C-SKY Flash Programmer with STM32 CK-Link Lite: Reading/Writing to Taixin TXW817-810 MCU

divadiow 26 May 2025 23:10 6 4578 Cool? (+3)

📢 Listen (AI):

TL;DR

C-SKY Flash Programmer is used with a CK-Link Lite to read and write flash on Taixin TXW817-810 MCU chips based on the C-SKY CK803 core.
The setup uses a cheap STM32F103 board as CK-Link Lite, wired PA9 to SCK and PA10 to DAT, with 5V micro-USB power.
The target chip is a 1mb TXW817-810, and the programmer is set to ICE Clk 1200Khz before reading flash.
Reading requires an algorithm .elf file, while writing uses a BIN image with Hex removed, a BIN entry added, and chip erase selected.
The dump succeeds, the TXW81x demo firmware boots on next power-up, and flashing the backup restores the original firmware.

Generated by the language model.

The C-SKY Flash Programmer is a piece of software supplied for download by XuanTie at https://www.xrvm.cn/community/download?id=4425633167990394880

Screenshot of the Xuantie website with a download panel for the Jianchi Development Toolset and FlashProgrammer Tool V1.0.15.

This tool works with CK-Link programmers to read and write to the flash memory in C-Sky's proprietary RISC core CPUs. CPUs based on C-SKY architecture include the WinnerMicro W800, W801 and W806 - XT804/CK804 type. TaiXin Semiconductor's TXW8xx are also based on C-SKY architecture - the CK803.

To make your own CKLink Lite using a cheap STM32F103 board see this thread: https://www.elektroda.com/rtvforum/topic4120455.html or cloned cheap ready-made CK-Link boards can be bought on sites like Ali Express. There's also the official tool, for a price

CkLink Lite programmer and debugger in a black case with white text.

Here I will demonstrate the process to read and write to a TXW817-810 - a 1mb Taixin chip seen in many cheap A9/X5/X6 type mini cams.

When PR is merged C-SKY Flash Programmer can be downloaded from https://github.com/openshwprojects/FlashTools/tree/main/C-SKY

Initial run of the program after install:

Screenshot of FLASH PROGRAMMER software interface for programming flash memory.

To read device flash, an algorithm .elf file needs to be specified. Currently I have working TXW81x and W806 elf files tested, attached.
Navigate to Advance

Configuration window of a programming tool for microcontrollers, showing algorithm file setup, erase type, and log options.

Under the read tab change to Bin programmer, set a save path for flash read and choose appropriate length for the flash in the target device

Screenshot of a memory reading software interface with file type and save path options.

Under "Local JTAG" tab set ICE Clk to 1200Khz

Advanced settings screen for Local JTAG interface with checked options and input fields.

With the CK-Link device connected, which in the case of the Taixin chips is through PA9 (DebugCLK) -> CKLink SCK and PA10 (DebugIO) -> CKLink DAT

Excerpt from technical documentation in Chinese about the TXW81x debug port.

Example device - X6 cam

Printed circuit board with microSD slot and labeled debug and signal pins.

Here's that cam connected to STM32 running as a CK-Link Lite
GND - GND
PA10 - STM32 A1
PA9 - STM32 A5
power via 5v micro-USB

Microcontroller programmer connected by wires to a PCB with an SD card reader.

Click the Read, not Start, button to dump flash under the Read tab

Screenshot of a program window for reading a binary file via JTAG interface.

Progress

Screen with Please wait... message, data read info, and a Cancel button.

Completion

Dialog window with Information message, indicating success and an OK button.

To write a flash file leave the Advance section and come back to main screen. Here I'll flash the Taixin demo firmware txw81x_v2.5.2.6-31320_2025.5.25_IOT_AT_PC6-PC7.bin available from https://github.com/openshwprojects/FlashDumps/tree/main/IoT/TXW817

Highlight the box labelled Hex and click REMOVE. Add a Bin type from the ADD button. Specify file to be flashed and to flash from 0x0. In the Advance menus I have chosen to Chip Erase the whole flash under Erase Type. Start button at the bottom begins flash

Flash programmer window with selected binary file path and programming and verification options enabled.

Flash Programmer window with a Please wait… message during programming data.

On next boot I can see from the output on TX/PC7 that it is the demo firmware booting

And flashing back my backup results in a working original firmware again.

Attachments:

txw81x_w806_elf_flash_algorithm.zip (44 KB) You must be logged in to download this attachment.

About Author

divadiow wrote 4761 posts with rating 838 , helped 412 times. Live in city Bristol. Been with us since 2023 year.

