WOW, this takes me back to when I was a programmer. We needed to modify a piece of test equipment that was bought from a company to expand it's capability to include more equipment testing. They refused to hand us the raw code and stated they would reprogram it for $1 million dollars. So two of us took the EPROM(S) out and read them. Not knowing where the program started or stopped addressing wise, we basically had to search the code to see what they did. It took a few weeks, but we broke the code and added our additional code and WALA, we saved so much money and knew exactly how they coded it...and was able to make it do whatever we wanted with it. Thumbs Up!
Yes, if you like this stuff check out the ultrasound scanner I looked at and bypassed the engineer code and unlocked a ton of extra features, or the video called no password no problem where I fixed a solar inverter and they wouldn't give me a service code, I found some interesting stuff in there 😂😂😂👍
i work in infosec and do hw reverse engineering and i'm so excited when there's like a "crossover" and a wide audience gets to experience this sort of thing & i've been loving that they're just tossed in with regular repair videos, because they are regular repairs!
Certainly will be easy money... and they probably don't even need to do any soldering as it looks like the data lines for the memory chip actually run to that header. They probably have a device that plugs right in and wipes it so no expertise beyond opening the case and plugging something in would be required.
Reminds me of when Gateway wanted $$$ to reset the "forgotten" BIOS password on my laptop. I hadn't actually forgotten it; it was "". That is, it was 0 characters long, as I changed it to that when trying to remove it. But the BIOS doesn't let you continue without typing at least one character, so it was impossible to enter. I ended up finding the backdoor password generator instead. Screw you and your convenient bugs, Gateway!
I knew immediately when I saw the computer screen and the programmer hooked up I was in trouble... You definitely have some exceptional skills sir. Appreciate these diagnose and repair videos, shows me just how much determination it takes to get the job done. Enjoy!
Thanks 👍I've done quite a few things like this, such as the solar inverter where I needed the service password or the AVerMedia capture card where I had to rebuild the firmware or the medical ultrasound where I unlocked a ton of hidden features and made it run Doom. Check them out if you haven't already seen them 👍
Outstanding work sir, well done. Note to self, never buy a 2nd hand car off this man. No matter how much he swears that the milage is genuine, there's just no way a 1998 Toyota Corolla, with that much wear and tear, can have only 1,234 miles on it. NO WAY, but it does seem like such a good deal though...🤣🤣🤣🤣
Clever! I sold Winco Generators until I retired. The Deep Sea controllers were very reliable, and fortunately came without a pass code! Now I see the "trick" to making a low hour unit, like new!
My landlord bought a 6 KW turbine, it's windy here so it generates about £5000 a year For an install price of £30000 it paid for itself in six years. That's better than the interest rate of the banks! FYI, you cannot get a bank loan for any turbine that has a gearbox.
My goto approach for these type of things is to use a logic analyzer. Watch the thing live when entering a code. While it could be loaded on bootup, just knowing what addresses the uC accesses allows you to narrow down faster. Same approach I used with a debugger for software key bypasses. You've got great patience to keep pulling/resoldering but I'd be slightly worried about stressing the PCB. I'm sure it's fine, but passively watching the memory reads is just easier! Nice work!
Sorry, just seeing your other comments now about the log file writing getting in the way of monitoring. Watching for READS from the chip could allow you to separate those log file writes from configuration reads. My preference is to collect all the accesses from startup to pin code entry, and then sort through the data. I use python pandas to read the csv's.
Thanks 👍Great minds think alike! I had thought of that approach too, but when I scoped the i2c pins of the eeprom there constantly data access before even pressing anything. I think this was the MCU writing log files continuously because of the sensors being disconnected, and possibly writes to the display which seem to be on the same bus.
I knew immediately upon seeing the comparison that it was D0 07, as those were the four digits that ended up being 00 00 in the nopw file :D excellent video, thank you for helping me learn
Same! As soon as I saw the 00 00 on the no-PIN side and D0 07 on the original, I guessed that that was where the Hex interpretation of the PIN was. Great video showing how to explore basic microcode data storage mechanisms!
Lovely! I have worked on Caterpillar generator sets with DSE controls on them. They were quite a bit ahead of their time when new. You can even build custom logic to add to the basic functionality and pass logic variables between two DSE controllers. The model we had was equipped with mains and generator synchronization. I worked on a project in Nigeria with two of these connected common bus with the DSE communication bus in place for allowing for them to be used as a two-unit plant. Seeing this brings back memories from my 4.5 months in Nigeria offshore working with some very good people from around the world. Glad you were able to save this one!
I'm always surprised by the fact that so many commercial/industrial electronics don't use a checksum. I sometimes do even for hobby projects. Great video!
@@pseudomemes5267 yeah, but if I’m not willing to implement a simple checksum, am I willing to spend the time and effort to build a robust system? Hmm…
In my experience checksum all only required on data that doesn't change (such as calibration data) that would be detrimental if it did therefore you need to be able to detect memory failures. Number of Hours run changes quite frequent and isn't life and death so why bother? Remember, the more tests you have the more chance something going wrong - KIFS.
13:42 easiest approach would be: - blanking - running once to set the configuration data - A. setting up known pin - reading flash - B. setting up known pin - reading flash. Then, after comparing differences between A and B would give you only changes in supposed checksum and pin itself.
Yes, setting I had thought of that but setting up a known pin required hardware that I didn't have, also sometimes blanking an eeprom doesn't always leave a device in a usable state. This was the case with the tractor dashboard I helped someone repair by dumping the eeprom from mine so they had some default values. The video is on here too👍
I have been repairing this kind of stuff for 40+ years. I really like your approach and I’ve learned a lot from you. I have a success rate around 80%+ for electronic repairs. I’m sure yours is even better, but it would be interesting to see a video of something that you ultimately couldn’t fix. Sometimes we learn more from our failures than from our successes. Thanks
Thanks 🙂Check out the circuit vinyl plotter or the Dyson fan or circular saw. Although I did manage to fix two of those items once I was sent parts from a donor unit 👍
I had to do something similar on my Chevy Avalanche gauge cluster when the memory got corrupted from rapidly power cycling the key while troubleshooting the fuel system. Used gauge clusters were $$$ and the now permanent error message tweaked my OCD. I didn't want to be soldering/desoldering the chip a million times so I soldered a 8-pin DIP socket on the board so I could directly plug the zif socket adapter from the MiniPro straight onto the dash for testing. The data was obfuscated and stored in several different places in memory. I didn't take the time to reverse engineer the obfuscation method, I simply played around with the data until the mileage was correct. I wasn't sure what the exact mileage was so I just rounded up to 150,000 so I knew I wasn't putting less on it than it had. It was a great bit of fun!
Nice, I also did something similar with a tractor dashboard a few video's back.The video is called "helping someone 10,323 miles away" as it was someone that needed a dump from my tractor dashboard who lived in Australia as he had a unit that wouldn't power up due to a corrupt EEProm. I managed to find the mileage in that, and it was stored as binary coded decimal.
