Deep Sea Generator Control Panel - PIN Code | Can I figure it out?

[@garymucher4082]

WOW, this takes me back to when I was a programmer. We needed to modify a piece of test equipment that was bought from a company to expand it's capability to include more equipment testing. They refused to hand us the raw code and stated they would reprogram it for $1 million dollars. So two of us took the EPROM(S) out and read them. Not knowing where the program started or stopped addressing wise, we basically had to search the code to see what they did. It took a few weeks, but we broke the code and added our additional code and WALA, we saved so much money and knew exactly how they coded it...and was able to make it do whatever we wanted with it. Thumbs Up!

[@Ea-Nasir_Copper_Co]

It's "voila".

[@nyetloki]

Now a days you'd be arrested for criminal copyright infringement and DMCA violations

[@BuyitFixit]

World sucks now, too much rules and regs

[@BuyitFixit]

Yes, if you like this stuff check out the ultrasound scanner I looked at and bypassed the engineer code and unlocked a ton of extra features, or the video called no password no problem where I fixed a solar inverter and they wouldn't give me a service code, I found some interesting stuff in there 😂😂😂👍

[@diemaschinedieviereckigeei2941]

It's "wallah".

[@iantyler4045]

It must be easy money for the manufacturer to reset the pin but for you it was "Challenge accepted". Very well done.

[@BuyitFixit]

Thank you 👍yes exactly like the video I did on the passworded solar inverter video 'challenge accepted ' 😂😂😂

[@pseudomemes5267]

It's crazy that they made that entire interface card that amounts to just an eeprom programmer. L

[@ThePoxun]

Certainly will be easy money... and they probably don't even need to do any soldering as it looks like the data lines for the memory chip actually run to that header. They probably have a device that plugs right in and wipes it so no expertise beyond opening the case and plugging something in would be required.

[@mfx1]

I doubt he's doing it for free either.

[@renakunisaki]

Reminds me of when Gateway wanted $$$ to reset the "forgotten" BIOS password on my laptop. I hadn't actually forgotten it; it was "". That is, it was 0 characters long, as I changed it to that when trying to remove it. But the BIOS doesn't let you continue without typing at least one character, so it was impossible to enter. I ended up finding the backdoor password generator instead. Screw you and your convenient bugs, Gateway!

[@steubens7]

i work in infosec and do hw reverse engineering and i'm so excited when there's like a "crossover" and a wide audience gets to experience this sort of thing & i've been loving that they're just tossed in with regular repair videos, because they are regular repairs!

[@BuyitFixit]

😂😂😂👍sounds interesting. I've done a bit myself but just for my own use or because I can 🙂

[@thinking-monkey]

Mix equal parts: 1) Detective, 2) Genius, 3) Electronics Expert... This fix was most excellent! Well played, sir! 👍

[@BuyitFixit]

Many thanks!

[@terrym1065]

I knew immediately when I saw the computer screen and the programmer hooked up I was in trouble... You definitely have some exceptional skills sir. Appreciate these diagnose and repair videos, shows me just how much determination it takes to get the job done. Enjoy!

[@BuyitFixit]

Thanks Terry 👍🙂

[@pdrg]

I didn't think you stood a chance, great work. And "2000" is such a 1990's password lol

[@BuyitFixit]

Thanks 👍I've done quite a few things like this, such as the solar inverter where I needed the service password or the AVerMedia capture card where I had to rebuild the firmware or the medical ultrasound where I unlocked a ton of hidden features and made it run Doom. Check them out if you haven't already seen them 👍

[@tomharris1457]

Clever! I sold Winco Generators until I retired. The Deep Sea controllers were very reliable, and fortunately came without a pass code! Now I see the "trick" to making a low hour unit, like new!

[@BuyitFixit]

Thanks 👍

[@rysacroft]

My landlord bought a 6 KW turbine, it's windy here so it generates about £5000 a year For an install price of £30000 it paid for itself in six years. That's better than the interest rate of the banks! FYI, you cannot get a bank loan for any turbine that has a gearbox.

[@generaldisarray]

Outstanding work sir, well done. Note to self, never buy a 2nd hand car off this man. No matter how much he swears that the milage is genuine, there's just no way a 1998 Toyota Corolla, with that much wear and tear, can have only 1,234 miles on it. NO WAY, but it does seem like such a good deal though...🤣🤣🤣🤣

[@BuyitFixit]

1234 miles 😯it only has 1003! 😂😂😂

[@generaldisarray]

@@BuyitFixit 🤣🤣🤣🤣

[@fluffehgamer4712]

U mean 8008

[@kmonyt]

My goto approach for these type of things is to use a logic analyzer. Watch the thing live when entering a code. While it could be loaded on bootup, just knowing what addresses the uC accesses allows you to narrow down faster. Same approach I used with a debugger for software key bypasses. You've got great patience to keep pulling/resoldering but I'd be slightly worried about stressing the PCB. I'm sure it's fine, but passively watching the memory reads is just easier! Nice work!

