logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

Own firmware for JDY-40 (BK2461) by piotr_go

piotr_go 10698 16
ADVERTISEMENT
Treść została przetłumaczona polish » english Zobacz oryginalną wersję tematu
Reply Cool? Ranking DIY | New topic
Notify about new articles
  • Own firmware for JDY-40 (BK2461) by piotr_go

    Some time ago, while browsing aliexpress for the next thing to throw into the corner the day after receiving the parcel, I came across JDY-40 radio modules. Price $ 0.60, similar to NRF24L01 +.

    Own firmware for JDY-40 (BK2461) by piotr_go

    What is it? I decided to dig a little deeper. BK2461 - Radio SOC with the C51. OK, "biere", for 60 cents I won't be picky. PDF skimpy after censorship, I'll see what comes out of it.
    (I will emphasize right away that I will not describe how the module works with the original FW. I was interested in uploading my own.)
    The radio is similar to other NRF24L01 + clones, only the registers are slightly rearranged. Procek has 8kB OTP. Hmmmm, you never know with the Chinese. Maybe it's flash?
    Several times I encountered systems with ROM which turned out to be a flash. Maybe this time it will be lucky. Also, the pdf mentions loading the program from an external flash. No details. There is only a pinout.
    In the meantime, while waiting for the modules, I decided to blindly design a PCB.
    I decided to use the CH552 / 4 microcontroller for communication with the computer. The 25Q40 memory is used to store the program. Half a megabyte, a bit large, but I had such, I will not order smaller ones.
    On 74xx244 I made a Flash disconnect buffer from BK2461. I disconnected the power supply with a stabilizer. VPP ~ 1.2V generated by a decrease in the zenith.
    For this a pair of buttons. One for FW programmer upgrade, the other for BK2461 power on. LED to control what is happening.

    Own firmware for JDY-40 (BK2461) by piotr_go

    I ordered a PCB.

    After a month of waiting, the modules and boards arrived. Will it work? I will cut paths? Will I curse?
    I soldered the whole thing and started soft. I wrote a simple DFU bootloader for flash programming. I wrote a simple soft test waving a pin. I loaded it into flash, it uploaded. At least that's how it works :D
    Nothing on the BK2461 pin. I connected the analyzer to check the BK2461 flash communication. Looks ok here. I took a risk and somehow it worked. Procek reads memory, but in a loop. Hmmmm, some header required or what? Maybe CRC?
    I generated a BIN with one crc, 2nd, 3rd ... 87th :D Doopa.
    In the end, I decided to check CRC32, which I excluded at the beginning because of the speed at which the proc reads flash.
    It seemed to me that C51 is not able to calculate it so quickly. Well, you can see CRC is counted by hardware because soft was read from flash only once :) SUCCESS
    Of course, nothing appeared on the pin, it would be too easy :P A few more tweaks and I have a blinking LED haha.
    24h later - radio communication fired.





    But is it possible to upload FW to the BK2461 itself?
    I connected 6.5V VPP, silence. No communication asleep with flash. Hmmmm.
    Maybe you need a programmer? I hooked up another microcontroller and started generating random spi sequences. Finally, BK2461 spoke up.
    Quote:
    0x12, 0x1F, 0xF4-0xFF, response

    It looks like 0x12 is a read and the range 0x1FF4-0x1FFF can be read.
    This is as much as I have found out so far.

    Oh well. That's good and that's it. At least you can fire soft from the outside.

    If anyone knows more, I would like to know how to program the internal BK2461 memory.
    Attachments:

    Cool? Ranking DIY
    About Author
    piotr_go
    DIY electronics designer  
    Offline 
    piotr_go wrote 2837 posts with rating 3187, helped 91 times. Been with us since 2003 year.
  • ADVERTISEMENT
  • #2 19119101
    SylwekK
    Level 32  
    How much self-denial in you to test these strange Chinese :D A plus
  • #3 19119195
    mariomario
    Level 18  
    I am curious about the development of the situation .. :)
    I also have 2 such modules (which I wanted to use so far according to their assumption - for wireless "sending" UART between the transmitter ---> the receiver in only one direction)
  • #4 19119475
    zgierzman
    Level 31  
    SylwekK wrote:
    How much self-denial in you to test these strange Chinese :D A plus


    "Those weird Chinese" in my opinion go to the market so that someone can to try replace such a module in a device that has broken down for him. Or for some other mysterious purpose. Certainly not for hobbyists to buy it en masse for their small projects.
    It seems to me that such a module is made either according to the specifications of the customer, for example a factory that produces millions of wirelessly controlled vibrators, or vice versa: the manufacturer of the module will provide the specification if someone orders hundreds of thousands of modules for their purposes.
    Chips, rejects, "bent" pieces, etc. come onto the consumer market. How else to explain the lack of a meaningful datasheet, "evaluation boards" and similar tools?

    Piotr's work certainly brings him a lot of satisfaction, but he will not contribute to the popularization of this type of invention on the market.
    Just look at these Padauki. Two or three years ago, some enthusiasts gathered around the world to discuss how the microcontroller works for 3 cents, even appropriate open-source tools, programmers, etc. were created. , are readers of Elektrody, EEVBlog and similar forums.
    These are systems targeted at mass producers.
    Piotr shows electronic cubes and bargraphs based on them, but who else will use these exotic processors in his projects, especially since it is mainly OTP ...? For my taste, one in a million, the rest will use AVR, ARM, STM, ESP, and the like, well-described and tooled platforms.
    And even if one piece of Padauk costs 3 cents, and another piece costs 3 dollars, for a hobbyist who buys one / several / a dozen or so pieces it does not make a huge difference. Because OTP versus flash is already doing. If you have to sacrifice X cubes to check the next versions of the software, or test soft on one prock that can be reprogrammed tens of thousands of times, you know what will win in the amateur and small-lot use.

