S620 Drive-Burst Flasher

Name: GAOMON S620 600 to 800 Hz Firmware Flasher
Author: miku

GAOMON S620 at around 600 Hz, roughly double the default, or up to 800 Hz if you trade away pen hover height. Keep the tablet's own smoothing or drop it.

Drive-burst research and this tool by miku

Unofficial firmware can brick your tablet. You flash it at your own risk and I am not responsible for any damage to your hardware.

Do these three first

Plug into a rear motherboard USB port. Front panels, monitor passthroughs and docks are hubs internally, and through a hub this bootloader's reads corrupt in ways that pass every check while drawing still works perfectly. That failure cost a full evening to track down here, because it looks like broken firmware, not a cable problem.
Windows: put the DFU device on WinUSB with Zadig. Otherwise Connect will not list the tablet or will fail immediately. Enter DFU mode first, tick Options then List All Devices, select USB ID 28E9 0189, choose WinUSB, install. Only that device. The tablet in normal mode is 256C 006F and putting WinUSB on that stops it working as a tablet.
Already running custom firmware? Restore to stock first. That includes taking a backup, not just flashing. A dump from a modified tablet is not a factory image, cannot be used to build a patch later, and this tool will refuse it. Restore with whichever tool you used, then back up here.

01Connect

This patches the Gaomon S620 running OEM02_T18e_241030 and nothing else. There is no model to pick: the only way to know which firmware you have is to read it, so the build is identified from your own backup in step 2. Other revisions exist, including a 16K pressure model, and they enumerate over USB identically.

Not identified yet.

Not connected

02Back up

Save the file. Once you flash, the tablet no longer holds the factory bytes, and every patch is built from them.

This is only a factory backup if the tablet is on factory firmware. Dumping a tablet that already runs custom firmware records the modified image, which is worth keeping but cannot be used as a patch source. The line below says which you got.

No backup yet

03Flash

20 drive periods of 29 stock with a 6µs pre-amp settle, . This is the combination measured end to end, and the one that reaches this rate without a noise penalty. Fewer periods go faster; far enough down the firmware stops enumerating on USB.

Load factory .bin

Line handling

SmoothRe-enables the tablet's own smoothing, which is left on by the factory firmware. Steadier lines. The filter is speed adaptive, so it smooths most when the pen is slow and backs off when you move fast, costing about 1.6 ms of lag at speed. RawSmoothing off, the lowest latency the tablet can do. Visibly shakier lines. This is what every build has shipped so far.

Report rate

Default610 Hz measured, 69% of stock drive energy. The stable one, and the only setting with real use behind it. 700 HzClean while drawing. Half the drive energy, so noticeably less lift-off height. It only shakes with the pen held still, which does not come up in play. 800 HzThe least stable of the three. Some shake is still visible and stray inputs have been reported. Lowest drive and least lift-off. If you get stray taps, turn on Advanced and disable the pen click and express keys.

Reported at 700 and 800: the tablet taps and presses keys on its own. Several people have seen phantom clicks and keystrokes at these two rates, enough to pause or quit an osu! map, and with the pen resting on the tablet rather than hovering. Nobody has reported it on Default. If it happens to you, turn on Advanced and tick Disable pen click and express keys, which marks those fields as padding in the report descriptors so Windows ignores them. Hover and pressure are unaffected, and OpenTabletDriver reads a different interface so it still sees everything. Nobody has flashed that option yet, so say whether it worked. None of this can put the tablet somewhere you cannot get it back from. This tool never writes the bootloader, so the express key combo still drops it into DFU and your backup still restores it. Disabling the express keys does not change that, because the bootloader reads those keys at plug-in, before the firmware runs.

Patch source: none yet. Back up first, or load a factory image.

Idle

If you hover rather than rest the pen on the tablet, read this first. The pen is passive and takes all its power from the drive burst, so cutting the burst cuts how far away the tablet can still find the pen. At 20 periods that is 69% of stock energy, and users report the cursor dropping out at a height where stock firmware still tracked. The S620's lift-off distance is unimpressive to begin with, which leaves little to spend.

