LabTool 48UXP Clone

[SunRise]

Also have one of these: Unused still sealed.

From reading:

- New software requires a licence key from supplier.
- Clones get bricked, killing contents of 2 chips - an ATTiny and an eeprom...
- Can anybody confirm reflashing the above fixes the issues
- Can anybody confirm what the latests 'safe' software versions are for clones?
- Does cloning dumps from a genuine make it appear genuine ... or is the clone detection based on something different?

I'm thinking about taking a look at possibility of cracking the latest software for some of these clone programmers and just want to establish what is currently known.

As much detail as possible please

[tango]

Not much been on these for ages
Main bit is the atiny12 (which don't seem to be any working dumps for)
If you have a way to read the atiny, I have a dead unit here that I could test with if interested
The eeprom sometimes gets erased too from what iv read but after checking mine it's not been erased
Software wise you can't use any above v6.35 if I remember correctly
And as you said newer versions/win 7 versions require software activations

[SunRise]

Not much been on these for ages
Main bit is the atiny12 (which don't seem to be any working dumps for)
If you have a way to read the atiny, I have a dead unit here that I could test with if interested
The eeprom sometimes gets erased too from what iv read but after checking mine it's not been erased
Software wise you can't use any above v6.35 if I remember correctly
And as you said newer versions/win 7 versions require software activations

What dumps for the ATtiny did you try?

I can try to dump mine but I suspect they would lock the ATtiny after programming.

[tango]

Only dump I have is ones found on Internet
And reports was they don't work

[SunRise]

Only dump I have is ones found on Internet
And reports was they don't work

Could you attach them here anyway? It will still tell me if bad dump or locked chip etc.

[tango]

dont think they work but you can try
i would buy a new atiny12 tbh then you dont have to mess with original just incase

[SunRise]

dont think they work but you can try
i would buy a new atiny12 tbh then you dont have to mess with original just incase

Well the ATtiny12 dump is blank (all 00's in hex) apart from the last 2 lines

FC 3F FF FF FF FF FF FF FF FF FF FF FF FF FF FF 
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF

So that's dump is very wrong.

It's not what I would expect to see on attempting to read a locked flash either.

I've yet to even confirm the chip is even an ATtiny12 - I'm taking everything with a pinch of salt.
There was a break down of this by bushing from fail0verflow (sadly no longer with us) some years ago on hackmii.com. His analysis was on a genuine unit though.

I can't see where the ATtiny chip is supposed to be on there, nor does he mention one.

I will be collecting my clone unit later today. I'm not sure if there are multiple clones around, so I'd be interested in the following:

1. A high resolution picture of your mainboard (clearly showing alleged ATtiny12)
2. Your units serial number (if a clone, I guess they may all be the same)

[gopelhu]

Hi SunRise,

I have these files my archive.

I cant read the Intel 80c32, so i dont have this file.

Regards, G

[SunRise]

The 80c32 does not have any firmware - It's just a processor. The FW is stored on the the 27C512, which you have in the W27C512_flash_v6.80_orig.bin file. This is the same as in tango's dump

   MD5: ac7595ebaf2ae8359a0f4f638a11d743
 SHA-1: 6f767af52d340954a2a224d693ed4be4ce1ebe59

Your ATtiny is also the same (blank code section, some random data for the internal eeprom)

  MD5: 07fa39f314221b486f3ef19a9363db82
 SHA-1: 09d9325ace7e819588e69c9420f482dd736e2243

Yours also includes a dump of a 24c02 which I've not seen any references too.

[tango]

sometimes the 24c02 is erased too (mine isnt)
also the winbond flash isnt erased too
so only atiny12 must get erased on some
serial number is garbage on erased clones
as said i was looking at this awhile ago with another user (he didnt want his name mentioned in forums) but i ended up with other things to do and family issues got in the way (as they do) so forgot about it all.
the 24c02 eeprom is in the right corner of the bottom pcb (looking with power supply to the left side)

[tango]

1: attiny12
2: 24c02

[SunRise]

That's interesting ... in your picture the ATtiny12 looks more like a regular DIP8 chip in a socket - can you confirm? on bushings pictures of a genuine this is a SOIC8 (SMD) variation soldered directly to the board. Infact looking at it, a lot of chips seem to be in sockets on the clone instead of soldered in - such as the 2xA6833's (chips numbered 11 on bushings picture of a genuine)

https://hackmii.com/2009/02/48uxp_hw/

This chip had the top sanded off on his.

This is really weird. If it's some kind of security chip then why use a common non secure part instead of a dedicated security chip?

Also the original site when talking about clones show 2 serial numbers - is this because there are 2 different clones doing the rounds or did the cloners just decide to change serial number at some point?

Does the serial come from the ATtiny12 or the 24c02? if so this could explain the randomizing. Did anyone ever try changing the serial to see if this is how it detects clones?

Oh and I see they swapped the green LED for a red LED

[tango]

i have seen the info you posted awhile back (saved the page when i was looking into it)
the 2 blacklisted serials are for the clones thats been around for a few years now (theres actually 3 serials, maybe more)
i think they cloned those 2 labtools
and yes the attiny in my clone is dip8

[SunRise]

i have seen the info you posted awhile back (saved the page when i was looking into it)
the 2 blacklisted serials are for the clones thats been around for a few years now (theres actually 3 serials, maybe more)
i think they cloned those 2 labtools
and yes the attiny in my clone is dip8

My clone appears to be different to yours - visually looks more like a genuine. Down to the sanded off tops of chips, SMD chips (shame).

Even the LED is green!

Seems to have pads to allow a DIP8 socket or SMD package.

I like the way they use a red wire instead of blue like a genuine for the ground pin of the PSU which goes to the case

I still see no evidence to say the chip is an ATtiny12 btw. I'm not saying it's not ... but if people know what it is then why are all the dumps bad. So I'm going to assume that is possibly wrong at this stage until I've something more conclusive.

Was the top of your chip sanded off or did it contain the part number?

[tango]

It's sanded off
On some chips that's been sanded, sometimes if you wet the sanded area you can still make out what was printed
Only sometimes so can't garentee it