CFW for KSGER/Quicko STM32 Soldering Stations

[GBember]

I removed all the wires to close the soldering station, thankfully it still works, my solder ended up not being great and the 3 wires were breaking off the solder points, I'll try to borrow a better iron/soldering station to properly do this again. I was using openocd 0.12.0-r. Do you think the solder points I chose were ok? Specially the USART pin, because of the oled using the same pin I'm concerned about interference. I tried using a multimeter to find those pins, but I might have gotten them wrong

[GBember]

Also there weren't any permission problems, I regularly used arduinos and other development boards that also used /dev/ttyACM0, so no problems there

[DavidAlfa]

No problem with using the oled pin, but this issue is not related to the uart.
Do what I said earlier and show the result  .

[sea1731]

https://aliexpress.com/item/1005006604163096.html

I had to make an isolation between the body and a wire sponge because it was triggering the sleep mode when cleaning the tip.
I chose the c245 version and made a small modification to place t12 handle.

Can you please add the internal photos.

[GBember]

No problem with using the oled pin, but this issue is not related to the uart.
Do what I said earlier and show the result  .

Here's the output of that command

Code: [Select]

Open On-Chip Debugger 0.12.0
Licensed under GNU GPL v2
For bug reports, read
http://openocd.org/doc/doxygen/bugs.html
Info : auto-selecting first available session transport "hla_swd". To override use 'transport select <transport>'.
Info : The selected transport took over low-level target control. The results might differ compared to plain JTAG/SWD
Info : clock speed 1000 kHz
Info : STLINK V2J39S7 (API v2) VID:PID 0483:3748
Info : Target voltage: 3.223037
Info : [stm32f1x.cpu] Cortex-M3 r1p1 processor detected
Info : [stm32f1x.cpu] target has 6 breakpoints, 4 watchpoints
Info : starting gdb server for stm32f1x.cpu on 3333
Info : Listening on port 3333 for gdb connections
[stm32f1x.cpu] halted due to debug-request, current mode: Thread
xPSR: 0x01000000 pc: 0x08000274 msp: 0x20001c58
Info : device id = 0x20036410
Warn : STM32 flash size failed, probe inaccurate - assuming 128k flash
Info : flash size = 128 KiB
option byte register = 0x3fffffe
write protection register = 0xffffffff
read protection: on
watchdog: software
stop mode: no reset generated upon entry
standby mode: no reset generated upon entry
user data = 0xffff

[DavidAlfa]

It's a fake stm32, but openOCD seems to be working.
Maybe the Pico pin can't supply enough power?
Measure VDD after it fails.

Try this to see what's going on:
https://github.com/CTXz/stm32f1-picopwner/blob/76f17499abf7691289889564730c8528f2212ca0/dump.py#L259-L261

Code: [Select]

    raise Exception(
        "Could not determine read protection status\nopenocd output: " + result
    )


You could try skipping the RDP check entirely by removing these lines:

https://github.com/CTXz/stm32f1-picopwner/blob/76f17499abf7691289889564730c8528f2212ca0/dump.py#L422-L437

[GBember]

Are you sure it's fake? I checked it by reading 0xE0042000 and it returned a valid value, I tried reading 0x1FFFF7E0 to check the flash size, but that seems to be in the read protected region.
Well, in any case I'll try to solder those 3 wires again to check the voltages, but I'll only be able to borrow another iron next week, so it will take a while.

[DavidAlfa]

I might be wrong, but the flash size isn't protected as far as I know, clones report 0xFFFFFFFF there...
Take a bluepill board and swap the mcu, will make things much easier.

Is that firmware missing in the GitHub FW backups?

[GBember]

I'm far from being able to swap a chip like that lol, I don't have any experience with soldering and desoldering this kind of thing, specially with hot air, which would be ideal.
There's a file called 3.1Snew1.hex in the repo,I suppose this is the right firmware for my board, but I'm not sure (I also wanted to make my own dump, just in case, who knows if they are different).
Also the markings on the chip looks just like the original one, so it's not an outright clone like those CS32, but I know they can also clone that.

