Xbee upgrade without using x-ctu

I am having Xbee Series 2.(XB24-BCIT-004 revD).
My xbee device is connected with my microcontroller board through line DIN, DOUT, DTR, RTS, RST.

Now I have ebl image of Xbee stored in SD card connected with my microcontroller.

I want to upgrade xbee device with ebl image I have in my SD card.

But unable to get procedure to enter into boot loader menu and send ebl image using XMODEM CRC protocol.

I am using following procedure as found in XBee™ Series 2 OEM RF Modules manual

8.1.3. XBee Series 2 Custom Bootloader
XBee Series 2 modules use a modified version of Ember’s boot loader. This version supports a
custom entry mechanism. To invoke the boot loader, do the following:

  1. Set DTR low (TTL 0V) and RTS high.
  2. Send a serial break to the DIN pin and power cycle or reset the module.
  3. When the module powers up, DTR and DIN should be low (TTL 0V) and RTS should be high.
  4. Terminate the serial break and send a carriage return at 115200bps to the module.
  5. If successful, the module will send the Ember boot loader menu out the DOUT pin at
    115200bps.
  6. Commands can be sent to the boot loader at 115200bps.

But even I follow this procedure or I don’t , I am receiving following hex output at 115200 8N1 uart setting.
[0x7e00028a00757e00028a066f]
I found some command in manual starting with 0x7e as in API but couldn’t resolve this particular.

And I think this is not what I need?

your help is appreciated…

There are two API packets there, and they both look reasonable. Here’s how the packet-check program decodes them:

First packet: 7e00028a0075

[john@henry ~]$ packet-check
API Packet analyzer version 1.5 for XBees (802.15.4, DigiMesh, ZNet, ZB)
Note: if it prompts for more bytes and you’re done, hit return
Enter packet: 7e00028a0075

Packet: 7E 00 02 8A 00 75
7E // Correct packet header byte
00 02 // payload length (decimal 2)
8A // Packet type: modem status
// Valid for 802.15.4, DigiMesh, Znet2.5, ZigBee
00 // Modem status: “Hardware reset”
75 // checksum - correct

Second packet: :7e00028a066f

[john@henry ~]$ packet-check
API Packet analyzer version 1.5 for XBees (802.15.4, DigiMesh, ZNet, ZB)
Note: if it prompts for more bytes and you’re done, hit return
Enter packet: 7e00028a066f

Packet: 7E 00 02 8A 06 6F
7E // Correct packet header byte
00 02 // payload length (decimal 2)
8A // Packet type: modem status
// Valid for 802.15.4, DigiMesh, Znet2.5, ZigBee
06 // Modem status: “Coordinator started”
6F // checksum - correct

If you’d like to use the packet-check program for yourself, check the pinned posts at the top of the 802.15.4 forum.

Hope that helps