miku's firmwares

experimental

Step 1 of 5

Do these three first

None of these are optional. Skipping any one of them fails in a way that looks like something else.

  1. Plug into a rear motherboard USB port. Front panels, monitor passthroughs and docks are hubs internally. Through a hub this bootloader's reads corrupt in ways that pass every check while drawing still works perfectly. That one cost me a full evening, because it looks like broken firmware and not a bad cable.
  2. Windows: put the DFU device on WinUSB with Zadig. Otherwise Connect will not list the tablet, or will fail the moment you pick it. Enter DFU mode first, tick Options then List All Devices, select USB ID 28E9 0189, choose WinUSB, install. Only that device. The tablet in normal mode is 256C 006F, and putting WinUSB on that stops it working as a tablet.
  3. Already running custom firmware? Restore to stock first. That includes taking the backup, not just flashing. A dump from a modified tablet is not a factory image, cannot be used to build a patch later, and this tool will refuse it. Restore with whichever tool you used, then come back.

Unofficial firmware can brick your tablet. You flash it at your own risk, and I am not responsible for any damage to your hardware.

Desktop Chrome or Edge. Close OpenTabletDriver, GAOMON drivers, and anything else holding the tablet.

The picker at the top detects nothing. One tablet and one firmware build are supported so far. Step 3 reads which build you actually have from your own backup.

Step 2 of 5

Connect in DFU mode

Unplug the tablet, hold the leftmost and rightmost express keys, and plug it back in while still holding them. The light stays off, and nothing else tells you it worked.

Then press Connect and pick the Gaomon S620 entry in the browser prompt. Depending on your driver it may be listed as GD32 or GigaDevice. There will only be one device offered either way.

Not connected

Not identified yet.

Step 3 of 5

Back up, then save the file

Once you flash, the tablet no longer holds the factory bytes, and every patch is built from them. This file is the only way back.

This reads the whole tablet twice and compares the two passes. A corrupt link shows up as a mismatch, before it can poison a backup you will trust later.

0%

No backup yet

This is only a factory backup if the tablet is on factory firmware. Dumping a tablet that already runs custom firmware records the modified image. Worth keeping, but it cannot be used as a patch source. The line above says which one you got.

Step 4 of 5

Flash

20 drive periods of the stock 29, with a 6µs pre-amp settle. . This is the combination measured end to end, and the one that reaches this rate without a noise penalty. Fewer periods go faster; far enough down, the firmware stops enumerating on USB.

Recommended: Default, about 600 Hz. 700 and 800 Hz currently have stability issues, shake and stray inputs, that are being worked on. Pick them only if you are happy to test.

Reported at 700 and 800: the tablet taps and presses keys on its own. Several people have seen phantom clicks and keystrokes at these two rates, enough to pause or quit an osu! map, and with the pen resting on the tablet rather than hovering. Nobody has reported it on Default. If it happens to you, turn on Advanced and tick Disable pen click and express keys, which marks those fields as padding in the report descriptors so Windows ignores them. Hover and pressure are unaffected, and OpenTabletDriver reads a different interface so it still sees everything. Nobody has flashed that option yet, so say whether it worked. None of this can put the tablet somewhere you cannot get it back from. This tool never writes the bootloader, so the express key combo still drops it into DFU and your backup still restores it. Disabling the express keys does not change that, because the bootloader reads those keys at plug-in, before the firmware runs.

Patch source: none yet. Back up first, or load a factory image.

If you hover the pen rather than rest it on the tablet, read this first. The pen is passive and takes all its power from the drive burst, so cutting the burst cuts how far away the tablet can still find the pen. At 20 periods that is 69% of stock energy, and users report the cursor dropping out at a height where stock firmware still tracked. The S620 does not have much lift-off distance to spend.

Drive periods are the lever. Turn on Advanced and try 24, or 29 for stock energy at roughly the old settle-only rate.

Advanced

Nothing here is validated except the default. Recovery is still the express key combo, but you will be doing it blind.