It's always nice to make the numbers match what you expect. It gives that nice warm glowing feeling knowing that you worked it out. Your soldering skills (sodering for the Americans watching) are top notch, If that was me the PCB would be destroyed after 3 or 4 removals (I must do some more practice)
Good video, thanks! I think you mentioned it briefly but if you are going to be pulling the EEPROM off the board repeatedly it's worth soldering a switch to the processor's reset line and some flying leads to the programmer. USually only need GND, SCL and SDA. Processor in reset typically puts all its pins in a high impedance state, allowing you to read/write the EEPROM from the programmer
Thanks, yes I had considered it but I'm pretty used to taking chips off and on now. I've not had much success in the past with EEPROMS in circuit, but thank you for the suggestion 👍
Back in the day i worked in a factory making fire alarms and there was a certain range of panels you could change the engineer code, and if you forgot it you had to send it back to us. We would then take out the eprom and read the data then using a chart we would look at a certain part of the code which was in hex then convert it to decimal to get the code.
You really do know your stuff! I’ve commented before that swapping components is easy for me , but when it comes to programming chips and decoding them , that’s a whole different level of cool! Well done 👍
At 15:18 thank you for showing the 'Programmer' option on the calculator. You've no idea how many times I've used a website converter (because I'm lazy) to convert Hex to Dec. Now I have it on my calculator. And I'm an advanced computer/server tech, but never realised it was that simple! I feel like an idiot right now.
You've got a lot more patience than I would have taking that chip on and off so many times, not to mention potential PCB damage. I noticed what looks like two serial resistors on the data line between the CPU and the EEPROM, these are usually fitted so you can back drive the EEPROM when the CPU is off, I would suspect that the EEPROM can be programmed in-situ via the header just below it.
Yes, I noticed them too when I was editing the video, but sometimes it's a lot easier to spot things when watching the video back than when you are actually working on something. The header is for the display, but it seems the i2c lines go there to drive the display too.
I have an embedded controller from a correctional facility door control panel that one of the techs bricked the IP address. Hoping the flash memory chip I spotted on the board holds the IP address.... Great video. Makes me want to give it a try.
Thanks 👍Worth a try, what's the worst that can happen it's bricked anyway? Alternatively if that didn't work and you have another unit you could always read that chip from that one and use the data to re-program the other one.
In a way, it goes to show people that their data really isn't as secure as they think, although, you do have to have some knowledge in doing what you do. I don't have a chip reader, but if I did, the chip would have probably started playing a tune by time I got done with it. It's been a long time since I played with HEX or Binary codes. Once again, you never disappoint in your videos.
Great sleuthing! What always amazes me is how much heat (and thermal cycles) those SMD chips can take! I'd be worried about destroying it after only one or two removals.
On a AUTEL IM608 key programmer, we read an eeprom and dump the file on the Immo side of the machine, the pin code comes up on the bottom corner. Makes key programming easy with the pincode👌
Nicely done! Given how generator runtime statistics are saved to EEPROM, I wonder how frequently it does so, given EEPROM's limited write cycle endurance. Then again, with a typical rating of at least a million write cycles, it's probably plenty enough to last the lifetime of the generator it's controlling.
Hi, good video! I thought that device looked familiar, I used to take care of many large generator dry land sets and some of them had that control panel.
amazing. I wouldn't have thought it was possible until you did it. I learnt a lot. potentially using the number guessing algorithm sometimes taught in programming 101 classes might have been quicker. blank the top half of the area, if the pin is still set, it's in the bottom half, repeat with blanking half of the bottom half, repeat, repeat, my names on my feet, I'm pete, pete repeat,.
Thanks 👍Yes that approach may have been quicker! It looked like the config data started at 0350 in the EEPROM so blanking the top half, and then the bottom half of that block might have narrowed it down quicker.
First thing I noticed was that the serial data pins from that EEPROM continue on to that debugging header. Companies doing this commercially would likely be using that header. With series resistors between the EEPROM and the processor, you could probably edit the EEPROM live.
Yes, I noticed the i2c pins went to that header too when I was editing. However that isn't a debug header. There is an unpopulated debug header elsewhere. The white header is where the display fits, so I guess that the display is using i2c also.
I would really really love you to take apart a washing machine rom and inspect those. You are bloody brilliant at this. We just had to go out and spend 1300 on a new appliance because our old one is draining to much energy. We do suffer alot of power outages, I believe the programmer is up the spout. This is not the only machine that failed on us in the last 6 years. So i would like to inspect the rom files.
Interesting, a lot of stuff doesn't have an external eeprom. Even this device has a microcontroller with memory that stores the actual program and other data.
Brownout (dips in the supply rather than no supply) cause a lot of damage to component chips. Probably worth you buying a small ups for your machine. That said I found the reason we had massive power usage and my pc's kept dying was poor house wiring, the breakers and cables were all 1950's and random, turned out that 3 electrical outlets had the live wire touching the case, we had a 120v earth/ground. Once I replaced the sockets the power drain stopped, I stopped getting shocks off the switch screws and I narrowed down one safe circuit I could connect my pc to. I went through so many ups devices because none of them expected a live ground cable. Or for the entire house to be run through a single breaker 🤦 lights and sockets both.
We have moved the washing machine to another power line. We are seeing max 2 amp draw on this line. Not the 9 amp or more. When money permit I will have to take down the ceiling to see where the wires are going@@luminousfractal420
That was quite interesting! I also love some messing arround with raw bytes. I already changed the name and number of a product by overwriting the bytes associated with it. Interesting and i love messing with bytes in a eeprom or flash
Thanks 👍Yes you and me both. I used the same programmer with the Stihl headset I just repaired, and with the Tractor dashboard I looked at (helping someone 10,323 miles away). If you like this type of stuff also check out the video I did called "no password no problem" 😉
I have an old 286 PC with no manual available. Same method here with EPROM .. hardcoded HDD types (cylinders/heads/sectors). Took a lot of work but reverse engineered it!
Hi hope you doing well and thank you for another great video that flabbergasted me from normal electronic repair, programming, binary and converting to hexadecimal and be able to change values, you are just a genius man there is nothing else to it. 😅🥶
Thanks 👍The same thing happened when I looked at a medical ultrasound scanner, I ended up unlocking a ton of stuff and running doom on it. (video is on here too) and similar to the "No password, no problem" solar inverter video too where I found tons of hidden stuff 😉
I wondered why you kept pulling the chip rather than use a chip-clip. :) While working on a rooted firmware on my buddy's Dell I had to buy a second chip-clip as the one that came with the kit simply would not work. Otherwise, no problem reading and writing the chip in circuit on the Dell (YMMV). Nice soldering and troubleshooting skills you have there too!