[@kmonyt]

Sorry, just seeing your other comments now about the log file writing getting in the way of monitoring. Watching for READS from the chip could allow you to separate those log file writes from configuration reads. My preference is to collect all the accesses from startup to pin code entry, and then sort through the data. I use python pandas to read the csv's.

[@BuyitFixit]

Thanks 👍Great minds think alike! I had thought of that approach too, but when I scoped the i2c pins of the eeprom there constantly data access before even pressing anything. I think this was the MCU writing log files continuously because of the sensors being disconnected, and possibly writes to the display which seem to be on the same bus.

[@davida1hiwaaynet]

Lovely! I have worked on Caterpillar generator sets with DSE controls on them. They were quite a bit ahead of their time when new. You can even build custom logic to add to the basic functionality and pass logic variables between two DSE controllers. The model we had was equipped with mains and generator synchronization. I worked on a project in Nigeria with two of these connected common bus with the DSE communication bus in place for allowing for them to be used as a two-unit plant. Seeing this brings back memories from my 4.5 months in Nigeria offshore working with some very good people from around the world. Glad you were able to save this one!

[@BuyitFixit]

Thank you kindly, and thanks for sharing your interesting story from Nigeria!

[@davida1hiwaaynet]

@@BuyitFixit You're welcome, and thanks for sharing your repairs via your videos!

[@lis6502]

13:42 easiest approach would be: - blanking - running once to set the configuration data - A. setting up known pin - reading flash - B. setting up known pin - reading flash. Then, after comparing differences between A and B would give you only changes in supposed checksum and pin itself.

[@BuyitFixit]

Yes, setting I had thought of that but setting up a known pin required hardware that I didn't have, also sometimes blanking an eeprom doesn't always leave a device in a usable state. This was the case with the tractor dashboard I helped someone repair by dumping the eeprom from mine so they had some default values. The video is on here too👍

[@sebastian_harnisch]

I'm always surprised by the fact that so many commercial/industrial electronics don't use a checksum. I sometimes do even for hobby projects. Great video!

[@BuyitFixit]

Thanks 👍

[@pseudomemes5267]

You'd hope they're backing up that lack of check summing with robust error handling

[@sebastian_harnisch]

@@pseudomemes5267 yeah, but if I’m not willing to implement a simple checksum, am I willing to spend the time and effort to build a robust system? Hmm…

[@steubens7]

the "return for service" impulse is very strong, companies learn a lot about how their devices are used in the process

[@marklatimer7333]

In my experience checksum all only required on data that doesn't change (such as calibration data) that would be detrimental if it did therefore you need to be able to detect memory failures. Number of Hours run changes quite frequent and isn't life and death so why bother? Remember, the more tests you have the more chance something going wrong - KIFS.

[@enoz.j3506]

Back in the 90's as an electronics engineer,repairing laptops + a host of electronic equipment,we had to regulary recover passwords from custmer machines,Toshiba was the easiest,IBM got clever,and today as a life long ,now retired engineer ,i get the occasional job to decipher modern passworded equipment,the algorithms of today ,are way more sophisticated,with reversal,adding,subtracting,shifting,code protected areas,you name it,more often, the password is embedded within the controller ,with chip id's being erased,making the job ni impossible,without some really expensive gear.You did a good job here,the only thing i would of done is 4 wires to a socket for the eeprom,just to make sure the removal/put back,didnt damage the tracks.

[@marklewus5468]

I have been repairing this kind of stuff for 40+ years. I really like your approach and I’ve learned a lot from you. I have a success rate around 80%+ for electronic repairs. I’m sure yours is even better, but it would be interesting to see a video of something that you ultimately couldn’t fix. Sometimes we learn more from our failures than from our successes. Thanks

[@BuyitFixit]

Thanks 🙂Check out the circuit vinyl plotter or the Dyson fan or circular saw. Although I did manage to fix two of those items once I was sent parts from a donor unit 👍

[@epicawesomesauceguy]

I knew immediately upon seeing the comparison that it was D0 07, as those were the four digits that ended up being 00 00 in the nopw file :D excellent video, thank you for helping me learn

[@BuyitFixit]

Thanks 👍and thanks for your input 🙂

[@SteltekOne]

Same! As soon as I saw the 00 00 on the no-PIN side and D0 07 on the original, I guessed that that was where the Hex interpretation of the PIN was. Great video showing how to explore basic microcode data storage mechanisms!

[@MrMaxeemum]

It's always nice to make the numbers match what you expect. It gives that nice warm glowing feeling knowing that you worked it out. Your soldering skills (sodering for the Americans watching) are top notch, If that was me the PCB would be destroyed after 3 or 4 removals (I must do some more practice)

[@BuyitFixit]

Thank you 👍🙂

[@loopdemack]

I think this is your best video, especially because you tried it for 30 times.

[@BuyitFixit]

Thanks 👍🙂

[@fixitagaintomorrow3132]

You are such a clever fella! Another great vid.

