Bus pirate interface with with winbond chip

spi

I have successfully interfaced to my winbond chip via the bus pirate.
I have successfully executed the chip identifier command and chip erase commands via spi, i would like to read and delete the chips security registers.

This is the command set i push via spi with bus pirate for read:
datasheet: The instructions is initiated by driving the /CS pin low and then shifting the instruction code "48h" followed bya a 24-bit address(A23-A0) and eight "dummy clocks into the DI pin.

What i send:
[0x48 0x00 0x00 0x00 0x00 0x00 r:256] <- read security register(read 256 bytes)

Each security register is 256 bytes in size and there are aparrantly 4 though i can only see 3 in the datasheet.

My questions is how would i read each security register 256 bytes at a time?

Section 8.2.33 is the reference and the the datasheet is here
http://www.nexflash.com/NR/rdonlyres/A5B6C30B-C174-43CF-867E-E1A2F371A07C/0/W25Q128FV.pdf

Best Answer

According to the datasheet, the 3 security registers' address range are:

Security Register 1 (256 Bytes): 0x001000 ~ 0x0010FE

Security Register 2 (256 Bytes): 0x002000 ~ 0x0020FE

Security Register 3 (256 Bytes): 0x003000 ~ 0x0030FE

So, read 256 bytes from one register (read entire register) with Pirate bus SPI command, should be like

read Security Register 1 ==> [0x48 0x00 0x10 0x00 0x00 r r:255 ]