Jabe UD-1200 vs. Jabe UD-1200 PRO vs. JBC CD-2SQE - need Firmware for UD-1200

[DavidAlfa]

Doesn't seem fake, perhabs ST sold the same die as RB at certain moment.
Now time to write the non-pro fw into the pro station!
Even having the fw backup, I'd preserve the original stm32s, just in case, getting a new STM32F103RB for testing.
If data after 128K is FF all the way to the end, trimming to 128K will probably work just fine.

[JimKnopf]

I wanted to see if there is anything interesting in the code. I loaded the bin file into ghidra using the svd loader for stm32f103. It seems, if you represent the knowledge for reverse engineering on one single meter, i'm stuck at the second mm. I thought i could find text from menu or something else. Nothing obvious to see to me.


@DavidAlfa I will look in my shelf if i have any spareparts with a STM32F103RB. If not, i will just flash the MCU from Pro device.

No risk, no fun.

[DavidAlfa]

Also did I. I got the main function for both fw, but that was all.
Ghidra didn't recognize some pointers automatically, that's why it doesn't make sense at first.
Symbol Tree->Functions->there you have main.

I'm not really interested in reverse-engineering the entire thing, I don't even own a Jabe!

[JimKnopf]

I resoldered both STM32F103 to their boards. Both devices were working as expected with original firmwares and RDP still on.

I used the JLink to disable RDP and to programm the Jabe UD-1200 PRO first. Quite easy with the 2x10 pinheader.

openocd -f interface/jlink.cfg -c "transport select swd" -f target/stm32f1x.cfg
    (and in another terminal)
telnet localhost 4444
init
reset halt
stm32f1x unlock 0
reset run
init
reset halt
flash write_image erase /...[...].../Jabe-UD1200-128k.bin 0x8000000
reset run
exit

After that, the device turned on and showed only the welcome screen. System doesn't start up. I tried all combinations on the buttons while starting the device, without success.
I then tried to flash quick and dirty the eeprom in the PRO version with data from non-PRO Version using a pomona clamp. Unfortunately, this didn't work.
I had to desolder the eeprom and programm with adapter instead of the easy way using a pomona clamp. 

The PRO then started, and i had english language. But i couldn't use the OK button. The OK button did the same as the down button. I was not able to use the menu. After reflashing both, eeprom and STM32f103 the PRO startet and i was able to use the OK button to use the menu. Picking up the T245 handle i could change temp. To my surprise, the device had the same temp limit on the tip like i had with the original firmware when using a T245 handle. Remember, the PRO came with T210 handle.

So far, no luck with my idea just swapping the firmware and use the PRO with a T245 handle.

The UD1200 non-PRO was my next victim. While the PRO showed me the welcome screen after flashing, the UD-1200 did nothing.
Usually there is a beep when turning on the device. It was just dead. I also desoldered the eeprom like i did on the PRO. I programmed the eeprom with data from PRO eeprom.

After that, the non-PRO device turned on and showed me the welcome screen but failed to start the system. The PRO firmware does not work on the non-PRO device. I reflashed the non-PRO firmware (while the eeprom still had it's data from PRO version) and the device starts as expected. Temperature on display matches the temp on the tip.

The only thing was, the counter had zeros.

Flashing is very easy once the RDP is turned off.
If there is any brave UD-1200 owner with a newer firmware that supports the three temperature presets and is willing to extract the firmware and eeprom content please contact me.

[yangzs]

It's an honor to download your program. It would be even better if you could manually set the firmware length.
Can designing such a circuit board work properly?

[yangzs]

Can you make your project support the GD32F103 chip? Where do I need to modify to read the firmware of GD32F103?

[JimKnopf]

@yangzs Your circuit

https://www.eevblog.com/forum/reviews/jabe-ud-1200-vs-jabe-ud-1200-pro-vs-jbc-cd-2sqe-need-firmware-for-ud-1200/?action=dlattach;attach=1884736

looks perfect. It will work.