[@BuyitFixit]

Thank you 👍

[@fastfourier666]

Good video, thanks! I think you mentioned it briefly but if you are going to be pulling the EEPROM off the board repeatedly it's worth soldering a switch to the processor's reset line and some flying leads to the programmer. USually only need GND, SCL and SDA. Processor in reset typically puts all its pins in a high impedance state, allowing you to read/write the EEPROM from the programmer

[@BuyitFixit]

Thanks, yes I had considered it but I'm pretty used to taking chips off and on now. I've not had much success in the past with EEPROMS in circuit, but thank you for the suggestion 👍

[@renakunisaki]

Or replace the chip with a socket.

[@marcseclecticstuff9497]

I had to do something similar on my Chevy Avalanche gauge cluster when the memory got corrupted from rapidly power cycling the key while troubleshooting the fuel system. Used gauge clusters were $$$ and the now permanent error message tweaked my OCD. I didn't want to be soldering/desoldering the chip a million times so I soldered a 8-pin DIP socket on the board so I could directly plug the zif socket adapter from the MiniPro straight onto the dash for testing. The data was obfuscated and stored in several different places in memory. I didn't take the time to reverse engineer the obfuscation method, I simply played around with the data until the mileage was correct. I wasn't sure what the exact mileage was so I just rounded up to 150,000 so I knew I wasn't putting less on it than it had. It was a great bit of fun!

[@BuyitFixit]

Nice, I also did something similar with a tractor dashboard a few video's back.The video is called "helping someone 10,323 miles away" as it was someone that needed a dump from my tractor dashboard who lived in Australia as he had a unit that wouldn't power up due to a corrupt EEProm. I managed to find the mileage in that, and it was stored as binary coded decimal.

[@Dime_Bar]

Back in the day i worked in a factory making fire alarms and there was a certain range of panels you could change the engineer code, and if you forgot it you had to send it back to us. We would then take out the eprom and read the data then using a chart we would look at a certain part of the code which was in hex then convert it to decimal to get the code.

[@BuyitFixit]

Nice 👍

[@Jesselovespinball]

You really do know your stuff! I’ve commented before that swapping components is easy for me , but when it comes to programming chips and decoding them , that’s a whole different level of cool! Well done 👍

[@BuyitFixit]

Thanks 🙂👍

[@MrBaldypete1]

That was thoroughly enjoyable to watch mate! It's always satisfying working out little company secrets like this!

[@BuyitFixit]

Thank you 👍🙂

[@dosgos]

Fascinating video! More of these chip analysis videos if possible.

[@BuyitFixit]

Thanks, will do!

[@rory9174]

Blown away, that's repair on another level. I'm guessing this is similar tech knowhow to car clocking. Great video, thank you.

[@BuyitFixit]

Thanks, yes exactly. Check out the video I did on the tractor it was called helping someone 10323 miles away, it is very similar 👍

[@brianvincent6266]

You analytical skills are exceptional.

[@BuyitFixit]

Thanks Brian 👍

[@AubsUK]

At 15:18 thank you for showing the 'Programmer' option on the calculator. You've no idea how many times I've used a website converter (because I'm lazy) to convert Hex to Dec. Now I have it on my calculator. And I'm an advanced computer/server tech, but never realised it was that simple! I feel like an idiot right now.

[@AubsUK]

Great video too, thanks for continuing to share :-)

[@BuyitFixit]

You're very welcome 👍

[@BuyitFixit]

Everyday is a school day 👍I'm glad you got something useful from it 🙂

[@davidchang-yen1256]

Once again I am just astounded at your sleuthing skills - the Sherlock Holmes of electronics you are 😂 Excellent work as always!

[@BuyitFixit]

Cheers David 👍

[@sean9595]

I wish you were my next door neighbour and I would never have a problem again 👍🏼👍🏼👍🏼😎

[@BuyitFixit]

My neighbours think so too 😂😂😂👍

[@nickdaria]

Very good work. This feels very similar to reverse engineering my CAN bus on my car. Hunting for data in the seemingly random raw output.

[@BuyitFixit]

Thanks 👍Yes I've messed around with CAN bus stuff ages ago when messing with an old VW dashboard.

[@roneckler9937]

In a way, it goes to show people that their data really isn't as secure as they think, although, you do have to have some knowledge in doing what you do. I don't have a chip reader, but if I did, the chip would have probably started playing a tune by time I got done with it. It's been a long time since I played with HEX or Binary codes. Once again, you never disappoint in your videos.

[@BuyitFixit]

Thanks Ron 👍

[@marklatimer7333]

You've got a lot more patience than I would have taking that chip on and off so many times, not to mention potential PCB damage. I noticed what looks like two serial resistors on the data line between the CPU and the EEPROM, these are usually fitted so you can back drive the EEPROM when the CPU is off, I would suspect that the EEPROM can be programmed in-situ via the header just below it.

