In an earlier blog entry, a low-cost USB-based EEPROM programmer was examined. It is being used to burn boot ROMs for the 2Wire modems. [1]
USB-based EEPROM programmer for just US$8
The programmer works well but its software is closed-source, only for Microsoft™ Windows®, and Chinese language to boot.
Of all those issues, it is, of course, the requirement for Microsoft® that is the greatest hindrance! 
Well not any more. A Linux tool for reading and writing EEPROMs using the i2c mode of the CH341a has been developed. The tool is based on the popular and portable libUSB programming library.
The CH341a is not well documented. There is a solitary C header file relating to a (closed source) Windows™ DLL (with comments in Chinese), but there is no proper datasheet for the CH341a.
To understand the CH341a means sniffing the USB bus traffic to and from the device. This reveals that the CH341a is using asynchronous transfers in its USB transaction protocol. Something of an overkill for such a simple application.
That asynchronous requirement makes the programming more complicated, since periodic polling and callback functions are needed. It also means that the newer libUSB-1.0 API is required. The earlier and simpler libUSB-0.1 only supports synchronous transactions.
As it stands, the tool meets our current needs: programming and reading the 24c32/24c64 boot ROMs used by the 2Wire modem-routers. However it could be extended to support a wider range of EEPROMs with different addressing modes and page sizes. Please email if you would like to develop this tool.
The GPL’ed source code can be downloaded from SourceForge. [2]
asbokid@u50si1:~/ch341eepromtool_0.5$ cat README
About
=====
Beta libUSB code for EEPROM programmers based on the WinChipHead CH341a IC
Author
======
Written by asbokid and released under the terms of the GNU GPL, version 3, or later.
Copyright Dec 2011, asbokid <ballymunboy@gmail.com>
Licence
=======
This is free software: you can redistribute it and/or modify it under the terms of
the latest GNU General Public License as published by the Free Software Foundation.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY;
without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License along with this program.
If not, see <http://www.gnu.org/licenses/>.
Requires
========
gcc
GNU make
libusb-1.0 and the libusb library development files. See http://libusb.wiki.sourceforge.net/
libusb-1.0-dev (on debian-based distros)
Compiling
=========
gcc -o ch341eeprom ch341eeprom.c ch341funcs.c -lusb-1.0
Running
=======
asbokid@u50si1:$ ./ch341eeprom
ch341eeprom - an i2c EEPROM programming tool for the WCH CH341a IC
Version 0.5 copyright (c) 2011 asbokid <ballymunboy@gmail.com>
This program comes with asbolutely no warranty; This is free software,
and you are welcome to redistribute it under certain conditions:
GNU GPL v3 License: http://www.gnu.org/licenses/gpl.html
Usage:
-h, --help display this text
-v, --verbose verbose output
-d, --debug debug output
-s, --size size of EEPROM {24c32|24c64}
-e, --erase erase EEPROM (fill with 0xff)
-w, --write <filename> write EEPROM with image from filename
-r, --read <filename> read EEPROM and save image to filename
Example: ch341eeprom -v -s 24c64 -w bootrom.bin
asbokid@u50si1:$ sudo ./ch341eeprom -v -s 24c64 -e
Searching USB buses for WCH CH341a i2c EEPROM programmer [1a86:5512]
Found [1a86:5512] as device [7] on USB bus [2]
Opened device [1a86:5512]
Claimed device interface [0]
Device reported its revision [3.03]
Configured USB device
Set i2c bus speed to [100kHz]
Erased [8192] bytes of [24c64] EEPROM
Closed USB device
asbokid@u50si1:$ sudo ./ch341eeprom -v -s 24c64 -r output.bin
Searching USB buses for WCH CH341a i2c EEPROM programmer [1a86:5512]
Found [1a86:5512] as device [7] on USB bus [2]
Opened device [1a86:5512]
Claimed device interface [0]
Device reported its revision [3.03]
Configured USB device
Set i2c bus speed to [100kHz]
Read [8192] bytes from [24c64] EEPROM
Wrote [8192] bytes to file [output.bin]
Closed USB device
asbokid@u50si1:$ xxd -l 128 output.bin
0000000: ffff ffff ffff ffff ffff ffff ffff ffff ................
0000010: ffff ffff ffff ffff ffff ffff ffff ffff ................
0000020: ffff ffff ffff ffff ffff ffff ffff ffff ................
0000030: ffff ffff ffff ffff ffff ffff ffff ffff ................
0000040: ffff ffff ffff ffff ffff ffff ffff ffff ................
0000050: ffff ffff ffff ffff ffff ffff ffff ffff ................
0000060: ffff ffff ffff ffff ffff ffff ffff ffff ................
0000070: ffff ffff ffff ffff ffff ffff ffff ffff ................
asbokid@u50si1:$ ./mktestimg > testimg24c64.bin
asbokid@u50si1:$ xxd -l 128 testimg24c64.bin
0000000: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0000010: 1111 1111 1111 1111 1111 1111 1111 1111 ................