This was a great video and loved how you went above and beyond to determine what each data entry corresponded to. My questions is how did you determine that was the chip to pull and read? Were there other suspects on yor radar or is there something to gleen from this video as to why you chose that chip over the many others on that board. Thanks
Thanks 👍The pin code has to be stored in memory somewhere, so either a battery backed up ram chip, an eeprom or the internal flash or eeprom of the microcontroller. Most of the chips on the board were either op amps for sensors, or interface ICs for external communication, so I started examining the board for memory type chips.
Great video - as always. Two more comments from me: The SOIC clip is a bit risky because parts or the whole circuit containing the serial EPROM is powered by the programmer during read/write which could lead to overload. But I think you have this in mind. Another option would be to use a logic analyzer (Salea cheap ones) to record the I2C bus for reengineering.
Thanks 👍Yes that was my thoughts, so it was easier to just remove the chip. I've tried programming them in circuit before (I think it was a Landrover ECU that needed the immobiliser removed) and just ended up removing the chip as I couldn't get it to program in circuit. I had thought about using my LA. I've got one and used it when I was reverse engineering the Milwaukee battery protocol over on Reddit about 9 months ago. I had been thinking about waiting to enter the pin and seeing what addresses it read from the EEProm but because it seemed it was constantly writing logs because of the missing sensors I didn't bother. Thanks again for commenting 🙂
The danger with using the clip is usually if the MCU powers up and sets the write flag for some reason, which leads you to corrupt data that you need. As long as you have a good dump from the same unit it's not very scary. For some units you can solve it by jumping the reset pin on the MCU so it does not start, also some nice programmers can keep the voltage low enough so the MCU does not start but the EEPROM does.
@@mrfrenzy. You are right. But in this case it is an i2c EEPROM and all transfers are handled by the bus protocol. And the write protection (WP, pin7) is tied to ground and not switchable, as you can see at 3:25.
The newer Deep Sea controllers just have a usb port on the back and they make the software available on their website. you can change all the config, hours and totals very easily
If anyone is interested this is pretty much exactly how we OEM engine ecm tuners do our thing, simply put read the eeprom, mess with values on a bench see what changes then create a "map" file for the data, that way we know what bytes to change to change the tuning of the engine in the same vehicle. Gets much trickier with modern vehicles now though, nasty checksums and data signing.
Thanks 👍The values were just converted from hex to decimal with the calculator. I showed the values on the screen. If you open calculator on windows and change it to programmer mode you can select hex and enter one of the hex values and it will show it in decimal.
DSE has quite neat models, some of them can be networked to cluster of generators. You can set what state the unloaded gensets are, are they running or shutdown standby. Once they’re needed, it will use syncroscope to sync phasing and once they overlap, the main contactor will connect the genset to load (grid). They use these in developing coutries where they don’t have large powerplants.
I wonder if you could have used a logic analyzer to see what address it was accessing when you submitted the pin? I suppose it would depend on whether the entire EEPROM was read in on startup and stored in memory, or if it was accessed on demand. Great work anyway.
Nice find, great work! Did you catch that the pinheader just below the ic is connected to the io lines? Bet you could use that instead of desoldering it!
Thanks 👍Yes, it's for the display but I didn't notice it had the i2c lines going to it until I was editing the video. I guess the display panel must be i2c too.
I've installed many deep sea controls over the past few years, funnily enough alot were replacement for Kohler controls with the "eprom write failure fault"
Interesting, I guess they were writing to the EEProm too often causing it to wear out prematurely. They should be an easy fix if they are using an external EEProm like this unit.
I like these videos, did something similar with an old Volvo radio i had found outside that had a pincode on it, found dumps online and i knew the password to the dumps so i could figure out where the password where stored in it
Another (possibly quicker) approach might have been to connect an i2c analyser to the bus and see what went on when the pin was entered. Still, i admire your balls for getting in there with the hot air first 👍
Thanks 👍I had thought of that approach too, and did poke the scope onto the lines to see what if they were accessed when the pin screen came up. The issue was because there was loads of sensors not connected it was constantly activity as I think it was writing to the log files, also I the lines go to the display so there it could have also been updating the display as well.
@@BuyitFixitUnderstandable, but filtering for the I2C address of the EEPROM might have made it easy enough. Would likely require some tinkering with sigrok, though.
Thanks 👍all in all probably around 10 times or so, as about 6 were working out where the pin was, then messing about with the other data, testing, and then putting it back to original without the pin 🙂
Have you ever had a go at a modern car radio/cassette/CD ? Many years ago I was fixing them for a job. The damn things were getting too complicated back then. Be well m8. Thanks for the vid. 😃👍🇦🇺
i have no ideea what is happening there 😁 i do instead watch Louis Rossman videos but only cos i really believe in right to repair,obviously not by me...very enjoyable thump up 👍
I'd say about an hour, I think the total fit / removal count ended up being around 12 or 14 😂😂😂 funny as I used to hate doing SMD work but it's all just practice.
@@BuyitFixit So much dedication, it's inspiring. Fixing technique is a thing but here you come with logical thinking to reverse engineer and hack the code of that bad boy... Simply cleverly brilliant.
That would be a deep sea controller from a ex aggreko machine, all the PIN codes were set as 2000, in the config suite using the p810 connector all the values can be edited.
Something to be aware of with industrial pin codes. Many times they are something that is on the machine so the factory service tech has a hint. Like the zip ( postal ) code of the maker, some combination of the model number.
Amazing absolutely love the detail and fault finding skills! I have a SIP 03937 BATTER BOOSTER RESCUE PAC 3000 that’s giving me some trouble, would love some help if you’d be willing 😅!
So sorry I’ve only just seen you’ve replied! Thanks so much! So it’s not charging right , there is a voltage selector switch, 12/24 and then off. It’s meant to be in the off position to charge but only indicates charging when the switch is in the 12v position?! And the charge state indicator doesn’t work! Not sure if that makes sense, I could send you a video if you had time to look?
Most stuff like this has a serial port for this kind of stuff, I bet there was a header somewhere for serial communion and it has the ability to reset the pin.
Possibly, I've came across quite a few devices over the years that have a serial UART header hidden away inside (the radiosonde rs41 weather balloon one was such device I did a video on) and also the recent AVerMedia video capture device I worked on had one too,
I probably would have blanked it, set a pin, scan and save. Blank it again, set a different pin code, scan and save. Repeat a few times and compare all the saves. I did this with a car stereo a few years ago and the only sections of data that changed were obvious and it allowed me to build a look up table as the code wasn't shown in plan numbers in my case.
You can't set a pin code on the panel via the panel. As I said in the video, you need the software (which I downloaded) but then you need the DSE810 interface and drivers to be able to adjust other settings such as setting the pin code, and changing things like the resistance of the fuel sender unit.
That's what I had initially planned to do, but there is no option to set a pin on the unit itself. You need the software, and interface to do more advanced configurations which also include things like setting the resistance of the fuel sender unit, as well as setting a pin code.
Looked like that pin header was there to access the eeprom. Usually when I add headers like that I add a pin for the reset of the main MCU as well. This allows you to connect a programmer and just hold the reset of main mcu thus disconnecting it from the eeprom. (During reset IO's usually go highZ.) Less soldering...
I did look for a programming port. The pin header is where the display board plugs in, although It does appear that it has the I2C signals going to it too as this is what drives the LCD display.
I'm only half way through the video, but I wouldn't think the hex values in the dump would be the PIN. Perhaps if you found four ascii characters... Update: Nicely done on finding the pin in the dump.
while a little harder to use the SOC clip are usefull. also note the white header had i2c pins and jtag ( including reset ) for cpu so from there you can read the eeprom without the MCU getting in the way.
I did notice the white connector had i2c when I was editing the video. This is actually the connector that the front panel connects to, so the display is probably driven by i2c also.
Like many others I suspect, I saw the 4 digits (5310) scrawled on the back and thought - that's gotta be the PIN. Glad that wasn't it in the end though :)
While I really appreciate how you narrowed it down, the constant resoldering of the chip isn't all that great for the chip itself. You could simply (as you mentioned) attach a clip on the chip or solder the wires necessary for programming it directly, then feed them into the programmer. Apart from that nitpick it was a nice watch :)
Thanks, unfortunately I've not had great success in the past programming chips in circuit, as you say probably not great for the chip but only around 30 secs to remove and about the same to replace.
@@BuyitFixit Yes, in circuit programming can be a bitch. As long as you can get spare EPROMs I don't think it is that big of a deal. It would suck though for the chip to die let's say 3 months after shipping the device out which was why I mentioned it.
Removing chip when you can see that I2C is also going to pin header next to it :) Most likely that is used to program it in factory. Soldering maybe faster if you have programmer that has socket for so-8.
I didn't notice the i2c going to the header until I was editing the video. The header is where the display board connects so I guess it must be also using i2c for the display and buttons.
Those "16 bit" values are probably actually at least 32 bit values, with the high bytes currently set to 00 00 in the following two bytes until/unless the value becomes too large to store in just two bytes.
WOW, this takes me back to when I was a programmer. We needed to modify a piece of test equipment that was bought from a company to expand it's capability to include more equipment testing. They refused to hand us the raw code and stated they would reprogram it for $1 million dollars. So two of us took the EPROM(S) out and read them. Not knowing where the program started or stopped addressing wise, we basically had to search the code to see what they did. It took a few weeks, but we broke the code and added our additional code and WALA, we saved so much money and knew exactly how they coded it...and was able to make it do whatever we wanted with it. Thumbs Up!
It's "voila".
Now a days you'd be arrested for criminal copyright infringement and DMCA violations
World sucks now, too much rules and regs
Yes, if you like this stuff check out the ultrasound scanner I looked at and bypassed the engineer code and unlocked a ton of extra features, or the video called no password no problem where I fixed a solar inverter and they wouldn't give me a service code, I found some interesting stuff in there 😂😂😂👍
It's "wallah".
i work in infosec and do hw reverse engineering and i'm so excited when there's like a "crossover" and a wide audience gets to experience this sort of thing & i've been loving that they're just tossed in with regular repair videos, because they are regular repairs!
😂😂😂👍sounds interesting. I've done a bit myself but just for my own use or because I can 🙂
It must be easy money for the manufacturer to reset the pin but for you it was "Challenge accepted". Very well done.
Thank you 👍yes exactly like the video I did on the passworded solar inverter video 'challenge accepted ' 😂😂😂
It's crazy that they made that entire interface card that amounts to just an eeprom programmer. L
Certainly will be easy money... and they probably don't even need to do any soldering as it looks like the data lines for the memory chip actually run to that header. They probably have a device that plugs right in and wipes it so no expertise beyond opening the case and plugging something in would be required.
I doubt he's doing it for free either.
Reminds me of when Gateway wanted $$$ to reset the "forgotten" BIOS password on my laptop. I hadn't actually forgotten it; it was "". That is, it was 0 characters long, as I changed it to that when trying to remove it. But the BIOS doesn't let you continue without typing at least one character, so it was impossible to enter.
I ended up finding the backdoor password generator instead. Screw you and your convenient bugs, Gateway!
I knew immediately when I saw the computer screen and the programmer hooked up I was in trouble... You definitely have some exceptional skills sir. Appreciate these diagnose and repair videos, shows me just how much determination it takes to get the job done. Enjoy!
Thanks Terry 👍🙂
I didn't think you stood a chance, great work.
And "2000" is such a 1990's password lol
Thanks 👍I've done quite a few things like this, such as the solar inverter where I needed the service password or the AVerMedia capture card where I had to rebuild the firmware or the medical ultrasound where I unlocked a ton of hidden features and made it run Doom. Check them out if you haven't already seen them 👍
Mix equal parts: 1) Detective, 2) Genius, 3) Electronics Expert... This fix was most excellent! Well played, sir! 👍
Many thanks!
Outstanding work sir, well done.
Note to self, never buy a 2nd hand car off this man. No matter how much he swears that the milage is genuine, there's just no way a 1998 Toyota Corolla, with that much wear and tear, can have only 1,234 miles on it. NO WAY, but it does seem like such a good deal though...🤣🤣🤣🤣
1234 miles 😯it only has 1003! 😂😂😂
@@BuyitFixit 🤣🤣🤣🤣
U mean 8008
Clever! I sold Winco Generators until I retired. The Deep Sea controllers were very reliable, and fortunately came without a pass code! Now I see the "trick" to making a low hour unit, like new!
Thanks 👍
My landlord bought a 6 KW turbine, it's windy here so it generates about £5000 a year For an install price of £30000 it paid for itself in six years. That's better than the interest rate of the banks!
FYI, you cannot get a bank loan for any turbine that has a gearbox.
My goto approach for these type of things is to use a logic analyzer. Watch the thing live when entering a code. While it could be loaded on bootup, just knowing what addresses the uC accesses allows you to narrow down faster. Same approach I used with a debugger for software key bypasses. You've got great patience to keep pulling/resoldering but I'd be slightly worried about stressing the PCB. I'm sure it's fine, but passively watching the memory reads is just easier! Nice work!
Sorry, just seeing your other comments now about the log file writing getting in the way of monitoring. Watching for READS from the chip could allow you to separate those log file writes from configuration reads. My preference is to collect all the accesses from startup to pin code entry, and then sort through the data. I use python pandas to read the csv's.
Thanks 👍Great minds think alike! I had thought of that approach too, but when I scoped the i2c pins of the eeprom there constantly data access before even pressing anything. I think this was the MCU writing log files continuously because of the sensors being disconnected, and possibly writes to the display which seem to be on the same bus.
