Web platform bootloader hacking

Mikael Gustafsson, developer of the ds30 Loader we depend on for lots of projects, spent some time hacking the web platform bootloader. His insights are posted below, you can download his bootloader tests in an archive or from the project SVN.

Because of the “long” download times I tweaked the bootloader firmware a little. Changed operation to 40MIPS. Added auto baudrate detection which allows for mega baud rates+. The limit of the ftdi chip is 3 Mbps. I’ve successfully downloaded at 2Mbps. But it seems using baud rates above 256k doesn’t do much difference.

You can buy an assembled web platform for $40, including worldwide shipping. Seeed isn’t currently shipping due to the Chinese spring holiday, but your order will ship ASAP after they return on February 22.

Bootloader hacking continues below.

Changed frc to operate at maximum frequency to minimize write times. Added clock switching because I don’t think pll settings should be change “online”. frc is used at startup then I switched to frc+pll after the pll settings are applied.

Because the frc is tuned in my modified firmware. Your main application is probably not compatible because it contains pll config.  As mentioned in the manual it recommended to use the same configuration for the firmware and main application.

There’s an easy way of upgrading the bootloader without a programmer. But it may be risky for the average user:

  1. Reboot device, led 1 is lit when bootloader is started
  2. Download temporary bootloader: “bootloader max frc 40MIPS abaud 3rd page.hex”
  3. Led 1 is unlit when receive timeout occurs.
  4. Led 2 is lit when the new bootloader in 3rd last page is started.
  5. Apply the following settings: don’t write goto at 0x00, auto baud rate, custom bootloader 3, 1.
  6. Download new bootloader: “bootloader max frc 40MIPS abaud.hex”
  7. Reboot device
  8. Finished

Here are the sources and latest beta binaries.

Join the Conversation


  1. “I had some very very strange thing happening earlier when I was testing the above. All programmings with the ICD3 was successful but even the simples code seemed to not execute properly.

    After a few hours and much frustration i concluded the frc was broken. I then made a last attempt using the ICD3 as a debugger instead of as a programmer and somehow managed to get the chip in a working state. Thought I would let you know even thou it’s not very much information.”

    It happened exactly the same to me, with a pickit2, the solution was to load the original firmware and load my programs using the bootloader.

    What are the exact settings I must change in mplab to make the compiled binary bootloader friendly? I have been looking for it with no luck

  2. n0p: on top of my head, simply commenting the ppl settings should be enough. Thats because the bootloader now runs at 40MIPS and the application is supposed to run in 40MIPS.

    The frc is tuned +11% => 8,xxxMHZ in the new bootloader, thats why the pll settings isn’t compatible anymore. It make the device go faster than 40MIPS because it assumes the frc is running at its nominal speed at 7,37MHz.

    Ian, I think you should remove the description of my problem in the post. I think it was a one time only and that it’s unrelated to the bootloader.

  3. I didn’t explained all the details well, sorry for my bad english

    I compile a program in mplab, if I program that .hex with the bootloader, it works

    If I put the pickit in debug mode and run it, it works

    But if I program that same .hex file using mplab and pickit, it doesn’t work

Leave a comment

Your email address will not be published. Required fields are marked *

Notify me of followup comments via e-mail. You can also subscribe without commenting.