Jabe UD-1200 vs. Jabe UD-1200 PRO vs. JBC CD-2SQE - need Firmware for UD-1200

[DavidAlfa]

I'd say we upload all the firmwares here.
After all, it can only be used in these stations!

[DavidAlfa]

I found the way to switch the language!
Hold both arrow buttons down, turn on the station, count 2 seconds, then quickly release the buttons and hold OK until the screen shows up.

FYI, the screen uses the same command set as a PCF8814.
I also found the logo locations and format! There're two of them (For each language).
They can be found by searching these patterns (Use HxD):

English:

Code: [Select]

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 E0 E0 20 E0 E0 20 E0
Chinese:

Code: [Select]

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 A0 A0 20 20 20
Note down the offsets where the pattern starts.

Make a 128x64 monochrome BMP in Paint or whatever, then upload it here: https://javl.github.io/image2cpp/
- Tick "Invert image colors".
- Draw mode: "Vertical - 1bit per pixel".
- Click "Download as binary".
You should get a file sized exactly 1KB.

Open it in HxD, copy everything, open the fw file, go to the offset position, right-click over it and press Control+B (Paste writing).

Save and flash!

[DavidAlfa]

Got it! It's hardcoded in a cpu instruction, after patching it effectively unlocks 130W.

I spent about 8 hours reverse-engineering this, so I'll post the Ghidra project for everyone, it would be a waste to simply forget it.
It has plenty of functions and variables identified, I also added the entire memory map by hand!
The menu has also been analyzed and commented.
Everything is made of pure bitmaps, there aren't text strings anywhere.





Limit patch:


Defaults patch:


Attaching the firmwares, it includes original 245, 210 and modded 210 for 130W (Newer FW version).

If you flash this: The EEPROM is not important, if you're having issues simply erase it.

[JimKnopf]

@DavidAlfa Fantastic!

You are great! I am very impressed. Very cool.

[DavidAlfa]

The v3.02.04 fw is included in the file, so give it a try!

Can you post a image comparing the transformers?
Because the one from the 210 has a a very obvious "30W" label on it!

I know, you won't put that power for more than 10-20 seconds at most, it'll be in the stand or flying in the air most of the time, 130W is only applied for very short peaks.

Finally: There's no need to remove the stm32, I connected it like this and I could perform the attack, extract the firmware and program without issues.
It was solely powered by the Rpi Zero pin.

The T-210 handle is not recognized when R41 is soldered.

It did for me, using the UD-1200 FW.
I accidentally plugged the 210 instead the 245 and went peach orange in just 3 seconds...
Are you 100% sure R41 is 2K2?

I didn't try with the 210 fw.

[JimKnopf]

@DavidAlfa I should have weighed the two devices at the beginning. They look almost the same inside. However, the UD-1200 is 197 grams heavier than the UD-1200 Pro. If you look closely, you can see the windings on the transformer of the UD-1200 (left one). They are not visible on the UD-1200-Pro (right one with the 220V sticker). They end at the edge of the metal core. The transformer of the UD-1200 has a little more copper on it. The Ohm and Henry values are very similar.

[DavidAlfa]

Hmm so not that good after all.
I wonder how it'll do in the medium-long term.

[JimKnopf]

@DavidAlfa R41 is the same value as R42, 222 marking code which is a 2.2k Ohm resistor.

[DavidAlfa]

 Thanks  .
 Could you measure the voltages on the secondaries?
I wonder how different they are.

[JimKnopf]

@DavidAlfa The differenz is very small. I would say it's nearly the same. Both with the T245 handle plugged in at 350°C. Temp measurement with the RST FG-100 was the same 344°C on both devices which depends on my Tip.

[DavidAlfa]

Thanks! If the transformer was really struggling the voltage would drop a lot.
Will have a more detailed look later

Edit: did you check under load?

[JimKnopf]

@DavidAlfa Yes, i tested with a hot tip at 350° both (under load).

[Solid_snake]

thank again guys for your research
it worked well by flashing the fw and placing R41

[JimKnopf]

I received from a UD-1200 the firmware 3.02.02 from a brave member who answered to my initial question for this firmware. Thanks to the image from @DavidAlfa, he was able to do download the file without desoldering the Chip. He did it on WSL (Ubuntu).

I flashed it and tested it. Works fine on both devices.

@DavidAlfa I was asked, if the trick will work on a STM32F0 or AT32f421. These MCU are used on a Atten ST-862D Hotair Station. I have the STM32F0 version, one of the first devices in the market i guess. The brave board member has a AT32f421 in his device. Seems pin compatible. I will start a new topic for that: https://www.eevblog.com/forum/reviews/atten-st-862d-firmware-(st32f0-and-at32f421-version)/

[DavidAlfa]

Totally different mxu and firmware, so no, it won't.
Also, you need to read the original firmware first, which might not be possible if the mcu is locked.