LabTool 48UXP Clone

[SunRise]

Also have one of these: Unused still sealed.

From reading:

- New software requires a licence key from supplier.
- Clones get bricked, killing contents of 2 chips - an ATTiny and an eeprom...
- Can anybody confirm reflashing the above fixes the issues
- Can anybody confirm what the latests 'safe' software versions are for clones?
- Does cloning dumps from a genuine make it appear genuine ... or is the clone detection based on something different?

I'm thinking about taking a look at possibility of cracking the latest software for some of these clone programmers and just want to establish what is currently known.

As much detail as possible please :)

[tango]

Not much been on these for ages
Main bit is the atiny12 (which don't seem to be any working dumps for)
If you have a way to read the atiny, I have a dead unit here that I could test with if interested
The eeprom sometimes gets erased too from what iv read but after checking mine it's not been erased
Software wise you can't use any above v6.35 if I remember correctly
And as you said newer versions/win 7 versions require software activations

[SunRise]

Not much been on these for ages
Main bit is the atiny12 (which don't seem to be any working dumps for)
If you have a way to read the atiny, I have a dead unit here that I could test with if interested
The eeprom sometimes gets erased too from what iv read but after checking mine it's not been erased
Software wise you can't use any above v6.35 if I remember correctly
And as you said newer versions/win 7 versions require software activations

What dumps for the ATtiny did you try?

I can try to dump mine but I suspect they would lock the ATtiny after programming.

[tango]

Only dump I have is ones found on Internet
And reports was they don't work

[SunRise]

Only dump I have is ones found on Internet
And reports was they don't work

Could you attach them here anyway? It will still tell me if bad dump or locked chip etc.

[tango]

dont think they work but you can try
i would buy a new atiny12 tbh then you dont have to mess with original just incase

[SunRise]

dont think they work but you can try
i would buy a new atiny12 tbh then you dont have to mess with original just incase

Well the ATtiny12 dump is blank (all 00's in hex) apart from the last 2 lines



FC 3F FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF


So that's dump is very wrong.

It's not what I would expect to see on attempting to read a locked flash either.

I've yet to even confirm the chip is even an ATtiny12 - I'm taking everything with a pinch of salt.
There was a break down of this by bushing from fail0verflow (sadly no longer with us) some years ago on hackmii.com. His analysis was on a genuine unit though.

I can't see where the ATtiny chip is supposed to be on there, nor does he mention one.

I will be collecting my clone unit later today. I'm not sure if there are multiple clones around, so I'd be interested in the following:

1. A high resolution picture of your mainboard (clearly showing alleged ATtiny12)
2. Your units serial number (if a clone, I guess they may all be the same)

[gopelhu]

Hi SunRise,

I have these files my archive.

I cant read the Intel 80c32, so i dont have this file.

Regards, G

[SunRise]

The 80c32 does not have any firmware - It's just a processor. The FW is stored on the the 27C512, which you have in the W27C512_flash_v6.80_orig.bin file. This is the same as in tango's dump



MD5: ac7595ebaf2ae8359a0f4f638a11d743
SHA-1: 6f767af52d340954a2a224d693ed4be4ce1ebe59


Your ATtiny is also the same (blank code section, some random data for the internal eeprom)



MD5: 07fa39f314221b486f3ef19a9363db82
SHA-1: 09d9325ace7e819588e69c9420f482dd736e2243



Yours also includes a dump of a 24c02 which I've not seen any references too.

[tango]

sometimes the 24c02 is erased too (mine isnt)
also the winbond flash isnt erased too
so only atiny12 must get erased on some
serial number is garbage on erased clones
as said i was looking at this awhile ago with another user (he didnt want his name mentioned in forums) but i ended up with other things to do and family issues got in the way (as they do) so forgot about it all.
the 24c02 eeprom is in the right corner of the bottom pcb (looking with power supply to the left side)

[tango]

1: attiny12
2: 24c02

[SunRise]

That's interesting ... in your picture the ATtiny12 looks more like a regular DIP8 chip in a socket - can you confirm? on bushings pictures of a genuine this is a SOIC8 (SMD) variation soldered directly to the board. Infact looking at it, a lot of chips seem to be in sockets on the clone instead of soldered in - such as the 2xA6833's (chips numbered 11 on bushings picture of a genuine)

https://hackmii.com/2009/02/48uxp_hw/

This chip had the top sanded off on his.

This is really weird. If it's some kind of security chip then why use a common non secure part instead of a dedicated security chip?

Also the original site when talking about clones show 2 serial numbers - is this because there are 2 different clones doing the rounds or did the cloners just decide to change serial number at some point?

Does the serial come from the ATtiny12 or the 24c02? if so this could explain the randomizing. Did anyone ever try changing the serial to see if this is how it detects clones?

Oh and I see they swapped the green LED for a red LED :D

[tango]

i have seen the info you posted awhile back (saved the page when i was looking into it)
the 2 blacklisted serials are for the clones thats been around for a few years now (theres actually 3 serials, maybe more)
i think they cloned those 2 labtools
and yes the attiny in my clone is dip8

[SunRise]

i have seen the info you posted awhile back (saved the page when i was looking into it)
the 2 blacklisted serials are for the clones thats been around for a few years now (theres actually 3 serials, maybe more)
i think they cloned those 2 labtools
and yes the attiny in my clone is dip8

My clone appears to be different to yours - visually looks more like a genuine. Down to the sanded off tops of chips, SMD chips (shame).

