TL866II Plus & TL866A/CS open source software (OEM software has malware) - Page 1
Forum section: electronics / beginners

author: alkmar
author_rank: Newbie
timestamp: November 25, 2019, 01:55:45 am
content: I had purchased a TL866II+ programmer about six months ago, upon scanning the included disc using VirusTotal.com it was fund to have malware by six scanning engines. I recently tried to download the software directly from the OEM's website (autoelectric), and this too has malware.Lucky I ran across an open source solutions for using a TL866II+ or TL866A/CS which save this device from becoming eWaste.MiniPro (https://gitlab.com/DavidGriffith/minipro) application is a command-line Linux/Mac application which works for these programmers.This software can also update the firmware on these programmers, but you have to obtain the firmware file update.dat (A/CS) or updateII.dat (II+) from somewhere else. One some what safe way is to download the programming application from autoelectric (but dont open or execute it). I then usedhttps://extract.me/to unarvcive the RAR file and then again to compress the .EXE. This allowed me to access only the update.dat or updateII.dat files needed for firmware updating. Even their archive for the old A/CS version have malware!Then you can use the open source MiniPro application along with the extracted update*.dat file to update your programmer to the latest version. Its highly recommend that you do not try to uncompress a .RAR file from a untrusted source on your computer. There are serious vulnerabilities in many RAR applications.It's really a shame AutoElectric would seem support malware, as its hard to see how they wouldn't know its been in their distribution for awhile.All said, I hope the information can be helpful to others... Cheers!

author: mcovington
author_rank: Regular Contributor
timestamp: November 25, 2019, 04:21:22 am
content: How sure are we that the TL866 software actually contains malware? Windows Defender does not find any malware in it. Some virus scanners do give false alarms. Has anything that came in with the TL866 software actually been observed doing harm?

author: alkmar
author_rank: Newbie
timestamp: November 25, 2019, 04:43:23 am
content: You are correct to point out that ever so often scanning engines will miss-attribute a behavior or sequence of bytes as a signature of malware. That said VirusTotal scans items uploaded with 50+ engines, one I could attribute to an errant engine. However then it gets flagged by six separate engines it gives me enough pause to seek another application/source.All said I don't have a proper sandbox setup to analyze what it's actually doing. So I figured it was at least a good idea to warn others of the potential, in addition to let everyone know of a Unix solution too.

author: james_s
author_rank: Super Contributor
timestamp: November 25, 2019, 04:49:21 am
content: This is probably the most popular device programmer on the market and has been for around a decade. The software is far from great, but I think if it contained malware there would be an uproar by now. Most of the users are technical types, so somebody would have figured that out.

author: mcovington
author_rank: Regular Contributor
timestamp: November 25, 2019, 02:21:16 pm
content: Here is some background on VirusTotal:https://en.wikipedia.org/wiki/VirusTotalVirusTotal aggregates the results of many, many antivirus programs, not all of which are equally reliable.Which of those antivirus programs say there is malware in the TL866 software, and what do they say about it?Actually confirming the presence of malware would be very important. But at this point that doesn't seem to have been done.

author: rsjsouza
author_rank: Super Contributor
timestamp: November 26, 2019, 06:47:10 pm
content: To me, six AVs captured issues on the latest version 6.85The older version 6.50 triggered only three AVs

author: SparkyFX
author_rank: Frequent Contributor
timestamp: November 26, 2019, 07:02:48 pm
content: And these were obtained from the autoelectric.cn website?

author: rsjsouza
author_rank: Super Contributor
timestamp: November 26, 2019, 07:09:32 pm
content: Yes. Version 6.50 I downloaded in 2016 (the executable is from 2015) and version 6.85 I downloaded about two months ago.If you ask me, I think it is a false positive.

author: JohnnyBerg
author_rank: Frequent Contributor
timestamp: November 26, 2019, 07:35:52 pm
content: I use this programmer for quite some time, dowloaded version 8.something fromhttp://www.xgecu.com/en/Never had a problem with it.