I knew immediately upon seeing the comparison that it was D0 07, as those were the four digits that ended up being 00 00 in the nopw file :D excellent video, thank you for helping me learn
Thanks 👍and thanks for your input 🙂
Same! As soon as I saw the 00 00 on the no-PIN side and D0 07 on the original, I guessed that that was where the Hex interpretation of the PIN was.
Great video showing how to explore basic microcode data storage mechanisms!
Lovely! I have worked on Caterpillar generator sets with DSE controls on them. They were quite a bit ahead of their time when new. You can even build custom logic to add to the basic functionality and pass logic variables between two DSE controllers. The model we had was equipped with mains and generator synchronization. I worked on a project in Nigeria with two of these connected common bus with the DSE communication bus in place for allowing for them to be used as a two-unit plant. Seeing this brings back memories from my 4.5 months in Nigeria offshore working with some very good people from around the world. Glad you were able to save this one!
Thank you kindly, and thanks for sharing your interesting story from Nigeria!
@@BuyitFixit You're welcome, and thanks for sharing your repairs via your videos!
I'm always surprised by the fact that so many commercial/industrial electronics don't use a checksum. I sometimes do even for hobby projects. Great video!
Thanks 👍
You'd hope they're backing up that lack of check summing with robust error handling
@@pseudomemes5267 yeah, but if I’m not willing to implement a simple checksum, am I willing to spend the time and effort to build a robust system? Hmm…
the "return for service" impulse is very strong, companies learn a lot about how their devices are used in the process
In my experience checksum all only required on data that doesn't change (such as calibration data) that would be detrimental if it did therefore you need to be able to detect memory failures.
Number of Hours run changes quite frequent and isn't life and death so why bother?
Remember, the more tests you have the more chance something going wrong - KIFS.
13:42 easiest approach would be:
- blanking
- running once to set the configuration data
- A. setting up known pin
- reading flash
- B. setting up known pin
- reading flash.
Then, after comparing differences between A and B would give you only changes in supposed checksum and pin itself.
Yes, setting I had thought of that but setting up a known pin required hardware that I didn't have, also sometimes blanking an eeprom doesn't always leave a device in a usable state. This was the case with the tractor dashboard I helped someone repair by dumping the eeprom from mine so they had some default values. The video is on here too👍
I have been repairing this kind of stuff for 40+ years. I really like your approach and I’ve learned a lot from you. I have a success rate around 80%+ for electronic repairs. I’m sure yours is even better, but it would be interesting to see a video of something that you ultimately couldn’t fix. Sometimes we learn more from our failures than from our successes. Thanks
Thanks 🙂Check out the circuit vinyl plotter or the Dyson fan or circular saw. Although I did manage to fix two of those items once I was sent parts from a donor unit 👍
I had to do something similar on my Chevy Avalanche gauge cluster when the memory got corrupted from rapidly power cycling the key while troubleshooting the fuel system. Used gauge clusters were $$$ and the now permanent error message tweaked my OCD. I didn't want to be soldering/desoldering the chip a million times so I soldered a 8-pin DIP socket on the board so I could directly plug the zif socket adapter from the MiniPro straight onto the dash for testing. The data was obfuscated and stored in several different places in memory. I didn't take the time to reverse engineer the obfuscation method, I simply played around with the data until the mileage was correct. I wasn't sure what the exact mileage was so I just rounded up to 150,000 so I knew I wasn't putting less on it than it had. It was a great bit of fun!
Nice, I also did something similar with a tractor dashboard a few video's back.The video is called "helping someone 10,323 miles away" as it was someone that needed a dump from my tractor dashboard who lived in Australia as he had a unit that wouldn't power up due to a corrupt EEProm. I managed to find the mileage in that, and it was stored as binary coded decimal.
It's always nice to make the numbers match what you expect. It gives that nice warm glowing feeling knowing that you worked it out. Your soldering skills (sodering for the Americans watching) are top notch, If that was me the PCB would be destroyed after 3 or 4 removals (I must do some more practice)
Thank you 👍🙂
Good video, thanks! I think you mentioned it briefly but if you are going to be pulling the EEPROM off the board repeatedly it's worth soldering a switch to the processor's reset line and some flying leads to the programmer. USually only need GND, SCL and SDA. Processor in reset typically puts all its pins in a high impedance state, allowing you to read/write the EEPROM from the programmer
Thanks, yes I had considered it but I'm pretty used to taking chips off and on now. I've not had much success in the past with EEPROMS in circuit, but thank you for the suggestion 👍
Or replace the chip with a socket.
Back in the day i worked in a factory making fire alarms and there was a certain range of panels you could change the engineer code, and if you forgot it you had to send it back to us. We would then take out the eprom and read the data then using a chart we would look at a certain part of the code which was in hex then convert it to decimal to get the code.
Nice 👍
I think this is your best video, especially because you tried it for 30 times.
Thanks 👍🙂
You really do know your stuff! I’ve commented before that swapping components is easy for me , but when it comes to programming chips and decoding them , that’s a whole different level of cool! Well done 👍
Thanks 🙂👍
Blown away, that's repair on another level. I'm guessing this is similar tech knowhow to car clocking. Great video, thank you.
Thanks, yes exactly. Check out the video I did on the tractor it was called helping someone 10323 miles away, it is very similar 👍
I wish you were my next door neighbour and I would never have a problem again 👍🏼👍🏼👍🏼😎
My neighbours think so too 😂😂😂👍
Very good work. This feels very similar to reverse engineering my CAN bus on my car. Hunting for data in the seemingly random raw output.
Thanks 👍Yes I've messed around with CAN bus stuff ages ago when messing with an old VW dashboard.
Once again I am just astounded at your sleuthing skills - the Sherlock Holmes of electronics you are 😂
Excellent work as always!
Cheers David 👍
At 15:18 thank you for showing the 'Programmer' option on the calculator. You've no idea how many times I've used a website converter (because I'm lazy) to convert Hex to Dec. Now I have it on my calculator. And I'm an advanced computer/server tech, but never realised it was that simple! I feel like an idiot right now.
Great video too, thanks for continuing to share :-)
You're very welcome 👍
Everyday is a school day 👍I'm glad you got something useful from it 🙂
Fascinating video! More of these chip analysis videos if possible.
Thanks, will do!
That was thoroughly enjoyable to watch mate! It's always satisfying working out little company secrets like this!
Thank you 👍🙂
You are such a clever fella! Another great vid.
Thank you 👍
You've got a lot more patience than I would have taking that chip on and off so many times, not to mention potential PCB damage.
I noticed what looks like two serial resistors on the data line between the CPU and the EEPROM, these are usually fitted so you can back drive the EEPROM when the CPU is off, I would suspect that the EEPROM can be programmed in-situ via the header just below it.
Yes, I noticed them too when I was editing the video, but sometimes it's a lot easier to spot things when watching the video back than when you are actually working on something. The header is for the display, but it seems the i2c lines go there to drive the display too.
