### Install stcgal from source Source: https://context7.com/grigorig/stcgal/llms.txt Alternatively, install stcgal directly from its source code. ```bash ./setup.py build sudo ./setup.py install ``` -------------------------------- ### Install stcgal using setuptools Source: https://github.com/grigorig/stcgal/blob/master/doc/INSTALL.md Installs stcgal globally after building it with setuptools. This command typically requires administrator/root privileges. ```bash sudo ./setup.py install ``` -------------------------------- ### Install stcgal via pip Source: https://context7.com/grigorig/stcgal/llms.txt Install stcgal using pip. Ensure Python 3.5+ and required libraries are installed. USB support can be optionally installed. ```bash pip3 install stcgal ``` ```bash pip3 install stcgal[usb] ``` ```bash stcgal -V # Output: stcgal 1.10 ``` -------------------------------- ### Install stcgal using pip Source: https://github.com/grigorig/stcgal/blob/master/doc/INSTALL.md Installs the latest release of stcgal globally using pip. Administrator/root permissions may be required. ```bash pip3 install stcgal ``` -------------------------------- ### STC8 Ranges vs Trim Value Example 2 Source: https://github.com/grigorig/stcgal/blob/master/doc/reverse-engineering/stc8-protocol.txt Second example showing ranges vs trim values, potentially related to clock calibration or settings. ```hex 46 B9 68 00 20 00 0C 36 9B 4E 92 65 E4 36 CB 4E 7D 66 29 36 D1 4E 83 66 05 36 CB 4E C2 66 47 0A EA 16 ``` -------------------------------- ### Build stcgal using setuptools Source: https://github.com/grigorig/stcgal/blob/master/doc/INSTALL.md Builds the stcgal package using setuptools. This is a preliminary step before installation. ```bash ./setup.py build ``` -------------------------------- ### STC15 MCS Bytes Configuration Examples Source: https://github.com/grigorig/stcgal/blob/master/doc/reverse-engineering/stc15-options.txt These examples show the byte sequences for configuring various options on STC15 microcontrollers. Each sequence corresponds to a specific setting, such as disabling long POR or changing LVD thresholds. ```text baseline B5 FF F7 BB 9F long por disabled B6 FF F7 BB 1F --> MCS4 bit 7 controls POR delay. low => short, high => long reset pin as io disabled B8 FF F7 BB 8F --> MCS4 bit 4 controls reset pin. low => reset is normal, high => reset is io low voltage reset disabled B6 FF F7 FB 9F --> MCS3 bit 6 controls low voltage reset. low => lv reset enabled, high => disabled lvd threshold 2.61v B8 FF F7 BA 9F lvd threshold 2.82v B5 FF F7 B9 9F lvd threshold 3.08v B6 FF F7 B8 9F --> MCS3 bits 0-2 control LVD threshold setting. exact mapping not yet clear. eeprom lv inhibit disabled B7 FF F7 3B 9F --> MCS3 bit 7 controls eeprom lv inhibit. high => eeprom lv inhibit enabled, low => disabled watchdog after reset enabled B6 FF D7 BB 9F --> MCS2 bit 5 controls watchdog after reset. high => disabled, low => enabled watchdog prescaler 128 B4 FF F6 BB 9F watchdog prescaler 64 B5 FF F5 BB 9F watchdog prescaler 32 B5 FF F4 BB 9F watchdog prescaler 2 B6 FF F0 BB 9F --> MCS2 bits 0-2 control watchdog prescaler. mapping is similar to early STC15. wdt stop in idle disabled B7 FF FF BB 9F erase eeprom next programming B4 FF F7 BB 9F --> it's somewhere else! it's bit 1 of the extra MCSX byte that is typically 0xfd. low => erase eeprom disabled, high => erase eeprom enabled p3.3 por