesdump might interest: it's fairly good at parsing files but rather less good at patching them.

MarkMLl

[maehw]

Hi all,

thanks for your helpful posts and insights! After about a year of silence, I'd like to join in. It seems that I fell into the same rabbit hole...

First, I'll start with a summary of my understandings - this might help others, at least it will help me if I come here again. You can also correct me if I am wrong and help me fix my understandings.

• The Brother memory cards used for embroidery machines have 40 pins in a single row with a 1mm pitch, likely using an AMP 175564 connector.
• There are machine models from other vendors (Baby Lock, White, Bernina Deco, Simplicity, Husqvarna, Viking) that are reported to be compatible.
• Thanks to opened cards and visible chip markings, we know that up to 4 Mbit of parallel flash memory can be addressed.
• The pinout seems to be verified as some of you have connected a card to an Arduino via a breadboard or even own PCBs.
• There are 19 address bus pins resulting in 2¹⁹ = 524288 addresses = 512k addresses.
• There are 8 data bus pins resulting in 512k addresses * 8 bit/address = 4 Mbits or 512 kBytes usable memory.
• The other pins on the connector are for VCC (5V), chip enable (CE), output enable (OE), write enable (WE).
• Some of you have been able to dump the whole 512 kByte memory of the chips.
• The memory layout still seems unknown, it's unlikely that they contain a "file system"... at least not a known standard one.
• The binary does not only seem to contain stripped(!) PES data but also preview images. (Where are they located? How can they be viewed? What format are they in?)
• The binary does not only seem to contain stripped(!) PES data but also preview images. (Where are they located? How can they be viewed? What format are they in?)

To me, the following is not quite clear yet ...

• if all cards are writeable because they really need to be writeable by the embroidery machines - or only those "blank" cards that have been sold to write them by a PC.
• if there are cards that have a program input voltage (VPP) which is different than VCC. (I've read about chips requiring 12.0 Volts).
• what the commands in the code in the git repositories brother_embroidery_card_experiments or brother-cart-emulator/ is based on? Are those vendor-specific or do they comply with some standard (CFI, JEDEC, ...)? (Edit: Both seem to have used the SST39SF040-55-4I-WHE device which has "software command sequences" such as the magics 0x5555, 0x2AAA, etc in its datasheets as well as manufacturer ID (0xBF). Not sure though if the former that's standardized or Microchip-specific.)
• does the Brother embroidery machine only accept only certain flash memories? e.g. only from a few vendors?
• has someone tested if the Brother PED Basic and those 3rd party card readers/writers (Magic Box OESD, The Magic Box, Vikant Ultimate Box, EmbCard, ...) accept only certain flash memories? e.g. only from a few "expected vendors/models"? e.g. from the same chip vendor they included in their cards?
• are there any new findings about the layout of the binary/ card's flash memory?
• other methods than "hooking" into some Windows DLL (CardIO.dll) or executable or serial connection to get a properly formatted binary file?
• any new efforts in reverse engineering those card readers?
• has anyone tried to reverse engineer the firmware from one of those machines?
• how did you visualize the binary and find the preview bitmaps in there? I've tried with Gimp and was not successful with 1-bit aka monochrome raw image data imports.

Or has everybody just given up or bought the old, expensive hardware?

Those old "original" re-writeable cards and card readers/writers seem very expensive (probably because "rare") these days (card readers ˜100-200 €/USD, cards ˜80-120 €/USD). And for some only 32-bit machines seem to be supported. I am not sure if I really want to spend ˜80-120 €/USD for a used, old, pretty standard memory chip+PCB+connector that's maybe worth only ˜5-10 €/USD.

[amyk]

• if there are cards that have a program input voltage (VPP) which is different than VCC. (I've read about chips requiring 12.0 Volts).

Someone posted a picture of a card with an AM29F010, and another posted one with a MX29F400. Those are both 5V-only.

• what the commands in the code in the git repositories brother_embroidery_card_experiments or brother-cart-emulator/ is based on? Are those vendor-specific or do they comply with some standard (CFI, JEDEC, ...)? (Edit: Both seem to have used the SST39SF040-55-4I-WHE device which has "software command sequences" such as the magics 0x5555, 0x2AAA, etc in its datasheets as well as manufacturer ID (0xBF). Not sure though if the former that's standardized or Microchip-specific.)

