├── README.md
├── dumper.py
└── wchprog.py


/README.md:
--------------------------------------------------------------------------------
 1 | # wchprog
 2 | 
 3 | A python script that programs firmware of CH55x chips through USB link.
 4 | 
 5 | needs: pyusb 1.0 
 6 | https://walac.github.io/pyusb/
 7 | 
 8 | under ubuntu:
 9 | 
10 | sudo apt-get install python-pip
11 | sudo pip install pyusb
12 | 
13 | 
14 | WCH forum
15 | http://www.wch.cn/bbs/thread-65023-1.html
16 | 
17 | 
18 | # MIT License
19 | 
20 | Permission is hereby granted, free of charge, to any person obtaining a copy
21 | of this software and associated documentation files (the "Software"), to deal
22 | in the Software without restriction, including without limitation the rights
23 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
24 | copies of the Software, and to permit persons to whom the Software is
25 | furnished to do so, subject to the following conditions:
26 | 
27 | The above copyright notice and this permission notice shall be included in all
28 | copies or substantial portions of the Software.
29 | 
30 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
31 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
32 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
33 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
34 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
35 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
36 | SOFTWARE.
37 | 
38 | # Copyright
39 | (C) 2017 juliuswwj@gmail.com
40 | 


--------------------------------------------------------------------------------
/dumper.py:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/python
  2 | from __future__ import print_function
  3 | 
  4 | import struct
  5 | import sys
  6 | import usb.core
  7 | import usb.util
  8 | from intelhex import IntelHex
  9 | 
 10 | scrambleCode = (0x29, 0x52, 0x8C, 0x70)
 11 | 
 12 | stats = [0xff, 0x02, 0x00, 0xf5, 0xe5, 0x75, 0x03, 0x04,
 13 |          0x80, 0x05, 0xd2, 0x01, 0xe4, 0xef, 0x82, 0x83,
 14 |          0x08, 0x24, 0xc2, 0x60, 0xe0, 0x12, 0x7f, 0x34,
 15 |          0x10, 0x07, 0x22, 0x40, 0x54, 0x94, 0x30, 0x70,
 16 |          0xc0, 0xf0, 0xaf, 0xd0, 0x44, 0xa3, 0x36, 0x74,
 17 |          0x15, 0xc3, 0x09, 0x93, 0x53, 0xec, 0x48, 0x06,
 18 |          0x0a, 0x14, 0x20, 0x25, 0x50, 0x64, 0xd4, 0x16,
 19 |          0x43, 0x47, 0xd6, 0xe7, 0xea, 0x0c, 0x32, 0x3f,
 20 |          0x46, 0x90, 0xc8, 0xdf, 0x38, 0x45, 0xb4, 0xd3,
 21 |          0xfa, 0xa1, 0xc5, 0xca, 0xcc, 0xde, 0xfc, 0x0b,
 22 |          0x23, 0x37, 0x42, 0xed, 0xfb, 0x2f, 0x95, 0x55,
 23 |          0x85, 0xdc, 0x18, 0x26, 0x33, 0x7d, 0x89, 0xac,
 24 |          0xae, 0xfe, 0x0f, 0x17, 0x1b, 0x27, 0x35, 0x39,
 25 |          0x3e, 0x57, 0x78, 0x8f, 0xa9, 0xaa, 0xc1, 0xd9,
 26 |          0xdd, 0xe3, 0xf3, 0xf8, 0x0d, 0x21, 0x3b, 0x3c,
 27 |          0x73, 0x81, 0x87, 0x88, 0x8a, 0x99, 0xbf, 0xdb,
 28 |          0xf2, 0xfd, 0x1a, 0x1f, 0x31, 0x5f, 0x6c, 0x7a,
 29 |          0x7e, 0x8e, 0xbc, 0xd5, 0xd8, 0xda, 0xe9, 0xeb,
 30 |          0xee, 0xf6, 0x11, 0x1c, 0x29, 0x2d, 0x56, 0x58,
 31 |          0x7c, 0x8d, 0x91, 0x98, 0xb3, 0xb9, 0xd7, 0xe1,
 32 |          0xe6, 0xe8, 0xf9, 0x13, 0x1e, 0x28, 0x2e, 0x41,
 33 |          0x4e, 0x69, 0x79, 0x7b, 0x9e, 0x9f, 0xa0, 0xab,