[@BuyitFixit]

Yes, I noticed them too when I was editing the video, but sometimes it's a lot easier to spot things when watching the video back than when you are actually working on something. The header is for the display, but it seems the i2c lines go there to drive the display too.

[@mitchellhw2006]

I have an embedded controller from a correctional facility door control panel that one of the techs bricked the IP address. Hoping the flash memory chip I spotted on the board holds the IP address.... Great video. Makes me want to give it a try.

[@BuyitFixit]

Thanks 👍Worth a try, what's the worst that can happen it's bricked anyway? Alternatively if that didn't work and you have another unit you could always read that chip from that one and use the data to re-program the other one.

[@tujuprojects]

DSE has quite neat models, some of them can be networked to cluster of generators. You can set what state the unloaded gensets are, are they running or shutdown standby. Once they’re needed, it will use syncroscope to sync phasing and once they overlap, the main contactor will connect the genset to load (grid). They use these in developing coutries where they don’t have large powerplants.

[@BuyitFixit]

Interesting, I'm no expert on generator (or anything for that matter 😂😂) but I do like to figure interesting devices out. Thanks for your insight!

[@tujuprojects]

@@BuyitFixit see video ”synchronizing DSE 8660 & 8610”, its shows syncroscope.

[@tujuprojects]

@@BuyitFixit they use rs485 and modbus to daisy chain them kzbin.info/www/bejne/bKuuhWSmp7Ccb9ksi=iON9GQQYsVaxas-x

[@rogerbailey7301]

The 5310 is a more basic controller. The 8660 is a mains controller and controls other genes via there own controller like a 8610.

[@blacklisted4885]

Great work! If only we all had such pals

[@BuyitFixit]

Thanks 👍🙂

[@DB25k]

Absolutely technical artist at work. This was a fantastic marvel and reminds me of develing into code years ago.. thanks so much for sharing....

[@BuyitFixit]

Thank you 👍

[@robertbackhaus8911]

First thing I noticed was that the serial data pins from that EEPROM continue on to that debugging header. Companies doing this commercially would likely be using that header. With series resistors between the EEPROM and the processor, you could probably edit the EEPROM live.

[@BuyitFixit]

Yes, I noticed the i2c pins went to that header too when I was editing. However that isn't a debug header. There is an unpopulated debug header elsewhere. The white header is where the display fits, so I guess that the display is using i2c also.

[@DemetryRomanowski]

If anyone is interested this is pretty much exactly how we OEM engine ecm tuners do our thing, simply put read the eeprom, mess with values on a bench see what changes then create a "map" file for the data, that way we know what bytes to change to change the tuning of the engine in the same vehicle. Gets much trickier with modern vehicles now though, nasty checksums and data signing.

[@kurdm1482]

This guy didn't share how he figured out the values efficiently. He definitely skipped a part. But still good video

[@BuyitFixit]

Yes signing and CRC's can be tricky. Sometimes it's easier to get rid of the checks in the code 🙂👍

[@BuyitFixit]

Thanks 👍The values were just converted from hex to decimal with the calculator. I showed the values on the screen. If you open calculator on windows and change it to programmer mode you can select hex and enter one of the hex values and it will show it in decimal.

[@mitumkallidin3464]

On a AUTEL IM608 key programmer, we read an eeprom and dump the file on the Immo side of the machine, the pin code comes up on the bottom corner. Makes key programming easy with the pincode👌

[@BuyitFixit]

Nice 👍

[@dont-want-no-wrench]

beautiful! i just love this kind of detective work.

[@BuyitFixit]

Thank you very much!

[@axelbrendel4091]

Great sleuthing! What always amazes me is how much heat (and thermal cycles) those SMD chips can take! I'd be worried about destroying it after only one or two removals.

[@BuyitFixit]

Thanks 👍I don't think I've managed to kill a chip yet due to removing / refitting.

[@renakunisaki]

I'd be worried about how many pins are left after a few cycles 😂

[@derekholme6922]

Now then Bonny Lad, I thouraley enjoy your videos, understand some of it but love the way you work around to find a solution, Thank you.

[@BuyitFixit]

Thanks 👍

[@ginbot86]

Nicely done! Given how generator runtime statistics are saved to EEPROM, I wonder how frequently it does so, given EEPROM's limited write cycle endurance. Then again, with a typical rating of at least a million write cycles, it's probably plenty enough to last the lifetime of the generator it's controlling.

[@BuyitFixit]

Thanks 👍I'm not too sure, I think we worked out that the tractor dashboard I looked at updated once every 10 seconds, but don't quote me on that!

[@madrafboy]

Nice bit of forensic electronics.

[@BuyitFixit]

Thank you 👍

[@FuzzyTekShow]

Great video, love that you got carried away and started changing other bytes to satisfy the curiosity! :P

[@BuyitFixit]

Thanks 👍The same thing happened when I looked at a medical ultrasound scanner, I ended up unlocking a ton of stuff and running doom on it. (video is on here too) and similar to the "No password, no problem" solar inverter video too where I found tons of hidden stuff 😉

[@FuzzyTekShow]

@@BuyitFixithaha love it, I'll check it out!

