radiomanV / TL866

Open source software for TL866
GNU General Public License v2.0
334 stars 79 forks source link

Unable to dump firmware #30

Closed mjk-gh closed 2 months ago

mjk-gh commented 3 years ago

Before trying to update the firmware of my freshly bought TL866 II plus with either the manufacturer's firmware and/or this very open source firmware, I wanted to dump the currently installed firmware from the device to a file on my PC, but I am absolutely at a loss about how to execute this task:

{ A few minutes later }

I just noted that the window title reads:

TL866 firmware updater 2.52 (0 devices connected)

I did install the udev rule (and did udevadm trigger afterwards), the device /dev/bus/usb/.... etc. has the following permissions:

crw-rw-rw-+ 1 root plugdev 189, 7 Jul 26 20:18 008

and my user is in group plugdev.

I also noted that the whole "Firmware to write" section in the "Hardware" tab is ambiguous, it could also mean to read from a file and write to a device, even if the word "dump" strongly suggests (to me, but I'm not an English native speaker) that it is the other way around.

I'm using Debian testing (AMD64), and I managed to successfully dump the content of an AMIBIOS chip (Intel D27C010A) using

https://gitlab.com/DavidGriffith/minipro/

H-help? :-}

mjk-gh commented 3 years ago

FWIW, David Griffith's minipro tool reports:

Found TL866II+ 04.2.86 (0x256) Warning: Firmware is out of date. Expected 04.2.116 (0x274) Found 04.2.86 (0x256)

radiomanV commented 3 years ago

The TL866 updater works only with the old TL866A/CS programmers. The TL866II+ is not supported because no one found yet the encryption algorithm for the updateII dat. So go ahead and update the programmer either with xgecu or the opensource minipro software. The update functionality in opensource minipro software was written by me and you can revert to an old version of the firmware if you want. Just isuue a minipro -F /path/to/updateii.dat.

mjk-gh commented 3 years ago

Thank you for the information! Your Wine wrapper works like a charme, at least reading a 1 MBit EPROM works with Xgecu 10.27 (which seems to contain 04.02.117 (0x275), which I flashed through the Xgecu software).

radiomanV commented 3 years ago

Your Wine wrapper works like a charme

I only intercept low level USB calls and redirect them to the default linux usb framework (libusb). The functionality is the same as in windows.

playaspec commented 2 years ago

I only intercept low level USB calls and redirect them to the default linux usb framework (libusb).

Is this TL866 specific, or might it work with with other USB devices? I have some rather expensive data collection hardware that won't run under modern Windows. Currently I'm forced to run W7 in a VM which is pretty resource heavy and not always reliable.

playaspec commented 2 years ago

Well, it was worth a try.

0009:err:module:DelayLoadFailureHook failed to delay load setupapi.dll.SetupDiGetClassDevsW
wine: Call from 0x7b032f82 to unimplemented function setupapi.dll.SetupDiGetClassDevsW, aborting

I get that this is entirely outside the scope of what you're doing here, but getting USB devices to work in Wine would be a huge win all around.

radiomanV commented 2 years ago

Is this TL866 specific, or might it work with with other USB devices?

This is TL866 specific but the same principle can be applied to almost any Windows software.
The entire process consists in patching the executable after loading (so, a memory patch, see https://en.m.wikipedia.org/wiki/Hooking) the setupapi.dll is used here as a trojan horse. Once loaded and executed, a special patcher function will patch all function calls related to USB communication to point to a new libusb implementation.

Depending on software this task can be from very easy to impossible. Anyway the .exe file must be disassembled and analyzed.
Sometimes many devices emulates an ordinary serial port (COM) and you don't have to modify anything. Just to map the COMx port name name to /dev/ttyx Linux name.
Can you tell me more about that software? can be downloaded?

playaspec commented 2 years ago

Thanks for your answer. I took a look at the Microsoft provided setupapi.dll's API and it's HUGE! I initially thought your version was more of a wrapper around libusb, but I see now that you're patching the executable on the fly.

Sometimes many devices emulates an ordinary serial port (COM) and you don't have to modify anything. Just to map the COMx port name name to /dev/ttyx Linux name.

If only I were so lucky! The device in question is an FHC (company) "Neurocraft" APM (Acquisition/Processor Module). It's a multi-channel recording system for neuroscience research. I believe it was discontinued circa 2008, but we're still using them. The system consists of a 19" rack cage with a power supply, two USB 2.0 four port hub cards (with TT support), up to 12 APM modules, each which have an Analog Devices DSP, and a Cypress EZ-USB bridge.

Given the amount of real time data they send back, I'm guessing they're using bulk transfers, and controlling the cards through application specific endpoints. We don't really use their software for the recording itself. Only to configure the sample rate, gain, and filter settings at the start of a session, then rely on the analog jack on the front panel. The DSPs themselves have flash on the card, so there's no firmware upload at runtime like with many EX-USB systems I've encountered.

I've been watching WIne's development, and it looks like USB support has been making progress, but the 6.0 branch still isn't quite up to the task. Maybe if I can get 6.2 to compile I'll have better luck.

At any rate, thanks for your work on the TL866. It's an indispensable part of my kit, and having alternatives that don't require Windows is always welcome.

Can you tell me more about that software? can be downloaded?

It's long since been removed from their website, but I've put a copy here if you're curious. Supposedly they had a development kit, but I missed my opportunity to get it. They say it's no longer available. This entire pursuit has all become more and more irrelevant as we migrate to OpenEphys. It's more of a hacking white whale than an imperative.

Again, thanks for the reply. I learned a couple of interesting new things out of it.

radiomanV commented 2 years ago

If only I were so lucky!

Fortunately you are. I have looked a bit through the documentation and i have found that all communications with that equipment is done via a serial/uart protocol. There's even a block diagram in the help file where the usb to serial converter is shown. Kind of Prolific/Ftdi/whatever they have used for this.
Can you please open a terminal and do a lsusb with and without that equipment connected?

radiomanV commented 2 months ago

No response from op.