Below 8 drive periods is unexplored. 8 is 28% of the pen's stock energy and 4 is 14%. Nobody has been down there, and at some point the tablet simply stops finding the pen. Watch pressure max in the measurement script: if it stops reaching 8191 the drive is no longer enough and you have found the floor.

Worth knowing before you try: the still rate is already at the 1000 Hz USB ceiling, so it cannot go up. The moving rate is held down by an 11 sample rescan that fires when the signal drops, and weaker drive makes that fire more often. Cutting further may well make the number that matters worse.

Untested. Nobody has flashed this. Each measurement currently converts three times and takes the median, which rejects outliers. Taking one saves about 128µs of every report, and because that is a fixed saving it is worth more the faster you already are. On a tablet near 950 Hz it models past the 1000 Hz USB ceiling, so it is the cheapest route to the cap. What it costs is outlier rejection, which Smooth may already be covering.

Untested. Every measurement converts three times, so shortening the aperture is worth three times the saving on each. Unlike dropping to one sample, which breaks tracking outright, this degrades gradually: too short and the sample capacitor does not fully charge, which shows up as noise and scale error rather than a cursor in the corner. Work down one step at a time and stop when lines get worse.

Untested, and it is 17 sites rather than one. A still pen reports around 100 Hz faster than a moving one, because moving pushes the signal peak to the edge of the search window where the firmware cannot interpolate, so it falls back to an 11 sample rescan. A wider window costs 2 measurements on every report and saves 11 each time it avoids that. If it goes wrong the cursor will not track properly, which is obvious immediately. Reflash without it to undo.

Untested. Nobody has flashed this yet. Turns off the tip click, the pen's side buttons and the four express keys, by marking those fields as padding in the report descriptors so Windows ignores them. Hover and pressure are untouched, and OpenTabletDriver reads a different interface, so it keeps full pen data and whatever you have bound there. Added for a report of phantom Escape presses at the faster presets. Windows caches these descriptors, so unplug and replug after flashing, and remove the device in Device Manager if it does not take. Reflash without it to undo, and the express key combo still enters DFU because the bootloader reads those keys before the firmware runs.

Untested. When the pen's signal drops below this fraction of the previous report, the firmware runs an 11 sample rescan to find it again, and that is what makes a moving pen report slower than a still one. At reduced drive the signal is small enough that noise trips it constantly. A smaller fraction means it fires less. Too small and the tablet will be slow to pick the pen up after a real lift, which shows as a pause rather than anything broken.

Untested. Only does anything with Smooth selected. The filter smooths harder the slower the pen moves, and stops at 40 of 256. That is its limit, and it is reached when the pen is sitting still. Lowering the floor smooths a stationary pen harder without touching how it behaves when you move, because the upper limit is unchanged. The cost is latency while nearly still, which is where you cannot feel it.

Each site costs its value times how often it fires, so coil recovery is about four times cheaper to restore than the other two. A drive period costs roughly 27µs. No site may be 0: stock_wait_us loads SysTick with microseconds times 72, so a 0 reload never raises COUNTFLAG and the wait never returns.

0%

Idle

Step 5 of 5

Unplug and replug

The tablet needs a power cycle to leave DFU mode and come up on the new firmware. Pull the cable, plug it back in normally, without holding any keys.

Rate varies by roughly 3% either side depending on what is reading it. OpenTabletDriver drops around 7% of reports and biases the number downward.

Restore factory on the previous step writes your backup back. Keep the tablet in DFU mode until you are happy with it.

Got a faster tablet out of this? The VPS this runs on and the tablets I test on come out of my own pocket. Chipping in keeps both going.

Donate on Ko-fi

For help, or to report a result, join the Discord. When you report a rate, say which button you used and whether the pen was moving, because both change the number.

The drive-burst finding, the timing model, the measurement tooling and this flasher are by miku, from reverse engineering OEM02_T18e_241030. Settle immediates and filter-bypass sites come from the published S620 work by catears124, MIT licensed; see third-party notices. All rights reserved. Run it on hardware you own, but do not redistribute or mirror it. Every address it writes is documented in the research notes. See the licence. No warranty. Not affiliated with GAOMON or Huion.