Chipmaster 6000 Programmer LabTool 48 Dataman 48 48LV 48XP Teardown + a Request

[stj]

an open-source programmer software using the original device bitstream files would be the best solution.
like was done with XGECU programmers.

for reference:
https://gitlab.com/DavidGriffith/minipro

and this may also contain usefull code/info
https://bues.ch/cms/hacking/toprammer.html
https://github.com/elgendk/u2pa

[vtp]

Current status: 931 devices should now work in my linux SW to control the labtool-48uxp programmer. I say should, because obviously not each and every one of those have been tested. Instead, representatives of various families have been successfully tested in HW, these include various EPROMS, EEPROMS, PAL/GAL, PIC MCUs etc.

Process of doing this is static analysis of the original software and execution time trace in a debugger controlled virtual machine.

Only 80C32 applets and FPGA bit streams come from the original SW installation. The rest is new code, C for program and GTK for UI. Progress is a bit slow as the applets and bit streams are not enough themselves - they need to be wired to the code too and the actual process of how they are used varies between single devices to device families.

Latest SW I had was 13.10 or 13.20 so the analysis (and device coverage) is based on that.

FPGA bit streams convert back to verilog and vice versa, this a prerequisite for new component addition tool. What is missing is schematics of the box, most importantly, FPGA to socket pins part.

[daisizhou]

Hi vtp

I am not sure if the missing connection diagrams you mentioned are the ones included in the attachment;
please check the attachment.

[ukamak]

Hi VTP, your work is very interesting. It seems there are about 9 subroutines or basic algorithms. I'll try to work out the scheme; it won't be quick, I won't be home until February, but I'll be able to do something. If you'd like, we can help to test your program.

[pityokas]

, most importantly, FPGA to socket pins part.

Here is, from my B1.0:

ZIF1-FPGA10
ZIF2-FPGA8
ZIF3-FPGA5
ZIF4-FPGA6
ZIF5-FPGA82
ZIF6-FPGA83
ZIF7-FPGA2
ZIF8-FPGA4
ZIF9-FPGA80
ZIF10-FPGA79
ZIF11-FPGA71
ZIF12-FPGA77
ZIF13-FPGA16
ZIF14-FPGA7
ZIF15-FPGA9
ZIF16-FPGA18
ZIF17-FPGA26
ZIF18-FPGA24
ZIF19-FPGA21
ZIF20-FPGA19
ZIF21-FPGA28
ZIF22-FPGA35
ZIF23-FPGA25
ZIF24-FPGA27
ZIF25-FPGA40
ZIF26-FPGA44
ZIF27-FPGA45
ZIF28-FPGA46
ZIF29-FPGA48
ZIF30-FPGA47
ZIF31-FPGA50
ZIF32-FPGA51
ZIF33-FPGA41
ZIF34-FPGA37
ZIF35-FPGA39
ZIF36-FPGA38
ZIF37-FPGA58
ZIF38-FPGA60
ZIF39-FPGA59
ZIF40-FPGA56
ZIF41-FPGA69
ZIF42-FPGA68
ZIF43-FPGA70
ZIF44-FPGA67
ZIF45-FPGA65
ZIF46-FPGA63
ZIF47-FPGA61
ZIF48-FPGA62

Connection:

Code: [Select]

FPGA-+-R560-+-R390-+-ZIF
     |      |      |
     |    SP720    |
     |             |
     +------C------+



[pityokas]

The MCU-FPGA side:

D0-FPGA81
D1-FPGA78
D2-FPGA3
D3-FPGA15
D4-FPGA30
D5-FPGA17
D6-FPGA23
D7-FPGA20
A0-FPGA49
A1-FPGA52
A2-FPGA53
A3-FPGA66
A4-FPGA75
A5-FPGA76
DIR-FPGA84

[alpher]

Hi, lot of good info here but most of the links to software expired.
I have a Chipmaster 6000XPu that I use with an ancient Thinkpad running winME
Is there any chance now for me to use it on something like modern Pc (win 10~11) ?
Below a couple of screenshots from the soft running on winME:

[stj]

the factory software situation is this:

you can use the parallel port ONLY on 32bit o.s.
USB port software can run on 32 or 64 bit o.s.

the win version is irelevent, only the lack of a 64bit parallel driver is holding it back.