state enabled B9 FF F7 BB 97 --> MCS4 bit 3 controls the p3.3 state. high => p3.3 high, low => p3.3 low p3.1 passthrough from p3.0 enabled B5 FF F7 BB DF --> MCS4 bit 2 controls the p3.1 passthrough. low => passthrough disabled, high => passthrough enabled p3.1 push pull enabled B5 FF F7 BB BF --> MCS4 bit 1 controls p3.1 push pull. low => quasi-bidi, high => push-pull b sl pindetect enabled B5 FF F7 BB BF --> somewhere else, MCSX bit 0. low => pindetect enabled, high => pindetect disabled. external oscillator enabled (IAP15F2K61S2) 9C 7F F7 BB 9E --> MCS4 bit 0 controls external oscillator. low => use external crystal, high => use RC. external oscillator enabled + clock gain low (IAP15F2K61S2) 9C 7F F7 BB 9C --> MCS 4 bit controls clock gain. high => high clock gain, low => low clock gain. ``` -------------------------------- ### STC8 Ranges vs Trim Value Example 1 Source: https://github.com/grigorig/stcgal/blob/master/doc/reverse-engineering/stc8-protocol.txt First example illustrating the relationship between general trim values and fine adjustment bytes within a specific range. ```hex 46 B9 6A 00 20 00 0C 00 00 80 00 FF 00 00 01 80 01 FF 01 00 02 80 02 FF 02 00 03 80 03 FF 03 06 A4 16 ``` -------------------------------- ### STC8 MCS Bytes Example Source: https://github.com/grigorig/stcgal/blob/master/doc/reverse-engineering/stc8-protocol.txt An example showing the MCS bytes, which appear to be part of the communication protocol for STC8 microcontrollers. ```hex 46 B9 68 00 30 50 01 31 2E 90 38 01 01 FF FD 8B BF FF 27 35 F7 FE 73 55 00 F6 28 09 85 E3 5F 80 07 20 20 20 01 00 00 FE 05 3A 17 05 25 91 FF 10 54 16 ``` -------------------------------- ### STC8 Status Packet Example Source: https://github.com/grigorig/stcgal/blob/master/doc/reverse-engineering/stc8-protocol.txt An example of a status packet observed from an STC8 microcontroller. Note the positions of wakeup clock, reference voltage, and manufacturing date. ```hex 46 B9 68 00 30 50 00 54 62 58 5D 00 04 FF FD 8B BF FF 27 4A F7 FE 73 55 00 F6 28 09 85 E3 5F 80 07 20 20 20 01 00 00 FE 05 3A 17 05 25 91 FF 10 AE 16 ``` -------------------------------- ### Get MCU Information Source: https://github.com/grigorig/stcgal/blob/master/doc/USAGE.md Call stcgal without any file arguments to retrieve and display information about the connected MCU. ```bash $ ./stcgal.py -P stc15 Waiting for MCU, please cycle power: done Target model: Name: IAP15F2K61S2 Magic: F449 Code flash: 61.0 KB EEPROM flash: 0.0 KB Target frequency: 10.046 MHz Target BSL version: 7.1S Target wakeup frequency: 34.771 KHz Target options: reset_pin_enabled=False clock_source=internal clock_gain=high watchdog_por_enabled=False watchdog_stop_idle=True watchdog_prescale=256 low_voltage_reset=True low_voltage_threshold=3 eeprom_lvd_inhibit=True eeprom_erase_enabled=False bsl_pindetect_enabled=False por_reset_delay=long rstout_por_state=high uart2_passthrough=False uart2_pin_mode=normal Disconnected! ``` -------------------------------- ### STC15A Host to MCU Get Status Handshake Source: https://github.com/grigorig/stcgal/blob/master/doc/reverse-engineering/stc15a-protocol.txt This snippet shows the host's response during the 'Get Status' handshake, including the ACK and 0x7f pulses required by the MCU. ```hex 7F 7F 7F 7F 46 B9 6A 00 07 80 00 F1 16 7F 7F 7F 7F ``` -------------------------------- ### STC8 Clock Division Examples Source: https://github.com/grigorig/stcgal/blob/master/doc/reverse-engineering/stc8-protocol.txt Examples suggesting clock division is used, with different sequences for 5.5 MHz, 11 MHz, and 22 MHz, indicated by specific bytes in the switch packet. ```hex 5.5 Mhz switch: 01 00 00 FF CC 01 5C 80 clkdiv = 4? ``` ```hex 11 MHz switch: 01 00 00 FF CC 01 5B 80 clkdiv = 2? ``` ```hex 22 MHz switch: 01 00 00 FF CC 01 5C 80 clkdiv = 1? ``` -------------------------------- ### STC15F2K08S2 MCU Data Structure Source: https://github.com/grigorig/stcgal/blob/master/doc/reverse-engineering/stc-mcu.txt Example of an F401 (STC15F2K08S2) entry. Includes a note about potential new extra data fields for the STC15 series. ```Assembly 0004e270 d1 05 03 00 68 4f 46 00 01 f4 00 00 00 20 00 00 |....hOF...... ..| ``` ```Assembly 0004e280 00 d4 00 00 00 00 00 00 00 00 01 00 07 00 00 00 |................| ^ some new 15 series extra data, not sure what it is ``` -------------------------------- ### STC11L08XE MCU Data Structure Source: https://github.com/grigorig/stcgal/blob/master/doc/reverse-engineering/stc-mcu.txt Example of a D3E4 (STC11L08XE) entry. Demonstrates the typical data fields for this MCU series. ```Assembly 00051090 c0 48 00 00 ac 3c 46 00 e4 d3 00 00 00 20 00 00 |.H...F.D.... ..| ``` ```Assembly 00050ac0 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 |................| ``` -------------------------------- ### STC11F02 MCU Data Structure Source: https://github.com/grigorig/stcgal/blob/master/doc/reverse-engineering/stc-mcu.txt Example of an E202 (STC11F02) entry. Shows typical data fields for smaller STC11 series MCUs. ```Assembly 00050510 c1 68 00 00 fc 40 46 00 02 e2 00 00 00 08 00 00 |.h...@F.........| ``` ```Assembly 00050520 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 00 |......... ......| ``` -------------------------------- ### STC11F08XE MCU Data Structure Source: https://github.com/grigorig/stcgal/blob/master/doc/reverse-engineering/stc-mcu.txt Example of a D364 (STC11F08XE) entry in the MCU data table. Shows byte offsets for MCU ID, code flash size, and name string pointer. ```Assembly 00050990 c1 48 00 00 4c 3f 46 00 64 d3 00 00 00 20 00 00 |.H..L?F.d.... ..| ^ ^ MCU ID ^ code flash size (32 bit le) ^ pointer to name string ^ feature flags? ``` ```Assembly 000509a0 00 d8 00 00 00 00 00 00 00 00 01 00 00 00 00 00 |................| ^ total flash size (incl. reserved space) (32 bit le) ^ eeprom size (32 bit le) doesn't really add up with datasheet, but it *does* add up with the amount of total flash minus bsl! parts without eeprom have zero here apparently we need to subtract 1 KB ``` -------------------------------- ### Set Device Options (-o flag) Source: https://context7.com/grigorig/stcgal/llms.txt Program fuse-like device configuration registers concurrently with firmware flashing. Multiple options can be combined. ```bash # Switch clock source to external crystal stcgal -P stc15 -p /dev/ttyUSB0 -o clock_source=external firmware.hex ``` ```bash # Combine multiple options in one command stcgal -P stc15 -p /dev/ttyUSB0 \ -o clock_source=internal \ -o watchdog_por_enabled=true \ -o watchdog_prescale=64 \ -o por_reset_delay=short \ firmware.hex ``` ```bash # STC89-specific: enable 6T fast mode stcgal -P stc89 -p /dev/ttyUSB0 -o cpu_6t_enabled=true firmware.hex ``` -------------------------------- ### STC15A Host to MCU Program Hello.bin Initial Handshake