mec16xx-util

A Python script to read, write, and erase the internal Flash and EEPROM memory of Microchip MEC16xx embedded controllers via JTAG and OpenOCD. Useful for mainboard repair and EC firmware development without expensive dedicated programmers.

Tested with the MEC1641. Should be compatible with other MEC16xx chips sharing a similar Flash controller architecture (e.g. MEC1632, MEC1633, MEC1663, MEC1618/MEC1618i, MEC1609/MEC1609i).

Since no datasheet was available for the MEC1641, all register information was taken from the MEC1632 datasheet.

Typical flash sizes by model

Model	Flash
MEC1609(i), MEC1618(i), MEC1632, MEC1633	192 KiB
MEC1663	256 KiB
MEC1641	288 KiB

Requirements

Hardware

Any JTAG adapter supported by OpenOCD should work. The following have been tested:

FTDI-based adapters (recommended)

• Adafruit FT232H Breakout - tested
• FT2232H / FT4232H boards

FT232H JTAG wiring

FT232H Pin	JTAG Signal
AD0	TCK
AD1	TDI
AD2	TDO
AD3	TMS
GND	GND

Segger J-Link

• J-Link Ultra - tested on Windows and Linux
• J-Link EDU Mini - tested on Linux only

Other OpenOCD-compatible adapters (untested)

• ST-Link V2/V3
• Bus Pirate
• Raspberry Pi GPIO

Software

• Python 3.7+
• OpenOCD 0.11.0+

# Ubuntu/Debian
sudo apt install openocd

# Windows - download from https://openocd.org/pages/getting-openocd.html

Usage

OpenOCD must be running before invoking the script. Use the config file matching your adapter:

# FT232H adapter
openocd -f mec16xx_ft232h.cfg

# J-Link
openocd -f mec16xx_jlink.cfg

Then run commands with:

python mec16xx-util.py <command> [args...]

Commands

Command	Description
info	Show chip and flash/EEPROM status
emergency-erase	Emergency mass erase via JTAG
erase-flash <addr> <size>	Erase flash pages via controller
write-flash <addr> <file> [--verify]	Program flash from binary
read-flash <addr> <size> [file] [--burst]	Read flash (hex dump or save to file)
verify-flash <addr> <file>	Verify flash against a binary
read-eeprom <addr> <size> [file]	Read EEPROM range
erase-eeprom	Erase entire EEPROM
write-eeprom <addr> <file> [--verify]	Program EEPROM from binary
verify-eeprom <addr> <file>	Verify EEPROM against a binary

Verify connection

python mec16xx-util.py info

Erasing

There are two erase modes:

• Flash erase (erase-flash) - erases specific flash pages via the flash controller. Use this for targeted erase before programming.
• Emergency mass erase (emergency-erase) - sends a special JTAG sequence that erases the entire flash and EEPROM, bypassing all protection. Useful when boot or data block protection is active, or the chip is in a bad state. Requires a power cycle before programming.

Programming

python mec16xx-util.py write-flash 0x1000 firmware.bin

Add --verify to automatically verify after programming:

python mec16xx-util.py write-flash 0x1000 firmware.bin --verify

Reading / Dumping

# Print hex dump to terminal
python mec16xx-util.py read-flash 0x0000 0x48000

# Save to file
python mec16xx-util.py read-flash 0x0000 0x48000 dump.bin

# Use burst mode for faster reads
python mec16xx-util.py read-flash 0x0000 0x48000 dump.bin --burst

Note: Boot region cannot be read if boot protection is active.

# Print EEPROM hex dump
python mec16xx-util.py read-eeprom 0x0000 0x800

# Save EEPROM to file
python mec16xx-util.py read-eeprom 0x0000 0x800 eeprom.bin

EEPROM Programming

python mec16xx-util.py write-eeprom 0x0000 eeprom.bin

# With automatic verify
python mec16xx-util.py write-eeprom 0x0000 eeprom.bin --verify

EEPROM Erasing

Erases the entire EEPROM (mass erase):

python mec16xx-util.py erase-eeprom

Disclaimer

Use at your own risk. I am not responsible for any damage to hardware or data loss. Always back up existing firmware before making any changes.

Credits

• Glasgow Interface Explorer - mec16xx applet
• dossalab/mec16xx-simple-flash
• Built with assistance from Claude (Anthropic)