 34 |          0xad, 0xcf, 0xe2, 0x0e, 0x19, 0x1d, 0x2a, 0x4b,
 35 |          0x52, 0x5b, 0x63, 0x84, 0x86, 0x8c, 0x9d, 0xa2,
 36 |          0xb1, 0xb2, 0xc4, 0x2b, 0x49, 0x4a, 0x4c, 0x4d,
 37 |          0x59, 0x61, 0x67, 0x68, 0x6b, 0x6d, 0x6e, 0x6f,
 38 |          0x77, 0x92, 0x96, 0x9a, 0xa6, 0xa8, 0xb0, 0xb5,
 39 |          0xbb, 0xc6, 0xc7, 0xc9, 0xcd, 0xd1, 0xf4, 0x2c,
 40 |          0x3a, 0x3d, 0x4f, 0x51, 0x5a, 0x5c, 0x5d, 0x5e,
 41 |          0x62, 0x65, 0x66, 0x6a, 0x71, 0x72, 0x76, 0x8b,
 42 |          0x97, 0x9b, 0x9c, 0xa4, 0xa5, 0xa7, 0xb6, 0xb7,
 43 |          0xb8, 0xba, 0xbd, 0xbe, 0xcb, 0xce, 0xf1, 0xf7]
 44 | 
 45 | 
 46 | def scramble(l):
 47 |     return [v ^ scrambleCode[i%4] for i, v in enumerate(l)]
 48 | 
 49 | 
 50 | def binStrOfList(l):
 51 |     return ''.join(chr(x) for x in l)
 52 | 
 53 | 
 54 | class WCHISP:
 55 |     def __init__(self):
 56 |         # find our device
 57 |         dev = usb.core.find(idVendor=0x4348, idProduct=0x55e0)
 58 |         if dev is None:
 59 |             raise ValueError('Device not found')
 60 | 
 61 |         dev.set_configuration()
 62 |         cfg = dev.get_active_configuration()
 63 |         intf = cfg[(0, 0)]
 64 | 
 65 |         self.epout = usb.util.find_descriptor(intf, custom_match = lambda e: usb.util.endpoint_direction(e.bEndpointAddress) == usb.util.ENDPOINT_OUT)
 66 |         self.epin = usb.util.find_descriptor(intf, custom_match = lambda e: usb.util.endpoint_direction(e.bEndpointAddress) == usb.util.ENDPOINT_IN)
 67 | 
 68 |     def cmd(self, msg, length=64):
 69 |         self.writeb(msg)
 70 |         b = self.readb(length)
 71 |         if len(b) == 2:
 72 |             return struct.unpack('<H', b)[0]
 73 |         return b
 74 | 
 75 |     def xcmd(self, msg, exp):
 76 |         #xmsg = map(lambda x: hex(ord(x))[2:], msg)
 77 |         #print ' '.join(xmsg)
 78 |         #return 0
 79 | 
 80 |         ret = self.cmd(msg)
 81 |         if ret != exp:
 82 |             xmsg = map(lambda x: hex(ord(x)), msg[0:4])
 83 |             raise Exception('cmd[%s] return %d != %d' % (','.join(xmsg), ret, exp))
 84 | 
 85 |     def info(self):
 86 |         v = self.cmd('\xa2\x13USB DBG CH559 & ISP' + '\0')
 87 |         self.cmd('\xbb\x00')
 88 |         return v
 89 | 
 90 |     def readb(self, size):
 91 |         return self.epin.read(size)
 92 | 
 93 |     def writeb(self, b):
 94 |         self.epout.write(b)
 95 | 
 96 |     def dump(self):
 97 |         # send the key
 98 |         b = '\xa6\x04' + struct.pack('BBBB', *scrambleCode)
 99 |         self.xcmd(b, 0)
100 |         # find block of 16 0xFF at the end of the device memory
101 |         block = [0xff] * 16
102 |         found = False
103 |         for address in range(0x3ff0, -1, -1):
104 |             print('\rLooking for address 0x{:04X}'.format(address), end='')
105 |             r = self.cmd('\xa7\16' + struct.pack('<H', address) +
106 |                  binStrOfList(scramble(block)))
107 |             if r == 0:
108 |                 print('\nFound 0xFF block at address 0x{:04X}'.format(address))
109 |                 found = True
110 |                 break
111 |         if not found:
112 |             print('\nUnable to find 0xFF block')