The SST39SF040 is also 5V-only and all the ones found so far seem to follow the standard parallel NOR flash commands, although I'm not sure which JEDEC standard it is.

• does the Brother embroidery machine only accept only certain flash memories? e.g. only from a few vendors?
• has someone tested if the Brother PED Basic and those 3rd party card readers/writers (Magic Box OESD, The Magic Box, Vikant Ultimate Box, EmbCard, ...) accept only certain flash memories? e.g. only from a few "expected vendors/models"? e.g. from the same chip vendor they included in their cards?

Given that there's an ID function and part of that determines the capacity, I suspect that is the case.

[maehw]

Thanks for sharing the bear's binary file. I've tried to reproduce the export and visualization of PEC data.

However, I've experimented with the start offset as 0x2F327 something seems missing:

See attached bear_0x2F327.png.

With a different (earlier) start offset, I can see more of the bear: bear_0x2F023.png -- however, this may go too far into memory regions that are not PEC yet.

Unfortunately, I could not find neither PES nor PEC headers (based on https://edutechwiki.unige.ch/en/Embroidery_format_PES and https://edutechwiki.unige.ch/en/Embroidery_format_PEC).

Two code snippets; the first using Linux command line tool `dd` to extract the binary snippet out of the whole file (which goes by putty.txt here) as a new .pec file, the second one is a Python script importing the .pec file and storing the stitch data as PNG image file:

Code: [Select]

#/bin/bash
binary_name="bear"
start_offset=0x2F023  # 0x2F327  # Starting byte offset
end_offset=0x321E7    # Ending byte offset
skip=$((start_offset))  # Number of bytes to skip
count=$((end_offset - start_offset + 1))  # Number of bytes to copy
dd if=${binary_name}.bin of=${binary_name}.pec bs=1 skip=$skip count=$count


Code: [Select]

import pyembroidery
import os

file_name="bear"
pec_file_name=file_name+".pec"
file_size=os.stat(pec_file_name).st_size
print(f"PEC file size: {file_size} bytes")
pattern = pyembroidery.read_pec(pec_file_name)
print(f"number of stitches: {len(pattern.stitches)}")
print(f"number of items in threadlist: {len(pattern.threadlist)}")
pyembroidery.write(pattern, file_name+".png")

Other things I could not get working: the Vikant card emulator (another Python script)... or rather I could not get it working with the "Ultimate Explorer for Brother" (Serial port version). Even though I created virtual COM ports with com0com, only the Python side connected... and Vikant's Ultimate Explorer didn't want to open or even find the COM port. So this approach currently won't work for me to write own card binaries from PES files.


Edit: Bear beared out, see bears_preview.png -- however, seems to be some kind of mirrored.

[MarkMLl]

I've updated my PES-reader program at https://github.com/MarkMLl/pesdump after another user checked it and highlighted some compiler-version problems (my fault: I'd reverted to an old compiler and made some changes, then hadn't tested it with the most recent).

Discussion at https://github.com/MarkMLl/pesdump/pull/2 has this

I've tried to get some free PES sample files to play around. Interestingly, Brother themselves provide some here: https://sewingcraft.brother.eu/en/inspiration-and-events/projects-and-free-patterns

Even more interesting: the newer files from 2024 seem to use newer file versions (seen 0080 in the "Paw Print" and even 0100 in the "Easter bunny"). So this file format still needs to be extended with new features - I am surprised! Going further down the list, the "Magic mushrooms" (file name Embroidery202401pes.pes) is the first one that uses an older version (0001) and that worked with your tool.

I've not yes attempted to follow the new file format up. If anybody finds themselves needing it then please speak up.

MarkMLl

[maehw]

Hi all,

this may be slightly off topic, but... it is still related to machine embroidery (and teaching) and some of yous might be interested in it:

Do you know about TurtleStitch?

Coded Embroidery

A community driven platform turning your coded designs into embroidered works of art

https://www.turtlestitch.org/

Unfortunately, the project does not natively support the Brother/PES file format. I'd like to change that. Hence, I've forked the repository and tried to add the support. But, I am stuck at the moment and am seeking for support.. maybe also some of you are more familiar with the PEC/PES file format and could take a look here?

https://github.com/backface/turtlestitch/pull/139

Kind regards

[viiix]

Hi !
I've been following this topic since a while now, hoping to gather info on brother memory cards.
I aim to make some kind of a flashcart for my embroidery machine (a brother one).
I tried to dump one of my cards using a AT mega 2560 (an ali express clone though  :'( ). Pinout matched perfectly !
I've attached a dump (quite bad: I think there is a timing problem while reading) and the sketch source code (I also attempted to tranfer C code via avrdude and failed, possibly due to the cheap copy of arduino, feel free to ask for my code).
Oh and if anyone has a provider for the connector (an AMP 5145564-1), it'd be great, I didn't found any provider selling it.