[@kentswan3230]

well done! It just prooves that going down some rabbit holes is productive.

[@BuyitFixit]

Thanks 👍Yes indeed 😂😂

[@maxvideodrome4215]

I have an old 286 PC with no manual available. Same method here with EPROM .. hardcoded HDD types (cylinders/heads/sectors). Took a lot of work but reverse engineered it!

[@BuyitFixit]

Very nice! Thanks for sharing 👍

[@101thenuke]

Must admit I really enjoy all your video's. Informative and a nice pleasant manner, thanks

[@BuyitFixit]

So nice of you 👍 Thanks 🙂

[@brianoflondon]

What’s that 4 digit number written on the back of the unit in nail polish at the start?

[@BuyitFixit]

It's the model number 😉

[@MrWaalkman]

I wondered why you kept pulling the chip rather than use a chip-clip. :) While working on a rooted firmware on my buddy's Dell I had to buy a second chip-clip as the one that came with the kit simply would not work. Otherwise, no problem reading and writing the chip in circuit on the Dell (YMMV). Nice soldering and troubleshooting skills you have there too!

[@BuyitFixit]

Thanks 👍

[@mikecass8306]

A man of many talents, thanks Mick 😀

[@BuyitFixit]

Cheers Mike 👍

[@richbwarner]

That would be a deep sea controller from a ex aggreko machine, all the PIN codes were set as 2000, in the config suite using the p810 connector all the values can be edited.

[@BuyitFixit]

Thanks for the info!

[@colingale]

while a little harder to use the SOC clip are usefull. also note the white header had i2c pins and jtag ( including reset ) for cpu so from there you can read the eeprom without the MCU getting in the way.

[@BuyitFixit]

I did notice the white connector had i2c when I was editing the video. This is actually the connector that the front panel connects to, so the display is probably driven by i2c also.

[@richb419]

Hi, good video! I thought that device looked familiar, I used to take care of many large generator dry land sets and some of them had that control panel.

[@BuyitFixit]

Thanks 👍and also thanks for the info 🙂

[@jasonputtock4428]

I would really really love you to take apart a washing machine rom and inspect those. You are bloody brilliant at this. We just had to go out and spend 1300 on a new appliance because our old one is draining to much energy. We do suffer alot of power outages, I believe the programmer is up the spout. This is not the only machine that failed on us in the last 6 years. So i would like to inspect the rom files.

[@BuyitFixit]

Interesting, a lot of stuff doesn't have an external eeprom. Even this device has a microcontroller with memory that stores the actual program and other data.

[@diemaschinedieviereckigeei2941]

For washing machine controllers it is not uncommon to have a masked rom

[@jasonputtock4428]

ohhhh hoooo. Would this cause programmers to cause issues. If yes, what issues could we expect.?@@diemaschinedieviereckigeei2941

[@luminousfractal420]

Brownout (dips in the supply rather than no supply) cause a lot of damage to component chips. Probably worth you buying a small ups for your machine. That said I found the reason we had massive power usage and my pc's kept dying was poor house wiring, the breakers and cables were all 1950's and random, turned out that 3 electrical outlets had the live wire touching the case, we had a 120v earth/ground. Once I replaced the sockets the power drain stopped, I stopped getting shocks off the switch screws and I narrowed down one safe circuit I could connect my pc to. I went through so many ups devices because none of them expected a live ground cable. Or for the entire house to be run through a single breaker 🤦 lights and sockets both.

[@jasonputtock4428]

We have moved the washing machine to another power line. We are seeing max 2 amp draw on this line. Not the 9 amp or more. When money permit I will have to take down the ceiling to see where the wires are going@@luminousfractal420

[@e42_channel]

Great video - as always. Two more comments from me: The SOIC clip is a bit risky because parts or the whole circuit containing the serial EPROM is powered by the programmer during read/write which could lead to overload. But I think you have this in mind. Another option would be to use a logic analyzer (Salea cheap ones) to record the I2C bus for reengineering.

[@BuyitFixit]

Thanks 👍Yes that was my thoughts, so it was easier to just remove the chip. I've tried programming them in circuit before (I think it was a Landrover ECU that needed the immobiliser removed) and just ended up removing the chip as I couldn't get it to program in circuit. I had thought about using my LA. I've got one and used it when I was reverse engineering the Milwaukee battery protocol over on Reddit about 9 months ago. I had been thinking about waiting to enter the pin and seeing what addresses it read from the EEProm but because it seemed it was constantly writing logs because of the missing sensors I didn't bother. Thanks again for commenting 🙂

[@mrfrenzy.]

The danger with using the clip is usually if the MCU powers up and sets the write flag for some reason, which leads you to corrupt data that you need. As long as you have a good dump from the same unit it's not very scary. For some units you can solve it by jumping the reset pin on the MCU so it does not start, also some nice programmers can keep the voltage low enough so the MCU does not start but the EEPROM does.