[coromonadalix]

@Alpher  8.32 was the "free no licence" version


v14.30 modded / hacked / patched   on Win11 x64  with an 6000Xpu,  absolutely no problems, from a full setup  ... WITH A GRAIN OF SALT  LOLL

--------------------------------------
EXAMPLE USING  THE UXP SOFTWARE


for the 14.30 xp  setup,  it must be unpacked on a 32 bit system,  because the InstallShield setup identify the os version and platform,  beyond W7, it may or will not install

Apparetly the : ISx-v0.3.11.7z can possibly extract Installshield self executables
https://github.com/lifenjoiner/ISx/releases


open a cmd prompt: type   isx LT48UXP_1430_WIN7.exe [test]    and everything should extract fine in a [test] folder   ..... (ok in my win11 x64)

--------------------------------------
YOU NEED THE XP  VERSION ...... i used the uxp  as a test,  both XP and UXP can be InstallShield unpacked


that way you can have the non InstallShield setup,  and do a proper 14.30_XP model setup under w10  or w11  IF YOU DO HAVE A REAL LPT PORT ... NO PCI-E OR PCI CARD(S) 
and lpt port support still there or if it was removed by msoft, you're out of luck ?

[stefankd]

I just want to say "hi", because you all guys moved to here at the same time, I got sick on bed with almost 39C and as result of that I kind of got lost to where you all moved.

so, it seems many people now are doing things, even they are different, but related enough that at the end they can all be merged:

1) Those of you that followed on the old place know that I reversed-engineer (at least partially) LT48/LT48LV LPT communication protocol, which is SPP with Nibble-based-encoding for the read-back channel.

2) @ukamak : is total expert on ATtiny12-based security of LT48XP/UXP and such related topics

3) @vtp : it seems even made full-blown software for LT48XP/UXP

now, considering the FPGA Bitstream for LT48/LT48LV and LT48XP/UXP is the same (at least the default one that is inside the 80C32 FW, which means the Top-PCB, the "Driver Unit" PCB, is the same between those programmers), then probably all ICs for which support was added after they abandoned LT48/LT48LV, can be programmed with LT48/LT48LV with merging 1) and 3).

and 2) allows us to keep the original software going, etc.

[stj]

i would be very carefull about trying to use software for the (U)XP on the older LV model until it's understood how the supply voltages are configured and routed to the socket.

[stefankd]

i would be very carefull about trying to use software for the (U)XP on the older LV model until it's understood how the supply voltages are configured and routed to the socket.

some time ago I compared *.REZ files from one of the latest software versions that supports LT48/LV with one of the first software versions that supports LT48XP and most of them were with no differences other than the byte(s) which indicate the version number of *.REZ file itself (and the *.REZ that had more differences can be contributed to the new devices, which support was added). that to me at least shows what is stored in the *.REZ was device-independent, at least in the first versions that supported LT48XP. however, I agree with you in a sense that it's possible the EXE interprets some parts of the *.REZ differently based on the actual device, i.e. LT48/LV vs LT48XP/UXP and even further that at some point in time with their software progressing they as well might became incompatible with each other and not possible to be interchanged directly.

[ukamak]

Only for coromonadalix license for SN AE0805000027  "For USB"
I don't have here the hardware to test it, hope it works.
Must extent to 2040

*** original  2017 ***
 --- e2p[29..2c] license  e2p[2e] calibration byte  e2p[3a] crc1  ----------------
   e2p[29]     - 17                 // lic_date year_low
   e2p[2a]     - 04                 // lic_date moth (must be 1,4,7 or 10)
   e2p[2b]     - 1b                 // lic crc_1       
   e2p[2c]     - fc                 // lic crc_2       
   e2p[3a]     - 5e                 // lic crc_3       

*** modified  2040 ***
--- e2p[29..2c] license  e2p[2e] calibration byte  e2p[3a] crc1  ----------------
   e2p[29]     - 40                 // lic_date year_low
   e2p[2a]     - 04                 // lic_date moth (must be 1,4,7 or 10)
   e2p[2b]     - 44                 // lic crc_1       
   e2p[2c]     - 20                 // lic crc_2       
   e2p[3a]     - 82                 // lic crc_3       

[stefankd]

Only for coromonadalix 

interesting that for his unit it seems someone paid for a license up to 2017 and maybe that's why it's included in the license list inside the EXE.

