Hakko FM-203 Dual Soldering Station Teardown W/ Temperature Control Key Bypass!
December 01 2024 Added Firmware Backup Info!
Here is a YouTube Video If the Hakko FM-203 Teardown
Photos of the Teardown.
The Hakko FM-203
FM-202 and FM-203 Size Comparison
Click Here to See The Hakko FM-202 Teardown
Cover Off
Face Plate Off
Main Control Board M1285-A11 Removed Form Face Plate.
Mail Control Board B3403 (Renesas R5F21258SNFP R8C/25 Group) Datasheet
ISP Headder J4 Pinout.
VSS Pin 1
MODE Pin 2
VCC Pin 3
Reset Pin 4
I attempted to back up the Hakko FM-203’s firmware form the Renesas R5F21258SNFP using the in-circuit headder, but unfortunately, it’s locked with an ID code. Consequently, I have no choice but to remove the 52 pin quad flat pack chip to read it in parallel mode, utilizing the Xeltek SuperPro 6100N or Xeltek Suprpro 7500 taking a chance that it is not protected. Once I acquire the required programming adapter a DX3010, DX3063 or a GX3010, I will promptly extract the firmware from chip.
I now have mega Magic Adapter for the Xeltek Programmer Just need to Order a QFP52 Socket.
11/20/2024 I have Changed Plans I am not going to spend the 60+ on a QFP52 socket on a Gamble that the MCU is not locked. I made a break out board and will solder the QFP-52 to the board and attempt the backup that way.
TQFP Adapter Boards Arrived.. November 2024!!
Firmware Backup… Attempt In System. And Hakko Being Anti – Repair
Attempts on the Segger Flasher Pro and the IS01 Was Not Default ID FF or 00 (See Data Below) Were Unsuccessful.
Xeltek Requires you to edit the Buffer Address Below.
Segger Makes it simple to enter the Flash ID Code in the Config.
Segger Flasher Pro Results: Fail ID Pwd Mismatch
Xeltek Is01 Results: Fail ID Code Error.
This leave only 1 Option chip off Read, So I Removed the Renasas R5F21258SNFP MCU from the Hakko FM-203’s Main Board and Soldered to the Adapter Baord.
Hakko FM-203 Sodlering Station MCU Firmware Backup and In System Programing Code Recovery Attempt.
The off board backup attempt was a successful.
Here is Some Buffer Data.. Recovery of the ISP key look at addresses 0xffdf, 48 0xffe3, 4B 0xffeb, 30 0xffef, 30 0xfff3, 32 0xfff7, 35 0xfffb, 36 This Info is No longer Proprietary and Confidential!!
I have Tested the ID Code With the Segger Flasher Pro on my other FM-203 Flasher Pro Basic Config.
When Reading to File it Says Sending ID Password and it worked Flawlessly
The Read was Successful.
Both My Units are Firmware V2.00 a Friend says he will bring his FM-203 over and we can get a backup of his firmware. Lets hope the code is good between the revisions, I am sure it is as most MFG’s will use the same code across the same models. Maybe Hakko will save us the trouble and provide it along with the schematics and end this war.
Heater Control Board
Temperature B2972 Control Card Key Bypass Place a thick Heatshrink over the Receivers PT1 & PT2
I also Place a Piece of Clear Scotch Tape over the speaker to quiet the beep down.
Hakko FM-203 Uses a Similar Heating Circuit M1285-A11 With Dual NEC 2SJ493’s (Datasheet) as the FM-202 for the D Port and Single For The S Port
The FX-951 Uses a Single 2SJ534 (Datasheet)
Last Updated on December 2, 2024 by Steven Rhine
[…] the last weekend, I finally tackled a long-postponed project: backing up the firmware of the Hakko FM-203 Soldering Station (Teardown). I’d been putting it off because the Renesas R5F21258SNFP microcontrollers (MCUs) used in these […]