diff --git a/flash-tool/cmd.c b/flash-tool/cmd.c
index 18c0884..bbef448 100644
--- a/flash-tool/cmd.c
+++ b/flash-tool/cmd.c
@@ -362,10 +362,16 @@ int nand_erase(struct nand_in_t *nand_in)
 		       nand_in->dev, i);
 
 		usb_send_data_address_to_ingenic(&ingenic_dev, start_blk);
-		ingenic_dev.file_len = blk_num;
-		usb_send_data_to_ingenic(&ingenic_dev);
+		usb_send_data_length_to_ingenic(&ingenic_dev, blk_num);
+
 		unsigned short temp = ((i << 4) & 0xff0) + NAND_ERASE;
 		usb_ingenic_nand_ops(&ingenic_dev, temp);
+
+		if (usb_get_ingenic_cpu(&ingenic_dev) < 3) {
+			printf("\n---debug----------------");
+			return -1;
+		}
+
 		ingenic_dev.file_buff = ret;
 		ingenic_dev.file_len = 8;
 		usb_read_data_from_ingenic(&ingenic_dev);
@@ -456,10 +462,10 @@ int nand_program_file(struct nand_in_t *nand_in,
 		printf("\n No.%d Programming...",k+1);
 		nand_in->length = code_len; /* code length,not page number! */
 		nand_in->buf = code_buf;
-		if ( nand_program_check(nand_in, &n_out, &start_page) == -1)
+		if (nand_program_check(nand_in, &n_out, &start_page) == -1)
 			return -1;
 
-		if ( start_page - nand_in->start > hand.nand_ppb ) 
+		if (start_page - nand_in->start > hand.nand_ppb)
 			printf("\n Skip a old bad block !");
 		nand_in->start = start_page;
 #if 0
diff --git a/flash-tool/ingenic_usb.c b/flash-tool/ingenic_usb.c
index 43f028b..37f8df5 100644
--- a/flash-tool/ingenic_usb.c
+++ b/flash-tool/ingenic_usb.c
@@ -199,8 +199,8 @@ int usb_send_data_length_to_ingenic(struct ingenic_dev *ingenic_dev, int len)
 	status = usb_control_msg(ingenic_dev->usb_handle,
           /* bmRequestType */ USB_ENDPOINT_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
           /* bRequest      */ VR_SET_DATA_LENGTH,
-          /* wValue        */ 0,
-          /* wIndex        */ len,
+          /* wValue        */ STAGE_ADDR_MSB(len),
+          /* wIndex        */ STAGE_ADDR_LSB(len),
           /* Data          */ 0,
           /* wLength       */ 0,
                               USB_TIMEOUT);
@@ -251,7 +251,7 @@ int usb_read_data_from_ingenic(struct ingenic_dev *ingenic_dev)
 {
 	int status;
 	status = usb_bulk_read(ingenic_dev->usb_handle,
-	/* endpoint         */ INGENIC_IN_ENDPOINT,
+	/* endpoint         */ INGENIC_IN_ENDPOINT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
 	/* bulk data        */ ingenic_dev->file_buff,
 	/* bulk data length */ ingenic_dev->file_len,
 				USB_TIMEOUT);