113 |             return
114 | 
115 |         memdump = IntelHex()
116 |         memdump.puts(address, binStrOfList(block))
117 | 
118 |         print('Starting flash dumping')
119 |         base = [0xa7, 16, 0, 0]
120 |         nTry = 0
121 |         nBytes = 0
122 |         for address in range(address - 1, - 1, -1):
123 |             block[1:] = block[:-1]  # shift
124 |             base[2:4] = address & 0xFF, address >> 8
125 |             found = False
126 |             for i in range(256):
127 |                 i = stats[i]
128 |                 block[0] = i
129 |                 nTry += 1
130 |                 r = self.cmd(binStrOfList(base + scramble(block)), 4)
131 |                 if r == 0:  # verification ok, we found the correct byte
132 |                     print('{:02X} '.format(i), end='')
133 |                     sys.stdout.flush()
134 |                     found = True
135 |                     nBytes += 1
136 |                     memdump[address] = i
137 |                     break
138 |             if not found:
139 |                 raise ValueError('Unable to find correct '
140 |                        'byte for address 0x{:04X}'.format(address))
141 | 
142 |         output_bin = 'out.bin'
143 |         output_hex = 'out.hex'
144 |         print('\nDone, writing output files {} and {}'. format(output_bin,
145 |                                                                output_hex))
146 |         print('Ntry = {} {:.2f}try/bytes'.format(nTry, float(nTry) / nBytes))
147 |         memdump.tobinfile(output_bin)
148 |         memdump.tofile(output_hex, format='hex')
149 | 
150 | 
151 | isp = WCHISP()
152 | 
153 | # check chip ID and bootloader presence
154 | if isp.info() != 0x52:
155 |     raise IOError("not a CH552T device")
156 | 
157 | # dump flash
158 | isp.dump()
159 | 


--------------------------------------------------------------------------------
/wchprog.py:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/python
  2 | 
  3 | import usb.core
  4 | import usb.util
  5 | import sys, struct
  6 | 
  7 | class WCHISP:
  8 |     def __init__(self):
  9 |         # find our device
 10 |         dev = usb.core.find(idVendor=0x4348, idProduct=0x55e0)
 11 |         if dev is None:
 12 |             raise ValueError('Device not found')
 13 |         
 14 |         dev.set_configuration()
 15 |         cfg = dev.get_active_configuration()
 16 |         intf = cfg[(0,0)]
 17 |         
 18 |         self.epout = usb.util.find_descriptor(intf, custom_match = lambda e: usb.util.endpoint_direction(e.bEndpointAddress) == usb.util.ENDPOINT_OUT)
 19 |         self.epin = usb.util.find_descriptor(intf, custom_match = lambda e: usb.util.endpoint_direction(e.bEndpointAddress) == usb.util.ENDPOINT_IN)
 20 | 
 21 |     def cmd(self, msg):
 22 |         self.writeb(msg)
 23 |         b = self.readb(64)
 24 |         if len(b) == 2:
 25 |             return struct.unpack('<H', b)[0]
 26 |         return b
 27 | 
 28 |     def xcmd(self, msg, exp):
 29 |         #xmsg = map(lambda x: hex(ord(x))[2:], msg)
 30 |         #print ' '.join(xmsg)
 31 |         #return 0
 32 | 
 33 |         ret = self.cmd(msg)
 34 |         if ret != exp: 
 35 |             xmsg = map(lambda x: hex(ord(x)), msg[0:4])
