Read the characteristic’s of the bootloader and of the DFU implementation in the device.


Field Value
INS 01
Data None


Byte Name Description
1 Timeout How many seconds will the bootloader stay in rescue mode before trying to boot the firmware
2 Version Version of the DFU protocol (0, 1 or 2)
3-4 Flags Flags set by the bootloader after hardware detection
5-2 CPU Name ASCII string with the MCU family (“RX65x”, “RX11x”, “SAMD5x”…)
13-16 ROM Start Address of first writable byte in MCU’s internal ROM
17-20 ROM End Address of last writable byte in MCU’s internal ROM
21- xx Flash ID ID string of the SPI flash (NVM)


Bit Name Description
12-15 RFU
11 has_expram RX65x family:
0: MCU has 1MB ROM and 256kB RAM
1: MCU has 2MB ROM and 512kB RAM
Other MCU families: RFU
10 has_aes_prng 0: No crypto engine
1: The device’s MCU features a crypto engine that provides AES HW & PRNG HW
9 has_network 0: No network interface
1: The device features a network interface (Ethernet)
8 has_usb 0: No USB interface
1: The device features a USB interface
7 has_battery 0: No battery charger detected
1: The device features a battery charger (and therefore is likely to have a battery)
6 in_bootloader 0: The firmware is running
1: The bootloader is running (rescue mode)
5 just_flashed 0: The firmware has not been changed since last reset
1: The bootloader has just rewritten the MCU’s internal ROM
4 has_vegas 0: No ‘Vegas’ antenna detected
1: A ‘Vegas’-compliant antenna has been detected on the I2C bus
3 has_storage 0: No SPI flash detected
1: A SPI flash has been detected (the Flash ID string is following)
2 force_rescue 0: The device is not forced in rescue mode
1: The device is forced in rescue mode, the bootloader will not start the firmware
1 cold_reset 0: Last boot reason is warm reset (software reset or reset button)
1: Last boot reason is cold reset (power on)
0 is_present 0: RFU
1: Bootloader flags are valid

Flash ID

The size of the answer is either 0 bytes long (no SPI Flash detected) or longer (SPI Flash detected).

Depending on the presence or not of the SPI Flash, the DFU protocol shall allow to perform a direct DFU/ROM rewriting using PUSH_TO_ROM instead of using the SPI flash storage (NVM) to store the new firmware using PUSH_TO_STORAGE or PUSH_TO_STORAGE_FAST.

Example for an MT25QL128 flash: 20 BA 18 10 40 00 2E 20 85 00 10 0E 00 2E 00 B6 08 BA A4 AA