Marshall Stanmore II - chip flash

[jingleslacks]

Most likely there is read protection (by default the protection is “0” and in the defer mode you can read the contents; if the manufacturer has set the protection to “1” or the maximum “2”, then when you try to read (unlock the protection) the data will be destroyed and your device will turn into a brick .

What do those numbers mean? Is there a way around it? Like with a password or something?

[jingleslacks]

Yes, sure. You need to use pins 2, 4, 6, 8 on the dongle and pins 4, 5, 7, 16 on Service port. Hope my drawing will help you. But be careful, looks like lotas is right about possible data destruction after read attempt. The software i used was STM32 ST-Link utility. Yo can download it for free after registration on st.com. Connection settings that worked for me are on the photo, but you can try different. Also i suggest the Service port has USB pins for firmware restore but I don’t know for sure.

With these types of devices, in order to use the USB port, the firmware has to contain a file telling it to run/download. The alternative is a button combination. For example, if you copied your firmware and saved it onto a USB, and I plugged it into my speaker, the speaker wouldn't know what to do with it. I'm looking forward to seeing how this method works.
I'm also curious as to why my demo unit has different firmware in multiple chips. If STM32F030CCT6 has the firmware that is controlling / limiting the features, why would MX25U3235F have completely different firmware since that function is blocked anyway?

[прямо]

Simple reason. They put the important stuff in the STM32 knowing they can enable a read protection, so people can't make copy of it, and leaving the not so important stuff on the standard NOR flash memory.

[b0ba]

Why would you try reading stm32 flash? It is well documented you can't do that. SWD is a serial JTAG yet well documented. Talking about CSR boomboxes: take a working set, desolder spi flash and give it a crank... yep..it works

[jingleslacks]

Why would you try reading stm32 flash? It is well documented you can't do that. SWD is a serial JTAG yet well documented. Talking about CSR boomboxes: take a working set, desolder spi flash and give it a crank... yep..it works

Which chip in the picture are you referring to?
Some things may be "well documented," but we're new at this, and don't know. We're learning as we go. Lots of trial and error. I have had success with a few different LG speakers, but this Marshall is a different beast.

[b0ba]

Which chip in the picture are you referring to?

SO-8 25u/25q one. Don't get me wrong. I've been fighting those windmills for quite a while and found that out the hard way. That flash contains nothing but key layout (vol+/- bt) and custom startup/shutdown audio. Software, brandless, runs inside otp/mask CSR chip.

[jingleslacks]

SO-8 25u/25q one. Don't get me wrong. I've been fighting those windmills for quite a while and found that out the hard way. That flash contains nothing but key layout (vol+/- bt) and custom startup/shutdown audio. Software, brandless, runs inside otp/mask CSR chip.

Can you mark it on the picture? I won't be home to mess this it for a week, and I the photo quality isn't great when I enlarge my pic.

[-MadMax-]

This is the firmware from my live unit. This site doesn't allow .bin files, so I tried this format. I don't know much about altering/sending files, so let me know if it opens properly. Then, let me know if it works. Also, if you're able to access your micro controller, and want to share that file...

Hello, is this the firmware from the MX25U3235F om the mainboard ?



I have the issue with 3 LEDS, probably after a software update issue. Thinking if I can use your firmware to fix the issue ?

[jingleslacks]

Hello, is this the firmware from the MX25U3235F om the mainboard ?



I have the issue with 3 LEDS, probably after a software update issue. Thinking if I can use your firmware to fix the issue ?

Yes, but a couple others in the thread have the same issue as you, and flashing this chip didn't help. We have moved onto the microcontroller, but it is protected.

[porclaude]

"Hello, I am contacting you because I have an issue with a Stanmore 2 motherboard. By mistake, I burned the STM32 by injecting 5V instead of 3.3V (beginner's mistake...). So, I am looking to extract the firmware from a healthy Marshall (either an Acton 2 or a Stanmore 2, as the printed circuits are almost the same and I assume that the STM32 firmwares are the same), and then replace the STM32 on my Marshall by injecting the correct firmware.

I encountered the same issue as you did regarding the limitation due to level 1 (or 2) protection of the STM32 encoded by Marshall. Recently, I found some websites explaining that it was possible to dump the firmware of protected STM32F0xxx in P1 (stanmore STM32 is STM32F030CCT6 ). This is achievable thanks to a program running on a Raspberry Pico. I am not an expert in Arduino coding. Has anyone tried the method or would anyone be tempted to try or explain how to proceed?

The information can be found on these links: https://github.com/racerxdl/stm32f0-pico-dump and https://hackaday.com/2023/02/05/need...use-your-pico/"

[socholand]

hello
has anyone managed to read the ST processor?
i would need the bin.

[thuygsm]

This is the firmware from my live unit. This site doesn't allow .bin files, so I tried this format. I don't know much about altering/sending files, so let me know if it opens properly. Then, let me know if it works. Also, if you're able to access your micro controller, and want to share that file...

hi, how is your marshall stanmore-ii? can you share more with me?
in my case the Bluetooth - AUX - RCA signal light turns off after 5 seconds and repeats, I successfully connect to the phone, but they do not emit to the speaker.
after I loaded your rom, I lost the bluetooth connection, and could not turn off the power, no startup sound

[thuygsm]

hi, how is your marshall stanmore-ii? can you share more with me?
in my case the Bluetooth - AUX - RCA signal light turns off after 5 seconds and repeats, I successfully connect to the phone, but they do not emit to the speaker.
after I loaded your rom, I lost the bluetooth connection, and could not turn off the power, no startup sound

i did it. i paid for a software

[wisammatuk]

for those who don't know, writing STM32F030CCT6 firmware isn't enough, the software has verification between mcu and Bluetooth firmware, I have the firmware and the solution, write me for help in telegram wisammatuk