author: rsjsouza
author_rank: Super Contributor
timestamp: November 26, 2019, 08:24:37 pm
content: Quote from: JohnnyBerg on November 26, 2019, 07:35:52 pmAs james_s also corroborated, I don't think the hundreds (thousands?) had a virus/trojan/spyware problem with the programmer software per se. I bought mine in 2014 or 2015 and it has been installed in more than one system without any shred of problems.Interesting; I just uploaded one of our small (173kB) full custom command-line applications (not scanned regularly at all) and it took quite some time going through all the AV scanners. However, several other scans were absolutely instantaneous, thus this hints of cached information. I really couldn't find a way to re-scan.(edit) there is a button to re-scan, which takes a given amount of time to complete. The results are the same. However, the detected threats vary wildly across the different engines. I wouldn't worry about this. Their heuristic algorithm and their database are being fooled.

author: SparkyFX
author_rank: Frequent Contributor
timestamp: November 26, 2019, 08:28:19 pm
content: They don't seem to scan the file at all, they calculate it's checksum (hash) and compare it against various databases.

author: macboy
author_rank: Super Contributor
timestamp: November 27, 2019, 04:23:09 am
content: Quote from: SparkyFX on November 26, 2019, 08:28:19 pmThe hash is computed, and if the file hasn't been scanned before then it is scanned, which takes time (and resources). Otherwise cached scan results are used and the result is returned immediately. Obviously this is the only reasonable way to handle the workload.

author: SparkyFX
author_rank: Frequent Contributor
timestamp: November 27, 2019, 10:16:39 am
content: There is nothing wrong with the method of hashing the file and comparing that, as hash collisions are very unlikely. It is just that changes in the constantly improving detection algorithms will not be resolved by doing so. Database entries might outdate with updates of the scan engines and Virustotal seems to give no indication on if that could have been the case.Scans for the V9.00 archive only shows a heuristic match, which is what it is. Unpacking the installer and then unpacking the installer executable gives you the folder structure. Individual scans of the included executables gives nothing but one "Grayware"-Detection for the UsbDriverIntall.exe (probably for displaying web content during install?).

author: janoc
author_rank: Super Contributor
timestamp: November 27, 2019, 10:29:29 am
content: Quote from: rsjsouza on November 26, 2019, 06:47:10 pmThat looks very much like a false positive - clues:- Very different problem description by each antivirus (e.g. Sality is a executable infecting malware/rootkit/botnet, Powershell trojan is a script-based malware, i.e. a very different thing).- It has been obviously found byheuristic scanning(which is notoriously unreliable and prone to false positives) and not by signature matching (generic/no problem description, one antivirus even says it is a result of the heuristics).- None of the actual large reputable programs (e.g. Avast, NOD32, AVG, F-Prot) has found anything wrong there, only a few minor players. Of course it is possible that e.g. BitDefender or ClamAV have some secret sauce that the major players don't or maybe someone like Avast could be in cahoots with the malware author, but that is, frankly, extremely unlikely - versus a crap result from a poor antivirus program.- Some of the antivirus programs listed are known for being junk - e.g. McAfee or Comodo and you are probably better off with just the basic Defender or even nothing at all.In short, I wouldn't worry too much about it. It is most likely due to the antivirus software being triggered by some techniques the Minipro USB driver installer or the driver itself uses and the antivirus flags it.However, if you are concerned, you can always run the software in a VM to limit the possible damage. That's how I do it (using VirtualBox), even though in my case it is because I don't want to reboot to Windows whenever I need the programmer.And re open source software - there is some as well:https://gitlab.com/DavidGriffith/minipro/(most recent)https://github.com/wd5gnr/qtl866https://github.com/wd5gnr/miniproI have tried the WD5GNR one's back in the day, they worked but they don't seem to be maintained, so the selection of chips may be lacking.