Drive periods are the lever. Turn the shield on and try 24, or 29 for stock energy at roughly the old settle-only rate. Nobody has measured lift-off height against drive periods yet, so there is no table to point you at, only the direction.

Got a faster tablet out of this? The VPS this runs on and the tablets I test on come out of my own pocket. Chipping in keeps both going.

Donate on Ko-fi

!!Advanced

Nothing here is validated except the default. Recovery is still the express key combo, but you will be doing it blind.

Drive periods per excitation routine, of 29 stock

Below 8 drive periods is unexplored. 8 is 28% of the pen's stock energy and 4 is 14%. Nobody has been down there, and at some point the tablet simply stops finding the pen. Watch pressure max in the measurement script: if it stops reaching 8191 the drive is no longer enough and you have found the floor.

Worth knowing before you try: the still rate is already at the 1000 Hz USB ceiling, so it cannot go up. The moving rate is held down by an 11 sample rescan that fires when the signal drops, and weaker drive makes that fire more often. Cutting further may well make the number that matters worse.

Settle delays, microseconds

ADC channel config
17x, stock 27

Max tip compression
rare, stock 20

Analog pre-amp
17x, stock 30

Coil recovery
~4x, stock 150

ADC median Take one ADC sample per measurement instead of three

Untested. Nobody has flashed this. Each measurement currently converts three times and takes the median, which rejects outliers. Taking one saves about 128µs of every report, and because that is a fixed saving it is worth more the faster you already are. On a tablet near 950 Hz it models past the 1000 Hz USB ceiling, so it is the cheapest route to the cap. What it costs is outlier rejection, which Smooth may already be covering.

ADC sample time

Untested. Every measurement converts three times, so shortening the aperture is worth three times the saving on each. Unlike dropping to one sample, which breaks tracking outright, this degrades gradually: too short and the sample capacitor does not fully charge, which shows up as noise and scale error rather than a cursor in the corner. Work down one step at a time and stop when lines get worse.

Coarse scan window Widen from 5 coils to 7

Untested, and it is 17 sites rather than one. A still pen reports around 100 Hz faster than a moving one, because moving pushes the signal peak to the edge of the search window where the firmware cannot interpolate, so it falls back to an 11 sample rescan. A wider window costs 2 measurements on every report and saves 11 each time it avoids that. If it goes wrong the cursor will not track properly, which is obvious immediately. Reflash without it to undo.

Pen click and express keys Disable pen click and express keys

Untested. Nobody has flashed this yet. Turns off the tip click, the pen's side buttons and the four express keys, by marking those fields as padding in the report descriptors so Windows ignores them. Hover and pressure are untouched, and OpenTabletDriver reads a different interface, so it keeps full pen data and whatever you have bound there. Added for a report of phantom Escape presses at the faster presets. Windows caches these descriptors, so unplug and replug after flashing, and remove the device in Device Manager if it does not take. Reflash without it to undo, and the express key combo still enters DFU because the bootloader reads those keys before the firmware runs.

Rescan sensitivity

Untested. When the pen's signal drops below this fraction of the previous report, the firmware runs an 11 sample rescan to find it again, and that is what makes a moving pen report slower than a still one. At reduced drive the signal is small enough that noise trips it constantly. A smaller fraction means it fires less. Too small and the tablet will be slow to pick the pen up after a real lift, which shows as a pause rather than anything broken.

Smoothing floor

Untested. Only does anything with Smooth selected. The filter smooths harder the slower the pen moves, and stops at 40 of 256. That is its limit, and it is reached when the pen is sitting still. Lowering the floor smooths a stationary pen harder without touching how it behaves when you move, because the upper limit is unchanged. The cost is latency while nearly still, which is where you cannot feel it.

Each site costs its value times how often it fires, so coil recovery is about four times cheaper to restore than the other two. A drive period costs roughly 27µs. No site may be 0: stock_wait_us loads SysTick with microseconds times 72, so a 0 reload never raises COUNTFLAG and the wait never returns.

