CH341A programmer

Reads and writes SPI flash chips over USB. With a clip, dumps a whole firmware image.

CORE KIT 3–6€ Flash & chips

What it does

The CH341A is an inexpensive USB programmer that reads and writes SPI NOR flash and 24-series EEPROM chips (it can also act as a USB-serial bridge). Clipped onto the flash chip that holds a device's firmware, it copies the whole image to your machine, no shell and no network access required - the fastest path from a sealed device to firmware on disk.

Use cases

Recover a lost admin password

Dump the flash, carve the filesystem with binwalk, and grep the config for credentials left in plaintext.

Back up before you brick

Read the original image and keep it. If a custom firmware flash goes wrong, write the backup back and the device lives again.

Patch and reflash

Modify the dumped image (flip a jump, disable a signature check, change a URL) and write it back to the chip.

How you use it

Pair it with a SOIC-8 clip and drive it with flashrom:

flashrom -p ch341a_spi                             # identify the chip
flashrom -p ch341a_spi -r dump.bin                 # read the flash to a file
flashrom -p ch341a_spi -r dump2.bin                # read again, then compare
sha256sum dump.bin dump2.bin                       # hashes must match
flashrom -p ch341a_spi:spispeed=128k -r dump.bin   # slower clock if unstable

SOIC-8 pinout

Blue = the six lines you wire for a flash dump. Pin 1 (dot) is /CS; the clip's red wire goes there. /WP and /HOLD stay unconnected.

Variants & pitfalls

The 5V trap. Most common black CH341A boards drive the SPI lines at 5V, which can stress or kill a 3.3V flash chip. Prefer a 3.3V-modified board or add a level shifter before reading modern parts.

In-circuit fights. If reads are inconsistent, the host SoC may be contending for the bus. Hold it in reset, or desolder the chip and read it in a socket.