diff --git a/.gitignore b/.gitignore
index 0b4af3e..7f3bd42 100644
--- a/.gitignore
+++ b/.gitignore
@@ -81,3 +81,4 @@ EETool_sch.jpg
 Code/appleiicplus.rom
 Code/dump.txt
 Code/veronica.rom
+Code/test2.rom
diff --git a/Code/EECommander b/Code/EECommander
index 67bbc4f..2955ee6 100755
--- a/Code/EECommander
+++ b/Code/EECommander
@@ -1,6 +1,6 @@
 #!/usr/bin/python
 
-import sys, getopt, serial, binascii, struct
+import sys, getopt, serial, binascii, struct, time
 
 
 class Mode:
@@ -116,7 +116,76 @@ def checkConnection():
 
 
 def burnROM():
-	usage()
+	if romfile=='' or serialport=='':
+		usage()
+	
+	print 'Connecting to ' + serialport + '...'
+	try:
+		# Create the serial connection
+		connection = serial.Serial(serialport,19200,timeout=1)
+
+	except (OSError,serial.SerialException):
+		print 'Unable to find that serial port.'
+		sys.exit(2)
+
+	try:
+		destFile = open (romfile, "r")
+
+	except OSError:
+		print 'Unable to read from ROM file',romfile
+		sys.exit(2)
+
+	try:
+		# Prepare to write
+		wrote = connection.write(bytearray([Command.PREFIX,Command.STARTRW]))
+		if wrote != 2:
+			raise ValueError()
+
+		print 'Sending data to EETool...'
+
+		totalSize = 0
+		
+		# Transmit all the blocks
+		for blockNum in range(0,64):
+			wrote = connection.write(bytearray([Command.PREFIX,Command.WRITEBLOCK]))
+			if wrote != 2:
+				raise ValueError()
+
+			# Read block from ROM file
+			block = destFile.read(BLOCKSIZE)
+			
+			# Send block to EETool
+			numBytes = connection.write(block)
+			if numBytes != BLOCKSIZE:
+				raise ValueError()
+			
+			# Wait for confirmation
+			while 1:
+				wrote = connection.inWaiting()
+				if wrote>=1:
+					break
+
+			confirmation = connection.read(numBytes)
+			chk = bytearray([confirmation]);
+			
+			if not ((wrote==1) and (chk[0]==Command.PREFIX)):
+				print 'ERROR: Confirmation failed while uploading block',blockNum,'   Aborting.'
+				sys.exit(2)
+
+			sys.stdout.write('#')
+			sys.stdout.flush()
+			totalSize += numBytes
+			time.sleep(0.1)
+
+		destFile.close()
+		print '\nDone! Wrote',totalSize,'bytes to EEPROM.'
+		sys.exit(0)
+			
+	except (ValueError,OSError,serial.SerialException):
+		print 'UNKNOWN ERROR'
+		connection.close()
+		sys.exit(0)
+
 
 
 def dumpROM():
diff --git a/Code/EETool.c b/Code/EETool.c
index 9da208a..aa165e3 100755
--- a/Code/EETool.c
+++ b/Code/EETool.c
@@ -13,12 +13,14 @@
 #define LEDPIN 6
 #define PREFIXBYTE 0x42
 #define ROMSIZE 32768
+#define EEPROM_PAGE_SIZE 64
+#define EEPROM_PAGE_MASK 0xffc0
 
 void SetupHardware(void);
 void FatalError(void);
 void ClearCommand(void);
 void Echo(const char* string);
-void WriteBlock(void);
+void WriteBlock(uint16_t startAddr, uint16_t length);
 void ReadBlock(uint16_t startAddr, uint16_t length, bool maskROM);
 void SetAddressMSB(uint8_t addr, bool maskROM);
 uint32_t CRC32(uint8_t *buf, size_t size);
@@ -140,6 +142,13 @@ int main(void)
 						gCurrentAddress += BUFF_SIZE;
 						break;
 					}
+					
+					case CMD_WRITEBLOCK:
+					{
+						WriteBlock(gCurrentAddress,BUFF_SIZE);
+						gCurrentAddress += BUFF_SIZE;
+						break;
+					}
 						
 					default:
 						FatalError();
@@ -317,6 +326,7 @@ void ReadBlock(uint16_t startAddr, uint16_t length, bool maskROM)
 	if (!maskROM)
 	{
 		SETE_HI(6);		// Write Enable to disable
+		FatalError();
 	}
 	
 	for (uint16_t i=startAddr; i<startAddr+length; i++)
@@ -359,11 +369,92 @@ void ReadBlock(uint16_t startAddr, uint16_t length, bool maskROM)
 }
 
 
-void WriteBlock()
+void WriteBlock(uint16_t startAddr, uint16_t length)
 {
-	// Data bus for output
+	// Configure data bus for output
 	DDRD = QDDRD(0) | QDDRD(1) | QDDRD(2) | QDDRD(3) | QDDRD(4) | QDDRD(5) | QDDRD(6) | QDDRD(7);
 
+	if (startAddr+length > ROMSIZE)
+	{
+		FatalError();
+	}
+		
+	SETE_HI(2);			// Force Output Enable high for writing
+	SETE_HI(6);			// Initialize Write Enable to disabled
+
+	uint16_t pageNum = startAddr & EEPROM_PAGE_MASK;
+	uint16_t pageByte = 0;
+	
+	// Wait for entire block from host
+	uint16_t byteCount = 0;
+	while (byteCount<BUFF_SIZE)
+	{
+		uint16_t numBytes = CDC_Device_BytesReceived(&EETool_CDC_Interface);
+		
+		uint16_t i;
+		for (i=0; i<numBytes; i++)
+		{
+			int16_t value = CDC_Device_ReceiveByte(&EETool_CDC_Interface);
+			if (value>=0)
+			{
+				gCommBuffer[byteCount] = (uint8_t)value;
+			}
+			byteCount++;
+			if (byteCount>=BUFF_SIZE)
+			{
+				break;
+			}
+		}
+
+	}
+
+	if (byteCount>BUFF_SIZE)
+	{
+		FatalError();
+	}
+	
+	// Read all data from host
+	
+	// Write data to the EEPROM
+	for (uint16_t i=startAddr; i<startAddr+length; i++)
+	{
+		// Drive address lines
+		PORTB = (uint8_t)(i & 0xff);	// LSB
+		SetAddressMSB((uint8_t)(i>>8),false);
+		
+		// Prepare read buffer
+		uint16_t index = i-startAddr;
+		if (index>=BUFF_SIZE)
+		{
+			FatalError();
+		}
+		
+		// Drive data lines
+		PORTD = gCommBuffer[index];
+		
+		// Show falling edge to Write Enable
+		SETE_LO(6);
+		SETE_HI(6);
+
+		_delay_ms(8);  // For now, just doing "byte write" mode. Easier than page write (see below), but glacially slow
+		
+		// After each EEPROM page, wait for the write to complete
+//		uint16_t nextPageNum = i & EEPROM_PAGE_MASK;
+		
+//		pageByte++;
+//		if (pageByte >= EEPROM_PAGE_SIZE || pageNum != nextPageNum)
+//		{
+//			pageByte = 0;
+//			pageNum = nextPageNum;
+//			_delay_ms(8);
+//		}
+	}
+	
+	// Confirm with host that we're done
+	uint8_t ackByte = PREFIXBYTE;
+	CDC_Device_SendData(&EETool_CDC_Interface, &ackByte, 1);
+
+	PULSEC(LEDPIN);
 }