Drive periods are the hover lever. The pen is passive and takes all its energy from the drive burst, and coupling falls off steeply with height, so a cut that leaves plenty of margin at contact can leave very little while hovering. 20 periods is 69% of stock energy, 24 is 83%, 29 is all of it at roughly the published settle-only rate. If hover behaves worse than you expect, raise this before touching anything else.

04Log

What this changes

Each of the twelve excitation routines bit-bangs a square wave on PA15 to pump the pen's LC tank, and opens with movs r4,#29, the number of drive periods. At 72 MHz those bursts are about 979µs of the 1838µs fixed path.

Published builds only shorten the four analog settle waits, which runs out near 530 Hz because by then 97% of the report period is fixed work and half of that is the bursts themselves. Cutting the bursts goes underneath that ceiling.

The accuracy cost comes from the settle waits, not the bursts. One of the four is the analog pre-amplifier settling window, and sampling before it settles produced nearly all the position noise earlier builds paid. Restoring it to 6µs, a fifth of stock, costs about 16 Hz and returns the noise to factory levels.

build	rate	noise X	noise Y
29 periods, stock settle	293.7 Hz	2.66	4.21
29 periods, min settle	~530 Hz	n/a	n/a
20 periods, 1µs pre-amp	626.4 Hz	10.2	5.2
20 periods, 6µs pre-amp	610.2 Hz	3.63	3.63
15 periods, 1µs pre-amp	684.4 Hz	17.1	19.4

Measured on one device, one firmware build. Noise is in raw tablet units, detrended so the pen can be moving. Ten units is about 2 px on a 50 mm mapped area. The shipped build measures inside the range the factory firmware itself measured, 2.66 to 4.36, so the rate is no longer being paid for with jitter.

Hover, and what the drive burst costs you

The pen has no battery. Every measurement starts with the tablet driving a burst into a coil, the pen's tuned circuit soaking up some of that energy, and the tablet listening for what comes back. How much reaches the pen falls off steeply with height.

Shortening the burst is what buys the report rate, and it spends exactly that margin. At contact there is plenty spare and the tablet behaves. Held above the surface the pen is already near the limit, so the same cut can take it past the point where the tablet finds it at all. The symptom is the cursor dropping out at a height where stock firmware still tracked, not tracking badly.

This is the real cost of the patch, and it does not show up in the noise figures because those were recorded with the pen on or near the surface.

drive periods	rate	energy into the pen
29, stock	~533 Hz	100%
24	~573 Hz	83%
20, default	610 Hz	69%
15	~663 Hz	52%
10, the 700 Hz button	~700 Hz	34%
8, the 800 Hz button	~800 Hz	28%

All measured on one tablet running 241030. The rate moves with pen speed and with whatever is reading it, so treat these as the ballpark rather than a figure to hold anyone to. Every other rate here is modelled. Yours will differ. Note that 29 periods lands near the 530 Hz settle timing alone reaches, so a hover user who needs full drive gets little from this tool beyond what was already published.

Position smoothing is removed

Stock firmware runs your coordinates through a moving average and an exponential filter before sending them. This build branches over that path, skipping seven calls, two to the moving average and five to the filter, so X and Y reach the host as measured.

Pressure keeps its smoothing, deliberately. A separate moving average over six samples feeds an exponential filter and then the tip-down threshold. Unsmoothed, that threshold chatters on light contact and the pen clicks on and off while you are barely touching the surface. You want that one.

If the shake bothers you, filter it yourself. An anti-chatter or noise reduction filter in OpenTabletDriver removes most visible shimmer, and costs a little latency to do it. With the firmware filter gone the tablet sends what it measured, so that trade is now yours to make at whatever strength you like. Stock firmware made it for you, at a fixed strength, and charged you the latency whether you wanted the smoothing or not.

Your driver is a separate matter either way. Any smoothing or noise reduction filter you enable applies on top of this, and Windows Ink does its own smoothing on the pen interface, which is why the same tablet can look different in a paint app and in a game.

