S620 Drive-Burst Flasher

Use a rear motherboard USB port. Front panels and monitor passthroughs are usually hubs internally. Through a hub this bootloader's DFU reads corrupt in ways that pass every sanity check, while drawing keeps working perfectly.

01Connect

This patches the Gaomon S620 running OEM02_T18e_241030 and nothing else. There is no model to pick: the only way to know which firmware you have is to read it, so the build is identified from your own backup in step 2. Other revisions exist, including a 16K pressure model, and they enumerate over USB identically.

Not identified yet.

Not connected

02Back up

Save the file. Once you flash, the tablet no longer holds the factory bytes, and every patch is built from them.

No backup yet

03Flash

20 drive periods of 29 stock with a 6µs pre-amp settle, . This is the combination measured end to end, and the one that reaches this rate without a noise penalty. Fewer periods go faster; far enough down the firmware stops enumerating on USB.

Load factory .bin

Patch source: none yet. Back up first, or load a factory image.

Idle

!!Advanced

Nothing here is validated except the default. Recovery is still the express key combo, but you will be doing it blind.

Drive periods per excitation routine, of 29 stock

Settle delays, microseconds

ADC channel config
17x, stock 27

Max tip compression
rare, stock 20

Analog pre-amp
17x, stock 30

Coil recovery
~4x, stock 150

Each site costs its value times how often it fires, so coil recovery is about four times cheaper to restore than the other two. A drive period costs roughly 27µs. No site may be 0: stock_wait_us loads SysTick with microseconds times 72, so a 0 reload never raises COUNTFLAG and the wait never returns.

04Log

What this changes

Each of the twelve excitation routines bit-bangs a square wave on PA15 to pump the pen's LC tank, and opens with movs r4,#29, the number of drive periods. At 72 MHz those bursts are about 979µs of the 1838µs fixed path.

Published builds only shorten the four analog settle waits, which runs out near 530 Hz because by then 97% of the report period is fixed work and half of that is the bursts themselves. Cutting the bursts goes underneath that ceiling.

Cutting them is not what costs accuracy. Driving the settle waits to their floor is. One of the four is the analog pre-amplifier settling window, and sampling before it settles was responsible for nearly all the position noise earlier builds paid. Restoring it to 6µs, a fifth of stock, costs about 16 Hz and returns the noise to factory levels.

build	rate	noise X	noise Y
29 periods, stock settle	293.7 Hz	2.66	4.21
29 periods, min settle	~530 Hz	n/a	n/a
20 periods, 1µs pre-amp	626.4 Hz	10.2	5.2
20 periods, 6µs pre-amp	610.2 Hz	3.63	3.63
15 periods, 1µs pre-amp	684.4 Hz	17.1	19.4

One device, one firmware build. Noise is in raw tablet units, detrended so the pen can be moving. Ten units is about 2 px on a 50 mm mapped area. The shipped build measures inside the range the factory firmware itself measured, 2.66 to 4.36, so the rate is no longer being paid for with jitter.

Entering DFU

Unplug the tablet, hold the leftmost and rightmost express keys, and plug it back in while holding. The light stays off, which is normal. Then click Connect and pick the Gaomon S620 entry in the browser prompt. Depending on your driver it may be listed as GD32 or GigaDevice instead; there will only be one device offered either way.

Before you start

Desktop Chrome or Edge. Close OpenTabletDriver, GAOMON drivers, and anything else holding the tablet.

If connecting reports transferSize 1024 rather than 2048, the link came up desynced and every button stays disabled on purpose. Replug into a rear motherboard port and connect again until it reads 2048. Reads over a bad link corrupt silently, so there is nothing useful you could safely do in that state.

What the flash does

Erase, prove the whole span reads back as 0xFF, write, then compare every byte. The bootloader and the calibration page are never written, so a bad application image is always recoverable with the same button combo.

Settle profile

Fixed at 1, 1, 6, 4µs against a stock 27, 20, 30, 150. The third value is the analog pre-amplifier settle and is the one that matters for noise, so it is held at 6µs rather than the floor.

Nerd notes

MCU GD32F350, Cortex-M4 at 72 MHz (PLL = HXTAL x6; USBFSPSC /1.5 forces 48 MHz).
Flash 64 KB. App 0x08004000, 35512 B, sha256 e4fe509d...
Bootloader 0x08000000 and calibration 0x0800fc00 are never written.

Twelve excitation routines, 0x08008f44 to 0x08009dfa, each opening with movs r4,#29 at entry+2. They bit-bang PA15 through GPIOA BSRR 0x18 and BRR 0x28, and differ only in NOP sled length (146 down to 118), a 456 to 554 kHz sweep. Dispatch is a TBB at 0x080050f8, cmp #13, index 0 a no-op and 1 to 12 the routines.

The sweep is for acquisition, not pressure. The firmware advances the index only while searching and locks it the moment the pen is found, so all 17 measurements in a tracking report run at one frequency. Pressure comes from signal magnitude.

Per report: 17 measurements across three adaptive windows, 5 + 6 + 6.
Settle sites 0x08004d3c / 4d4a / 4d58 / 4d9a firing 17 / rare / 17 / ~4 times each.
Model: 1006 + 27 x periods + sum(settle x weight), weights 17/2/17/4. Fits the stock, 626 Hz and 684 Hz builds within 0.2%, but all three were recorded with OpenTabletDriver running, which drops around 7% of reports and biases a rate downward. The one recording made with it closed came in 2.6% above the model, and no single set of weights fits both groups. Treat modelled rates as a floor and measure the result.

The 1006µs floor is modelled rather than measured. USB Full Speed caps everything at 1000 Hz regardless.

Risk

This writes unofficial firmware to your tablet. It can brick it. Every safeguard described above is there because the bootloader misbehaves in ways that are easy to get wrong, not because the process is risk free. You accept that risk yourself. I am not responsible for any damage to your hardware.

It has been validated on one device running OEM02_T18e_241030. If your tablet reports a different build the patch is refused rather than applied, so it should fail safely, but that path is untested.

Drive-burst research and this tool were built by reverse engineering OEM02_T18e_241030. Settle immediates and filter-bypass sites come from the published S620 work by catears124, MIT licensed; see third-party notices. This tool is source-available, not open source: read it, run it on your own hardware, but do not redistribute or mirror it. See the licence. No warranty. Not affiliated with GAOMON or Huion.