CH341A is an USB interface chip that can emulate UART communication, standard parallel port interface, parallel communication and synchronous serial (I2C, SPI).
CH341A is used by some cheap memory programmers. The IC is somehow limited in this configuration, because the programmer makes use only of the SPI and I2C interface. A popular device is the so-called “CH341A MiniProgrammer” that you can buy for Rs. 450 from techcart.pk.
CH341A - Driver Download. Vendor: QinHeng Electronics. Product: USB-EPP/I2C. CH341A. Hardware Class: libusb-win32 devices. Search For More Drivers. CH341A Pro Mini USB SPI Programmer Software & Drivers. Best techcart.pk CH341A is an USB interface chip that can emulate UART communication, standard parallel port interface, parallel communication and synchronous serial (I2C, SPI). CH341A 24 25 Series EEPROM Flash BIOS USB Programmer with Software & Driver. This low-cost mini USB CH341A 24 25 Series EEPROM Flash BIOS USB Programmer is intended to support 24xx Series EEPROM and 25xx series SPI flash 8pin/16 pin chip. It is equipped with CH 341A chip, can automatically recognize 25 series chip, and its 24/25 series. CH341A is an USB interface chip that can emulate UART communication, standard parallel port interface, parallel communication and synchronous serial (I2C, SPI). CH341A is used by some cheap memory programmers. The IC is somehow limited in this configuration, because the programmer makes use only of the SPI and I2C interface.
Click to Buy CH341A Programmer in Pakistan
CH341A Software & Driver.
The problem is that this device comes as-is, without any documentation or software. Drivers are available from manufacturer’s website (but the site is written in Chinese). Also, some source codes are available from Manufacturer. But, first of all, let’s have a look at the hardware.
The manufacturer provides a lot of useful things on the product page. Here are the files you can find and what they contain (the first two are the ones you need):
- CH341SER.EXE – self installing archive with USB to serial driver.
- CH341PAR.EXE – self installing archive with multi-protocol interface driver (this one is for the programmer mode)
- CH341SER.ZIP – archive containing driver files and serial API and library (you don’t need specific API for standard serial port, but it contains some special functions to get IC version etc.)
- CH341PAR.ZIP – archive containing driver files for interface mode and API (header and library to access the device and use any protocol you want).
- CH341PAR_LINUX.ZIP – archive containing Linux driver source code and Linux API
- CH341SER_LINUX.ZIP – Linux driver source code for serial port (don’t need this one, it’s already included in kernels)
- CH341EVT.ZIP – some source code and tools written to be used with an evaluation board (may be useful for programming software that can access this device)
- CH341DS1.PDF – datasheet, in Chinese
- CH341DS2.PDF – some additional info and API documentation, in Chinese
- CH341DP.ZIP – contains an ISP programming tool?
- CH341DPS.ZIP – probably similar to the above, but requires login to download.
A regular user only needs the first two. Just double click on each of them and when the dialog appears click on Install. Next thing you’ll need is software. You can download it from here.
Devices to be used with CH341A Programmer.
CH341A programmer is complete package a user can done work with accessories provided with this programmer but in some conditions you may need some additional accessories like SOIC8 Test Clip or different type of adapter. SOIC8 Socket Clip is very useful you can program IC without removing chip from motherboard which is also available in stock.
Rick Wisser //
Note: This blog will also be a lab for any of the upcoming Wild West Hackin’ Fest Conferences.
During a recent engagement, I came across an issue. The issue I encountered was that the SPI chip I was trying to dump the firmware off of was a 1.8v chip. This would not have been a problem but both the shikra and bus pirate are rated for 3.3v chips. I considered creating a voltage divider to step the voltage down but after a little Googling, I came across the CH341a with the 1.8v adapter. I decided to order it with one-day shipping. After I worked with it and was able to successfully dump the firmware from the 1.8v IC without having to remove the SPI chip from the circuit board, I decided to write a blog about it. This blog is targeted for all audiences. It might be a little too step-by-step for intermediate or experienced people who have dumped firmware with other tools but I wanted to include the beginner as well because we all started somewhere right?
Below is a picture of the CH341a package that I got. I will include links at the end of this blog on which items I bought or reference.
The CH341a is very easy to set-up. Usually, I use a Linux variant Operating System for conducting any testing. However, from previous experience, I know that the AsProgrammer works better on a Windows PC. All you need are the drivers and the AsProgrammer software which can be found in the following links.
“CH341-Windows-SPI-I2C-Driver+SDK-library” and “CH341-Windows-Serial-Driver+SDK-library” directories at https://github.com/boseji/CH341-Store.
AsProgrammer software – https://github.com/nofeletru/UsbAsp-flash/releases/
After downloading the software and installing it on my Windows laptop, it was time to pick a target. I went into my collection of “garage sale” electronics and found a Netgear WNDR3700 router that would do the trick. After cracking open the case and conducting reconnaissance on the chips for the device, I found a target SPI chip. The following is a picture of the board with the SPI chip identified.
As with any reconnaissance, you will want to find more information. Therefore, I grabbed the datasheet for the MX25L6445E SPI chip and looked at the pin diagram and identified the type of package that is installed on the WNDR3700 circuit board.