Comments

Add a comment

divadiow 27 May 2025 06:57

Regarding the TXW806, also CK803, it appears PA8 and PA9 should be used instead of PA9/PA10. From TXW80X Mass production and programming guide.pdf at https://github.com/divadiow/DataSheets/tree/main/Taixin... [Read more]

divadiow 29 May 2025 14:20

and of course WinnerMicro W80x can be dumped in this app too if start address is correctly set https://obrazki.elektroda.pl/1290401300_1748521283_bigthumb.jpg [Read more]

p.kaczmarek2 03 Oct 2025 11:21

@divadiow @insmod are there any known technical details of the protocol used to flash it here? I would like to implement it with Beken, Arduino, or CH341. Anything? Is this I2C? Alternatively, a salae... [Read more]

insmod 03 Oct 2025 11:28

Probably some SWD or JTAG variant [Read more]

p.kaczmarek2 03 Oct 2025 14:54

Isn't JTAG using 4 wires? SWD, on the other hand... well, it makes sense, SWDIO and SWCLK, right? Any futher references on that? Do we expect it to carry usual flash commands, or would it be fully custom? We... [Read more]

divadiow 03 Oct 2025 15:02

https://www.tindie.com/products/johnnywu/cklink-lite-debugger-probe/ [Read more]

FAQ

TL;DR: This FAQ shows how to dump and reflash a 1 MB Taixin TXW817-810 with an STM32F103 CK-Link Lite. As one quoted description says, "JTAG2 is a two-wire debugging protocol," so the method targets users who need backup, recovery, or firmware testing on TXW8xx and W80x devices. [#21708794]

Why it matters: It turns a cheap STM32 board into a practical tool for reading, restoring, and testing firmware on C-SKY/XuanTie-based camera and IoT chips.

Option	Hardware source	Cost signal in thread	Best use
STM32F103 as CK-Link Lite	DIY from a cheap STM32F103 board	Cheap DIY	Read/write TXW817 backups and test firmware
Cloned CK-Link board	Ready-made clone boards	Cheap	Faster setup with similar workflow
Official CK-Link tool	Official programmer	"for a price"	Paid official path

Key insight: For TXW817 dumping, the crucial setup is the correct flash algorithm ELF, the Read button under the Read tab, and a 1200 kHz Local JTAG clock. If you skip any of those, the dump or write process can fail. [#21561229]

Quick Facts

The demonstrated target is a TXW817-810 with 1 MB flash, commonly found in A9/X5/X6 mini cams. [#21561229]
The working Local JTAG setting shown for reading is ICE Clk = 1200 kHz. [#21561229]
TXW81x debug pins have an internal default pull-up of 100K, and the board should avoid large capacitors or heavy loads on the debug interface. [#21561229]
The example wiring powers the target from 5 V micro-USB and connects TXW817 lines to an STM32F103 used as CK-Link Lite. [#21561229]
After flashing the demo image, the boot log reports cpu clk: 240, flash clk: 60, and a 256-byte syscfg write. [#21561229]

How do I read the flash memory of a Taixin TXW817-810 using C-SKY Flash Programmer and an STM32 CK-Link Lite?

Use the TXW81x flash algorithm ELF, then read the chip from the Advance menu. 1. Open Advance, switch the Read tab to Bin programmer, choose a save path, and set the flash length to match the target. 2. In Local JTAG, set ICE Clk to 1200 kHz and wire the CK-Link Lite to the TXW817 debug pins. 3. Click Read under the Read tab to dump flash; do not press Start for this job. [#21561229]

What is CK-Link Lite, and how does it work with C-SKY or XuanTie microcontrollers like the TXW817 and W806?

CK-Link Lite is a debugger/programmer that works with XuanTie and C-SKY cores through CK-Link protocols. "CK-Link Lite" is a debug probe that downloads and debugs T-Head/XuanTie microcontrollers, supports the full XuanTie CPU range, and exposes JTAG5 plus the two-wire JTAG2 mode for programming and debugging. In this thread, an STM32F103 board emulates CK-Link Lite and successfully reads and writes Taixin TXW817 flash with C-SKY Flash Programmer. [#21708794]

Which algorithm .elf file should I select in C-SKY Flash Programmer for a TXW81x, TXW80x, or WinnerMicro W80x chip?

Select the algorithm ELF that matches the chip family you are targeting. The thread states that TXW81x and W806 ELF files were tested and working, while a TXW80x flash algorithm ELF was also linked later but marked not tested. For WinnerMicro W80x, the app can dump those chips too, but you must also set the correct start address. [#21561305]

Why do I need to click the Read button instead of Start when dumping flash in C-SKY Flash Programmer?

You must click Read because the dump operation is performed from the Read tab, not from the main flashing workflow. The thread explicitly warns to click Read, not Start, when saving flash to a file. Start is used later for programming a firmware image, such as a BIN written from 0x0 after changing the main-screen file entry. [#21561229]

What is the ICE clock in C-SKY Flash Programmer, and why was 1200 kHz used for the Local JTAG setting?

ICE clock is the debugger communication clock used between CK-Link and the target chip. The thread defines it as the In-Circuit Emulator Clock and shows a working Local JTAG setting of 1200 kHz for TXW817 dumping. That value matters because the demonstrated read process used it successfully with the STM32-based CK-Link Lite and the Taixin debug pins. [#21561229]

How should PA9, PA10, PA8, SCK, and DAT be wired between a Taixin TXW817 or TXW806 board and an STM32F103 running as CK-Link Lite?

