C-SKY Flash Programmer with STM32 CK-Link Lite: Reading/Writing to Taixin TXW817-810 MCU

divadiow 4761 6

TL;DR

C-SKY Flash Programmer is used with a CK-Link Lite to read and write flash on Taixin TXW817-810 MCU chips based on the C-SKY CK803 core.
The setup uses a cheap STM32F103 board as CK-Link Lite, wired PA9 to SCK and PA10 to DAT, with 5V micro-USB power.
The target chip is a 1mb TXW817-810, and the programmer is set to ICE Clk 1200Khz before reading flash.
Reading requires an algorithm .elf file, while writing uses a BIN image with Hex removed, a BIN entry added, and chip erase selected.
The dump succeeds, the TXW81x demo firmware boots on next power-up, and flashing the backup restores the original firmware.

Generated by the language model.

Report a violation of the law

Reply Cool? Ranking DIY | New topic

Notify about new articles

📢 Listen (AI):

Topic author Helpful post? (+3)

Helpful post
Post #1
21561229 26 May 2025 23:10

The C-SKY Flash Programmer is a piece of software supplied for download by XuanTie at https://www.xrvm.cn/community/download?id=4425633167990394880

This tool works with CK-Link programmers to read and write to the flash memory in C-Sky's proprietary RISC core CPUs. CPUs based on C-SKY architecture include the WinnerMicro W800, W801 and W806 - XT804/CK804 type. TaiXin Semiconductor's TXW8xx are also based on C-SKY architecture - the CK803.

To make your own CKLink Lite using a cheap STM32F103 board see this thread: https://www.elektroda.com/rtvforum/topic4120455.html or cloned cheap ready-made CK-Link boards can be bought on sites like Ali Express. There's also the official tool, for a price

Here I will demonstrate the process to read and write to a TXW817-810 - a 1mb Taixin chip seen in many cheap A9/X5/X6 type mini cams.

When PR is merged C-SKY Flash Programmer can be downloaded from https://github.com/openshwprojects/FlashTools/tree/main/C-SKY

Initial run of the program after install:

To read device flash, an algorithm .elf file needs to be specified. Currently I have working TXW81x and W806 elf files tested, attached.
Navigate to Advance

Under the read tab change to Bin programmer, set a save path for flash read and choose appropriate length for the flash in the target device

Under "Local JTAG" tab set ICE Clk to 1200Khz

Code: Text
Log in, to see the code

With the CK-Link device connected, which in the case of the Taixin chips is through PA9 (DebugCLK) -> CKLink SCK and PA10 (DebugIO) -> CKLink DAT

Code: Text
Log in, to see the code

Example device - X6 cam

Here's that cam connected to STM32 running as a CK-Link Lite
GND - GND
PA10 - STM32 A1
PA9 - STM32 A5
power via 5v micro-USB

Click the Read, not Start, button to dump flash under the Read tab

Progress

Completion

To write a flash file leave the Advance section and come back to main screen. Here I'll flash the Taixin demo firmware txw81x_v2.5.2.6-31320_2025.5.25_IOT_AT_PC6-PC7.bin available from https://github.com/openshwprojects/FlashDumps/tree/main/IoT/TXW817

Highlight the box labelled Hex and click REMOVE. Add a Bin type from the ADD button. Specify file to be flashed and to flash from 0x0. In the Advance menus I have chosen to Chip Erase the whole flash under Erase Type. Start button at the bottom begins flash

On next boot I can see from the output on TX/PC7 that it is the demo firmware booting
Code: Text
Log in, to see the code

And flashing back my backup results in a working original firmware again.

Attachments:

txw81x_w806_elf_flash_algorithm.zip (44 KB) You must be logged in to download this attachment.

Cool? Ranking DIY
About Author
divadiow divadiow

Level 38
Offline

Joined: 20 Nov 2023

Posts: 4825

Help: 419

Posts rating: 848

Points: 23959
divadiow wrote 4825 posts with rating 848, helped 419 times. Live in city Bristol. Been with us since 2023 year.

ADVERTISEMENT
Helpful post

#2 21561305 27 May 2025 06:57

divadiow divadiow

Level 38

Topic author Helpful post? (+1)

Helpful post
Post #2
21561305 27 May 2025 06:57

Regarding the TXW806, also CK803, it appears PA8 and PA9 should be used instead of PA9/PA10. From TXW80X Mass production and programming guide.pdf at https://github.com/divadiow/DataSheets/tree/main/Taixin we see:

This also may explain why the pad labels in the example above appears to be incorrect for the TXW817. If TXW817 is a drop-in replacement for TXW806 maybe the boards were labelled for and originally made for use with TXW806.