Source: https://github.com/grigorig/stcgal/blob/master/doc/reverse-engineering/stc15a-protocol.txt The initial host-to-MCU communication for programming 'hello.bin', including the ACK and 0x7f pulses. ```hex FF 7F 7F 7F 7F 46 B9 6A 00 07 80 00 F1 16 7F 7F 7F 7F 7F 7F ``` -------------------------------- ### Display MCU Information Source: https://context7.com/grigorig/stcgal/llms.txt Connect to the MCU and display device identity, clock frequency, BSL version, and device options. Auto-detects protocol or allows explicit specification. ```bash stcgal ``` ```bash stcgal -P stc15 -p /dev/ttyUSB0 # Output: # Waiting for MCU, please cycle power: done # Target model: # Name: IAP15F2K61S2 # Magic: F449 # Code flash: 61.0 KB # EEPROM flash: 0.0 KB # Target frequency: 10.046 MHz # Target BSL version: 7.1S # Target wakeup frequency: 34.771 KHz # Target options: # reset_pin_enabled=False # clock_source=internal # clock_gain=high # watchdog_por_enabled=False # watchdog_stop_idle=True # watchdog_prescale=256 # low_voltage_reset=True # low_voltage_threshold=3 # eeprom_lvd_inhibit=True # eeprom_erase_enabled=False # bsl_pindetect_enabled=False # por_reset_delay=long # rstout_por_state=high # uart2_passthrough=False # uart2_pin_mode=normal # Disconnected! ``` -------------------------------- ### STC15A MCU to Host Get Status Packet Dump Source: https://github.com/grigorig/stcgal/blob/master/doc/reverse-engineering/stc15a-protocol.txt A raw communication dump showing the MCU's response to a 'Get Status' request. This includes initial ACK and subsequent data packets. ```hex 46 B9 68 00 07 80 00 EF 16 2014-01-09 11:35:18.056583: 46 B9 68 00 40 50 02 B0 02 B0 02 AF 02 B0 02 E6 02 E7 00 00 00 00 67 51 FF F2 94 8C EF 3B F5 58 34 FF FF FF FF FF FF FF FF FF FF FF 00 00 00 00 FF FF FF FF FF FF FF FF 58 50 0C 94 21 FF 29 21 82 16 ``` -------------------------------- ### Flash Firmware in Makefile/CI Script Source: https://context7.com/grigorig/stcgal/llms.txt Use this command in a Makefile or CI script to flash firmware. It checks for successful flashing and provides error handling. ```bash stcgal -P stc8d -p /dev/ttyUSB0 -a -t 11059 -o clock_source=internal build/firmware.hex \ && echo "Flash successful" \ || { echo "Flash FAILED"; exit 1; } ``` -------------------------------- ### STC11F02E MCU Data Structure Source: https://github.com/grigorig/stcgal/blob/master/doc/reverse-engineering/stc-mcu.txt Example of an E222 (STC11F02E) entry. Similar to STC11F02 but with 'E' designation. ```Assembly 00050470 c1 68 00 00 38 41 46 00 22 e2 00 00 00 08 00 00 |.h..8AF.".......| ``` ```Assembly 00050480 00 10 00 00 00 00 00 00 00 20 00 00 00 00 00 00 |......... ......| ``` -------------------------------- ### Configure Device Options Source: https://github.com/grigorig/stcgal/blob/master/doc/USAGE.md Modify device options by providing one or more -o flags followed by a key-value pair. Device options can only be set when flash memory is programmed. ```bash $ ./stcgal.py -P stc15 -o clock_source=external hello.bin ``` -------------------------------- ### Automatic Power-Cycling with stcgal Source: https://github.com/grigorig/stcgal/blob/master/doc/USAGE.md Automate the power-on reset process for entering the bootloader using the DTR signal or a custom command. The -a flag enables autoreset, and -r specifies a custom reset command or script. ```bash ./stcgal.py -P stc15 -a -r "echo 1 > /sys/class/gpio/gpio666/value" ``` ```bash ./stcgal.py -P stc15 -a -r "./powercycle.sh" ``` -------------------------------- ### Display stcgal Usage Information Source: https://github.com/grigorig/stcgal/blob/master/doc/USAGE.md Call stcgal with -h to display all available command-line options and their descriptions. ```bash usage: stcgal [-h] [-e] [-a] [-A {dtr,rts}] [-r RESETCMD] [-P {stc89,stc12a,stc12b,stc12,stc15a,stc15,stc8,stc8d,stc8g,usb15,auto}] [-p PORT] [-b BAUD] [-l HANDSHAKE] [-o OPTION] [-t TRIM] [-D] [-V] [code_image] [eeprom_image] stcgal 1.7 - an STC MCU ISP flash tool (C) 2014-2018 Grigori Goronzy and others https://github.com/grigorig/stcgal positional arguments: code_image code segment file to flash (BIN/HEX) eeprom_image eeprom segment file to flash (BIN/HEX) options: -h, --help show this help message and exit -e, --erase only erase flash memory -a, --autoreset cycle power automatically by asserting DTR -A {dtr,rts,dtr_inverted,rts_inverted}, --resetpin {dtr,rts,dtr_inverted,rts_inverted} pin to hold down when using --autoreset (default: DTR) -r RESETCMD, --resetcmd RESETCMD shell command for board power-cycling (instead of DTR assertion) -P {stc89,stc12a,stc12b,stc12,stc15a,stc15,stc8,stc8d,stc8g,usb15,auto}, --protocol {stc89,stc12a,stc12b,stc12,stc15a,stc15,stc8,stc8d,stc8g,usb15,auto} protocol version (default: auto) -p PORT, --port PORT serial port device -b BAUD, --baud BAUD transfer baud rate (default: 115200) -l HANDSHAKE, --handshake HANDSHAKE handshake baud rate (default: 2400) -o OPTION, --option OPTION set option (can be used multiple times, see documentation) -t TRIM, --trim TRIM RC oscillator frequency in kHz (STC15+ series only) -D, --debug enable debug output -V, --version print version info and exit ``` -------------------------------- ### Specify Protocol Version Source: https://github.com/grigorig/stcgal/blob/master/doc/USAGE.md Use the -P flag to specify the protocol version if autodetection fails or for specific MCU series. ```bash stcgal -P stc15 ``` -------------------------------- ### IHex Python API for Intel HEX Files Source: https://context7.com/grigorig/stcgal/llms.txt The `stcgal.ihex.IHex` class provides a programmatic interface for parsing, manipulating, and writing Intel HEX files. This is useful for preprocessing firmware before flashing. ```python from stcgal.ihex import IHex # --- Reading a HEX file --- ihex = IHex.read_file("firmware.hex") print("HEX mode:", ihex.get_mode()) # 8, 16, or 32 print("Base address:", hex(ihex.get_linearBaseAddress())) # --- Extracting raw binary --- binary_data = ihex.extract_data() print("Firmware size:", len(binary_data), "bytes") # Extract a specific address range (e.g., first 4 KB) chunk = ihex.extract_data(start=0x0000, end=0x1000) # --- Inserting data --- ihex2 = IHex() ihex2.insert_data(0x0000, bytes([0x02, 0x00, 0x03, 0x00])) # LJMP 0x0003 # --- Writing back to HEX string --- hex_string = ihex2.write() print(hex_string) # :04000000020003003D # :00000001FF # --- Writing to a file --- ihex2.write_file("output.hex") # --- Parsing from a string/iterable of lines --- lines = [b":04000000020003003D\r\n", b":00000001FF\r\n"] ihex3 = IHex.read(lines) data = ihex3.extract_data() assert data == bytes([0x02, 0x00, 0x03, 0x00]) ``` -------------------------------- ### Set Serial Port for Programming Source: https://github.com/grigorig/stcgal/blob/master/doc/USAGE.md Use the -p option to specify the serial port device for programming the MCU. ```bash stcgal -p /dev/ttyUSB0 ``` -------------------------------- ### Automate Power-Cycling for BSL Entry Source: https://context7.com/grigorig/stcgal/llms.txt Automates the power-on reset required to enter the BSL, using either the DTR/RTS serial control pin or a custom shell command. ```bash # Autoreset via DTR pin (default) stcgal -P stc15 -p /dev/ttyUSB0 -a firmware.hex ``` ```bash # Autoreset via RTS pin instead of DTR stcgal -P stc15 -p /dev/ttyUSB0 -a -A rts firmware.hex ``` ```bash # Autoreset via inverted DTR signal stcgal -P stc15 -p /dev/ttyUSB0 -a -A dtr_inverted firmware.hex ``` ```bash # Custom reset command using GPIO (e.g., Raspberry Pi or relay board) stcgal -P stc15 -p /dev/ttyUSB0 -a -r "echo 1 > /sys/class/gpio/gpio666/value" firmware.hex ``` ```bash # Custom reset via an external shell script stcgal -P stc15 -p /dev/ttyUSB0 -a -r "./powercycle.sh" firmware.hex ``` -------------------------------- ### STC89C52RC Status Packet Data Source: https://github.com/grigorig/stcgal/blob/master/doc/reverse-engineering/stc89c52rc.txt This is a raw hexadecimal dump of a status packet received from the STC89C52RC. It may indicate communication issues like a missing frame start. ```hex 68 00 3B 00 25 E6 25 E6 25 E6 25 E6 25 E6 25 E6 25 E2 25 E6 43 43 FC F0 02 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ED 16 ``` -------------------------------- ### STC8 Basic Challenge - Host to MCU Source: https://github.com/grigorig/stcgal/blob/master/doc/reverse-engineering/stc8-protocol.txt The initial host challenge packet, followed by 0xfe pulses, sent to the MCU. This is simpler than in STC15. ```hex 46 B9 6A 00 0C 00 02 00 00 80 00 00 F8 16 ``` -------------------------------- ### Set Transfer Baud Rate Source: https://github.com/grigorig/stcgal/blob/master/doc/USAGE.md For older MCUs, use -b 19200 for correct operation if the default 115200 Baud is not supported. ```bash stcgal -b 19200 ``` -------------------------------- ### STC8 Clock Set to 20 MHz Status Packet Source: https://github.com/grigorig/stcgal/blob/master/doc/reverse-engineering/stc8-protocol.txt Two examples of status packets indicating the clock is set to 20 MHz. The encoding differs from STC15, with specific bytes related to clock settings and trim values. ```hex 46 B9 68 00 30 50 01 31 2E 90 38 01 01 FF FD 8B BF FF 27 35 F7 FE 73 55 00 F6 28 09 85 E3 5F 80 07 20 20 20 01 00 00 FE 05 3A 17 05 25 91 FF 10 54 16 ``` ```hex 46 B9 68 00 30 50 01 31 2E 90 38 01 01 FF FD 8B BF FF 27 3B F7 FE 73 55 00 F6 28 09 85 E3 5F 80 07 20 20 20 01 00 00 FE 05 3A 17 05 25 91 FF 10 5A 16 ``` -------------------------------- ### STCgal Option Keys Source: https://github.com/grigorig/stcgal/blob/master/doc/USAGE.md This table lists available option keys for STC microcontrollers, their possible values, and the protocols or models they apply to. These options configure various hardware features and operational modes. ```text cpu_6t_enabled ``` ```text bsl_pindetect_enabled ``` ```text eeprom_erase_enabled ``` ```text clock_gain ``` ```text ale_enabled ``` ```text xram_enabled ``` ```text watchdog_por_enabled ``` ```text low_voltage_reset ``` ```text clock_source ``` ```text watchdog_stop_idle ``` ```text watchdog_prescale ``` ```text reset_pin_enabled ``` ```text oscillator_stable_delay ``` ```text por_reset_delay ``` ```text