I have an embedded controller from a correctional facility door control panel that one of the techs bricked the IP address. Hoping the flash memory chip I spotted on the board holds the IP address.... Great video. Makes me want to give it a try.
Thanks 👍Worth a try, what's the worst that can happen it's bricked anyway? Alternatively if that didn't work and you have another unit you could always read that chip from that one and use the data to re-program the other one.
In a way, it goes to show people that their data really isn't as secure as they think, although, you do have to have some knowledge in doing what you do. I don't have a chip reader, but if I did, the chip would have probably started playing a tune by time I got done with it. It's been a long time since I played with HEX or Binary codes. Once again, you never disappoint in your videos.
Thanks Ron 👍
Great sleuthing! What always amazes me is how much heat (and thermal cycles) those SMD chips can take! I'd be worried about destroying it after only one or two removals.
Thanks 👍I don't think I've managed to kill a chip yet due to removing / refitting.
I'd be worried about how many pins are left after a few cycles 😂
On a AUTEL IM608 key programmer, we read an eeprom and dump the file on the Immo side of the machine, the pin code comes up on the bottom corner. Makes key programming easy with the pincode👌
Nice 👍
Now then Bonny Lad, I thouraley enjoy your videos, understand some of it but love the way you work around to find a solution, Thank you.
Thanks 👍
You analytical skills are exceptional.
Thanks Brian 👍
Absolutely technical artist at work. This was a fantastic marvel and reminds me of develing into code years ago.. thanks so much for sharing....
Thank you 👍
Nicely done! Given how generator runtime statistics are saved to EEPROM, I wonder how frequently it does so, given EEPROM's limited write cycle endurance. Then again, with a typical rating of at least a million write cycles, it's probably plenty enough to last the lifetime of the generator it's controlling.
Thanks 👍I'm not too sure, I think we worked out that the tractor dashboard I looked at updated once every 10 seconds, but don't quote me on that!
Hi, good video! I thought that device looked familiar, I used to take care of many large generator dry land sets and some of them had that control panel.
Thanks 👍and also thanks for the info 🙂
amazing. I wouldn't have thought it was possible until you did it. I learnt a lot. potentially using the number guessing algorithm sometimes taught in programming 101 classes might have been quicker. blank the top half of the area, if the pin is still set, it's in the bottom half, repeat with blanking half of the bottom half, repeat, repeat, my names on my feet, I'm pete, pete repeat,.
Thanks 👍Yes that approach may have been quicker! It looked like the config data started at 0350 in the EEPROM so blanking the top half, and then the bottom half of that block might have narrowed it down quicker.
First thing I noticed was that the serial data pins from that EEPROM continue on to that debugging header. Companies doing this commercially would likely be using that header. With series resistors between the EEPROM and the processor, you could probably edit the EEPROM live.
Yes, I noticed the i2c pins went to that header too when I was editing. However that isn't a debug header. There is an unpopulated debug header elsewhere. The white header is where the display fits, so I guess that the display is using i2c also.
Nice bit of forensic electronics.
Thank you 👍
I would really really love you to take apart a washing machine rom and inspect those. You are bloody brilliant at this. We just had to go out and spend 1300 on a new appliance because our old one is draining to much energy. We do suffer alot of power outages, I believe the programmer is up the spout. This is not the only machine that failed on us in the last 6 years. So i would like to inspect the rom files.
Interesting, a lot of stuff doesn't have an external eeprom. Even this device has a microcontroller with memory that stores the actual program and other data.
For washing machine controllers it is not uncommon to have a masked rom
ohhhh hoooo. Would this cause programmers to cause issues. If yes, what issues could we expect.?@@diemaschinedieviereckigeei2941
Brownout (dips in the supply rather than no supply) cause a lot of damage to component chips. Probably worth you buying a small ups for your machine.
That said I found the reason we had massive power usage and my pc's kept dying was poor house wiring, the breakers and cables were all 1950's and random, turned out that 3 electrical outlets had the live wire touching the case, we had a 120v earth/ground.
Once I replaced the sockets the power drain stopped, I stopped getting shocks off the switch screws and I narrowed down one safe circuit I could connect my pc to.
I went through so many ups devices because none of them expected a live ground cable.
Or for the entire house to be run through a single breaker 🤦 lights and sockets both.
We have moved the washing machine to another power line. We are seeing max 2 amp draw on this line. Not the 9 amp or more. When money permit I will have to take down the ceiling to see where the wires are going@@luminousfractal420
That was quite interesting! I also love some messing arround with raw bytes. I already changed the name and number of a product by overwriting the bytes associated with it. Interesting and i love messing with bytes in a eeprom or flash
Thanks 👍Yes you and me both. I used the same programmer with the Stihl headset I just repaired, and with the Tractor dashboard I looked at (helping someone 10,323 miles away). If you like this type of stuff also check out the video I did called "no password no problem" 😉
Great work! If only we all had such pals
Thanks 👍🙂
I have an old 286 PC with no manual available. Same method here with EPROM .. hardcoded HDD types (cylinders/heads/sectors). Took a lot of work but reverse engineered it!
Very nice! Thanks for sharing 👍
Great job!
Nice, that there wasn't a crc..
I did similar things with different devices.. 😂 It's always a fun to figure out meaning of stored data.
Thanks 👍yes, I've worked on stuff before where there was a CRC and there are quite a few different methods for calculating them.
Hi hope you doing well and thank you for another great video that flabbergasted me from normal electronic repair, programming, binary and converting to hexadecimal and be able to change values, you are just a genius man there is nothing else to it. 😅🥶
Hi, thank you for your kind comment 👍
well done! It just prooves that going down some rabbit holes is productive.
Thanks 👍Yes indeed 😂😂
Great video, love that you got carried away and started changing other bytes to satisfy the curiosity! :P
Thanks 👍The same thing happened when I looked at a medical ultrasound scanner, I ended up unlocking a ton of stuff and running doom on it. (video is on here too) and similar to the "No password, no problem" solar inverter video too where I found tons of hidden stuff 😉
@@BuyitFixithaha love it, I'll check it out!
beautiful! i just love this kind of detective work.
Thank you very much!
I wondered why you kept pulling the chip rather than use a chip-clip. :)
While working on a rooted firmware on my buddy's Dell I had to buy a second chip-clip as the one that came with the kit simply would not work. Otherwise, no problem reading and writing the chip in circuit on the Dell (YMMV).
Nice soldering and troubleshooting skills you have there too!
Thanks 👍
This was a great video and loved how you went above and beyond to determine what each data entry corresponded to. My questions is how did you determine that was the chip to pull and read? Were there other suspects on yor radar or is there something to gleen from this video as to why you chose that chip over the many others on that board. Thanks
Thanks 👍The pin code has to be stored in memory somewhere, so either a battery backed up ram chip, an eeprom or the internal flash or eeprom of the microcontroller. Most of the chips on the board were either op amps for sensors, or interface ICs for external communication, so I started examining the board for memory type chips.
