diff --git a/src/dfu.c b/src/dfu.c
index 289fad9..54b8808 100644
--- a/src/dfu.c
+++ b/src/dfu.c
@@ -110,10 +110,33 @@ static void handle_dnload_eeprom(void)
 
 static void handle_dnload_blctrl(void)
 {
-	/*
-	 * TODO: write buf to blctrl#iface @ address
-	 * inc. address
-	 */
+	uint32_t i2c_dev = TWI_ADDR_BL1 + (prog_iface -2);
+
+	uint8_t buf[66] = { 0x47, 0x11 };
+
+	uint32_t i;
+	for (i = 0; i < prog_length; i += 0x40) {
+
+		uint32_t j;
+		for (j = 0; j < 0x40; j++)
+			buf[j +2] = ((i + j) < prog_length) ? ((uint8_t *)prog_buf)[i + j] : 0xFF;
+
+		struct blmc_cmd cmd = {
+			.cmd = (CMD_WRITE_FLASH << 16) | (prog_block * 0x100 + i),
+			.mode = BLMC_CMD_WRITE | BLMC_CMD_2_ARG,
+			.size = sizeof(buf),
+			.data = buf,
+		};
+
+		printf("cmd:0x%08lx\n\r", cmd.cmd);
+
+		if (twi_cmd(i2c_dev, &cmd) != 0) {
+			printf("flash write failed\n\r");
+			dfu_state = DFU_STATE_dfuERROR;
+			dfu_status = DFU_STATUS_errUNKNOWN;
+		}
+	}
+
 	ep_transfer_send(0, NULL, 0, NULL);
 }