TXW80x flash algorithm elf https://github.com/divadiow/FlashTools/tree/main/C-SKY - not tested
ADVERTISEMENT
#3 21563820 29 May 2025 14:20

divadiow divadiow

Level 38

Topic author Helpful post? (0)

Post #3
21563820 29 May 2025 14:20

and of course WinnerMicro W80x can be dumped in this app too if start address is correctly set
ADVERTISEMENT
#4 21708587 03 Oct 2025 11:21

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #4
21708587 03 Oct 2025 11:21

@divadiow @insmod are there any known technical details of the protocol used to flash it here? I would like to implement it with Beken, Arduino, or CH341. Anything? Is this I2C?

Alternatively, a salae logic analyzer capture could be a good start.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
ADVERTISEMENT
#5 21708596 03 Oct 2025 11:28

insmod insmod

Level 31

Helpful post? (0)

Post #5
21708596 03 Oct 2025 11:28

Probably some SWD or JTAG variant
#6 21708789 03 Oct 2025 14:54

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #6
21708789 03 Oct 2025 14:54

Isn't JTAG using 4 wires? SWD, on the other hand... well, it makes sense, SWDIO and SWCLK, right? Any futher references on that?

Do we expect it to carry usual flash commands, or would it be fully custom?

We really need a capture in order to do some initial considerations on the feasability of implementing that.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#7 21708794 03 Oct 2025 15:02

divadiow divadiow

Level 38

Topic author Helpful post? (0)

Post #7
21708794 03 Oct 2025 15:02

Quote:
CKLink lite is used for downloading and debugging T-Head series microcontrollers. supports debugging the full range of XuanTie CPU cores. It supports JTAG5 and JTAG2. JTAG5 is a standard JTAG interface, while JTAG2 is similar to SWD, reusing the TCK and TMS signals of the standard JTAG protocol. This is a two-wire debugging protocol (designed by XuanTie), occupies fewer pins and offers a higher debug clock frequency. JTAG2 is generally recommended for debugging microcontrollers.

https://www.tindie.com/products/johnnywu/cklink-lite-debugger-probe/
Create an account, log in here. You will receive points by participating in discussions.
Join this discussion.

Install Elektroda application

Didn't find an answer? Ask Artificial Intelligence

*I agree to send the question to OpenAI, Anthropic PBC, Perplexity AI, Inc., Kagi Inc., Google LLC - owners of language models in order to prepare the best response. The companies may monitor and log information entered into the form.

*I agree to publicly display my question and answer. The question and answer will be publicly available to everyone. The process may take a few minutes. Upon completion, you will be redirected to the page with the answer.

Wait...(2min)

Reply Cool? Ranking DIY | New topic

Notify about new articles

📢 Listen (AI):

Report a violation of the law

Topic summary

✨ The C-SKY Flash Programmer software, provided by XuanTie, interfaces with CK-Link programmers to read and write flash memory on C-SKY architecture CPUs, including WinnerMicro W800, W801, W806 (XT804/CK804), and TaiXin Semiconductor's TXW8xx series based on the CK803 core. A cost-effective CK-Link Lite programmer can be built using an STM32F103 board or purchased as a clone from marketplaces like AliExpress. The discussion focuses on programming the TXW817-810, a 1MB flash Taixin MCU commonly found in low-cost A9/X5/X6 mini cameras. For the TXW806/CK803, correct pin usage involves PA8 and PA9 rather than PA9 and PA10, as detailed in the TXW80X mass production and programming guide available on GitHub. This pin correction may also apply to the TXW817 if it is a drop-in replacement for the TXW806, explaining discrepancies in board pad labeling. Flash algorithm files for TXW80x are available but untested. Additionally, the software supports dumping flash from WinnerMicro W80x devices when the start address is properly configured.
Generated by the language model.