low_voltage_threshold ``` ```text eeprom_lvd_inhibit ``` ```text rstout_por_state ``` ```text uart1_remap ``` ```text uart2_passthrough ``` ```text uart2_pin_mode ``` ```text cpu_core_voltage ``` ```text epwm_open_drain ``` ```text program_eeprom_split ``` -------------------------------- ### STC15 Password Setting and Checking Source: https://github.com/grigorig/stcgal/blob/master/doc/reverse-engineering/stc15-options.txt This section details how passwords are set and checked using specific packet types and option bytes. It explains the role of MCSP and MCS3 bit 3 in password validation. ```text in set options packet: 46 B9 6A 00 4B 04 00 00 5A A5 FF FF FF 00 FF FF 00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 00 00 FF A8 FF EE FF E0 FF FD 03 FF FF FF FF FF ^^ MCSP FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FD FF FF FF 75 BF F7 BC 9F 3A 80 16 ^^ MCSY password setting the password is sent with packet type 0x07 and checked before erase with packet type 0x05. setting the password uses two fields. index 22 of the option block encodes the password length in bytes (MCSP, see above). bit 3 in MCS3 decides whether the password will be checked. if the bit is set, no password check occurs. if it is reset, a password check occurs. quick dump from USB-ISP packets: set: foobar 0000 ff ff ff 00 ff ff 00 05 ff ff ff ff ff ff ff 07 ................ 0010 ff ff ff ff ff ff ff 07 ff 06 01 ff 6e ff 36 58 ............n.6X 0020 ff 00 ff f5 03 ff ff 0c ff ff ff ff ff ff ff 07 ................ 0030 ff ff ff ff ff ff ff 07 ff ff ff ff ff ff ec 1a ................ 0040 ff ff ff 99 7f f7 bc 38 9f 61 .......8.a reset: 0000 ff ff ff 00 ff ff 00 05 ff ff ff ff ff ff ff 07 ................ 0010 ff ff ff ff ff ff ff 07 ff 00 01 ff 6e ff 36 5e ............n.6^ 0020 ff 00 ff fd 03 ff ff 04 ff ff ff ff ff ff ff 07 ................ 0030 ff ff ff ff ff ff ff 07 ff ff ff ff ff ff ec 1a ................ 0040 ff ff ff 99 7f f7 bc 38 9f 61 .......8.a ``` -------------------------------- ### Program Flash and EEPROM Memory Source: https://github.com/grigorig/stcgal/blob/master/doc/USAGE.md To program both flash and EEPROM memory, provide the path to the EEPROM image after the flash image path in the command. ```bash $ ./stcgal.py -P stc15 hello.hex eeprom.hex ``` -------------------------------- ### STCGAL Target Model Details Source: https://github.com/grigorig/stcgal/blob/master/doc/reverse-engineering/stc15w4.txt Details about the target MCU model, including name, magic number, flash sizes, and firmware version. This information is crucial for correct programming. ```text Target model: Name: STC15W4K56S4 Magic: F528 Code flash: 56.0 KB EEPROM flash: 3.0 KB Target frequency: 0.000 MHz Target BSL version: 7.3.4T Target wakeup frequency: 36.351 KHz Target options: reset_pin_enabled=False clock_source=internal clock_gain=high watchdog_por_enabled=False watchdog_stop_idle=True watchdog_prescale=64 low_voltage_reset=False low_voltage_threshold=3 eeprom_lvd_inhibit=False eeprom_erase_enabled=True bsl_pindetect_enabled=False por_reset_delay=long rstout_por_state=high uart2_passthrough=False uart2_pin_mode=normal Disconnected! ``` -------------------------------- ### Configure Baud Rate and Handshake Source: https://context7.com/grigorig/stcgal/llms.txt Controls the serial handshake baud rate for BSL negotiation and the data transfer baud rate for flash programming. Lowering these values