Thanks for this very useful thread.

[maehw]

Hi viiix,

thanks for sharing your code and memory dump.  I had started reverse engineering back in the days myself but had lost motivation and interest in the meantime. I've also written a Python to read, write and erase the flash cards using the original brother PE DESIGN USB card reader/ writer. Unfortunately, they are quite hard to obtain. Also, I don't have a source for the connector — they seem special and outdated.

Cheers
Mäh

PS: Let me know when you know more about the flash dump.
PPS: I currently cannot view the files as I don't have my laptop with me, only my smartphone.

[maehw]

Hi viix,

I've used the following Python script to convert the file with your HEX strings to a true binary file:

Code: [Select]

from binascii import unhexlify

with open("outfile.bin", "wb") as ofile:
    with open("dump8_viix.txt", "r") as ifile:
        for line in ifile:
            ofile.write(unhexlify(line.strip()))
You'll have to remove the two lines containing "begin dump" first.

I've also attached the resulting binary file (zip-ed as otherwise it is not accepted as an attachment here) for others to poke in with a regular HEX editor. The file contains 0xD000 = 53.248 bytes.

It doesn't start with a Copyright notice, so is somewhat unexpected content for me. Can you please tell us which card you've tried to dump these contents from?

[stj]

the string of plaintext is probably a security check.

some games consoles used the same trick to prevent private company's selling "un licensed" games.
if you make something without the string it isnt recognised,
if you include the string they sue you for copywrite infringement.

[viiix]

Hi,
The card is the no14 from Brother (at least it works on my brother machine)
https://becsew.com/products/brother-embroidery-design-card-no-14-large-floral-pre-owned?variant=12222008066149

I think this dump doesn't show copyright information because it is of poor quality. Some dumps made later shows some bits of copyright information ("patterf created bq") (I've attached them in binary format).

Unfortunately I managed to burn my card (I mean litteraly burn), so I wont be able to give more dumps than those I already made. I've attached them all in a .zip below.

[maehw]

Having the reference to card #14 is really helpful.. because that's a card I've dumped myself.

This allowed me to compare our two dumps (see screenshot attached).

@viiix

Yours is on the left (from the binary conversion I had attached in my last post), mine is on the right.

Now you can also see what I mean by Copyright notice.

From the ASCII text on the right, it seems that we got some matching bytes:

- The "4" of "external 4M"
- The "3" of "DRAGON3"
- The "&" of "M.K & T.F"
- The "4"+"1" of "1994/12"

Maybe there's a timing issue in your code?
Or some noise toggling some bits quite often?

____

Edit:

I also compared dump12inBinaryFormatNotTXT.txt with my dump file. (Second screenshot with the later time in its name.)

Seems like you get the "o"+"y"+"i"+"h" of "Copyright" right. From the structure it doesn't look too bad... the 0xFF regions match my 0xFF regions. I haven't done a detailed binary comparison on the bit level (you could do it) -- maybe you can identify relevant bit lines that should be double-checked.

You'll have to explain what to find in embroidery.zip... as there are a lot of files in this archive.

[ap0ptosis]

Hello everyone,

I would like to start off by saying thank you to everyone prior for taking the time to document their findings on the forum. I realize I'm digging this thread up from the graveyard, but I'm hoping what little I have to contribute will be of use.

I've just acquired a Husqvarna 1250 Embroidery/Sewing machine. This machine also uses the same cards. I've disassembled mine in the hopes of contributing to the reversing efforts in the coming weeks (do not hold your breath; I'm a complete, absolute beginner).

This card shares the same AMP 175564 (now TE Connectivity I believe) connector, obsolete now. The chip is an ST M27C2001 2Mbit EPROM, so 256k but I know that this machine also accepts 512k cards (marketed as programmable cards that come with a dock to connect to a computer via LPT). So this aligns with the previous findings - I would wager that any EPROM that matches the spec would work fine.

I'm attaching the board photos and the datasheet for this chip.

I hope to share more findings if I make headway in the coming weeks, though progress will be slow.