EDIT: I just noticed you can see where I tried to solder those extra wires in the picture on C4 and C5, please let me know if those aren't ideal solder points

[DavidAlfa]

Sure for nrst that's fine.
But where are you connecting Boot0 and Boot1 (PB2)?
They're connected to ground in most boards, the attack won't work without them.

This seems to be your board, with schematics:
https://github.com/dreamcat4/t12-t245-controllers-docs/tree/master/controllers/stm32-t12-oled/v3.0-and-v3.1/r0

[GBember]

I just checked with my meter again, what I thought connected to BOOT0 (that side of C5) connects directly to ground and it seems BOOT0 is directly connected to ground, the other side of that capacitor goes to VCC. So the only way to get proper connections is to remove the chip from the board?

[DavidAlfa]

Yes, or by lifting the boot pins, very risky and likely breaking.
You can remove it by building large blobs of solder, joining all the pins on each side.
Mask the board or you'll likely wipe off lots of small parts...

Get a TQFP64 adapter:
https://www.aliexpress.com/item/1005007261319772.html

[GBember]

And after removing the chip, putting it in a bluebill board would be the easiest way to get it working again to dump the firmware, right? I think I'll look into learning how to use hot air for soldering, so it might take a while. Thanks for all the help!

[DavidAlfa]

You have the 64pin version, blue pill comes with 48pin!

[GBember]

I was doing some research and I found that out, I guess I'll try to use a breakout board then. Just need to figure out the extra necessary components for it to work (and how to solder all that together of course)

[GBember]

The chip on my soldering station is the 64 pin version unfortunately

[DavidAlfa]

You don't need anything. Just connect together all VDD/VBAT, VSS, then connect to the Pico as usual.

[DavidAlfa]

I found the T12 patent posted here (Thanks Andrey!), has plenty of details.

[ststefanov13]

Question for David:
Why is the no-iron default value for the c210 profile in the latest firmware 1200 and not 4000 like the t12 and c245 profiles?

[DavidAlfa]

Because in theory the C210 thermocouple outputs half the voltage from what the C245 does, I don't have C210 myself so I used a better-safe-than-sorry value.

If people reported their calibration values I could update them.

[Joewag]

Hello, everyone!
I decided to slightly rework David's firmware for myself.
I replaced t12-c115, adjusted noiron-4000 for c210. At 1200, after heating the tip during calibration at 450 degrees, the tip falls off, over time the tip falls off to lower temperatures of about 320 degrees (Relif, Sunshain tips)
I spent three days fiddling with installing the 1.8.5 package, MX refused to automatically collect files, in the end I did everything manually from the 1.8.0 and 1.8.5 packages.
Don't laugh, I don't understand anything about this.
I wanted to add automatic switching of the knobs by the input voltage level, I was even able to add a menu - Autosel on/off, but
when it came to C, problems began.
David, please tell me what and where to write, there is a forest of information

[DavidAlfa]

I don't know what you're doing, compilation is straighforward, everything is explained in the manual, you only need to install cube ide 1.12.1, nothing else.

CubeMX is embedded in the IDE, when you open the ioc file in cubeIDE it will download the required packages automatically.

Theres is a forest of information, sure, but you aren't helping either, what modifications you made to the hardware?
You will need to add a new ADC channel for the detection  then handle it somewhere.

[Joewag]

The servers do not allow the use of IDE 1.12.1 to download updates, so I put it manually.  In version 1.12.1, MX 6.8.1 was built in, but the last available package for IDE - 1.8.4, in order to integrate it, has to be replaced 1.8.0.  at 1.8.5, after that the list of packages was updated, and I was able to manually add 1.8.0 and 1.8.5, otherwise nothing happened.  I don’t know what went wrong, the first time I install IDE, but the internal MX could not add the necessary files to the project.  Now it does not matter.  Everything turned out and the firmware was compiled.

 I will have a power supply with three output voltages, the handles will switch the voltage.  According to my version, the controller sees the input voltage and switch the necessary profile.
 In this case, I also need to introduce ADC channel?
I have  ksger v2.1 board.

[DavidAlfa]

So you toggle the input voltage manually?

[Joewag]

You could say that.
There is a resistance in the knobs between the first pin and the gnd, this is how the output voltage on the power supply is set.