[@e42_channel]

@@mrfrenzy. You are right. But in this case it is an i2c EEPROM and all transfers are handled by the bus protocol. And the write protection (WP, pin7) is tied to ground and not switchable, as you can see at 3:25.

[@Marshmish]

Nice work Mick, you make it look so easy! suppose it is if you know what your doing.

[@BuyitFixit]

Thanks 👍 Yes, I'm pretty good at working things out 🙂

[@Marshmish]

@BuyitFixit Looking forward to a catch up with your other content.

[@309electronics5]

That was quite interesting! I also love some messing arround with raw bytes. I already changed the name and number of a product by overwriting the bytes associated with it. Interesting and i love messing with bytes in a eeprom or flash

[@BuyitFixit]

Thanks 👍Yes you and me both. I used the same programmer with the Stihl headset I just repaired, and with the Tractor dashboard I looked at (helping someone 10,323 miles away). If you like this type of stuff also check out the video I did called "no password no problem" 😉

[@hammer313]

amazing. I wouldn't have thought it was possible until you did it. I learnt a lot. potentially using the number guessing algorithm sometimes taught in programming 101 classes might have been quicker. blank the top half of the area, if the pin is still set, it's in the bottom half, repeat with blanking half of the bottom half, repeat, repeat, my names on my feet, I'm pete, pete repeat,.

[@BuyitFixit]

Thanks 👍Yes that approach may have been quicker! It looked like the config data started at 0350 in the EEPROM so blanking the top half, and then the bottom half of that block might have narrowed it down quicker.

[@kareno8634]

*Really Coo,l* but confusing. lol Seeing you master these chips brings the whole *marvel of knowledge* i sadly missed.

[@BuyitFixit]

Thanks 👍

[@tiggydorset9041]

Quality stuff. Thanks for the education. I thought you were just playing around just for kicks when changing the other values, but then you gave a legitimate reason why someone would actually want to change them. Nice work.

[@BuyitFixit]

Thanks 👍Yes, that's a legitimate use case, but as with anything, there are also some not so legitimate use cases too..

[@DaveCurran]

Looks like the EEPROM serial data lines are connected to the processor via resistors and those same pins are wired directly to the pin header next to it. So it may be intended to be able to program the EEPROM via that header?

[@BuyitFixit]

Yes, I didn't notice at the time but the i2c lines go to that header for the display, as it also must be i2c.

[@K6WRF]

This was a great video and loved how you went above and beyond to determine what each data entry corresponded to. My questions is how did you determine that was the chip to pull and read? Were there other suspects on yor radar or is there something to gleen from this video as to why you chose that chip over the many others on that board. Thanks

[@BuyitFixit]

Thanks 👍The pin code has to be stored in memory somewhere, so either a battery backed up ram chip, an eeprom or the internal flash or eeprom of the microcontroller. Most of the chips on the board were either op amps for sensors, or interface ICs for external communication, so I started examining the board for memory type chips.

[@K6WRF]

@@BuyitFixit Ahh ok .. I suppose that makes sense. Thanks for the quick reply and great job

[@mattsmalley5780]

As always mate, absolutely amazing. Love your videos 👏

[@BuyitFixit]

Thanks a ton!

[@cecildramat-ps9eq]

Hi hope you doing well and thank you for another great video that flabbergasted me from normal electronic repair, programming, binary and converting to hexadecimal and be able to change values, you are just a genius man there is nothing else to it. 😅🥶

[@BuyitFixit]

Hi, thank you for your kind comment 👍

[@melkiorwiseman5234]

Those "16 bit" values are probably actually at least 32 bit values, with the high bytes currently set to 00 00 in the following two bytes until/unless the value becomes too large to store in just two bytes.

[@BuyitFixit]

Yes, I did think of that when I was editing as the adjacent bytes did seem to be 00 00. Thanks for commenting 👍

[@ducatisteve20081]

Your knowledge is so vast love the vids keep up the good work .

[@BuyitFixit]

Thanks, will do!

[@artursmihelsons415]

Great job! Nice, that there wasn't a crc.. I did similar things with different devices.. 😂 It's always a fun to figure out meaning of stored data.

[@BuyitFixit]

Thanks 👍yes, I've worked on stuff before where there was a CRC and there are quite a few different methods for calculating them.

[@ThriftyToolShed]

Well done! I enjoyed watching it, thanks for sharing!

[@BuyitFixit]

Glad you enjoyed it, Cheers Thrifty 👍

[@bobroberts2371]

Something to be aware of with industrial pin codes. Many times they are something that is on the machine so the factory service tech has a hint. Like the zip ( postal ) code of the maker, some combination of the model number.

[@BuyitFixit]

Thanks for that 👍

[@jeroen5838]

Fascinating they set the password similar to DEIF (deepsea competitor), customer password is 2000, service 2001 and master 2002.

