airforce.unix7.org

I share my experience.

Flashing the receiver is like flashing typical stm32f* but I am faced with the fact that memory bank of the receiver is locked for write at factory.

Unlock sequence:

# openocd \
   -f interface/stlink-v2.cfg \
   -f target/stm32f0x.cfg \
   -c "init" \
   -c "reset halt" \
   -c "stm32f0x unlock 0" \
   -c "reset halt" \
   -c "shutdown"

After that it is flashed with a typical sequence of openocd commands:

# image=X6B_rssi_ch14.bin
# openocd \
  -f 'interface/stlink-v2.cfg' \
  -f 'target/stm32f0x.cfg'  \
  -c "init" \
  -c "reset halt" \
  -c "flash write_image erase $image 0x08000000"\
  -c "verify_image $image" \
  -c "reset" \
  -c "shutdown"

I use clone STLink V2 from Aliexpress. Important! Also I soldered and connect to STLink “Reset” line on the receiver.

After that I got RSSI on channel 14 (Aux10)

For save original firmware:

 # st-flash read ./firmware-orig.bin 0x08000000 0x8000

No guarantees, of course.

PS

I found that you can unlock flash memory immediately when recording. http://openocd.org/doc/html/Flash-Commands.html

Command: flash write_image [erase] [unlock] filename [offset] [type]

That should work.