RCD310 no eeprom

[alexics]

I have been given one of these to decode but it does not have the 95128 eeprom. So the first thing I have to do is get a replacement eeprom. Then what???? Any ideas?

[fabi]

You need write other eeprom and reapir MCU checksum with Martech RCD PRO.

[alexics]

Or I could just disassemble the processor dump to see what is going on.

[siti]

if you can,read mcu....

[alexics]

The JTAG requires a 10 byte security ID. So....

[laxitylabs]

bullshit. there's no jtag support in this nec.

[siti]

you need martech,orange5 or beeprog



ps.:hmmmm2: have original code?

[alexics]

bullshit. there's no jtag support in this nec.

Strange that. The datasheet says there is. When not in use it is clamped with a resistor block.

[laxitylabs]

go practice, leave theory.

[Totaldecodes]

You are right friend but if he knew practical he could do it,he only knows theory so he guesses
lol he needs electronic skill which he lacks.


go practice, leave theory.

[alexics]

Well Renesas don't know their own processors then.

[alexics]

You are right friend but if he knew practical he could do it,he only knows theory so he guesses
lol he needs electronic skill which he lacks.

Just in case you didn't know those zig-zag lines represent resistors.

[fabi]

Info from Elnec Beeprog programmer:

Device info:

Manufacturer: NEC
Type: uPD70F3358 [LQFP144]
8-bit bytes: 100000h (1*048*576 Bytes)
Organization: 100000hx8 bit
Algorithm name: Specialized
Package Info: LQFP(144)

Supported by programmers and programming adapters/modules:

BeeHive208S with adapter/module:
DIL48/QFP144 ZIF NEC-2 (ord.no. 70-1074)
BeeHive204 with adapter/module:
DIL48/QFP144 ZIF NEC-2 (ord.no. 70-1074)
BeeHive204AP with adapter/module:
AP1 QFP144 ZIF NEC-2 (ord.no. 71-1660)
BeeProg2 with adapter/module:
DIL48/QFP144 ZIF NEC-2 (ord.no. 70-1074)
BeeProg2AP with adapter/module:
AP1 QFP144 ZIF NEC-2 (ord.no. 71-1660)
BeeProg+ with adapter/module:
DIL48/QFP144 ZIF NEC-2 (ord.no. 70-1074)
BeeHive8S (discontinued product) with adapter/module:
DIL48/QFP144 ZIF NEC-2 (ord.no. 70-1074)
BeeHive4+ (discontinued product) with adapter/module:
DIL48/QFP144 ZIF NEC-2 (ord.no. 70-1074)
BeeHive4 (discontinued product) with adapter/module:
DIL48/QFP144 ZIF NEC-2 (ord.no. 70-1074)
BeeProg (discontinued product) with adapter/module:
DIL48/QFP144 ZIF NEC-2 (ord.no. 70-1074)
JetProg (DIL48) (discontinued product) with adapter/module:
DIL48/QFP144 ZIF NEC-2 (ord.no. 70-1074)


General Info:
Due to security reason the NEC don't implement the read ability into this chip, therefore the read operation is not available. The verify operation is done by sending of whole content into the chip, which perform internal comparison and response "OK" or "Error".
Performance of operations is dependent variable of target device clock frequency.

[oemrepair]

Give me a your radio NEC dump and any eeprom dump, you wish. I will repair eeprom dump with mcu data .

[alexics]

Well if you think there aren't any undocumented scan chains in there then that is naivety. Even though NEC will use emulators Blaupunkt still need to check on board functionality and do in-circuit bug testing. Blaupunkt are well known for using 'special' devices that do not have full datasheets. An example is the TMS375 which was subtly different from the TMS370. Although in fact it was similar enough for the expanded mode to still work in the same way as for the TMS370. The datasheet was available if you knew where to look.

[laxitylabs]

go practice, radio waits for repair :)

[branco]

can mod close this thread please?
regards

[Car235]

Why close ?

it would be wonderful someone explain how read MCU and calculate code, then all members will know the big secret.

[alexics]

In the 95128 there are 6 static bytes that do not change. The rest of the checksums are like those in the Ford Visteons. They have a random element. I am looking for a virgin mode for these sets which will allow recoding.

I will be attempting to restore this radios original code if possible.

[oemrepair]

alexics, you have to use your nec dump values for recalculate eeprom values for repair and set any code you want.

[alexics]

I have had to put that one aside for now as I am too busy with other stuff. It will be next week before I can get something sorted.

[alexics]

I am working on conversion tables at the moment. Will report progress.

[alexics]

I have recovered the code 1539 from an RCD510 successfully. No need to read the processor. It appears at first glance that only two digits are recoverable but this isn't the case. I need to make sure it is not just a fluke.

[bonus2010]

Yes..yes, keep us updated :D

[alexics]

I have managed somehow to get a set saying "attempts left 29". When the code was entered wrong, instead of saying "attempts left 28" it said "attempts left 1". I am going to look into the differences between the 29 attempts and the 1 attempt left to see what the significance is.

It is usually by making a system go wrong that you learn interesting things. :-)

[oemrepair]

You will get no fast decoding in seconds (change code) for this radio without nec data. This is medicine fact.

[alexics]

I know the data is locked to the processor but that is not the point of this exercise. The SPI and UART interfaces are the answer to that but I am trying other stuff.

[alexics]

Majority logic is a simple data recovery method but there are other more sophisticated methods. :-)

[alexics]

I now have an RCD510 in a mode where it never comes off the 29 attempts and the timer is never locked, I have no idea if this will produce a valid code but I am going to go through all 9999 combinations because I have to know. :D

[branco]

I now have an RCD510 in a mode where it never comes off the 29 attempts and the timer is never locked, I have no idea if this will produce a valid code but I am going to go through all 9999 combinations because I have to know. :D

corrupted processor
you will never find code
untill repairing nec
regards

[alexics]

For anyone wanting to investigate the programming modes the documentation is here:

http://documentation.renesas.com/doc/products/mpumcu/apn/v850/r01an0930ej0200_v850essx3.pdf

[alexics]

Just fully decoded an RDC510 using only the eeprom data. All the digits are in there. You use 4 bytes from the code and four of the six checksum values.

[alexics]

It'll be a bastard to work out the coding to read it from a dump but that is the next step.

[M1DJF]

you need a radio to play with have you got one.


It'll be a bastard to work out the coding to read it from a dump but that is the next step.