Subaru Clarion CZ341R6 - SECURITY

[VTS_Tibi]

Hi Guys,

I have a Subaru Impreza STI from 2004, for which I've bought a new stereo from Ebay - it came out of a 2007 Impreza STI (the hatchback shaped).

Whne I put the radio into my car it displayed "SECURITY", but if I poushed the ON button again it switched on! It was like this for around two days, with only a few mins of listening to music. Then after around 30mins of total listening time it switched off, and now it's always indicating "SECURITY" and I can not switch it on.

Any clue about this?

This is the radio itself:

http://i1115.photobucket.com/albums/k545/TestorVTS/WP_000214.jpg

The number on the face panel: CZ341R6

The product number on the back label: PF-2952A-A

[M1DJF]

This radio is immo coded you need to up load dump from your radio here so we can help you unmarry this radio from other car so you can replace it in your car.

[VTS_Tibi]

Okies! :) Would I have to read something out from the car too? Or is it sufficient to unmarry the radio, and revert it back to a some kind of virgin state?

[M1DJF]

as far as i know its just the radio but if i am wrong let me know


Okies! :) Would I have to read something out from the car too? Or is it sufficient to unmarry the radio, and revert it back to a some kind of virgin state?

[VTS_Tibi]

What kind of EEPROM is in this radio?

I've only found a K04P02T. How should I read it out?

[tvzmaj]

PHK04P02T - P-channel vertical D-MOS logic level FET Battery powered applications - NXP

[VTS_Tibi]

Here are all the other SOIC8 ICs and the two MCUs found on the board.


http://i1115.photobucket.com/albums/k545/TestorVTS/sszes-1.jpg


SOIC 8s:

1. A2187
18
L7GI

2. 2103
H061G
JRC

3. and 4. BB0PA
2134UA
77840




I'm suspecting it'll be the number 1. M30876FJAGP Renesas MCU, which is the size of a regular Motorola MCU, like a 9S12.

[mobilart]

Read M30876FJAGP

[VTS_Tibi]

Okay... and how? With what kind of tool? :D

[VTS_Tibi]

Bump! Anyone? :(

[VTS_Tibi]

M30876FJAGP Renesas MCU - any idea about how on earth could I read that out?

[mobilart]

Martech, Orange5.... No problem

[VTS_Tibi]

Martech, Orange5.... No problem
Who could possible do this for me? I would love to use this radio but I don't have the tools to do this...

Please help me! :)

[VTS_Tibi]

Who could possible do this for me? I would love to use this radio but I don't have the tools to do this...

Please help me! :)

BUMP! Please help me! :( I found out that the same radio is used in the Nissan Maxima and Versa.

[morfej]

Search for M16C Flash Start User Manual.pdf and Flash Start.exe on the web.

Simple RS232 to TTL interface should do the job according to the User Manuals.

br

[VTS_Tibi]

Search for M16C Flash Start User Manual.pdf and Flash Start.exe on the web.

Simple RS232 to TTL interface should do the job according to the User Manuals.

br

Holy thread resurrection :D After 2 months I have time to work on my own car

I bought an USB to TTL interface. It has 5 connections - 5V, 3.3V, GND, Tx, Rx.

I hooked up these wires to the MCU, according the datasheet (page 15.): http://documentation.renesas.com/doc/products/mpumcu/rej03b0127_32c87ds.pdf


5V - VCC1
3V - VCC2
GND - VSS
Rx - RxD0
Tx - TxD0

Then started the M16C Flash Starter application, select the assigned COM port, but whenever I click "OK" to start communication with the ECU I receive the following message:

"Timout. Push RESET."


According to the M16C Flash Starter guide, this type of MCU needs 10 pins to be connected for the readout, but I only have 5... See page 6 here:

http://documentation.renesas.com/doc/products/tool/rej10j0108_m3a0806um.pdf


Any clue about what should I do next?

[VTS_Tibi]

BUMP! Any clue about this?