[@BuyitFixit]

Thanks 👍

[@rogerbailey7301]

DEIF are not as easy to use

[@ignem432]

While I really appreciate how you narrowed it down, the constant resoldering of the chip isn't all that great for the chip itself. You could simply (as you mentioned) attach a clip on the chip or solder the wires necessary for programming it directly, then feed them into the programmer. Apart from that nitpick it was a nice watch :)

[@BuyitFixit]

Thanks, unfortunately I've not had great success in the past programming chips in circuit, as you say probably not great for the chip but only around 30 secs to remove and about the same to replace.

[@ignem432]

@@BuyitFixit Yes, in circuit programming can be a bitch. As long as you can get spare EPROMs I don't think it is that big of a deal. It would suck though for the chip to die let's say 3 months after shipping the device out which was why I mentioned it.

[@theothermikeg]

I've installed many deep sea controls over the past few years, funnily enough alot were replacement for Kohler controls with the "eprom write failure fault"

[@BuyitFixit]

Interesting, I guess they were writing to the EEProm too often causing it to wear out prematurely. They should be an easy fix if they are using an external EEProm like this unit.

[@mazafreno]

As usual unbelievable job, thank you for your videos.

[@BuyitFixit]

Many thanks!

[@snaggglepus]

The newer Deep Sea controllers just have a usb port on the back and they make the software available on their website. you can change all the config, hours and totals very easily

[@BuyitFixit]

Nice 👍I wonder if they require you to send it back still for the pin on newer models?

[@rogerbailey7301]

Yes they do

[@Actual_electrical_content]

Proper hooked me in this video in to trying to things have not done before

[@BuyitFixit]

Nice, nothing to loose by trying and you'll gain experience if nothing else 👍

[@Actual_electrical_content]

Oh I’ll be buying a reader for sure great content

[@BuyitFixit]

Thank you 👍

[@PhreakDarkSoul]

13:35: Wouldn't it be easier to change the pin again, dump it again and compare the 2 new pins to get the right part?

[@BuyitFixit]

Yes, apart from you can't physically SET a pin code via the controls on the panel. You have to use the software and the DSE810 interface which I didn't have to do that.

[@LimbaZero]

Removing chip when you can see that I2C is also going to pin header next to it :) Most likely that is used to program it in factory. Soldering maybe faster if you have programmer that has socket for so-8.

[@BuyitFixit]

I didn't notice the i2c going to the header until I was editing the video. The header is where the display board connects so I guess it must be also using i2c for the display and buttons.

[@philphil3707]

Your so smart at what you do, I wish I could learn to do what you do, how did you learn to do what you do?

[@BuyitFixit]

Thanks 👍Mostly just messing about with things, I've done stuff like this for years. I've always been curious how things work.

[@davidshaw1830]

did you try the number written on the back 5310

[@BuyitFixit]

I actually didn't, but that was the model DSE5310

[@pgsss6354]

As always, excellent job! You 're a genius. Congrats!

[@BuyitFixit]

Thank you very much!

[@neiltheplayer]

Once again (you've heard it before) Brilliant!! thanks for posting

[@BuyitFixit]

Thanks 👍I might have another video similar to this in the next few weeks... 🙂

[@MarkLemanUK]

Another (possibly quicker) approach might have been to connect an i2c analyser to the bus and see what went on when the pin was entered. Still, i admire your balls for getting in there with the hot air first 👍

[@BuyitFixit]

Thanks 👍I had thought of that approach too, and did poke the scope onto the lines to see what if they were accessed when the pin screen came up. The issue was because there was loads of sensors not connected it was constantly activity as I think it was writing to the log files, also I the lines go to the display so there it could have also been updating the display as well.

[@schlollepop]

@@BuyitFixitUnderstandable, but filtering for the I2C address of the EEPROM might have made it easy enough. Would likely require some tinkering with sigrok, though.

[@599miata]

By the looks of it, you had great fun there, mate.😊😊

[@BuyitFixit]

Yes, thanks👍

[@Ratzfaz]

17:07 I think u don't need a SOIC testclip. both datalines end up in the white connector next to it (seen on 3:24).

[@BuyitFixit]

Yes, I didn't notice at the time but did when I was editing the video. I guess that the display must also use i2c for communication. You would still need to hold the processor in _Reset though.

[@ralphj4012]

​@@BuyitFixitYou may have been able to isolate the EPROM by removing what appears to be two 0R resistors in the SCK and SDA lines (pure guesswork on my part and they may be pullups). No criticism intended (still a fix)

[@BuyitFixit]

No problem mate👍, it honestly was around 30 seconds or so to remove the chip.

[@Ratzfaz]

@@ralphj4012 removing this 0R resistors and puting a jumper in would be a good idea.

[@substandard649]

I love reverse engineering code and eprom chips but man do i wish i had your soldering skills , removing that chip multiple times gave me pulpit actions 😂

[@DanielCoffey67]

Do they make sockets for these little bios chips? That would make the in and out process a lot simpler.