author: alkmar
author_rank: Newbie
timestamp: December 08, 2019, 12:11:48 am
content: I also recently received a TL866CS (I needed the higher voltage programming ability for legacy eproms). This software showed the following on VirtusTotal (see attached picture). This package contained the professionally pressed (not burned) mini-CD with the software.I don't have a sandbox to run this stuff safely for testing (however I do trust results including FireEye, Palo Alto Networks, Sophos). It was my intent to let others know in case there is some distributions containing malware. If someone has a "sandbox" and is welling try using the files located on autoelectric.cn (these downloads get the same results).

author: janoc
author_rank: Super Contributor
timestamp: December 08, 2019, 01:27:59 pm
content: That's the same as above. Very likely a false positive due to inaccurate heuristic analysis. If you are worried, install Virtual Box and run it in there.

author: alkmar
author_rank: Newbie
timestamp: December 09, 2019, 07:15:36 am
content: Actually I have been successful with compiling and using the open source MiniPro programming software from David Griffith. This allows me to use it on Unix via command line which is fairly handy. So, ill continue using the open source code. You suggestion of a virtualization layer is a good one too.So far I have been able to programed the following:D27C64-120UTINY85SST39SF040-70-4C-PHEATF16V8B-15PUIts a good and inexpensive little programmer, that's very handy when messing around with retro style computers.

author: jesuscf
author_rank: Frequent Contributor
timestamp: November 20, 2020, 12:29:06 am
content: The CLI for the TL866 (https://gitlab.com/DavidGriffith/minipro) now compiles and runs natively on Windows. I used the gcc that comes with strawberry perl:Code:D:\Source\minipro>gcc --versiongcc (x86_64-posix-seh, Built by strawberryperl.com project) 8.3.0Copyright (C) 2018 Free Software Foundation, Inc.This is free software; see the source for copying conditions. There is NOwarranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.Run make:Code:D:\Source\minipro>makegcc -g -O0 -Wall -std=c99 -DSHARE_INSTDIR="\"/usr/local/share/minipro\"" -c -o xml.o xml.cgcc -g -O0 -Wall -std=c99 -DSHARE_INSTDIR="\"/usr/local/share/minipro\"" -c -o jedec.o jedec.cgcc -g -O0 -Wall -std=c99 -DSHARE_INSTDIR="\"/usr/local/share/minipro\"" -c -o ihex.o ihex.cgcc -g -O0 -Wall -std=c99 -DSHARE_INSTDIR="\"/usr/local/share/minipro\"" -c -o srec.o srec.cgcc -g -O0 -Wall -std=c99 -DSHARE_INSTDIR="\"/usr/local/share/minipro\"" -c -o database.o database.cgcc -g -O0 -Wall -std=c99 -DSHARE_INSTDIR="\"/usr/local/share/minipro\"" -c -o minipro.o minipro.cgcc -g -O0 -Wall -std=c99 -DSHARE_INSTDIR="\"/usr/local/share/minipro\"" -c -o tl866a.o tl866a.cgcc -g -O0 -Wall -std=c99 -DSHARE_INSTDIR="\"/usr/local/share/minipro\"" -c -o tl866iiplus.o tl866iiplus.cgcc -g -O0 -Wall -std=c99 -DSHARE_INSTDIR="\"/usr/local/share/minipro\"" -c -o version.o version.cgcc -g -O0 -Wall -std=c99 -DSHARE_INSTDIR="\"/usr/local/share/minipro\"" -c -o usb_win.o usb_win.cgcc -g -O0 -Wall -std=c99 -DSHARE_INSTDIR="\"/usr/local/share/minipro\"" -c -o main.o main.cgcc xml.o jedec.o ihex.o srec.o database.o minipro.o tl866a.o tl866iiplus.o version.o usb_win.o main.o -lsetupapi -lwinusb -o miniproTest:Code:D:\Source\minipro>minipro -p 2764A@DIP28 -w total.hexFound TL866II+ 04.2.123 (0x27b)Warning: Firmware is newer than expected.Expected 04.2.122 (0x27a)Found 04.2.123 (0x27b)VPP=12V, VDD=5.5V, VCC=5V, Pulse=1000usChip ID OK: 0x8908Found Intel hex file.Writing Code... 28.98Sec OKReading Code... 0.21Sec OKVerification OK

