Deep Sea Generator Control Panel - PIN Code | Can I figure it out?

[@garymucher4082]

WOW, this takes me back to when I was a programmer. We needed to modify a piece of test equipment that was bought from a company to expand it's capability to include more equipment testing. They refused to hand us the raw code and stated they would reprogram it for $1 million dollars. So two of us took the EPROM(S) out and read them. Not knowing where the program started or stopped addressing wise, we basically had to search the code to see what they did. It took a few weeks, but we broke the code and added our additional code and WALA, we saved so much money and knew exactly how they coded it...and was able to make it do whatever we wanted with it. Thumbs Up!

[@Ea-Nasir_Copper_Co]

It's "voila".

[@nyetloki]

Now a days you'd be arrested for criminal copyright infringement and DMCA violations

[@BuyitFixit]

World sucks now, too much rules and regs

[@BuyitFixit]

Yes, if you like this stuff check out the ultrasound scanner I looked at and bypassed the engineer code and unlocked a ton of extra features, or the video called no password no problem where I fixed a solar inverter and they wouldn't give me a service code, I found some interesting stuff in there 😂😂😂👍

[@diemaschinedieviereckigeei2941]

It's "wallah".

[@iantyler4045]

It must be easy money for the manufacturer to reset the pin but for you it was "Challenge accepted". Very well done.

[@BuyitFixit]

Thank you 👍yes exactly like the video I did on the passworded solar inverter video 'challenge accepted ' 😂😂😂

[@pseudomemes5267]

It's crazy that they made that entire interface card that amounts to just an eeprom programmer. L

[@ThePoxun]

Certainly will be easy money... and they probably don't even need to do any soldering as it looks like the data lines for the memory chip actually run to that header. They probably have a device that plugs right in and wipes it so no expertise beyond opening the case and plugging something in would be required.

[@mfx1]

I doubt he's doing it for free either.

[@renakunisaki]

Reminds me of when Gateway wanted $$$ to reset the "forgotten" BIOS password on my laptop. I hadn't actually forgotten it; it was "". That is, it was 0 characters long, as I changed it to that when trying to remove it. But the BIOS doesn't let you continue without typing at least one character, so it was impossible to enter. I ended up finding the backdoor password generator instead. Screw you and your convenient bugs, Gateway!

[@thinking-monkey]

Mix equal parts: 1) Detective, 2) Genius, 3) Electronics Expert... This fix was most excellent! Well played, sir! 👍

[@BuyitFixit]

Many thanks!

[@terrym1065]

I knew immediately when I saw the computer screen and the programmer hooked up I was in trouble... You definitely have some exceptional skills sir. Appreciate these diagnose and repair videos, shows me just how much determination it takes to get the job done. Enjoy!

[@BuyitFixit]

Thanks Terry 👍🙂

[@steubens7]

i work in infosec and do hw reverse engineering and i'm so excited when there's like a "crossover" and a wide audience gets to experience this sort of thing & i've been loving that they're just tossed in with regular repair videos, because they are regular repairs!

[@BuyitFixit]

😂😂😂👍sounds interesting. I've done a bit myself but just for my own use or because I can 🙂

[@generaldisarray]

Outstanding work sir, well done. Note to self, never buy a 2nd hand car off this man. No matter how much he swears that the milage is genuine, there's just no way a 1998 Toyota Corolla, with that much wear and tear, can have only 1,234 miles on it. NO WAY, but it does seem like such a good deal though...🤣🤣🤣🤣

[@BuyitFixit]

1234 miles 😯it only has 1003! 😂😂😂

[@generaldisarray]

@@BuyitFixit 🤣🤣🤣🤣

[@fluffehgamer4712]

U mean 8008

[@tomharris1457]

Clever! I sold Winco Generators until I retired. The Deep Sea controllers were very reliable, and fortunately came without a pass code! Now I see the "trick" to making a low hour unit, like new!

[@BuyitFixit]

Thanks 👍

[@rysacroft]

My landlord bought a 6 KW turbine, it's windy here so it generates about £5000 a year For an install price of £30000 it paid for itself in six years. That's better than the interest rate of the banks! FYI, you cannot get a bank loan for any turbine that has a gearbox.