0000020: 2222 2222 2222 2222 2222 2222 2222 2222 """"""""""""""""
0000030: 3333 3333 3333 3333 3333 3333 3333 3333 3333333333333333
0000040: 4444 4444 4444 4444 4444 4444 4444 4444 DDDDDDDDDDDDDDDD
0000050: 5555 5555 5555 5555 5555 5555 5555 5555 UUUUUUUUUUUUUUUU
0000060: 6666 6666 6666 6666 6666 6666 6666 6666 ffffffffffffffff
0000070: 7777 7777 7777 7777 7777 7777 7777 7777 wwwwwwwwwwwwwwww
asbokid@u50si1:$ sudo ./ch341eeprom -v -s 24c64 -w testimg24c64.bin
Searching USB buses for WCH CH341a i2c EEPROM programmer [1a86:5512]
Found [1a86:5512] as device [7] on USB bus [2]
Opened device [1a86:5512]
Claimed device interface [0]
Device reported its revision [3.03]
Configured USB device
Set i2c bus speed to [100kHz]
Read [8192] bytes from file [testimg24c64.bin]
Wrote [8192] bytes to [24c64] EEPROM
Closed USB device
asbokid@u50si1:$ sudo ./ch341eeprom -v -s 24c64 -r output.bin
Searching USB buses for WCH CH341a i2c EEPROM programmer [1a86:5512]
Found [1a86:5512] as device [7] on USB bus [2]
Opened device [1a86:5512]
Claimed device interface [0]
Device reported its revision [3.03]
Configured USB device
Set i2c bus speed to [100kHz]
Read [8192] bytes from [24c64] EEPROM
Wrote [8192] bytes to file [output.bin]
Closed USB device
asbokid@u50si1:$ xxd -l 128 output.bin
0000000: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0000010: 1111 1111 1111 1111 1111 1111 1111 1111 ................
0000020: 2222 2222 2222 2222 2222 2222 2222 2222 """"""""""""""""
0000030: 3333 3333 3333 3333 3333 3333 3333 3333 3333333333333333
0000040: 4444 4444 4444 4444 4444 4444 4444 4444 DDDDDDDDDDDDDDDD
0000050: 5555 5555 5555 5555 5555 5555 5555 5555 UUUUUUUUUUUUUUUU
0000060: 6666 6666 6666 6666 6666 6666 6666 6666 ffffffffffffffff
0000070: 7777 7777 7777 7777 7777 7777 7777 7777 wwwwwwwwwwwwwwww
Concluding Notes
================
The code handles the 3 byte addressing used by EEPROMS of 32kbit and greater (24c32-)
It uses asynchronous USB transfers but should be portable to Microsoft Windows.
All comments and contributions welcomed!
asbokid <ballymunboy@gmail.com> - Dec 2011
[1] http://hackingbtbusinesshub.wordpress.com/2011/11/05/ultra-low-cost-boot-rom-programmer/
For consistency, perhaps the output shown on line 53 (in the ‘-w’ flag example) should appear over two lines, as is the case in the ‘-r’ flag example (lines 65 & 66)?
..Read [xxxx] bytes from file [fname]
..Wrote [xxxx] bytes to EEPROM
..Read [xxxx] bytes from EEPROM
..Wrote [xxxx] bytes to file [fname]
Thanks burakkucat for the suggestions.
The command line interface is now as above. Hopefully an improvement.
An erase function has also been added, and the tool now warns if the image to burn is larger or smaller than the EEPROM, before it performs a padding or truncation.
Since this EEPROM tool does what is needed – it programs/reads 24c32 and 24c64 devices from Linux – it will probably be left at that. Which means this is an open invitation for someone to come forward and reverse engineer the arbitrary control bytes needed to read and write the other types and sizes of 24cxx EEPROMs.
Incidentally, Frank Kingswood, the Linux guru who developed the serial device driver for the CH341a kindly replied to my requests for any further documentation on this IC which he might still have. Sadly, Frank doesn’t have anything beyond what is already known.
Back in 2007, Frank approached Winchiphead requesting documentation from the company, but his queries (which were in Chinese..) went unreplied.
Frank also reported that the CH341a was found to have a major design fault, at least in its serial port implementation, and “loses bytes in hardware”. Luckily, this doesn’t seem to happen with the i2c protocol.
Thank you once again for your interest and for your suggestions, burakkucat.
Cheers, a
can you please tell me were i can download the software for this programmer
Hi Gus,
The (incomplete) Linux tool is here:
https://sourceforge.net/projects/ch341eepromtool/
and the original Chinese language software for Windows is here:
https://docs.google.com/open?id=0B6wW18mYskvBMmIwMGJjOTQtZDMxNS00MzNiLThkYzgtMGE4N2ZiNTEwMGM3
cheers, a