can improve compatibility with problematic USB-UART adapters. ```bash # Use slower transfer baud rate for compatibility with older MCUs or bad UART chips stcgal -P stc12 -p /dev/ttyUSB0 -b 19200 firmware.hex ``` ```bash # Reduce handshake baud rate for problematic USB UARTs (default: 2400) stcgal -P stc15 -p /dev/ttyUSB0 -l 1200 firmware.hex ``` ```bash # Combine: slow handshake + faster transfer stcgal -P stc15 -p /dev/ttyUSB0 -l 1200 -b 57600 firmware.hex ``` -------------------------------- ### STC8 Challenge for 27 MHz Source: https://github.com/grigorig/stcgal/blob/master/doc/reverse-engineering/stc8-protocol.txt Observed challenge sequence for a 27 MHz clock speed. ```hex 46B96A0020000C B000 B001 B002 B003 B100 B101 B102 B103 B200 B201 B202 B203 08F416 ``` -------------------------------- ### STC8 Challenge for 20 MHz Source: https://github.com/grigorig/stcgal/blob/master/doc/reverse-engineering/stc8-protocol.txt Observed challenge sequence for a 20 MHz clock speed. ```hex 46B96A0020000C 3600 3601 3602 3603 3700 3701 3702 3703 3800 3801 3802 3803 033C16 ``` -------------------------------- ### STC8 Challenge for 5.5 MHz Source: https://github.com/grigorig/stcgal/blob/master/doc/reverse-engineering/stc8-protocol.txt Observed challenge sequence for a 5.5 MHz clock speed. ```hex 46B96A0020000C 5C00 5C01 5C02 5C03 5D00 5D01 5D02 5D03 5E00 5E01 5E02 5E03 050416 ``` -------------------------------- ### STC8 Challenge for 11 MHz Source: https://github.com/grigorig/stcgal/blob/master/doc/reverse-engineering/stc8-protocol.txt Observed challenge sequence for an 11 MHz clock speed. ```hex 46B96A0020000C 5B00 5B01 5B02 5B03 5C00 5C01 5C02 5C03 5D00 5D01 5D02 5D03 04F816 ``` -------------------------------- ### Speed Up Programming with Faster Baud Rate Source: https://github.com/grigorig/stcgal/blob/master/doc/USAGE.md Increase programming speed by specifying a faster baud rate using the -b flag. The default is 19200 bps. ```bash $ ./stcgal.py -b 115200 -P stc15 hello.hex ``` -------------------------------- ### STC8 Challenge for 6 MHz Source: https://github.com/grigorig/stcgal/blob/master/doc/reverse-engineering/stc8-protocol.txt Observed challenge sequence for a 6 MHz clock speed. ```hex 46B96A0020000C 1400 1401 1402 1403 1500 1501 1502 1503 1600 1601 1602 1603 01A416 ``` -------------------------------- ### STC8 Challenge for 24 MHz Source: https://github.com/grigorig/stcgal/blob/master/doc/reverse-engineering/stc8-protocol.txt Observed challenge sequence for a 24 MHz clock speed. ```hex 46B96A0020000C 7C00 7C01 7C02 7C03 7D00 7D01 7D02 7D03 7E00 7E01 7E02 7E03 068416 ``` -------------------------------- ### Program Flash Memory (Intel HEX) Source: https://context7.com/grigorig/stcgal/llms.txt Program firmware images in Intel HEX or binary format to the MCU's code memory. Supports specifying baud rate and programming flash and EEPROM simultaneously. ```bash stcgal -P stc15 -p /dev/ttyUSB0 hello.hex # Output: # Waiting for MCU, please cycle power: done # Target model: # Name: IAP15F2K61S2 # ... # Loading flash: 80 bytes (Intel HEX) # Trimming frequency: 10.046 MHz # Switching to 19200 baud: done # Erasing flash: done # Writing 256 bytes: .... done # Setting options: done # Target UID: 0D000021022632 # Disconnected! ``` ```bash stcgal -P stc15 -p /dev/ttyUSB0 -b 115200 firmware.bin ``` ```bash stcgal -P stc15 -p /dev/ttyUSB0 firmware.hex eeprom_data.bin ```