author: avrkris
author_rank: Newbie
timestamp: February 07, 2021, 12:09:26 am
content: Quote from: jesuscf on November 20, 2020, 12:29:06 amhmm my compile under windows fails on jedec.o ... so something has changed:C:\Users\Kris\Documents\MiniPro\minipro>makeprocess_begin: CreateProcess(NULL, which git, ...) failed.Makefile:31: pipe: No errorprocess_begin: CreateProcess(NULL, which git, ...) failed.Makefile:188: pipe: No error"Creating version.h""#define GIT_BRANCH \""ormat:D | sed s/^.*\>\\s*//\"" >> version.h"#define GIT_HASH \""ormat:H\"" >> version.h"#define GIT_HASH_SHORT \""ormat:h\"" >> version.h"#define GIT_DATE \""ormat:ci\"" >> version.h"Creating version.c"gcc -g -O0 -Wall -DSHARE_INSTDIR="\"/usr/local/share/minipro\"" -c -o xml.o xml.cgcc -g -O0 -Wall -DSHARE_INSTDIR="\"/usr/local/share/minipro\"" -c -o jedec.o jedec.cIn file included from jedec.c:25:version.h:1:1: error: expected identifier or '(' before string constant"/*"^~~~C:\Users\Kris\Documents\MiniPro\minipro>gcc --versiongcc (x86_64-posix-seh, Built by strawberryperl.com project) 8.3.0Copyright (C) 2018 Free Software Foundation, Inc.This is free software; see the source for copying conditions. There is NOwarranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.Any chance you can share the compiled binary?thanksKris

author: rsjsouza
author_rank: Super Contributor
timestamp: February 07, 2021, 01:26:06 am
content: I never tried to build this but, usually when there is an error such as the one below, it indicates there is a utility or a path that cannot be found. I would check any spaces or special characters in paths, as well as any missing utility or even the actual path to GCC utilities (gcc, ar, etc.)process_begin: CreateProcess(NULL,

author: avrkris
author_rank: Newbie
timestamp: February 07, 2021, 03:35:12 am
content: thanks, yeah I will need to spend some more time trying to figure it out, but wouldn't mind grabbing a compiled binary for windows if anyone has it already...