@@BuyitFixit Ahh ok .. I suppose that makes sense. Thanks for the quick reply and great job
*Really Coo,l* but confusing. lol Seeing you master these chips brings the whole *marvel of knowledge* i sadly missed.
Thanks 👍
Great video - as always. Two more comments from me: The SOIC clip is a bit risky because parts or the whole circuit containing the serial EPROM is powered by the programmer during read/write which could lead to overload. But I think you have this in mind.
Another option would be to use a logic analyzer (Salea cheap ones) to record the I2C bus for reengineering.
Thanks 👍Yes that was my thoughts, so it was easier to just remove the chip. I've tried programming them in circuit before (I think it was a Landrover ECU that needed the immobiliser removed) and just ended up removing the chip as I couldn't get it to program in circuit. I had thought about using my LA. I've got one and used it when I was reverse engineering the Milwaukee battery protocol over on Reddit about 9 months ago. I had been thinking about waiting to enter the pin and seeing what addresses it read from the EEProm but because it seemed it was constantly writing logs because of the missing sensors I didn't bother. Thanks again for commenting 🙂
The danger with using the clip is usually if the MCU powers up and sets the write flag for some reason, which leads you to corrupt data that you need. As long as you have a good dump from the same unit it's not very scary. For some units you can solve it by jumping the reset pin on the MCU so it does not start, also some nice programmers can keep the voltage low enough so the MCU does not start but the EEPROM does.
@@mrfrenzy. You are right. But in this case it is an i2c EEPROM and all transfers are handled by the bus protocol. And the write protection (WP, pin7) is tied to ground and not switchable, as you can see at 3:25.
The newer Deep Sea controllers just have a usb port on the back and they make the software available on their website. you can change all the config, hours and totals very easily
Nice 👍I wonder if they require you to send it back still for the pin on newer models?
Yes they do
Your so smart at what you do, I wish I could learn to do what you do, how did you learn to do what you do?
Thanks 👍Mostly just messing about with things, I've done stuff like this for years. I've always been curious how things work.
If anyone is interested this is pretty much exactly how we OEM engine ecm tuners do our thing, simply put read the eeprom, mess with values on a bench see what changes then create a "map" file for the data, that way we know what bytes to change to change the tuning of the engine in the same vehicle. Gets much trickier with modern vehicles now though, nasty checksums and data signing.
This guy didn't share how he figured out the values efficiently.
He definitely skipped a part.
But still good video
Yes signing and CRC's can be tricky. Sometimes it's easier to get rid of the checks in the code 🙂👍
Thanks 👍The values were just converted from hex to decimal with the calculator. I showed the values on the screen. If you open calculator on windows and change it to programmer mode you can select hex and enter one of the hex values and it will show it in decimal.
Nice work Mick, you make it look so easy! suppose it is if you know what your doing.
Thanks 👍 Yes, I'm pretty good at working things out 🙂
@BuyitFixit Looking forward to a catch up with your other content.
What’s that 4 digit number written on the back of the unit in nail polish at the start?
It's the model number 😉
DSE has quite neat models, some of them can be networked to cluster of generators. You can set what state the unloaded gensets are, are they running or shutdown standby. Once they’re needed, it will use syncroscope to sync phasing and once they overlap, the main contactor will connect the genset to load (grid). They use these in developing coutries where they don’t have large powerplants.
Interesting, I'm no expert on generator (or anything for that matter 😂😂) but I do like to figure interesting devices out. Thanks for your insight!
@@BuyitFixit see video ”synchronizing DSE 8660 & 8610”, its shows syncroscope.
@@BuyitFixit they use rs485 and modbus to daisy chain them ruclips.net/video/6zKT1prKi9w/видео.htmlsi=iON9GQQYsVaxas-x
The 5310 is a more basic controller. The 8660 is a mains controller and controls other genes via there own controller like a 8610.
I wonder if you could have used a logic analyzer to see what address it was accessing when you submitted the pin? I suppose it would depend on whether the entire EEPROM was read in on startup and stored in memory, or if it was accessed on demand. Great work anyway.
I had thought of that, but when I used the scope on the SDA it was constantly being accessed due to it writing log files, good thinking though 👍
@@BuyitFixit I see. That would definitely have complicated it.
Nice find, great work!
Did you catch that the pinheader just below the ic is connected to the io lines?
Bet you could use that instead of desoldering it!
Thanks 👍Yes, it's for the display but I didn't notice it had the i2c lines going to it until I was editing the video. I guess the display panel must be i2c too.
I've installed many deep sea controls over the past few years, funnily enough alot were replacement for Kohler controls with the "eprom write failure fault"
Interesting, I guess they were writing to the EEProm too often causing it to wear out prematurely. They should be an easy fix if they are using an external EEProm like this unit.
I like these videos, did something similar with an old Volvo radio i had found outside that had a pincode on it, found dumps online and i knew the password to the dumps so i could figure out where the password where stored in it
Thanks 👍 and nice 🙂
Must admit I really enjoy all your video's. Informative and a nice pleasant manner, thanks
So nice of you 👍 Thanks 🙂
You are becoming a bit of a whiz at this programming lark. Great video as always, very interesting. Thanks for sharing.
Thanks Brian👍, I've done loads of stuff like this in the past, just not on RUclips 🙂
A man of many talents, thanks Mick 😀
Cheers Mike 👍
Well done! I enjoyed watching it, thanks for sharing!
Glad you enjoyed it, Cheers Thrifty 👍
Proper hooked me in this video in to trying to things have not done before
Nice, nothing to loose by trying and you'll gain experience if nothing else 👍
Oh I’ll be buying a reader for sure great content
Thank you 👍
Another (possibly quicker) approach might have been to connect an i2c analyser to the bus and see what went on when the pin was entered. Still, i admire your balls for getting in there with the hot air first 👍
Thanks 👍I had thought of that approach too, and did poke the scope onto the lines to see what if they were accessed when the pin screen came up. The issue was because there was loads of sensors not connected it was constantly activity as I think it was writing to the log files, also I the lines go to the display so there it could have also been updating the display as well.
@@BuyitFixitUnderstandable, but filtering for the I2C address of the EEPROM might have made it easy enough.
Would likely require some tinkering with sigrok, though.
nice work 👍. how many times do you reckon the chip was removed and replaced during this session?? I appreciate your dedication.
Thanks 👍all in all probably around 10 times or so, as about 6 were working out where the pin was, then messing about with the other data, testing, and then putting it back to original without the pin 🙂
As usual unbelievable job, thank you for your videos.
Many thanks!
As always mate, absolutely amazing. Love your videos 👏
Thanks a ton!
Have you ever had a go at a modern car radio/cassette/CD ? Many years ago I was fixing them for a job. The damn things were getting too complicated back then. Be well m8.
