James Munns

Today I wrote a firmware image that contained a bootloader. When I flashed it onto a board with an existing bootloader, it erased the existing bootloader, and replaced it with the bootloader image baked into the firmware image.

This seems like a silly thing to do, but it means that I can replace the off-the-shelf uf2 bootloader in the seeed studio xiao nrf52 with my fancy bootloader, without having to use an SWD debugger. The set up process for switching over to my environment is:

• Plug in USB cable
• Drag this uf2 file to the usb drive.
• The usb flash drive will disconnect, and it will come back up as a usb serial port you can use with my cli tool instead.

And you are now done.

I don't really recommend you do this (unless you are looking for adventure), as my bootloader is pretty limited and opinionated. But it's really neat that I did this and it worked on the first try.

I follow a lot of tags, but lately I feel like I haven't seen very many posts out there for the kinds of things I'm interested in. Cohost is a nice place, but I feel like I haven't found my "scene" at all (or maybe it just doesn't live here, sadly).

If y'all have any cool folks or tags to follow, feel free to share them with me. I'd love to have more of this stuff on my feed.

This is my ramloader tool. In this demo, it does this sequence twice (once on command, then I hit save so it retriggers):

• connects to the nrf52 over USB, figures out an app is running, sends a "reboot to bootloader" command (the nrf52 then disconnects)
• reconnects, uploads the program, sends a bootload command (that's actually two separate connections lol)
• waits for the device to re-enumerate, then exits

Rust takes 2.0 seconds to recompile the project with no changes, then my loader tool takes 1.3 seconds.

So 3.3 seconds after you hit save, your new firmware is running.

Pretty happy with that.

Writing a little tool to peek and poke values to RAM. Here's my little end to end test ensuring it actually works :D

Edit: I'm reading and writing RAM to an nRF52, a 64MHz microcontroller with USB and 256KiB of RAM. The other 32KiB are running the application.

$ cat hound-of-the-baskervilles.txt | head -c 229376 > hound.bin

$ time target/release/stage0-cli peek -a 0x20000000 -l 229376 -f boop.bin
target/release/stage0-cli peek -a 0x20000000 -l 229376 -f boop.bin  0.02s user 0.06s system 8% cpu 0.891 total

$ cat boop.bin | head -c 128 | xxd
00000000: ffff ffff ffff ffff ffff ffff ffff ffff  ................
00000010: ffff ffff ffff ffff ffff ffff ffff ffff  ................
00000020: ffff ffff ffff ffff ffff ffff ffff ffff  ................
00000030: ffff ffff ffff ffff ffff ffff ffff ffff  ................
00000040: ffff ffff ffff ffff ffff ffff ffff ffff  ................
00000050: ffff ffff ffff ffff ffff ffff ffff ffff  ................
00000060: ffff ffff ffff ffff ffff ffff ffff ffff  ................
00000070: ffff ffff ffff ffff ffff ffff ffff ffff  ................

$ time target/release/stage0-cli poke -a 0x20000000 -f hound.bin
len: 229376
target/release/stage0-cli poke -a 0x20000000 -f hound.bin  0.04s user 0.04s system 8% cpu 0.940 total

$ time target/release/stage0-cli peek -a 0x20000000 -l 229376 -f boop.bin
target/release/stage0-cli peek -a 0x20000000 -l 229376 -f boop.bin  0.02s user 0.06s system 9% cpu 0.866 total

$ cat boop.bin | head -c 128 | xxd
00000000: 693b 3c4d 4253 263e 0a0a 0a0a 496e 0a0a  i;<MBS&>....In..
00000010: 0a0a 484f 554e 440a 0a0a 0a4f 4620 5448  ..HOUND....OF TH
00000020: 450a 4241 354b 4552 7969 4c4c 4553 0a0a  E.BA5KERyiLLES..
00000030: 0a0a 0a41 2e47 2e4a 2e0a 0a0a 0a43 4f4e  ...A.G.J.....CON
00000040: 414e 2044 4f59 4545 0a0a 0a0a 7269 0a0a  AN DOYEE....ri..
00000050: 0a0a 0a0a 0a0a 556e 6976 6572 7369 7479  ......University
00000060: 206f 6620 4361 6c69 666f 726e 6961 20e2   of California .
00000070: 80a2 2042 6572 6b65 6c65 790a 4769 6674  .. Berkeley.Gift

$ sha256sum *.bin
bad0e0a674772058f5d13400187367579244fcd0e9f0b34c8f6a2629ef74236c  boop.bin
bad0e0a674772058f5d13400187367579244fcd0e9f0b34c8f6a2629ef74236c  hound.bin

I have a demo building an application, which you can "poke" into memory with the bootloader, then command the bootloader to jump to.

Check it out here: