I have successfully interfaced to my winbond chip via the bus pirate. I have successfully executed the chip identifier command and chip erase commands via spi, i would like to read and delete the chips security registers.

This is the command set i push via spi with bus pirate for read: datasheet: The instructions is initiated by driving the /CS pin low and then shifting the instruction code "48h" followed bya a 24-bit address(A23-A0) and eight "dummy clocks into the DI pin.

What i send: [0x48 0x00 0x00 0x00 0x00 0x00 r:256] <- read security register(read 256 bytes)

Each security register is 256 bytes in size and there are aparrantly 4 though i can only see 3 in the datasheet.

My questions is how would i read each security register 256 bytes at a time?

Section 8.2.33 is the reference and the the datasheet is here http://www.nexflash.com/NR/rdonlyres/A5B6C30B-C174-43CF-867E-E1A2F371A07C/0/W25Q128FV.pdf

  • \$\begingroup\$ [0x48 0x00 0x00 0x00 0x00 0x00 r:256] should be [0x48 0x00 0x00 0x00 0x00 r:256] ? Because there are 24 bits address (3 bytes) + 8 dummy bits (1 byte) = 4 bytes? \$\endgroup\$
    – diverger
    Commented Nov 24, 2014 at 12:46
  • \$\begingroup\$ sounds correct. how would i address each register? [0x48 0x00 0x01 0x00 0x00 0x00 r:256] -<register 1 ? \$\endgroup\$
    – TomTom
    Commented Nov 24, 2014 at 13:17

1 Answer 1


According to the datasheet, the 3 security registers' address range are:

Security Register 1 (256 Bytes): 0x001000 ~ 0x0010FE

Security Register 2 (256 Bytes): 0x002000 ~ 0x0020FE

Security Register 3 (256 Bytes): 0x003000 ~ 0x0030FE

So, read 256 bytes from one register (read entire register) with Pirate bus SPI command, should be like

read Security Register 1 ==> [0x48 0x00 0x10 0x00 0x00 r r:255 ]

  • \$\begingroup\$ what does it mean followed by 8 dummy clocks to the di pin? \$\endgroup\$
    – TomTom
    Commented Nov 25, 2014 at 2:11
  • \$\begingroup\$ "Dummy" clocks means these clocks won't clock in/out useful data, the internal implementation of the chip may need these clocks to do some "preparation" before it can give you useful data. \$\endgroup\$
    – diverger
    Commented Nov 25, 2014 at 2:26
  • \$\begingroup\$ ok so do i need to add these dummy clocks to the spi command? it does say instruction 48h followed by a 24bit address and eight dummy clocks into the di pin... how would i achieve this? really appreciate your help \$\endgroup\$
    – TomTom
    Commented Nov 25, 2014 at 2:31
  • \$\begingroup\$ You simply send the 3 bytes address, and then followed by 1 byte data (any is ok), and read. \$\endgroup\$
    – diverger
    Commented Nov 25, 2014 at 2:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.