EEVblog #411 - MiniPro TL866 Universal Programmer Review

[radioman]

  Radioman, I want to bring to the forum, the next question
  be possible in the near future, with the marvelous TL866CS program, the following:
   HYNIX: HY27U/HY29F......
   MICRON: MT29F......
   SAMSUNG: K9F/K9K/K9G......

Maybe will be supported i don't know.

On the other hand, what criteria you judge these two usb programmers :

   TNM 2000+ USB MINI Universal Programmer
   TNM 5000+ USB MINI Universal Programmer

Well, at first sight the 5000+ is from another league, 48pin socket, jtag, FPGA, CPLD over 21000 devices!
The 2000+ model well, is more like TL866 (but more expensive) but from what i see its supporting JTAG and supported devices is over 7000.
Regarding to PC software well its OK, but below of TL866 minipro.

[NateOcean]

Here's a brief analysis I thought I'd share with you.  (My first post here, so be gentle.)

I ran the MiniPro device list thru Excel and sliced-and-diced the data a bit.
I was mainly interested in how many unique devices were really supported.
So regardless of manufacturer or package type, each listed device was reduced to the industry standard part number.
Then the number of devices in the MiniPro list that map to that industry standard list was totaled.
And then the entire list was sorted based on most popular to least.

For example, the single part with the most number of manufacturers and packaging implementations is the serial 9346 eeprom.
Of the total number of parts in the 13137 long MiniPro list, the 9346 serial eeprom accounts for 524 of those parts....about 4%.

If you include the top three parts on the list (9345, 9356, 9366... all serial eeproms) all possible manufacturers and packaging options account for 1354 of the 13137 listed MiniPro parts.  Three parts account for over 10%!

The attached graph shows the cumulative effect of how a few parts dominate the MiniPro list.
Further, note how list is inflated by the number of Serial eeProm entires.

Here's part of the list. 
This shows that of the 1044 unique industry part numbers in the MiniPro list of 13137, that only 34 of 1044 unique parts are needed to account for 50% (6579 entries) of MiniPro's 13137 entries .
The graph shows that only 157 devices are needed to account for 10003 of the 13137 entries.

      part        count         rank   cumulative         pcnt
      9346          524            1          524            4
      9356          415            2          939            7
      9366          415            3         1354           10
      2402          331            4         1685           13
      2408          305            5         1990           15
      2404          304            6         2294           17
      2416          301            7         2595           20
      9386          290            8         2885           22
     29800          268            9         3153           24
     29400          244           10         3397           26
     29002          226           11         3623           28
      2401          184           12         3807           29
      9376          184           13         3991           30
      2432          183           14         4174           32
      2464          176           15         4350           33
     24256          150           16         4500           34
      2516          149           17         4649           35
     27256          142           18         4791           36
     27010          141           19         4932           38
     29040          135           20         5067           39
     27512          133           21         5200           40
     24128          131           22         5331           41
     29200          124           23         5455           42
      2532          120           24         5575           42
     49002          116           25         5691           43
      2864          112           26         5803           44
     25040          105           27         5908           45
     29160          104           28         6012           46
        74          102           29         6114           47
     25512          100           30         6214           47
      2580           94           31         6308           48
     25080           91           32         6399           49
     25020           90           33         6489           49
      2540           90           34         6579           50
     27020           89           35         6668           51
. . . . .
    252005           11          157        10003           76
. . . . .
    628512            1         1041        13134          100
      8956            1         1042        13135          100
      9310            1         1043        13136          100
      9395            1         1044        13137          100


The second part of the analysis placed each of the 13137 listed parts into 1 of 40 part series.
This makes it clear how a few predominate serial eeprom families along with the 29-series flash, and 27-series UV eproms account for the vast majority of the MiniPro's repertoire.