FAQ

TL;DR: This FAQ shows how to dump and reflash a 1 MB Taixin TXW817-810 with an STM32F103 CK-Link Lite. As one quoted description says, "JTAG2 is a two-wire debugging protocol," so the method targets users who need backup, recovery, or firmware testing on TXW8xx and W80x devices. [#21708794]

Why it matters: It turns a cheap STM32 board into a practical tool for reading, restoring, and testing firmware on C-SKY/XuanTie-based camera and IoT chips.

Option	Hardware source	Cost signal in thread	Best use
STM32F103 as CK-Link Lite	DIY from a cheap STM32F103 board	Cheap DIY	Read/write TXW817 backups and test firmware
Cloned CK-Link board	Ready-made clone boards	Cheap	Faster setup with similar workflow
Official CK-Link tool	Official programmer	"for a price"	Paid official path

Key insight: For TXW817 dumping, the crucial setup is the correct flash algorithm ELF, the Read button under the Read tab, and a 1200 kHz Local JTAG clock. If you skip any of those, the dump or write process can fail. [#21561229]

Quick Facts

The demonstrated target is a TXW817-810 with 1 MB flash, commonly found in A9/X5/X6 mini cams. [#21561229]
The working Local JTAG setting shown for reading is ICE Clk = 1200 kHz. [#21561229]
TXW81x debug pins have an internal default pull-up of 100K, and the board should avoid large capacitors or heavy loads on the debug interface. [#21561229]
The example wiring powers the target from 5 V micro-USB and connects TXW817 lines to an STM32F103 used as CK-Link Lite. [#21561229]
After flashing the demo image, the boot log reports cpu clk: 240, flash clk: 60, and a 256-byte syscfg write. [#21561229]

How do I read the flash memory of a Taixin TXW817-810 using C-SKY Flash Programmer and an STM32 CK-Link Lite?

Use the TXW81x flash algorithm ELF, then read the chip from the Advance menu. 1. Open Advance, switch the Read tab to Bin programmer, choose a save path, and set the flash length to match the target. 2. In Local JTAG, set ICE Clk to 1200 kHz and wire the CK-Link Lite to the TXW817 debug pins. 3. Click Read under the Read tab to dump flash; do not press Start for this job. [#21561229]

What is CK-Link Lite, and how does it work with C-SKY or XuanTie microcontrollers like the TXW817 and W806?

CK-Link Lite is a debugger/programmer that works with XuanTie and C-SKY cores through CK-Link protocols. "CK-Link Lite" is a debug probe that downloads and debugs T-Head/XuanTie microcontrollers, supports the full XuanTie CPU range, and exposes JTAG5 plus the two-wire JTAG2 mode for programming and debugging. In this thread, an STM32F103 board emulates CK-Link Lite and successfully reads and writes Taixin TXW817 flash with C-SKY Flash Programmer. [#21708794]

Which algorithm .elf file should I select in C-SKY Flash Programmer for a TXW81x, TXW80x, or WinnerMicro W80x chip?

Select the algorithm ELF that matches the chip family you are targeting. The thread states that TXW81x and W806 ELF files were tested and working, while a TXW80x flash algorithm ELF was also linked later but marked not tested. For WinnerMicro W80x, the app can dump those chips too, but you must also set the correct start address. [#21561305]

Why do I need to click the Read button instead of Start when dumping flash in C-SKY Flash Programmer?

You must click Read because the dump operation is performed from the Read tab, not from the main flashing workflow. The thread explicitly warns to click Read, not Start, when saving flash to a file. Start is used later for programming a firmware image, such as a BIN written from 0x0 after changing the main-screen file entry. [#21561229]

What is the ICE clock in C-SKY Flash Programmer, and why was 1200 kHz used for the Local JTAG setting?

ICE clock is the debugger communication clock used between CK-Link and the target chip. The thread defines it as the In-Circuit Emulator Clock and shows a working Local JTAG setting of 1200 kHz for TXW817 dumping. That value matters because the demonstrated read process used it successfully with the STM32-based CK-Link Lite and the Taixin debug pins. [#21561229]

How should PA9, PA10, PA8, SCK, and DAT be wired between a Taixin TXW817 or TXW806 board and an STM32F103 running as CK-Link Lite?

For the TXW817 example, connect PA9 (DebugCLK) to CKLink SCK and PA10 (DebugIO) to CKLink DAT. The shown camera-to-STM32 wiring is GND to GND, PA10 to STM32 A1, PA9 to STM32 A5, with power from 5 V micro-USB. For TXW806, the follow-up note says PA8 and PA9 should be used instead of PA9 and PA10. [#21561305]

Why do the TXW817 debug pad labels seem inconsistent, and how do they relate to the TXW806 pinout?