Thanks for the vid. 😃👍🇦🇺
Thanks for commenting 👍🙂
@@BuyitFixit😃
i have no ideea what is happening there 😁 i do instead watch Louis Rossman videos but only cos i really believe in right to repair,obviously not by me...very enjoyable thump up 👍
Thanks 👍
How long did it take to blank part after part? That was a painful but brilliant idea + you practice your soldering skills 👌
I'd say about an hour, I think the total fit / removal count ended up being around 12 or 14 😂😂😂 funny as I used to hate doing SMD work but it's all just practice.
@@BuyitFixit So much dedication, it's inspiring. Fixing technique is a thing but here you come with logical thinking to reverse engineer and hack the code of that bad boy... Simply cleverly brilliant.
Once again (you've heard it before) Brilliant!! thanks for posting
Thanks 👍I might have another video similar to this in the next few weeks... 🙂
That would be a deep sea controller from a ex aggreko machine, all the PIN codes were set as 2000, in the config suite using the p810 connector all the values can be edited.
Thanks for the info!
By the looks of it, you had great fun there, mate.😊😊
Yes, thanks👍
Something to be aware of with industrial pin codes. Many times they are something that is on the machine so the factory service tech has a hint. Like the zip ( postal ) code of the maker, some combination of the model number.
Thanks for that 👍
Fascinating they set the password similar to DEIF (deepsea competitor), customer password is 2000, service 2001 and master 2002.
Thanks 👍
DEIF are not as easy to use
Amazing absolutely love the detail and fault finding skills!
I have a SIP 03937 BATTER BOOSTER RESCUE PAC 3000 that’s giving me some trouble, would love some help if you’d be willing 😅!
Thanks 👍What's it doing? or not doing?
So sorry I’ve only just seen you’ve replied! Thanks so much!
So it’s not charging right , there is a voltage selector switch, 12/24 and then off. It’s meant to be in the off position to charge but only indicates charging when the switch is in the 12v position?! And the charge state indicator doesn’t work! Not sure if that makes sense, I could send you a video if you had time to look?
You can drop me an email at the channel's name at out look dot com
Most stuff like this has a serial port for this kind of stuff, I bet there was a header somewhere for serial communion and it has the ability to reset the pin.
Possibly, I've came across quite a few devices over the years that have a serial UART header hidden away inside (the radiosonde rs41 weather balloon one was such device I did a video on) and also the recent AVerMedia video capture device I worked on had one too,
I probably would have blanked it, set a pin, scan and save. Blank it again, set a different pin code, scan and save. Repeat a few times and compare all the saves.
I did this with a car stereo a few years ago and the only sections of data that changed were obvious and it allowed me to build a look up table as the code wasn't shown in plan numbers in my case.
That's exactly, what I wanted to suggest, too, as it would have also highlighted a possible checksum!
As he said in the video, you need a special interface and software to set a pin.
@@mrfrenzy. he also showed that clearing the chip reset everything so you could set the PIN on the unit.
You can't set a pin code on the panel via the panel. As I said in the video, you need the software (which I downloaded) but then you need the DSE810 interface and drivers to be able to adjust other settings such as setting the pin code, and changing things like the resistance of the fuel sender unit.
That's what I had initially planned to do, but there is no option to set a pin on the unit itself. You need the software, and interface to do more advanced configurations which also include things like setting the resistance of the fuel sender unit, as well as setting a pin code.
Your knowledge is so vast love the vids keep up the good work .
Thanks, will do!
Looked like that pin header was there to access the eeprom.
Usually when I add headers like that I add a pin for the reset of the main MCU as well. This allows you to connect a programmer and just hold the reset of main mcu thus disconnecting it from the eeprom. (During reset IO's usually go highZ.) Less soldering...
I did look for a programming port. The pin header is where the display board plugs in, although It does appear that it has the I2C signals going to it too as this is what drives the LCD display.
@@BuyitFixit That's also a classic trick. Since the display header will be there anyways it can serve double duty.
I'm only half way through the video, but I wouldn't think the hex values in the dump would be the PIN. Perhaps if you found four ascii characters... Update: Nicely done on finding the pin in the dump.
Thanks 👍
while a little harder to use the SOC clip are usefull. also note the white header had i2c pins and jtag ( including reset ) for cpu so from there you can read the eeprom without the MCU getting in the way.
I did notice the white connector had i2c when I was editing the video. This is actually the connector that the front panel connects to, so the display is probably driven by i2c also.
Like many others I suspect, I saw the 4 digits (5310) scrawled on the back and thought - that's gotta be the PIN. Glad that wasn't it in the end though :)
Yes, that was the model number DSE5310, although I must admit that I didn't actually try that as a PIN 😂😂😂
As always, excellent job! You 're a genius.
Congrats!
Thank you very much!
did you try the number written on the back 5310
I actually didn't, but that was the model DSE5310
While I really appreciate how you narrowed it down, the constant resoldering of the chip isn't all that great for the chip itself. You could simply (as you mentioned) attach a clip on the chip or solder the wires necessary for programming it directly, then feed them into the programmer.
Apart from that nitpick it was a nice watch :)
Thanks, unfortunately I've not had great success in the past programming chips in circuit, as you say probably not great for the chip but only around 30 secs to remove and about the same to replace.
@@BuyitFixit Yes, in circuit programming can be a bitch. As long as you can get spare EPROMs I don't think it is that big of a deal.
It would suck though for the chip to die let's say 3 months after shipping the device out which was why I mentioned it.
Do they make sockets for these little bios chips? That would make the in and out process a lot simpler.
Yes, I was putting it in a socket in the EEprom programmer. It wasn't actually that much of an issue tbh, but thank you for the suggestion 👍
@@BuyitFixitsurprised the chip can handle being repeatedly heated up
That’s some serious skills right there! 👍
Thank you 👍
Removing chip when you can see that I2C is also going to pin header next to it :)
Most likely that is used to program it in factory.
Soldering maybe faster if you have programmer that has socket for so-8.
I didn't notice the i2c going to the header until I was editing the video. The header is where the display board connects so I guess it must be also using i2c for the display and buttons.
Another really interesting video and very informative, thank you.
Glad you enjoyed it👍
Great video! Tell me why you have read the hex code in reverse. Is it common?
Yes, it's because its stored as a 16 bit (two bytes) or 32bit (4 bytes) and depends on the endianess of the microcontroller.
Good job mate, way above my pay grade but it was still good to learn something new 👍
Thanks mate 👍
For all those test blanks/reads, did you resolder/desolder it in all those times, or did you use a temporary holder on the PCB to plug the EEPROM in?
I just desoldered it, it doesn't take long with the rework station.
Those "16 bit" values are probably actually at least 32 bit values, with the high bytes currently set to 00 00 in the following two bytes until/unless the value becomes too large to store in just two bytes.
Yes, I did think of that when I was editing as the adjacent bytes did seem to be 00 00. Thanks for commenting 👍