EDIT: actually, it seems all SNs are inside, just with different license information.

@coromonadalix  : the unit you own is it "LabTool"-branded or some of the OEM brands (Chipmaster, Dataman, etc.)?

[coromonadalix]

Hi guys  thks

branded    Logical Device Chipmaster 6000Xpu ....  with original box  etc ....      got it in a very clean state, almost brand new, or very light use

interesting to know it was registered / paid


not at home  will test later ...

[stefankd]

almost brand new, or very light use

if I read correctly the bytes that designate the "usage counter" in your dump, it was used only 936 times - that is the number that the original software shows in the lower right corner of its window. so, indeed "very light use", because most of those 2nd hand units are in the several thousand count.

will test later ...

don't forget to use unpatched EXE, other than that I expect to be fully working.

[coromonadalix]

BEHOLD the results,      the software goes very fast and close   loll,  no pause to see ...  shutdown and re-power the programmer ...

non patched EXE as requested

thks  a lot   a 2040 license     

Q:  what is the meaning of (4004) ??  year 40   4th month ?

[ukamak]

e2p[29]     - 40   // lic_date year_low e2p[2a]     - 04   // lic_date moth (must be 1,4,7 or 10)

Yes (4004) is year 2040 moth 4.

Now if you want to test other versions don't need to patch.

[coromonadalix]

14.30  xp and uxp  was only made available on the defunct AEC website, i searched a lot .......

many "clones" websites do offer 13.10, some talk about 14.30 ....... but was not made publicly available, unless i missed something

 has someone offered a archival destination, or maybe i should try to push them to archive. org ?

[ukamak]

Maybe Rhine labs can help?

[asis]

Hi,

A very interesting topic.
Perhaps I can help in some way, too?
-
Choose what you need and let me know where to put it.

[msuthar]

mine is clone  Labtool 48UXP  USB
attached is the dump of the at12.

Comparing with your results:
Year and date fields are FF FF
can you check what is different?  14.30 knows this serial number in its look up table and gives license in valid error.

*** Ours  FF FF  *** AE701000123
--- e2p[29..2c] license  e2p[2e] calibration byte  e2p[3a] crc1  ----------------
   e2p[29]     - FF                 // lic_date year_low
   e2p[2a]     - FF                 // lic_date month (must be 1,4,7 or 10)
   e2p[2b]     - FE                 // lic crc_1       
   e2p[2c]     - 53                 // lic crc_2       
   e2p[3a]     - A6                 // lic crc_3
 
   e2p[2e]     - 38                 //calibration byte

Serial Number location
0030 41  -A
0031 45  -E
0032 07  -7
0033 01  -1
0034 00  -0
0035 01  -1
0036 23  -23

0037 45  -E

00E0  53 1E 90 05 00 3E 14  58  // cfg bytes
   7B id  1

[ukamak]

Hi msuthar,
Yes it's a clone, have many differences with stored datas in the exe.
Mainly 3 MD5's that can not be reversed/calculated.
That means we can't license it with your datas , you need a donor.

We have 3 ways, 1 is the most easy if we found that donor.
1 - In Your case we need a dump of flash and tiny12 from a licensed one, with atiny12 calibration byte 0x3E
2 - Or find one tiny12 that match the calibration byte of one licensed.
3 - Another way is to install one hardware "tiny25+tiny12" and after we can clone from any licensed one.


00E0  53 1E 90 05 00 3E 14  58  // cfg bytes    "3E  is your calibration byte"

[stj]

the calibration byte may not need to be correct for the chip, it depends how the chip communicates.
if it uses syncronous serial with a clock pin then running it a bit fast or slow wont matter.

[msuthar]

thanks for reply.
In this case I need a donar.

Any donar with 3E calibration byte, would like to donate.

The clone unit works well with all 4 patches done on 14.30.


Best regards.
Manoj Suthar  VU2EHY