 36 |             raise Exception('cmd[%s] return %d != %d' % (','.join(xmsg), ret, exp)) 
 37 | 
 38 |     def info(self):
 39 |         v = self.cmd('\xa2\x13USB DBG CH559 & ISP' + '\0'*42)
 40 |         self.cmd('\xbb\x00')
 41 |         return v
 42 | 
 43 |     def readb(self, size):
 44 |         return self.epin.read(size)
 45 | 
 46 |     def writeb(self, b):
 47 |         self.epout.write(b)
 48 | 
 49 |     def program(self, hexfile):
 50 |         def readhex():
 51 |             lno = 0
 52 |             mem = []
 53 |             with open(hexfile, 'r') as f:
 54 |                 for line in f:
 55 |                     lno += 1
 56 |                     line = line.strip()
 57 |                     if len(line)<6 or line[0] != ':': continue
 58 |                     if line[7:9] == '01': break
 59 |                     if line[7:9] != '00': 
 60 |                         raise ValueException('unknown data type @ %s:%d' % (hexfile, lno))
 61 |                     n = int(line[1:3], 16)
 62 |                     addr = int(line[3:7], 16)
 63 |                     if n + addr > len(mem): 
 64 |                         mem.extend([255] * (n+addr-len(mem)))
 65 |                     i = 9
 66 |                     while n > 0:
 67 |                         mem[addr] = int(line[i:i+2], 16)
 68 |                         i += 2
 69 |                         addr += 1
 70 |                         n -= 1
 71 |             return mem
 72 | 
 73 |         def wv(mode):
 74 |             if mode == '\xa7':
 75 |                 print 'Verifying ',
 76 |             else:
 77 |                 print 'Programming ',
 78 |             sys.stdout.flush()
 79 | 
 80 |             addr = 0
 81 |             while addr < len(mem):
 82 |                 b = mode
 83 |                 sz = len(mem) - addr
 84 |                 if sz > 0x3c: sz = 0x3c
 85 |                 b += struct.pack('<BH', sz, addr)
 86 |                 for i in range(sz):
 87 |                     b += chr(mem[addr+i]^rand[i%4])
 88 |                 self.xcmd(b, 0)
 89 |                 addr += sz
 90 |                 sys.stdout.write('#')
 91 |                 sys.stdout.flush()
 92 |             print ''
 93 | 
 94 |         rand = (0x29, 0x52, 0x8C, 0x70)
 95 |         mem = readhex()
 96 |         if len(mem) < 256 or len(mem) > 16384: 
 97 |             raise "hexfile codesize %d not in (256, 16384)" % len(mem)
 98 | 
 99 |         b = '\xa6\x04' + struct.pack('BBBB', *rand)
100 |         self.xcmd(b, 0)
101 |         for page in range(0, 0x40, 4):
102 |             b = '\xa9\x02\x00' + chr(page)
103 |             self.xcmd(b, 0)
104 | 
105 |         wv('\xa8')
106 | 
107 |         self.cmd('\xb8\x02\xff\x4e') # Code_Protect, Boot_Load, No_Long_Reset, No_RST 
108 |         self.cmd('\xb9\x00')
109 | 
110 |         wv('\xa7')
111 |         self.writeb('\xa5\x02\x00\x00')
112 |         
113 | 
114 | if len(sys.argv) != 2:
115 |     print 'wchprog hexfile'
116 |     sys.exit(1)
117 | 
118 | isp = WCHISP()
119 | if isp.info() != 0x52:
120 |     raise IOException("not a CH552T device")
121 | 
122 | isp.program(sys.argv[1])
123 | 
124 | 


--------------------------------------------------------------------------------