[@BuyitFixit]

Yes, I was putting it in a socket in the EEprom programmer. It wasn't actually that much of an issue tbh, but thank you for the suggestion 👍

[@eliotmansfield]

@@BuyitFixitsurprised the chip can handle being repeatedly heated up

[@martinsamuelsson2322]

Nice find, great work! Did you catch that the pinheader just below the ic is connected to the io lines? Bet you could use that instead of desoldering it!

[@BuyitFixit]

Thanks 👍Yes, it's for the display but I didn't notice it had the i2c lines going to it until I was editing the video. I guess the display panel must be i2c too.

[@hypergaming654xbl7]

hey i have a controller similar to this one and i was wondering i have the official software to program them from my computer and i want to know if the only way to reset the memory chip storing the 4 digit pin is by removing it , or is it possible to reset it with the printer cable port in the back

[@BuyitFixit]

From what I read the official software doesn't let you do this, and the only way is to send the unit back to DeepSea. Unless it's like this one and now you know pretty much how to do it yourself.

[@SwapPartLLC]

I wonder if you could have used a logic analyzer to see what address it was accessing when you submitted the pin? I suppose it would depend on whether the entire EEPROM was read in on startup and stored in memory, or if it was accessed on demand. Great work anyway.

[@BuyitFixit]

I had thought of that, but when I used the scope on the SDA it was constantly being accessed due to it writing log files, good thinking though 👍

[@SwapPartLLC]

@@BuyitFixit I see. That would definitely have complicated it.

[@Karthor.]

I like these videos, did something similar with an old Volvo radio i had found outside that had a pincode on it, found dumps online and i knew the password to the dumps so i could figure out where the password where stored in it

[@BuyitFixit]

Thanks 👍 and nice 🙂

[@Stefan_Van_pellicom]

That’s some serious skills right there! 👍

[@BuyitFixit]

Thank you 👍

[@greenaum]

Might be that the generator itself stores it's runtime stats, somewhere oily and hard to get at. So if it checked with the front panel it might flash up a warning. Or might not. As you mentioned, surprising they didn't store the important numbers in on-chip EEPROM on one of the microcontroller chips, with the security bit set so you couldn't get at them. If they did you'd be buggered as far as fixing it, so fortunate here that they don't.

[@BuyitFixit]

The rest of the generator was pretty much an engine with a few sensors. Yes I would have thought possibly in the microcontroller, but it may have still been possible to get at it with some type of glitch attack, but obviously a lot more work!

[@rogerbailey7301]

Using the free software from DSE you can set the run hours to what you want on a conventional engine generator, unless it is read from the engine ecu on electronic engines

[@johnhousego9218]

Another really interesting video and very informative, thank you.

[@BuyitFixit]

Glad you enjoyed it👍

[@1kreature]

Looked like that pin header was there to access the eeprom. Usually when I add headers like that I add a pin for the reset of the main MCU as well. This allows you to connect a programmer and just hold the reset of main mcu thus disconnecting it from the eeprom. (During reset IO's usually go highZ.) Less soldering...

[@BuyitFixit]

I did look for a programming port. The pin header is where the display board plugs in, although It does appear that it has the I2C signals going to it too as this is what drives the LCD display.

[@1kreature]

@@BuyitFixit That's also a classic trick. Since the display header will be there anyways it can serve double duty.

[@TheRealBobHickman]

Like many others I suspect, I saw the 4 digits (5310) scrawled on the back and thought - that's gotta be the PIN. Glad that wasn't it in the end though :)

[@BuyitFixit]

Yes, that was the model number DSE5310, although I must admit that I didn't actually try that as a PIN 😂😂😂

[@ion3lm588]

i have no ideea what is happening there 😁 i do instead watch Louis Rossman videos but only cos i really believe in right to repair,obviously not by me...very enjoyable thump up 👍

[@BuyitFixit]

Thanks 👍

[@crazycarl9484]

Great work as usual, clever bugger 🤣

[@BuyitFixit]

Cheers 👍

[@brianwood5220]

You are becoming a bit of a whiz at this programming lark. Great video as always, very interesting. Thanks for sharing.

[@BuyitFixit]

Thanks Brian👍, I've done loads of stuff like this in the past, just not on KZbin 🙂

[@MrJeffschefke]

Most stuff like this has a serial port for this kind of stuff, I bet there was a header somewhere for serial communion and it has the ability to reset the pin.

[@BuyitFixit]

Possibly, I've came across quite a few devices over the years that have a serial UART header hidden away inside (the radiosonde rs41 weather balloon one was such device I did a video on) and also the recent AVerMedia video capture device I worked on had one too,

[@Dorff_Meister]

I'm only half way through the video, but I wouldn't think the hex values in the dump would be the PIN. Perhaps if you found four ascii characters... Update: Nicely done on finding the pin in the dump.

[@BuyitFixit]

Thanks 👍