I do not know why it take me so long o realize that i can change pins in v2 firmware to make it works on v3 boards. But better later then never, here it is.
Tuesday, 25 August 2015
Wednesday, 5 August 2015
audi chorus - concert: how to recover password
what you need:
motorola cracker :
for serial connection I used cp2102 based adapter from ebay, it has wired RTS signal:
Software part is motorola cracker version 6.x (7 didn't work!!!). It has support for com port from 1 to 4, so change this in advance settings for your usb2UART adapter, then just boot MCU and read eeprom, here is a actual eeprom dump, with code 1790, you can see its on 3 places:
number in eeprom, directly after code (from my observation) can be:
06 - SAFE2 mode, you need to wait 1hour(info from here) to be able to enter pin
08 - SAFE1 mode, you can enter pin code to unlock
A0 - no code required
UPDATE: I have Motorola MCU with fixed volume problem, so I dump eeprom of this MCU as it has fixed problem, it didn't store volume value in eeprom and so this dump is "clean" of garbage. I try to load this dump to one of affected MCU, just to test how long it take to have volume issue back. For now it's looks ok.
EDIT: it didn't fix it radio volume is garbage at low temperatures, of corse. But I have to try :)
any data are on my github including eeprom dumps.
UPDATE: based on this blogpost: http://www.realitytech.co.uk/rich/?p=192
I try it, it's works kind of. communication was really unstable, but it works for reading eeprom directly after booting CPU, or write simple byte of data, in my case It take 3times to boot CPU and each time write simple byte (0xA0) on positions 3,33 and 63, to disable code protection.
!!1important note!!! you must connect only 12V and ground on main connector of radio. In my first attempts I have illumination connected to 12V and this makes pin 22 go Low so my additional pull-up did not work.
here are some pictures:
motorola cracker :
for serial connection I used cp2102 based adapter from ebay, it has wired RTS signal:
Software part is motorola cracker version 6.x (7 didn't work!!!). It has support for com port from 1 to 4, so change this in advance settings for your usb2UART adapter, then just boot MCU and read eeprom, here is a actual eeprom dump, with code 1790, you can see its on 3 places:
number in eeprom, directly after code (from my observation) can be:
06 - SAFE2 mode, you need to wait 1hour(info from here) to be able to enter pin
08 - SAFE1 mode, you can enter pin code to unlock
A0 - no code required
 |
| locked for 1 hour |
 |
| no code required |
 |
| standard SAFE mode |
UPDATE: I have Motorola MCU with fixed volume problem, so I dump eeprom of this MCU as it has fixed problem, it didn't store volume value in eeprom and so this dump is "clean" of garbage. I try to load this dump to one of affected MCU, just to test how long it take to have volume issue back. For now it's looks ok.
EDIT: it didn't fix it radio volume is garbage at low temperatures, of corse. But I have to try :)
any data are on my github including eeprom dumps.
UPDATE: based on this blogpost: http://www.realitytech.co.uk/rich/?p=192
I try it, it's works kind of. communication was really unstable, but it works for reading eeprom directly after booting CPU, or write simple byte of data, in my case It take 3times to boot CPU and each time write simple byte (0xA0) on positions 3,33 and 63, to disable code protection.
!!1important note!!! you must connect only 12V and ground on main connector of radio. In my first attempts I have illumination connected to 12V and this makes pin 22 go Low so my additional pull-up did not work.
here are some pictures:
 |
| RESET LINE (18) |
 |
| RX/TX/+12V/pullups on 22,9,11 |
 |
| only 12V and ground is connected in main connector of radio |
 |
| RX,TX,RTS and ground on UART2USB |
openbox x-810 won't boot
another bad caps story with PSU, this time openbox x-810, won't boot, stoped with double dot ":" on display. Measuring on 3.3V rail showed 2V with load. Changing 1000uf and 470uf caps on this rail fix problem, just to be on safe side, I changed all caps on secondary side of psu.