For the TXW817 example, connect PA9 (DebugCLK) to CKLink SCK and PA10 (DebugIO) to CKLink DAT. The shown camera-to-STM32 wiring is GND to GND, PA10 to STM32 A1, PA9 to STM32 A5, with power from 5 V micro-USB. For TXW806, the follow-up note says PA8 and PA9 should be used instead of PA9 and PA10. [#21561305]

Why do the TXW817 debug pad labels seem inconsistent, and how do they relate to the TXW806 pinout?

The thread suggests the pad labels may reflect an older TXW806-oriented board design, not the TXW817 itself. It says this may explain the incorrect-looking labels on the TXW817 example board, because TXW817 may be a drop-in replacement for TXW806. In that case, boards originally laid out for TXW806 could keep TXW806-style debug labeling even after a TXW817 was fitted. [#21561305]

What is JTAG2 on XuanTie CK-Link devices, and how is it different from standard JTAG5 or ARM-style SWD?

JTAG2 is XuanTie’s two-wire debug mode that reuses standard JTAG signals. The quoted device description says JTAG5 is the standard JTAG interface, while JTAG2 is similar to SWD, reusing TCK and TMS and reducing the interface to two wires. That makes it closer in pin count to ARM-style SWD than to 4-wire JTAG, but it is still described as a XuanTie-designed protocol. [#21708794]

How do I write a .bin firmware file to a TXW817 from address 0x0 using C-SKY Flash Programmer and Chip Erase?

Go back to the main screen, replace the default file entry, and flash the BIN from 0x0. 1. Remove the item labeled Hex and add a new Bin entry. 2. Select the firmware file and set the write address to 0x0. 3. In Advance, choose Chip Erase under Erase Type, then press Start to program the full flash. [#21561229]

What causes the lvd fault and syscfg invalid magic_num messages after flashing the Taixin demo firmware on a TXW817?

The demo firmware booted, but its log showed configuration and power-related faults on that hardware. The output reports syscfg: invalid magic_num=ffff at 0xfe000 and 0xff000, then writes 256 bytes of default parameters, and later prints repeated lvd fault messages with srp_lvd_vcc15_vol_low. That indicates the image started, but the stored syscfg content and supply conditions did not match a clean, stable runtime setup for that board. [#21561229]

How can I back up the original firmware from a mini cam with a TXW817 and restore it later if testing custom images fails?

First dump the original flash to a BIN file, then write that backup back from 0x0 if your test image fails. The thread shows a full readout saved with the Read workflow, then later restores the original firmware by reflashing the saved backup. It explicitly states that flashing back the backup resulted in a working original firmware again on the mini cam. [#21561229]

What start address should I use to dump WinnerMicro W80x flash in the C-SKY Flash Programmer app?

Use the correct start address for the specific WinnerMicro W80x image layout, because the thread does not give one universal numeric value. It states that WinnerMicro W80x can be dumped in this app too if start address is correctly set, but it does not publish the exact address in the post itself. So the key requirement is not the same ELF alone; the start address must also match the target firmware mapping. [#21563820]

STM32 CK-Link Lite vs a cloned or official CK-Link programmer: which is better for flashing Taixin TXW8xx chips?

The STM32 CK-Link Lite is the best low-cost choice if you want a working DIY path with proven TXW817 results. The thread shows successful read and write operations using a cheap STM32F103 board, while also noting that cheap cloned CK-Link boards are available ready-made and that the official tool exists for a price. Choose STM32 DIY for flexibility, clones for convenience, and official hardware for a paid first-party route. [#21561229]

What technical details are known about the flashing/debug protocol used by CK-Link Lite on Taixin or XuanTie chips, and how feasible is it to reimplement it with Beken, Arduino, or CH341?

The thread confirms only the protocol family, not the packet-level implementation. One reply identifies the link as JTAG5 or JTAG2, and JTAG2 is described as a two-wire XuanTie protocol that reuses TCK and TMS. The same discussion says a logic-analyzer capture would be needed for serious feasibility work with Beken, Arduino, or CH341, because no command set, framing, or flash transaction details were provided. [#21708794]

Where can I download the C-SKY Flash Programmer, flash algorithm ELF files, and example TXW817 firmware images mentioned in the thread?

The thread names three sources. It says C-SKY Flash Programmer is supplied by XuanTie from xrvm.cn, and later notes that when the PR is merged it can also be downloaded from the FlashTools GitHub tree. It also points to the TXW80x algorithm ELF in the same GitHub area and gives an example TXW817 demo BIN, txw81x_v2.5.2.6-31320_2025.5.25_IOT_AT_PC6-PC7.bin, from the FlashDumps GitHub tree. [#21561229]

Generated by the language model.