Peter Liu asked a question whose response is relevant for the entier list: Peter Liu asked: > Do you have a log of actual messages sent/received during the firmware > download and program download? Here is the trace, taken from a firmware download from Set Up Options. I removed a lot of the middle, which is unnecessary if you just want to figure out the pattern of things. PC 0000: 10 . RCX 0000: 10 . RCX 0000: ef . PC 0000: 18 . RCX 0000: 18 . RCX 0000: e7 . PC 0000: 10 . RCX 0000: 10 . RCX 0000: ef . PC 0000: 1d 01 03 05 07 0b ...... RCX 0000: 1d 01 03 05 07 0b ...... RCX 0000: e2 00 03 00 01 00 00 00 00 ......... PC 0000: 15 01 03 05 07 0b ...... RCX 0000: 15 01 03 05 07 0b ...... RCX 0000: ea 00 03 00 01 00 00 00 00 ......... PC 0000: 6d 01 03 05 07 0b m..... RCX 0000: 6d 01 03 05 07 0b m..... RCX 0000: 92 . PC 0000: 75 00 80 78 c2 00 u..x.. RCX 0000: 75 00 80 78 c2 00 u..x.. RCX 0000: 8a 00 .. PC 0000: 4d 01 00 c8 00 6d f1 6d f2 6d f3 6d f4 6d f5 6d M....m.m.m.m.m.m PC 0010: f6 1b 87 79 03 cc 00 0d 36 ae 00 b6 f0 44 08 18 ...y....6....D.. PC 0020: ee 68 be 0b 03 40 f0 79 06 82 8c 6b 86 cc 66 79 .h...@.y...k..fy PC 0030: 06 84 40 6b 86 cc 68 79 06 86 3c 6b 86 cc 6a 79 ..@k..hy..y...^...y PC 0090: 06 cc 00 5e 00 85 ec 79 06 cc 00 5e 00 8d 0c 79 ...^...y...^...y PC 00a0: 06 cc 00 5e 00 8f 3a 79 06 cc 00 5e 00 bd c0 fe ...^..:y...^.... PC 00b0: 02 6a 8e cc 37 fc 03 5a 00 82 3a ac 03 46 62 18 .j..7..Z..:..Fb. PC 00c0: 44 fa 06 18 22 a4 06 44 1c 0c 4e 18 66 3e D..."..D..N.f> RCX 0000: 4d 01 00 c8 00 6d f1 6d f2 6d f3 6d f4 6d f5 6d M....m.m.m.m.m.m RCX 0010: f6 1b 87 79 03 cc 00 0d 36 ae 00 b6 f0 44 08 18 ...y....6....D.. RCX 0020: ee 68 be 0b 03 40 f0 79 06 82 8c 6b 86 cc 66 79 .h...@.y...k..fy RCX 0030: 06 84 40 6b 86 cc 68 79 06 86 3c 6b 86 cc 6a 79 ..@k..hy..y...^...y RCX 0090: 06 cc 00 5e 00 85 ec 79 06 cc 00 5e 00 8d 0c 79 ...^...y...^...y RCX 00a0: 06 cc 00 5e 00 8f 3a 79 06 cc 00 5e 00 bd c0 fe ...^..:y...^.... RCX 00b0: 02 6a 8e cc 37 fc 03 5a 00 82 3a ac 03 46 62 18 .j..7..Z..:..Fb. RCX 00c0: 44 fa 06 18 22 a4 06 44 1c 0c 4e 18 66 3e D..."..D..N.f> RCX 0000: b2 00 .. ... skipping packets 0x02-0x50 ... RCX 0000: 4d 51 00 c8 00 00 00 00 00 00 00 00 00 00 00 00 MQ.............. RCX 0010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ RCX 0020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ RCX 0030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ RCX 0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ RCX 0050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ RCX 0060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ RCX 0070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ RCX 0080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ RCX 0090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ RCX 00a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ RCX 00b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ RCX 00c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .............. RCX 0000: b2 00 .. PC 0000: 45 00 00 b8 00 00 00 00 00 00 00 00 00 00 00 00 E............... PC 0010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ PC 0020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ PC 0030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ PC 0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ PC 0050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ PC 0060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ PC 0070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ PC 0080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ PC 0090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ PC 00a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ PC 00b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .............. RCX 0000: 45 00 00 b8 00 00 00 00 00 00 00 00 00 00 00 00 E............... RCX 0010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ RCX 0020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ RCX 0030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ RCX 0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ RCX 0050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ RCX 0060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ RCX 0070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ RCX 0080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ RCX 0090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ RCX 00a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ RCX 00b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .............. RCX 0000: ba 00 .. PC 0000: ad 4c 45 47 4f ae .LEGO. RCX 0000: ad 4c 45 47 4f ae .LEGO. RCX 0000: 52 4a 75 73 74 20 61 20 62 69 74 20 6f 66 66 20 RJust a bit off RCX 0010: 74 68 65 20 62 6c 6f 63 6b 21 the block! PC 0000: 10 . RCX 0000: 10 . RCX 0000: ef . PC 0000: 18 . RCX 0000: 18 . RCX 0000: e7 . What follows is the first program that gets downloaded by Set Up Options: PC 0000: 18 . RCX 0000: 18 . RCX 0000: e7 . PC 0000: 10 . RCX 0000: 10 . RCX 0000: ef . PC 0000: 1d 01 03 05 07 0b ...... RCX 0000: 1d 01 03 05 07 0b ...... RCX 0000: e2 00 03 00 01 00 03 00 09 ......... PC 0000: 91 00 .. RCX 0000: 91 00 .. RCX 0000: 6e n PC 0000: 2d 00 00 00 13 00 -..... RCX 0000: 2d 00 00 00 13 00 -..... RCX 0000: d2 00 .. PC 0000: 45 00 00 13 00 14 1e 02 00 00 e1 87 13 07 02 07 E............... PC 0010: 71 01 43 02 0a 00 27 81 28 q.C...'.( RCX 0000: 45 00 00 13 00 14 1e 02 00 00 e1 87 13 07 02 07 E............... RCX 0010: 71 01 43 02 0a 00 27 81 28 q.C...'.( RCX 0000: ba 00 .. PC 0000: 2d 00 01 00 04 00 -..... RCX 0000: 2d 00 01 00 04 00 -..... RCX 0000: d2 00 .. PC 0000: 45 00 00 04 00 51 01 21 85 f8 E....Q.!.. RCX 0000: 45 00 00 04 00 51 01 21 85 f8 E....Q.!.. RCX 0000: ba 00 .. A few comments: The trace is of opcodes plus data, no packet header, checksums, or complements. Every line containing 0000: is the start of a new message. DownloadFirmware and presumably UnlockFirmware should be the only two commands needed to download the firmware. I verified that DownloadFirmware also sends the 65/6d message. Oops, two messages ago I mentioned the reply, 92/9a, not the request, as something you need to send before the firmware download. -Kekoa