Entering DFU

Unplug the tablet, hold the leftmost and rightmost express keys, and plug it back in while holding. The light stays off, which is normal. Then click Connect and pick the Gaomon S620 entry in the browser prompt. Depending on your driver it may be listed as GD32 or GigaDevice instead; there will only be one device offered either way.

Before you start

Desktop Chrome or Edge. Close OpenTabletDriver, GAOMON drivers, and anything else holding the tablet.

Zadig, in more detail

Windows gives the bootloader a driver WebUSB cannot claim, which is why step 2 at the top exists. You only do it once. The entry you want appears only while the tablet is in DFU mode and reads GD32 USB DFU in FS Mode, USB ID 28E9 0189.

If you get it wrong and put WinUSB on 256C 006F, the tablet stops working as a tablet. Undo it in Device Manager: find the device, Update driver, Browse, Let me pick, and choose the HID-compliant entry rather than WinUSB.

If connecting reports transferSize 1024 rather than 2048, the link came up desynced and every button stays disabled on purpose. Replug into a rear motherboard port and connect again until it reads 2048. Reads over a bad link corrupt silently, so there is nothing useful you could safely do in that state.

What the flash does

Erase, prove the whole span reads back as 0xFF, write, then compare every byte. The bootloader and the calibration page are never written, so a bad application image is always recoverable with the same button combo.

Settle profile

Fixed at 1, 1, 6, 4µs against a stock 27, 20, 30, 150. The third value is the analog pre-amplifier settle and is the one that matters for noise, so it is held at 6µs instead of the floor.

Nerd notes

MCU GD32F350, Cortex-M4 at 72 MHz (PLL = HXTAL x6; USBFSPSC /1.5 forces 48 MHz).
Flash 64 KB. App 0x08004000, 35512 B, sha256 e4fe509d...
Bootloader 0x08000000 and calibration 0x0800fc00 are never written.

Twelve excitation routines, 0x08008f44 to 0x08009dfa, each opening with movs r4,#29 at entry+2. They bit-bang PA15 through GPIOA BSRR 0x18 and BRR 0x28, and differ only in NOP sled length (146 down to 118), a 456 to 554 kHz sweep. Dispatch is a TBB at 0x080050f8, cmp #13, index 0 a no-op and 1 to 12 the routines.

The sweep is for acquisition, not pressure. The firmware advances the index only while searching and locks it the moment the pen is found, so all 17 measurements in a tracking report run at one frequency. Pressure comes from signal magnitude.

Per report: 17 measurements across three adaptive windows, 5 + 6 + 6.
Settle sites 0x08004d3c / 4d4a / 4d58 / 4d9a firing 17 / rare / 17 / ~4 times each.
Model: 1006 + 27 x periods + sum(settle x weight), weights 17/2/17/4. Fits the stock, 626 Hz and 684 Hz builds within 0.2%, but all three were recorded with OpenTabletDriver running, which drops around 7% of reports and biases a rate downward. The one recording made with it closed came in 2.6% above the model, and no single set of weights fits both groups. Treat modelled rates as a floor and measure the result.

The 1006µs floor is modelled rather than measured. USB Full Speed caps everything at 1000 Hz regardless.

Risk

This writes unofficial firmware to your tablet. It can brick it. Every safeguard described above is there because the bootloader misbehaves in ways that are easy to get wrong, not because the process is risk free. You accept that risk yourself. I am not responsible for any damage to your hardware.

Two devices have been flashed successfully, both running OEM02_T18e_241030, on different bootloader revisions. All the rate and noise figures come from the first of them. If your tablet reports a different build the patch is refused rather than applied, and that refusal has now fired on a real tablet and held.

For help, or to report a result, join the Discord. When you report a rate, say which button you used and whether the pen was moving, because both change the number.

The drive-burst finding, the timing model, the measurement tooling and this flasher are by miku, from reverse engineering OEM02_T18e_241030. Settle immediates and filter-bypass sites come from the published S620 work by catears124, MIT licensed; see third-party notices. All rights reserved. Run it on hardware you own, but do not redistribute or mirror it. Every address it writes is documented in the research notes. See the licence. No warranty. Not affiliated with GAOMON or Huion.