Here's the report sorted by family:

          TOTAL          13137
          family         count
    1     14000 CMOS        30
    2     24 Series       2525
    3     25 Series       1925
    4     26 Series         42
    5     27 Series        941
    6     28 Series        757
    7     29 Series       2466
    8     35 Series         12
    9     36 Series          4
   10     37 Series         12
   11     39 Series        165
   12     4000 CMOS         34
   13     45 Series         15
   14     49 Series        462
   15     54 Series          4
   16     57 Series          8
   17     58 Series         26
   18     59 Series         72
   19     61 Series          4
   20     7400 Series      102
   21     87 Series         76
   22     89 Series        102
   23     90 Series         19
   24     93 Series       1993
   25     ATMEGA            59
   26     ATTINY            66
   27     DS12 Series       19
   28     GAL Series        24
   29     PIC Series       910
   30     STM35 Series       8
   31     STM50 Series      60
   32     STM95 Series      89
   33     BR90 Series       21
   34     BR95 Series       10
   35     PCF Series         5
   36     SM39 Series        5
   37     SM79 Series        8
   38     SM89 Series       28
   39     W78 Series        20
   40     uncategorized      9

[radioman]

Here's a brief analysis I thought I'd share with you.  (My first post here, so be gentle.)

Welcome to the forum NateOcean! Good job with this analysis!
Yes I know that the supported device list is somewhat artificially inflated, it is more like a database. For example there are only 40 programming algorithms implemented in the current firmware, so every supported device belongs to one of these algorithms; if I remember correctly approx. 6000+ devices (serial eeproms) are mapped in only three programming algorithms (24-i2c, 93-microwire and 25-spi), so if they want to add a new chip and this chip already have a programming algorithm implemented then is simple, is just a copy paste with name and eventually chip ID changed!

On the other hand if they want to add a new chip which doesn't have a preexisting algorithm implemented then they must implement it in firmware first and after that to add the newly created algorithm in PC software client, test it, release a new version, and every user must reflash this new version.

[timberwolf]

I have one of these programmers on order, just waiting for it to arrive.

I was wondering if anyone has done any work on disassembling the firmware?

[timberwolf]

my programmer arrived, thanks to this forum my TL866CS is now a TL866A
The help file was in Chinese and nobody seems to have an English version so by way of contributing back to the site I created an English version of the help file. It's far from perfect but definitely a step in the right direction.

replace the MiniProHelp.chm file in the folder where you installed the programmer software with the one in the zip file.
(rename the original first just in case there are any problems but there shouldn't be)

https://www.dropbox.com/s/hglk40qhs745rmm/MiniProHelp.zip

[Thor-Arne]

Thanks 

[radioman]

my programmer arrived, thanks to this forum my TL866CS is now a TL866A

Congratulations! What method you used for conversion (external programmer or direct firmware reflash)?
Regarding to your question about firmware disassembling, yes I did some disassembling; in fact serial/device Id decryption and other features of my tool is based on the firmware disassembly 

[timberwolf]

I used your tool to generate the firmware images and also to reflash the firmware.
Later on I connected a pickit2 to the internal programming header in debugger mode. This was only partially successful as the debugger has to add some code and every so often the programmer stops working presumably because it fails to checksum. I recover it by using the pickit2 to reflag the device.
I couldn't get the save current firmware to work, no idea how to load the dumper or where to get it from.

[timberwolf]

I didn't like any of the free disassemblers I could find so I wrote an intelligent disassembler for this specific pic, just adding some refinements and then I'll start seriously trying to reverse engineer the firmware concentrating on the programming routines as you seem to have the downloader well in hand

[radioman]

I couldn't get the save current firmware to work, no idea how to load the dumper or where to get it from.

The firmware dumper must be programmed into device to work with! it is nothing more than a custom firmware. You need to browse for update.dat file, check the "Use firmware dumper" radio button and click Reflash. After that the dump button will become active and you can save the current firmware. After you end with the dumper you must write a working firmware (A or CS) at your choice; so check "TL866A firmware" or "TL866CS firmware" and click reflash again! this will restore your device.

I didn't like any of the free disassemblers I could find so I wrote an intelligent disassembler for this specific pic, just adding some refinements and then I'll start seriously trying to reverse engineer the firmware concentrating on the programming routines as you seem to have the downloader well in hand

I don't like PIC asm at all with those RAM banks switching and crappy asm syntax, it is very hard to follow the program flow, but well I can live with that 
For me MPLABX and its disassembler/debugger was enough for my needs. Also if you need any help please tell me i can help as far i can including the source code for my custom "dumper" firmware.