A circuit design like in this picture

https://www.eevblog.com/forum/reviews/jabe-ud-1200-vs-jabe-ud-1200-pro-vs-jbc-cd-2sqe-need-firmware-for-ud-1200/?action=dlattach;attach=1875904;image

could be used for 48 and 64 pin together in one board.

[yangzs]

If it can support GD32F103, it would be even more perfect. Can you give me some guidance?

[DavidAlfa]

The PRO firmware does not work on the non-PRO device.

I guess you''ll have to reverse engineer the schematic. Initially it might look similar, but have very different connections in the end.
Perhabs a simple pullup resistor tells it to behave like a pro/non-pro.
Go figure!

[JimKnopf]

@yangzs The GD32F103 is pin compatible. Flashmemory has same start address. Flash memory size is bigger. Just try it. You may open a new thread in Microcontroller section if you need further advice.

[yangzs]

The waveform is like this, and it can only read 2 bytes. What's wrong with this?

[DavidAlfa]

What's going on? Last messages make no sense. Are you guys talking through PM?

[yangzs]

It's already evening now
Only two bytes can be read out
I should do this

[JimKnopf]

@DavidAlfa No PM. He tries to hijack the thread or focus on STM32F103 comparable chips. Has nothing to do with the Jabe topic. I recommended to @yangzs to open a new thread in Microcontroller for further advice.

[DavidAlfa]

Hah! Unbelievable.
yangzs go ask elsewhere where they talk about GD32, or make your own thread! 
Spamming a random STM32 thread asking for this makes no sense at all.

[yangzs]

@JimKnopf I mentioned it's also TM32F103RE，sleep_ms(15); Change to 30 Everything Okay。

[DavidAlfa]

Ah,ok, so it was related, attacking a GD32 . My apologies.
Yeah GD32 load the firmware from the external flash so it takes longer to boot.

[balu.2019@gmail.com]

Hi Jim,

I was struckup in the below step after transferring IC (STM32F103C8) to the breakout board.

Info : STLINK V2J42S7 (API v2) VID:PID 0483:3748
Info : Target voltage: 3.213132
Error: init mode failed (unable to connect to the target)

i tried the connectios as per attahced, but still no luck.

Could you please help me on the connections

Regards,
Balakrishna

[JimKnopf]

Have a look at my post https://www.eevblog.com/forum/reviews/jabe-ud-1200-vs-jabe-ud-1200-pro-vs-jbc-cd-2sqe-need-firmware-for-ud-1200/?action=dlattach;attach=1881895

In the top right corner you can see the connection to the ST-Link adapter. Be aware you have to connect the all GND pins together and also connect all Vcc pins to 3,3V as shown in my picture.

[balu.2019@gmail.com]

Hi Jim,

Thanks for the info, I have connected as per you suggestion (connected all GND pins together and also connected all Vcc pins to 3,3V)

howerver I am getting Timeout : No data recieved from Target.

Could you please help on this.

Regards,
Balakrishna

[JimKnopf]

Did you notice the two pull-up resistors? If i remember correctly, the value was 10k.

[balu.2019@gmail.com]

Hi Jim,
Yes, I have used 1K resistors, but still same error Timeout : No data recieved from Target..

for Vcc pins I am using the STLink v2 power (3.3v) , but getting only 2.7v to the IC pins, will it be the issue?

Regards,
Balakrishna

[JimKnopf]

Scroll through the messages on page 2. I had same error until i used a pullob resistor on nrst https://www.eevblog.com/forum/reviews/jabe-ud-1200-vs-jabe-ud-1200-pro-vs-jbc-cd-2sqe-need-firmware-for-ud-1200/msg5047624/#msg5047624

[alexgubanow]

hello everyone, i do have jabe ud-1200 for already few years, bought from banggood with English firmware.
Recently it has switched to Chinese on it is own and i have no idea how to switch it back...
Any ideas? What are the chances of language setting being stored in eeprom?

[JimKnopf]

@alexgubanow

I'm pretty sure the settings are stored in Eeprom. Can you share a dump of your eeprom?

What firmwareversion does your UD-1200 has? Can you post the service manual? Is there an option for language settings?