author: jesuscf
author_rank: Frequent Contributor
timestamp: February 07, 2021, 05:34:28 am
content: Quote from: avrkris on February 07, 2021, 03:35:12 amOnce again I fall for the trickery of 'make'! When make runs on Windows it looks for a Linux/Unix shell in the path; if it finds it, it will use it instead of the 'cmd' of Windows. It so happens that I have Cygwin installed, so make uses that shell (I think is 'bash') where all the wonderful commands used by the 'makefile' all located. That is why the 'makefile' worked so nicely in my system. Try running the attached .bat file (rename from .txt to .bat as .bat files are not permitted in this forum). It creates the two version files (version.h and version.c) compiles all the source files using GCC, and links to minipro.exe. I think it just needs GCC installed. This is the output:Code:D:\Source\minipro2>makeminiproD:\Source\minipro2>gcc -g -O0 -Wall -DSHARE_INSTDIR="." -c -o xml.o xml.cD:\Source\minipro2>gcc -g -O0 -Wall -DSHARE_INSTDIR="." -c -o jedec.o jedec.cD:\Source\minipro2>gcc -g -O0 -Wall -DSHARE_INSTDIR="." -c -o ihex.o ihex.cD:\Source\minipro2>gcc -g -O0 -Wall -DSHARE_INSTDIR="." -c -o srec.o srec.cD:\Source\minipro2>gcc -g -O0 -Wall -DSHARE_INSTDIR="." -c -o database.o database.cD:\Source\minipro2>gcc -g -O0 -Wall -DSHARE_INSTDIR="." -c -o minipro.o minipro.cD:\Source\minipro2>gcc -g -O0 -Wall -DSHARE_INSTDIR="." -c -o tl866a.o tl866a.cD:\Source\minipro2>gcc -g -O0 -Wall -DSHARE_INSTDIR="." -c -o tl866iiplus.o tl866iiplus.cD:\Source\minipro2>gcc -g -O0 -Wall -DSHARE_INSTDIR="." -c -o version.o version.cD:\Source\minipro2>gcc -g -O0 -Wall -DSHARE_INSTDIR="." -c -o usb_win.o usb_win.cD:\Source\minipro2>gcc -g -O0 -Wall -DSHARE_INSTDIR="." -c -o main.o main.cD:\Source\minipro2>gcc xml.o jedec.o ihex.o srec.o database.o minipro.o tl866a.o tl866iiplus.o version.o usb_win.o main.o -lsetupapi -lwinusb -o miniproThis is the batch file, based on the source collected from the repository the day of this posting:Code::: Create version.c@echo /* > version.c@echo * This file is automatically generated. Do not edit. >> version.c@echo */ >> version.c@echo #include "minipro.h" >> version.c@echo #include "version.h" >> version.c:: Create version.h@echo /* > version.h@echo * This file is automatically generated. Do not edit. >> version.h@echo */ >> version.h@echo #define VERSION "0.5" >> version.h@echo #define GIT_BRANCH " master, refs/keep-around/f5d979a215b4c44e8f23dce918b283a9d7db4d72" >> version.h@echo #define GIT_HASH "f5d979a215b4c44e8f23dce918b283a9d7db4d72" >> version.h@echo #define GIT_HASH_SHORT "f5d979a" >> version.h@echo #define GIT_DATE "2021-01-03 14:04:08 -0800" >> version.hgcc -g -O0 -Wall -DSHARE_INSTDIR="." -c -o xml.o xml.cgcc -g -O0 -Wall -DSHARE_INSTDIR="." -c -o jedec.o jedec.cgcc -g -O0 -Wall -DSHARE_INSTDIR="." -c -o ihex.o ihex.cgcc -g -O0 -Wall -DSHARE_INSTDIR="." -c -o srec.o srec.cgcc -g -O0 -Wall -DSHARE_INSTDIR="." -c -o database.o database.cgcc -g -O0 -Wall -DSHARE_INSTDIR="." -c -o minipro.o minipro.cgcc -g -O0 -Wall -DSHARE_INSTDIR="." -c -o tl866a.o tl866a.cgcc -g -O0 -Wall -DSHARE_INSTDIR="." -c -o tl866iiplus.o tl866iiplus.cgcc -g -O0 -Wall -DSHARE_INSTDIR="." -c -o version.o version.cgcc -g -O0 -Wall -DSHARE_INSTDIR="." -c -o usb_win.o usb_win.cgcc -g -O0 -Wall -DSHARE_INSTDIR="." -c -o main.o main.cgcc xml.o jedec.o ihex.o srec.o database.o minipro.o tl866a.o tl866iiplus.o version.o usb_win.o main.o -lsetupapi -lwinusb -o miniproavrkris if you try this, please let us know how it goes.I hadn't check if 'minipro.exe' actually works (I need to find my TL866II first!)UPDATE: it works:Code:D:\Source\minipro2>minipro -p 2764A@DIP28 -w total.hexFound TL866II+ 04.2.123 (0x27b)VPP=12V, VDD=5.5V, VCC=5V, Pulse=1000usChip ID OK: 0x8908Found Intel hex file.Writing Code... 28.78Sec OKReading Code... 0.19Sec OKVerification OKD:\Source\minipro2>where minipro.exeD:\Source\minipro2\minipro.exe