    As for me, he is a "positively crazy madman", but the educational value of his articles is zero, because the amount of details of his "reverse engineering" is limited to an absurd minimum. And the practical value is even less.
    But if I were the owner / boss of a company looking for an outstanding employee, I would write a private message to him asking about his terms of employment :-D
  • ADVERTISEMENT
  • #5 19119556
    piotr_go
    DIY electronics designer  
    zgierzman wrote:
    the educational value of his articles is zero, because the amount of details of his "reverse engineering" is reduced to an absurd minimum

    For beginners, probably yes.
    Advanced users will find missing information that they do not write about in PDF.
    There is a schematic, there is software for BIN generation for flash, the rest is standard C51.

    zgierzman wrote:
    And even if one piece of Padauk costs 3 cents, and another piece costs 3 dollars, for a hobbyist who buys one / several / a dozen or so pieces it does not make a huge difference. Because OTP versus flash is already doing.

    There are flash versions of some chips, sometimes even cheaper than OTP.
    Recently, I described Cortexes at 60 cents.
    Rather, the problem is the lack of information in a language other than Chinese and ready-made projects for arduino.

    I am just browsing PDF for Chinese "nrf24l01 +" on steroids version SO8 :D
    Heh .... They probably have a hundred of them.
    Why don't Western companies produce such wonders?

    I hope the Chinese will release more interesting chips outside. There is nothing like the competition.
  • ADVERTISEMENT
  • #6 19119662
    Jogesh
    Level 28  
    I always read with interest about the cheapest chips. I can always find something for myself that I recommend to a friend who does LED flashing systems or WS2811 LEDs. With several thousand pieces, it already pays off, especially since the competition on the market is fighting for every penny. I don't really use such systems myself, because my production scale is too small.
  • #8 19120353
    piotr_go
    DIY electronics designer  
    Yes.
    They did not describe parts of the registers, part of the description is contradictory, empty tables ...
  • #9 19120369
    speedy9
    Helpful for users  
    piotr_go wrote:
    Procek has 8kB OTP. Hmmmm, you never know with the Chinese. Maybe it's flash?

    In total, there is such an interesting entry in the PDF:
    Quote:
    Program memory is normally assumed to be read only

    So something's up :)
  • #10 19120459
    piotr_go
    DIY electronics designer  
    1.
    And what the Chinese meant, only he himself knows.
    As I wrote, I have already seen the chips with the program memory described as "ROM", and further in the description was how to program it from the FW level. :)

    2.
    It could be an early version of the "copy paste" PDF from some other scaler that would suggest some discrepancies.

    3.
    Maybe you can overwrite the unused part of OTP? Such 1kB would be enough for me.
    Erase the old code with zeros (NOP) and put the new one behind it in the empty space.
    Interrupts wouldn't work, but you can live with it.

    4.
    If it is impossible, it is impossible, it is difficult to say.
    Maybe you can buy clean chips somewhere.
  • #12 19120763
    piotr_go
    DIY electronics designer  
    speedy9 wrote:
    Try it, maybe you can get to this file

    I have tried on this and several other servers.
    Registration does not give you anything, they want cash or you need to share something and the shared files must be downloaded.
    Beken did not respond and the aliexpress sellers do not have the files and cannot download.
  • #13 19248229
    altar3
    Level 13  
    Hello, I know I'm reheating the cutlet, but I have a small question. Do these systems to talk with each other somehow need to be paired, do we connect and work?
  • ADVERTISEMENT
  • #14 19248856
    piotr_go
    DIY electronics designer  
    I haven't tried, but from what I can see in the manual, they default to UART bridge 9600bps.
  • #15 19250146
    altar3
    Level 13  
    This is how I read it and I know that it is factory set for transparent UART transmissions. But my point is whether two modules need to be paired with each other somehow or connect and work. And that would mean that all such modules talk to each other and the transmission is in no way secured. Not that I had a plan to send any important or confidential data, but if I would, for example, make a socket that can be switched on from the remote control, another person with such a module can control my socket and annoy me. And I just mean whether these modules pair up with each other in any way so that this transmission is secured to any degree
  • #16 19251138
    piotr_go
    DIY electronics designer  
    I have never tried to fire them on the original FW. I know as much as in the manual.
    I would not count on encryption in modules for 60 cents.
  • #17 19253240
    altar3
    Level 13  
    I know you haven't tried the original FW. I only hoped that someone who tried and would be able to answer my question, and this is what I have to buy and try, and it will last, because parcels are coming from China for a long time.
Reply Cool? Ranking DIY | New topic
Notify about new articles
Report a violation of the law

Topic summary

The discussion revolves around the JDY-40 radio module, which utilizes the BK2461 SoC with a C51 core. Users express curiosity about the module's capabilities, particularly regarding the potential for custom firmware development. The original firmware's limitations and the lack of comprehensive documentation are noted, with some users sharing their experiences and challenges in obtaining necessary programming resources. Concerns about the security of UART communication between modules are raised, questioning whether pairing is required for secure transmission. Overall, the conversation highlights the interest in exploring low-cost Chinese modules for various applications despite the challenges posed by insufficient documentation and support.
Summary generated by the language model.
Popular Topics
ADVERTISEMENT