Examining the datasheet, I noticed that this particular chip has a VCC of 3.3v and the actual package type on the board is a 16 pin chip. Due to this information, we know that it is not necessary to use the 1.8v adapter. But it appears that we might have an issue with the 16 pin chip package (note that the middle 8 pins are not used.) The CH341a only comes with an 8 pin chip clip and header. I could solder wires onto the functioning pins of the MX25L6445E and interface it to the CH341a Zero Insertion Force (ZIF) socket but since I could use a 16 pin chip clip for future engagements I decided to purchase one.
After a quick internet search, I chose a 16 pin chip clip that included headers already soldered for interfacing with the ZIF socket of the CH341a. I will place the link for the 16 pin chip clip at the bottom of this blog along with a link for the CH341a programmer. The headers that were provided with the 16 pin chip clip included an 8 to 16 pin as well as a 16 to 16 pin header. I also ohmed out the 8 to 16 pin header and found that it had the correct traces in place to interface directly with the 16 pin MX25L6445E chip and the CH341a ZIF socket. Here is a picture of the chip clip with the headers.
The connections were easy to make since everything has either pin markings, silkscreen prints, or some type of indicator to reference pin 1. For instance, the chip is marked with a divot in the corner where pin 1 is. The chip clip has one of its strands of cable red to indicate pin 1 and the interface board has numbers silk-screened on the board to indicate the pins. Finally, the CH341a has silkscreen as well to indicate where pin one goes for either a 24xxx or 25xxx chip type. Below are images with descriptions showing the pin and silk marking indicators.
The CH341a silkscreen has indicators for 25xx and 24xx with little half circles to the right of them. This half-circle indicates that pin 1 is next to the half-circle and would be the top right corner. The ZIF socket has 16 pins so it is divided in half with the right side for 24xx chips and the left side for 25xx chips. In this situation, we will be using the left side of the ZIF socket since our chip is an MX25Usbee ax pro. L6445E chip.
The above image shows the chip clip cable attached to the header board with the pin 1 designators lined up.
Next, we will hook the chip clip to the chip with the red pin 1 indicator aligned with the pin 1 designator of the MX25L6445E chip as shown below.
Finally, we install the header with the chip clip cable onto the CH341a ZIF socket as shown below.
Now with everything connected, we can dump the firmware from our MX25L6445E chip. We connect the CH341a to the USB port on our Windows PC and open up AsProgrammer. First, we have to select the CH341a as the hardware device in the Hardware menu.
IMPORTANT NOTE: The CH341a supplies the power to the board so you do not need to plug in the WNDR3700 into the wall. If you do so, you may damage your CH341a.
The next thing you need to do is select the type of SPI chip you will be using. Select IC from the main menu and then SPI followed by the vendor and then the IC. In this case, we want the MACRONIX MX25L6445E chip.
Once the chip is selected it will be shown in the top menu screen of the AsProgrammer. The “Size”, “Page”, and “SPI commands” will also auto-populate so you should not have to mess with them. You also want to confirm that the SPI radio button is selected. Below is a screenshot of how AsProgrammer should be set-up.
Once everything looks good you will click the box with the green arrow coming out of it to read the contents of the chip. Once it is done, you can also save it with the floppy disc icon.
This particular chip took 1.5 minutes to read the contents which can be shown below in the screenshot below after reading the contents of the MX25L6445E Chip.
Now that we have our firmware dumped we can evaluate it for anything of interest. In this case, I used the “strings” or “strings.exe” (You will have to download it for the Windows OS) to search for “password” and “SSID” as shown below.
As you observe you can see that this particular router looks to have been reset before it was taken out of commission and sold since it has what looks like default values.
The best thing about the CH341a is that with other hardware, such as the Bus Pirate and Shikra I have found that I need to remove the SPI chip from the board to interact with it due to other circuits interfering with the targeted SPI chip. However, with the CH341a, I can just place a chip clip on the chip and dump the firmware without worrying about damaging the component by desoldering and soldering it on a breakaway board.
If you enjoyed this blog post and would like to get your hands dirty, come and join us at one of our Wild West Hackin’ Fest conferences. I will have this and many other labs available for attendees to play with.
Below are the links for the items that I purchased in the blog post.
Usb Programmer Ch341a Software
- Amazon CH341a Pro with 1.8v add on: https://www.amazon.com/Organizer-EEPROM-CH341A-Adapter-Programmer/dp/B07V2M5MVH/ref=sr_1_1?keywords=ch341a&qid=1579295338&s=electronics&sr=1-1
- Amazon link for the 16 pin chip clip: https://www.amazon.com/WINGONEER-SOIC16-circuit-programming-adapter/dp/B01CYA9BTY/ref=pd_sbs_147_20?_encoding=UTF8&pd_rd_i=B01CYA9BTY&pd_rd_r=bcbc95e8-fcd8-4012-a17a-5e15d8a7da7b&pd_rd_w=4xhD3&pd_rd_wg=BUd6J&pf_rd_p=670e3530-913b-43e2-8005-da937e9a4fe8&pf_rd_r=AE4216TVMK66NZAYCY34&psc=1&refRID=AE4216TVMK66NZAYCY34
Ch341a Programmer Software Windows 10
Join the BHIS Blog Mailing List – get notified when we post new blogs, webcasts, and podcasts.