Even the LED is green!

Seems to have pads to allow a DIP8 socket or SMD package.

I like the way they use a red wire instead of blue like a genuine for the ground pin of the PSU which goes to the case :D

I still see no evidence to say the chip is an ATtiny12 btw. I'm not saying it's not ... but if people know what it is then why are all the dumps bad. So I'm going to assume that is possibly wrong at this stage until I've something more conclusive.

Was the top of your chip sanded off or did it contain the part number?

[tango]

It's sanded off
On some chips that's been sanded, sometimes if you wet the sanded area you can still make out what was printed
Only sometimes so can't garentee it

[SunRise]

It's sanded off
On some chips that's been sanded, sometimes if you wet the sanded area you can still make out what was printed
Only sometimes so can't garentee it

So we really have no proof this is an ATtiny12 other than the word of people who post blank dumps?

[tango]

So we really have no proof this is an ATtiny12 other than the word of people who post blank dumps?

i agree
not sure if iv seen somewhere it say
will try taking a closer look at mine
i also have a genuine labtool48xp (none usb)
will look at that pcb to see what it has

[tango]

genuine has same reference of u62 and thats sanded off too
so im guessing this chip must hold the serial etc

[SunRise]

genuine has same reference of u62 and thats sanded off too
so im guessing this chip must hold the serial etc

I am personally guessing this chip will be code locked tbh. Can't see them trying to go to the trouble of sanding the contents off but not locking it during programming.

[tango]

I am personally guessing this chip will be code locked tbh. Can't see them trying to go to the trouble of sanding the contents off but not locking it during programming.
i would have thought so too but my main thought is if it can be code locked/fuse bits blown then why sand the chip id off them???

only reason i can see for any company to sand the chip id off is to just make it more awkward for cloning, but someone somewhere must know if its an ATtiny12 or not for sure.

the older labtool48lv used a peel chip that was prone for corrupting

[SunRise]

i would have thought so too but my main thought is if it can be code locked/fuse bits blown then why sand the chip id off them???

only reason i can see for any company to sand the chip id off is to just make it more awkward for cloning, but someone somewhere must know if its an ATtiny12 or not for sure.

the older labtool48lv used a peel chip that was prone for corrupting

Sanding off is common as it slows down cloners; lock bits are not considered secure - they can be beaten by MCU attack, sanding makes it hard to choose what CPU you are attacking.

I've not disappeared - Just had a busy few days. I'm going to look at dumping the chip tomorrow on mine (if it's possible)

[tango]

before you do that can you do a self test and send me the .rep file it creates please
details i sent you in pm

[tango]

any progress?????????

[tango]

anyone with a working clone ?
can someone that has a working clone please do a self test and post or send me the .rep file it creates please
it has to be from a working 48uxp

[SunRise]

anyone with a working clone ?
can someone that has a working clone please do a self test and post or send me the .rep file it creates please
it has to be from a working 48uxp

Ill be sending mine over later, just need to find some safe sw for it.

[tango]

You want sw version 6.80 or lower
I have the software somewhere, I'll dig it out and send you it

[SunRise]

You want sw version 6.80 or lower
I have the software somewhere, I'll dig it out and send you it

I just need something that won't brick it for the rep file you want.

[tango]

found version 6.20
software must be used on windows xp only

[tango]

is there anyone with a clone that can do a self test and post the .rep file ???
surely someone has a working clone ???

[SunRise]

I am still here. WinXP is a minor issue or me until the Christmas break when I can set up a temp XP one.

[tango]

still waiting for a .rep file
any software for labtool will be ok just for doing self diagnostic test
install any sw ie v8.xx click self test then after its done close software
DO NOT TRY TO READ OR WRITE ANY IC'S THIS WILL KILL THE CLONED LABTOOL48UXP
all thats needed to do is open sw with labtool48uxp connected and click self test

[Aquastar32]

Anyone got anywhere with this as I have a clone unit wished I'd known when I bought it of eBay I could of got my money back then anyway where can I download software and I will try mine I know it needs to be an old version of it to work
Mark

[tango]

you can make rep file with any version
but if your clone still working dont try to do anymore
only use the old sw with windows xp that you got with the labtool
mine needed a new attiny12

[ingelekt]

Hello
Does anyone sucesfuly repair bricked LT48UXP clone?
Here is mine bricked.
i need working files or programming controler .Or someone know wher buy repair pack.610878

[civet]

the U62 chip is an ATtiny11, use the beeprog+ to read it show "chip protected".

[civet]

rep file: w93bb63a8b19.rep

[civet]

you can make rep file with any version
but if your clone still working dont try to do anymore
only use the old sw with windows xp that you got with the labtool
mine needed a new attiny12

I just use the Win10 system to test it; my laptool 48UXP should be a fake one, the U62 chip already been soldering looks, and when I use the 8.3 within XP, connect the programmer need at least one minute, then show different ID each time although the LED is green. also in Win10, use the version 13, identify the programmer need quite long time. any way, even the programmer is orginal, that is rubbish, no software can use it, who want to use the old version 8.3 and winxp ?

[kamaku]

Hi civet,
Could you do a rep2 dump from Your machine?
Seems your attiny12 is erased.
986883