author: avrkris
author_rank: Newbie
timestamp: February 07, 2021, 05:51:55 am
content: your batch file made the magic:C:\Users\Kris\Documents\MiniPro\minipro>makeminipro.batC:\Users\Kris\Documents\MiniPro\minipro>gcc -g -O0 -Wall -DSHARE_INSTDIR="." -c -o xml.o xml.cC:\Users\Kris\Documents\MiniPro\minipro>gcc -g -O0 -Wall -DSHARE_INSTDIR="." -c -o jedec.o jedec.cC:\Users\Kris\Documents\MiniPro\minipro>gcc -g -O0 -Wall -DSHARE_INSTDIR="." -c -o ihex.o ihex.cC:\Users\Kris\Documents\MiniPro\minipro>gcc -g -O0 -Wall -DSHARE_INSTDIR="." -c -o srec.o srec.cC:\Users\Kris\Documents\MiniPro\minipro>gcc -g -O0 -Wall -DSHARE_INSTDIR="." -c -o database.o database.cC:\Users\Kris\Documents\MiniPro\minipro>gcc -g -O0 -Wall -DSHARE_INSTDIR="." -c -o minipro.o minipro.cC:\Users\Kris\Documents\MiniPro\minipro>gcc -g -O0 -Wall -DSHARE_INSTDIR="." -c -o tl866a.o tl866a.cC:\Users\Kris\Documents\MiniPro\minipro>gcc -g -O0 -Wall -DSHARE_INSTDIR="." -c -o tl866iiplus.o tl866iiplus.cC:\Users\Kris\Documents\MiniPro\minipro>gcc -g -O0 -Wall -DSHARE_INSTDIR="." -c -o version.o version.cC:\Users\Kris\Documents\MiniPro\minipro>gcc -g -O0 -Wall -DSHARE_INSTDIR="." -c -o usb_win.o usb_win.cC:\Users\Kris\Documents\MiniPro\minipro>gcc -g -O0 -Wall -DSHARE_INSTDIR="." -c -o main.o main.cC:\Users\Kris\Documents\MiniPro\minipro>gcc xml.o jedec.o ihex.o srec.o database.o minipro.o tl866a.o tl866iiplus.o version.o usb_win.o main.o -lsetupapi -lwinusb -o miniproC:\Users\Kris\Documents\MiniPro\minipro>minipro.exe --presence_checktl866a: TL866CSSo, yes it works now. Thank you for your help, that was super useful.

author: kripton2035
author_rank: Super Contributor
timestamp: February 07, 2021, 09:20:31 am
content: for the records, I compiled it on my mac and it works finefor now it let me program an eeprom on a graphic card, directly on the board without desoldering it.I also programmed a 16f628 pic but on the zif, it did not let me program it with icsp (or may be my icsp hardware is wrong I must investigate this)

author: brufnus
author_rank: Newbie
timestamp: November 04, 2021, 01:22:06 pm
content: One thing to consider is the the fact that many EPROM burning software tools pretty much resembles programs for flashing a computer BIOS. However, since it's not entirely the same code as, say, Asus or Award BIOS flash utilities, some scanners may get the false impression that this is malware, designed to corrupt the computer BIOS.It's not an ordinary spreadsheet or poker game, but a flashing utility. Thus, the malware/virus scanners could very well be more harsh in their opinion about this program. So yes, it might very well be a false positive.

author: amyk
author_rank: Super Contributor
timestamp: November 05, 2021, 01:49:11 am
content: IMHO all the "heuristic" stuff is just a way to hide the fact that the AV companies are in bed with the big corps to make it harder for smaller independent software developers.As someone who does RE, if you link me a download I can analyse it and give an honest opinion. But given whoever wrote the open source software probably did so already, I doubt I'd find anything they miss...