Skip to content

Programming Protocols

Henrik Olsson edited this page Sep 14, 2026 · 9 revisions

Firestarter EPROM Programmer


Programming Protocols

Every chip Firestarter knows carries a protocol number. That number decides how the chip gets driven — what voltage, what sequence, what timing. You never pick it yourself; the database picks it from the part number you give.

This page says what each protocol does and which chips it is for. The firmware implementation — write algorithms, pulse widths, voltage routing, datasheet citations — is in PROTOCOLS.md in the firmware repository.


The protocols

5 V page-write flash (0x05)

Flash that erases a page automatically as part of writing it, so there is no separate erase step. 5 V only.

27 chips, 28 and 32-pin. Atmel AT29BV010A and AT29BV020, Winbond W29C010 and W29C020, SST29EE010.

AMD-style unlock flash (0x06)

Parallel flash that needs a fixed unlock sequence written to it before it will accept a command. The most common kind of parallel flash by some margin.

190 chips, 32-pin. The largest family by some way — AMD AM29F002B, Atmel AT49BV001, Macronix MX26LV040, SST29SF010, Winbond W39F010 and many compatibles.

28-pin EPROM (0x07)

The classic 28-pin UV-EPROM. Programmed with a high voltage on pin 1, one byte at a time, verifying each byte as it goes.

170 chips, 28-pin. AM2764A, AM27C256, AM27512 and relatives.

Seven electrically-erasable parts share this number. They are corrected to the 5 V EEPROM protocol before programming, so they never see the high voltage.

32-pin EPROM (0x08)

The same idea as the 28-pin EPROM, on the larger 32-pin package.

127 chips, 32-pin. AM27C010, AM27C020, AM27C040, AM27C080.

24-pin EPROM (0x0B)

The oldest family — 2716 and 2732 era parts. These take the highest programming voltage of anything supported, up to 25 V, and the voltage varies by part. Set the trimpot to the value for your exact chip before programming.

32 chips, 24-pin. AM2716, AM2732, CAT27C16 and compatibles.

5 V EEPROM (0x0D)

Parallel EEPROM that writes a page at a time and reports when it is done, so no timing guesswork is needed. 5 V only — these never see a programming voltage. Some have software write protection that is disabled before writing.

84 chips, 24, 28 and 32-pin. AM28C16A, AT28BV64, AT28BV256 and relatives.

The family also has a chip erase, advertised for all 84 chips — proven in software and not yet validated on real silicon.

Intel flash (0x10)

Intel 28F parallel flash. Driven through a command register rather than an unlock sequence, and needs 12 V present to program or erase.

39 chips, 32-pin. AM28F256, AM28F512, AM28F010, AM28F020.

SRAM and NVRAM (0x0E, 0x27, 0x28, 0x29)

Static RAM and battery-backed NVRAM. These simply read and write like memory — no programming voltage, no erase, no timing sequence.

  • 24-pin, 6116 family (0x27) — 2 chips
  • 28-pin SRAM and FRAM (0x28) — 34 chips
  • 32-pin NVRAM (0x0E) — 20 chips
  • 32-pin larger NVRAM (0x29) — 20 chips

Mostly Dallas battery-backed NVRAM modules, plus the 6116 on the 24-pin bucket.


Chip capability flags

Each chip also carries a set of flags describing what the part can do:

Bit Mask Meaning
1 0x00000002 Package pin numbering is reversed
4 0x00000010 Can be erased electrically
5 0x00000020 Has a readable manufacturer and device ID
12 0x00001000 Has a data memory offset
13 0x00002000 Data bus width: clear = 8-bit, set = 16-bit
14 0x00004000 Turn protection off before the operation
15 0x00008000 Turn protection on after the operation
18 0x00040000 Lock bit is write-only
19 0x00080000 Has calibration data
20–21 0x00300000 Programming support level

Bits 3, 6 and 7 also appear in real chip data with no definition available. Older documentation guessed at their meaning from the chips they turned up on; those guesses were never confirmed and are not repeated here.

Bits 14 and 15 are stored but nothing currently reads them — see Chip Database Fields.


What is not supported

A few protocol numbers exist in the upstream chip data but cannot be programmed on this hardware: Intel firmware hub parts (serial, 3.3 V), GAL logic devices, PIC32 microcontrollers, and ITE embedded controllers. None of them is a parallel memory chip in a DIP package.


Relocated from firestarter/doc/PROTOCOLS.md in firestarter at a218b4f5273d14f0abd796b21ac104792de01603. Moved intact and not edited since; not re-verified against the code.

Clone this wiki locally