diff --git a/d868uv.c b/d868uv.c
index 0a5c937..adee543 100644
--- a/d868uv.c
+++ b/d868uv.c
@@ -41,7 +41,8 @@
 #define NSCANL          250
 #define NMESSAGES       100
 
-#define MEMSZ           0xd0000
+//#define MEMSZ           0x100000
+#define MEMSZ           0x4300000
 
 //
 // Print a generic information about the device.
@@ -72,12 +73,10 @@ static void d868uv_print_version(radio_device_t *radio, FILE *out)
 //
 static void d868uv_download(radio_device_t *radio)
 {
-    //TODO
-#if 0
-    int bno;
+    int addr;
 
-    for (bno=0; bno<MEMSZ/1024; bno++) {
-        dfu_read_block(bno, &radio_mem[bno*1024], 1024);
+    for (addr = 0x00000000; addr < MEMSZ; addr += 1024) {
+        serial_read_region(addr, &radio_mem[addr], 1024);
 
         ++radio_progress;
         if (radio_progress % 32 == 0) {
@@ -85,7 +84,6 @@ static void d868uv_download(radio_device_t *radio)
             fflush(stderr);
         }
     }
-#endif
 }
 
 //
@@ -97,10 +95,8 @@ static void d868uv_upload(radio_device_t *radio, int cont_flag)
 #if 0
     int bno;
 
-    dfu_erase(0, MEMSZ);
-
     for (bno=0; bno<MEMSZ/1024; bno++) {
-        dfu_write_block(bno, &radio_mem[bno*1024], 1024);
+        serial_write_region(addr, &radio_mem[bno*1024], 1024);
 
         ++radio_progress;
         if (radio_progress % 32 == 0) {
@@ -175,10 +171,7 @@ static void d868uv_read_image(radio_device_t *radio, FILE *img)
 //
 static void d868uv_save_image(radio_device_t *radio, FILE *img)
 {
-    //TODO
-#if 0
     fwrite(&radio_mem[0], 1, MEMSZ, img);
-#endif
 }
 
 //
diff --git a/radio.c b/radio.c
index 0d5592f..cb1c0de 100644
--- a/radio.c
+++ b/radio.c
@@ -53,7 +53,7 @@ static struct {
     { 0, 0 }
 };
 
-unsigned char radio_mem [1024*1024];    // Radio memory contents, up to 1Mbyte
+unsigned char radio_mem [1024*1024*67]; // Radio memory contents, up to 67 Mbytes
 int radio_progress;                     // Read/write progress counter
 
 static radio_device_t *device;          // Device-dependent interface
diff --git a/serial.c b/serial.c
index 756708b..ab28f75 100644
--- a/serial.c
+++ b/serial.c
@@ -62,6 +62,8 @@ static const unsigned char CMD_PRG[]   = "PROGRAM";
 static const unsigned char CMD_PRG2[]  = "\2";
 static const unsigned char CMD_QX[]    = "QX\6";
 static const unsigned char CMD_ACK[]   = "\6";
+static const unsigned char CMD_READ[]  = "Raaaan";
+static const unsigned char CMD_WRITE[] = "Waaaan...";
 static const unsigned char CMD_END[]   = "END";
 
 //
@@ -641,3 +643,51 @@ const char *serial_identify()
     reply[8] = 0;
     return (char*)&reply[1];
 }
+
+void serial_read_region(int addr, unsigned char *data, int nbytes)
+{
+    static const int DATASZ = 64;
+    unsigned char cmd[6], reply[8 + DATASZ];
+    int n;
+
+    for (n=0; n<nbytes; n+=DATASZ) {
+        // Read command: 52 aa aa aa aa 10
+        cmd[0] = CMD_READ[0];
+        cmd[1] = (addr + n) >> 24;
+        cmd[2] = (addr + n) >> 16;
+        cmd[3] = (addr + n) >> 8;
+        cmd[4] = addr + n;
+        cmd[5] = DATASZ;
+        send_recv(cmd, 6, reply, sizeof(reply));
+        if (reply[0] != CMD_WRITE[0] || reply[7+DATASZ] != CMD_ACK[0]) {
+            fprintf(stderr, "%s: Wrong read reply %02x-...-%02x, expected %02x-...-%02x\n",
+                __func__, reply[0], reply[7+DATASZ], CMD_WRITE[0], CMD_ACK[0]);
+            exit(-1);
+        }
+        memcpy(data + n, reply + 6, DATASZ);
+    }
+}
+
+void serial_write_region(int addr, unsigned char *data, int nbytes)
+{
+    //TODO
+#if 0
+    unsigned char ack, cmd[4+32];
+    int n;
+
+    for (n=0; n<nbytes; n+=32) {
+        // Write command: 57 aa aa aa aa 10 .. .. ss nn
+        cmd[0] = CMD_WRITE[0];
+        cmd[1] = (addr + n) >> 8;
+        cmd[2] = addr + n;
+        cmd[3] = 32;
+        memcpy(cmd + 4, data + n, 32);
+        send_recv(cmd, 4+32, &ack, 1);
+        if (ack != CMD_ACK[0]) {
+            fprintf(stderr, "%s: Wrong acknowledge %#x, expected %#x\n",
+                __func__, ack, CMD_ACK[0]);
+            exit(-1);
+        }
+    }
+#endif
+}
diff --git a/util.h b/util.h
index a64cf47..037bbfa 100644
--- a/util.h
+++ b/util.h
@@ -83,11 +83,8 @@ void hid_write_finish(void);
 int serial_init(int vid, int pid);
 const char *serial_identify(void);
 void serial_close(void);
-//void serial_send_recv(const unsigned char *data, unsigned nbytes, unsigned char *rdata, unsigned rlength);
-//void serial_read_block(int bno, unsigned char *data, int nbytes);
-//void serial_read_finish(void);
-//void serial_write_block(int bno, unsigned char *data, int nbytes);
-//void serial_write_finish(void);
+void serial_read_region(int addr, unsigned char *data, int nbytes);
+void serial_write_region(int addr, unsigned char *data, int nbytes);
 
 //
 // Delay in milliseconds.