FM-1 Transporter

The RP2040 sends the JieLi USB_KEY pattern at power-on to get the AC791N into its built-in UBOOT mode, or asks stock V15 to enter it over USB-MIDI, then acts as a USB host to the FM-1. A Python script on the Mac prints chip info, dumps the whole 1 MiB flash in a few seconds and writes only the 4 KiB sectors that differ, checking each one. The firmware refuses writes outside 0x4000 to 0x93000, so the bootloader area and device data are never touched, and no erase-all or chip-key write exists. It can also load and run code in RAM for research. Three wires go to the FM-1 (D+, D-, GND) and VBUS stays unconnected. It is built from source and needs the WL82 loader from jl-uboot-tool, which the repository does not include.

Build with pico-sdk 2.2.0, an ARM GCC toolchain, CMake and picotool, then load the UF2 onto a Seeed XIAO RP2040; other RP2040 boards are untested and the Waveshare RP2350-USB-A is not supported. Wire GP0 (D6) to D+, GP1 (D7) to D- and GND to GND, nothing to VBUS. Take a dump before writing; write needs the --write flag, and without it only checks.