The thread suggests the pad labels may reflect an older TXW806-oriented board design, not the TXW817 itself. It says this may explain the incorrect-looking labels on the TXW817 example board, because TXW817 may be a drop-in replacement for TXW806. In that case, boards originally laid out for TXW806 could keep TXW806-style debug labeling even after a TXW817 was fitted. [#21561305]

What is JTAG2 on XuanTie CK-Link devices, and how is it different from standard JTAG5 or ARM-style SWD?

JTAG2 is XuanTie’s two-wire debug mode that reuses standard JTAG signals. The quoted device description says JTAG5 is the standard JTAG interface, while JTAG2 is similar to SWD, reusing TCK and TMS and reducing the interface to two wires. That makes it closer in pin count to ARM-style SWD than to 4-wire JTAG, but it is still described as a XuanTie-designed protocol. [#21708794]

How do I write a .bin firmware file to a TXW817 from address 0x0 using C-SKY Flash Programmer and Chip Erase?

Go back to the main screen, replace the default file entry, and flash the BIN from 0x0. 1. Remove the item labeled Hex and add a new Bin entry. 2. Select the firmware file and set the write address to 0x0. 3. In Advance, choose Chip Erase under Erase Type, then press Start to program the full flash. [#21561229]

What causes the lvd fault and syscfg invalid magic_num messages after flashing the Taixin demo firmware on a TXW817?

The demo firmware booted, but its log showed configuration and power-related faults on that hardware. The output reports syscfg: invalid magic_num=ffff at 0xfe000 and 0xff000, then writes 256 bytes of default parameters, and later prints repeated lvd fault messages with srp_lvd_vcc15_vol_low. That indicates the image started, but the stored syscfg content and supply conditions did not match a clean, stable runtime setup for that board. [#21561229]

How can I back up the original firmware from a mini cam with a TXW817 and restore it later if testing custom images fails?

First dump the original flash to a BIN file, then write that backup back from 0x0 if your test image fails. The thread shows a full readout saved with the Read workflow, then later restores the original firmware by reflashing the saved backup. It explicitly states that flashing back the backup resulted in a working original firmware again on the mini cam. [#21561229]

What start address should I use to dump WinnerMicro W80x flash in the C-SKY Flash Programmer app?

Use the correct start address for the specific WinnerMicro W80x image layout, because the thread does not give one universal numeric value. It states that WinnerMicro W80x can be dumped in this app too if start address is correctly set, but it does not publish the exact address in the post itself. So the key requirement is not the same ELF alone; the start address must also match the target firmware mapping. [#21563820]

STM32 CK-Link Lite vs a cloned or official CK-Link programmer: which is better for flashing Taixin TXW8xx chips?

The STM32 CK-Link Lite is the best low-cost choice if you want a working DIY path with proven TXW817 results. The thread shows successful read and write operations using a cheap STM32F103 board, while also noting that cheap cloned CK-Link boards are available ready-made and that the official tool exists for a price. Choose STM32 DIY for flexibility, clones for convenience, and official hardware for a paid first-party route. [#21561229]

What technical details are known about the flashing/debug protocol used by CK-Link Lite on Taixin or XuanTie chips, and how feasible is it to reimplement it with Beken, Arduino, or CH341?

The thread confirms only the protocol family, not the packet-level implementation. One reply identifies the link as JTAG5 or JTAG2, and JTAG2 is described as a two-wire XuanTie protocol that reuses TCK and TMS. The same discussion says a logic-analyzer capture would be needed for serious feasibility work with Beken, Arduino, or CH341, because no command set, framing, or flash transaction details were provided. [#21708794]

Where can I download the C-SKY Flash Programmer, flash algorithm ELF files, and example TXW817 firmware images mentioned in the thread?

The thread names three sources. It says C-SKY Flash Programmer is supplied by XuanTie from xrvm.cn, and later notes that when the PR is merged it can also be downloaded from the FlashTools GitHub tree. It also points to the TXW80x algorithm ELF in the same GitHub area and gives an example TXW817 demo BIN, txw81x_v2.5.2.6-31320_2025.5.25_IOT_AT_PC6-PC7.bin, from the FlashDumps GitHub tree. [#21561229]