[timberwolf]

Where would I have found the dumper software to program into the device?

[radioman]

Where would I have found the dumper software to program into the device?

The firmware dumper is a binary resource in tl866.exe file not a separate bin file 

[timberwolf]

the disassembler is coming on quite well, this is a snippet of the output it is producing:


0000187A 0E40                  MOVLW   0x40
0000187C 5C26                  SUBWF   RAM_AT_26, W, ACCESS
0000187E E103                  BNZ     L_01886
00001880 9C90                  BCF     LATH, 0x6, ACCESS   ; Make RH6 Pin (VID_10) Low
00001882 9E90                  BCF     LATH, 0x7, ACCESS   ; Make RH7 Pin (VID_11) Low
00001884 948E                  BCF     LATF, 0x2, ACCESS   ; Make RF2 Pin (VID_12) Low
00001886 AE18    L_01886:      BTFSS   RAM_AT_18, 0x7, ACCESS
00001888 D003                  BRA     L_01890
0000188A 0EF0'                 MOVLW   0xF0


it tries to follow the program flow starting at the reset and interrupt vectors to find out what is code and what is data. It also comments using the pin names from the schematic where possible.

what would be useful is a pointer to where to patch the bootloader such that it always passes the validation of the main code so that I can load the debugger without it failing

[BravoV]

So the plan is to make it "open" ? That will be great if it works ! 

[timberwolf]

I'm ok with making my stuff open.

It would be good to come up with our own firmware and PC application that is compatible with the original but that has extra devices and features

[jinzo]

That would be great indeed. I would like to offer my help but I'm currently studying for some exams and I will be able to offer some help (I'm a CS student, but not much experience with pics/mcus) in a ~month time (if you would accept/need help of course).

And thanks to all the work you two heroes do! I'm sure I'm not the only one dreaming of a somehow open programmer (I found some interesting chips that use basicly UART to program them - but autoelectric people are not interested it seems.)

[tcleavela]

Does this device truly support Atmel's GALs? I see support for the ATF16V8B but I'm skeptical as the algorithm for programming these is different than that for Lattice's GALs.

[dupontg]

it works very well with Lattice GAL..But not with PALCE AMD...For Atmel I never use..

[Fritz]

Hi,

It would be good to come up with our own firmware and PC application that is compatible with the original but that has extra devices and features

that would indeed be great! Currently I'm using OSX and the only way to use this programmer is by using a virtual machine on my computer running Window$. Until the last update, VirtualBox would refuse to connect the TL866 to the virtual machine, so I had to use Parallels to make any use out of it.
I think that the TL866 would be interesting for more hackers if they could use it directly with the operation system of their choice.
I am willing to support with software development as soon as the protocol has been sucessfully reverse engineered and documented...

Cheers
Carsten

[timberwolf]

Another option is to just use the hardware and write our own software from scratch, especially if we make the programmer look like a standard serial port

[jinzo]

That's what I was thinking about some time ago. But I don't have the correct knowledge/experience on how to design the overall system for this. How much logic would be needed in the device and how much in the software on the PC itself.
So if someone can shed some light on what other programmers use and what would be a good system design - I can help with the implementation.

Also if someone is interested in private (or public, but for that github and bitbucket are probably better for public stuff) project hosting/repository (via GitLab: git, wiki, issues, ...) send me a message and I can set up something.

[radzio]

Does this device truly support Atmel's GALs? I see support for the ATF16V8B but I'm skeptical as the algorithm for programming these is different than that for Lattice's GALs.

I'm using TL866 with ATF16V8B and it support these devices. But... sometimes I get "Overcurrent protection error" with some parts. Sometimes this is temporarily error, sometimes is permanent.  All devices are "new".

[aissaok]

how to remove protection for winbond 25q64fv
minipro with tl866

[radioman]

how to remove protection for winbond 25q64fv
minipro with tl866

what? 

[aissaok]

when I  program winbond 25q64fv
  with minipro tl866  it comes this message

how to clear otp