I do not know why it take me so long o realize that i can change pins in v2 firmware to make it works on v3 boards. But better later then never, here it is.
Tuesday, 25 August 2015
Wednesday, 5 August 2015
audi chorus - concert: how to recover password
what you need:
motorola cracker :
for serial connection I used cp2102 based adapter from ebay, it has wired RTS signal:
Software part is motorola cracker version 6.x (7 didn't work!!!). It has support for com port from 1 to 4, so change this in advance settings for your usb2UART adapter, then just boot MCU and read eeprom, here is a actual eeprom dump, with code 1790, you can see its on 3 places:
number in eeprom, directly after code (from my observation) can be:
06 - SAFE2 mode, you need to wait 1hour(info from here) to be able to enter pin
08 - SAFE1 mode, you can enter pin code to unlock
A0 - no code required
UPDATE: I have Motorola MCU with fixed volume problem, so I dump eeprom of this MCU as it has fixed problem, it didn't store volume value in eeprom and so this dump is "clean" of garbage. I try to load this dump to one of affected MCU, just to test how long it take to have volume issue back. For now it's looks ok.
EDIT: it didn't fix it radio volume is garbage at low temperatures, of corse. But I have to try :)
any data are on my github including eeprom dumps.
UPDATE: based on this blogpost: http://www.realitytech.co.uk/rich/?p=192
I try it, it's works kind of. communication was really unstable, but it works for reading eeprom directly after booting CPU, or write simple byte of data, in my case It take 3times to boot CPU and each time write simple byte (0xA0) on positions 3,33 and 63, to disable code protection.
!!1important note!!! you must connect only 12V and ground on main connector of radio. In my first attempts I have illumination connected to 12V and this makes pin 22 go Low so my additional pull-up did not work.
here are some pictures:
motorola cracker :
for serial connection I used cp2102 based adapter from ebay, it has wired RTS signal:
Software part is motorola cracker version 6.x (7 didn't work!!!). It has support for com port from 1 to 4, so change this in advance settings for your usb2UART adapter, then just boot MCU and read eeprom, here is a actual eeprom dump, with code 1790, you can see its on 3 places:
number in eeprom, directly after code (from my observation) can be:
06 - SAFE2 mode, you need to wait 1hour(info from here) to be able to enter pin
08 - SAFE1 mode, you can enter pin code to unlock
A0 - no code required
![]() |
locked for 1 hour |
![]() |
no code required |
![]() |
standard SAFE mode |
UPDATE: I have Motorola MCU with fixed volume problem, so I dump eeprom of this MCU as it has fixed problem, it didn't store volume value in eeprom and so this dump is "clean" of garbage. I try to load this dump to one of affected MCU, just to test how long it take to have volume issue back. For now it's looks ok.
EDIT: it didn't fix it radio volume is garbage at low temperatures, of corse. But I have to try :)
any data are on my github including eeprom dumps.
UPDATE: based on this blogpost: http://www.realitytech.co.uk/rich/?p=192
I try it, it's works kind of. communication was really unstable, but it works for reading eeprom directly after booting CPU, or write simple byte of data, in my case It take 3times to boot CPU and each time write simple byte (0xA0) on positions 3,33 and 63, to disable code protection.
!!1important note!!! you must connect only 12V and ground on main connector of radio. In my first attempts I have illumination connected to 12V and this makes pin 22 go Low so my additional pull-up did not work.
here are some pictures:
![]() |
RESET LINE (18) |
![]() |
RX/TX/+12V/pullups on 22,9,11 |
![]() |
only 12V and ground is connected in main connector of radio |
![]() |
RX,TX,RTS and ground on UART2USB |
openbox x-810 won't boot
another bad caps story with PSU, this time openbox x-810, won't boot, stoped with double dot ":" on display. Measuring on 3.3V rail showed 2V with load. Changing 1000uf and 470uf caps on this rail fix problem, just to be on safe side, I changed all caps on secondary side of psu.
Tuesday, 21 July 2015
audi FIS 3-line protocol update
Thursday, 25 June 2015
S3860M-S breadboard adapter
kicad files
foto:
updated version:
- with reset button and on/off button (MFB)
- 2leds
- option to select between XS3868 and S3860M-S module
- made by dirtyPCB.com
- will be sold on tindie.com after test with 0402 resistors and jack (hard to find this in low quantity)
check my store on tindie:

Wednesday, 24 June 2015
SOYO-BT24G03 kicad lib and module
finaly I have time to make package module for kicad of SOYO bluetooth module SOYO-BT24G03:
lib files:
SOYO-BT24G03.dcm SOYO-BT24G03.lib
and module:
SOYO-BT24G03.kicad_mod
also one new smt jack PJ320B (stereo, 3.5mm) I found in my pile of scrap parts:
3.5mm_stereo_jack_PJ320B.kicad_mod
lib files:
SOYO-BT24G03.dcm SOYO-BT24G03.lib
and module:
SOYO-BT24G03.kicad_mod
also one new smt jack PJ320B (stereo, 3.5mm) I found in my pile of scrap parts:
3.5mm_stereo_jack_PJ320B.kicad_mod
Friday, 12 June 2015
new kicad libraries and modules
on project of bluetooth support for old vw group head units I have to try more bt modules, so I made kicad files needed to make breadbord adapter , SOYO-BT24G03 is in queue also...
MB-CM15113.kicad_mod - old module which has no uart, I made Fritzing file for this module, I try this module one more time
(library files: MB-CM15113.lib, MB-CM15113.dcm)
BLK-MD-SPK-B.kicad_mod - module mentioned on this blog, no call posible with this module or I'm lame :)
(library files: BLK-MD-SPK-B.lib, BLK-MD-SPK-B.dcm)
XS3868.kicad_mod - new module I will try, breadbord adapter files here
(library files: XS3860.dcm, XS3860.lib)
am1d.kicad_mod - DC - DC convertor 5V->+-12V i have planes to use it for galvanic insulation audio part for low noise in amlifier, which is realy needed....
(library files: aimtec.dcm, aimtec.lib)
also I made some kicad modules for 3.5mm jack from ebay ....

MB-CM15113.kicad_mod - old module which has no uart, I made Fritzing file for this module, I try this module one more time
(library files: MB-CM15113.lib, MB-CM15113.dcm)
BLK-MD-SPK-B.kicad_mod - module mentioned on this blog, no call posible with this module or I'm lame :)
(library files: BLK-MD-SPK-B.lib, BLK-MD-SPK-B.dcm)
XS3868.kicad_mod - new module I will try, breadbord adapter files here
(library files: XS3860.dcm, XS3860.lib)
am1d.kicad_mod - DC - DC convertor 5V->+-12V i have planes to use it for galvanic insulation audio part for low noise in amlifier, which is realy needed....
(library files: aimtec.dcm, aimtec.lib)
also I made some kicad modules for 3.5mm jack from ebay ....
3.5mm_stereo_jack_PJ-313C.kicad_mod |
Subscribe to:
Posts (Atom)