[@kmonyt]

My goto approach for these type of things is to use a logic analyzer. Watch the thing live when entering a code. While it could be loaded on bootup, just knowing what addresses the uC accesses allows you to narrow down faster. Same approach I used with a debugger for software key bypasses. You've got great patience to keep pulling/resoldering but I'd be slightly worried about stressing the PCB. I'm sure it's fine, but passively watching the memory reads is just easier! Nice work!

[@kmonyt]

Sorry, just seeing your other comments now about the log file writing getting in the way of monitoring. Watching for READS from the chip could allow you to separate those log file writes from configuration reads. My preference is to collect all the accesses from startup to pin code entry, and then sort through the data. I use python pandas to read the csv's.

[@BuyitFixit]

Thanks 👍Great minds think alike! I had thought of that approach too, but when I scoped the i2c pins of the eeprom there constantly data access before even pressing anything. I think this was the MCU writing log files continuously because of the sensors being disconnected, and possibly writes to the display which seem to be on the same bus.

[@pdrg]

I didn't think you stood a chance, great work. And "2000" is such a 1990's password lol

[@BuyitFixit]

Thanks 👍I've done quite a few things like this, such as the solar inverter where I needed the service password or the AVerMedia capture card where I had to rebuild the firmware or the medical ultrasound where I unlocked a ton of hidden features and made it run Doom. Check them out if you haven't already seen them 👍

[@sebastian_harnisch]

I'm always surprised by the fact that so many commercial/industrial electronics don't use a checksum. I sometimes do even for hobby projects. Great video!

[@BuyitFixit]

Thanks 👍

[@pseudomemes5267]

You'd hope they're backing up that lack of check summing with robust error handling

[@sebastian_harnisch]

@@pseudomemes5267 yeah, but if I’m not willing to implement a simple checksum, am I willing to spend the time and effort to build a robust system? Hmm…

[@steubens7]

the "return for service" impulse is very strong, companies learn a lot about how their devices are used in the process

[@marklatimer7333]

In my experience checksum all only required on data that doesn't change (such as calibration data) that would be detrimental if it did therefore you need to be able to detect memory failures. Number of Hours run changes quite frequent and isn't life and death so why bother? Remember, the more tests you have the more chance something going wrong - KIFS.

[@davida1hiwaaynet]

Lovely! I have worked on Caterpillar generator sets with DSE controls on them. They were quite a bit ahead of their time when new. You can even build custom logic to add to the basic functionality and pass logic variables between two DSE controllers. The model we had was equipped with mains and generator synchronization. I worked on a project in Nigeria with two of these connected common bus with the DSE communication bus in place for allowing for them to be used as a two-unit plant. Seeing this brings back memories from my 4.5 months in Nigeria offshore working with some very good people from around the world. Glad you were able to save this one!

[@BuyitFixit]

Thank you kindly, and thanks for sharing your interesting story from Nigeria!

[@davida1hiwaaynet]

@@BuyitFixit You're welcome, and thanks for sharing your repairs via your videos!

[@epicawesomesauceguy]

I knew immediately upon seeing the comparison that it was D0 07, as those were the four digits that ended up being 00 00 in the nopw file :D excellent video, thank you for helping me learn

[@BuyitFixit]

Thanks 👍and thanks for your input 🙂

[@SteltekOne]

Same! As soon as I saw the 00 00 on the no-PIN side and D0 07 on the original, I guessed that that was where the Hex interpretation of the PIN was. Great video showing how to explore basic microcode data storage mechanisms!

[@lis6502]

13:42 easiest approach would be: - blanking - running once to set the configuration data - A. setting up known pin - reading flash - B. setting up known pin - reading flash. Then, after comparing differences between A and B would give you only changes in supposed checksum and pin itself.

[@BuyitFixit]

Yes, setting I had thought of that but setting up a known pin required hardware that I didn't have, also sometimes blanking an eeprom doesn't always leave a device in a usable state. This was the case with the tractor dashboard I helped someone repair by dumping the eeprom from mine so they had some default values. The video is on here too👍

[@marklewus5468]

I have been repairing this kind of stuff for 40+ years. I really like your approach and I’ve learned a lot from you. I have a success rate around 80%+ for electronic repairs. I’m sure yours is even better, but it would be interesting to see a video of something that you ultimately couldn’t fix. Sometimes we learn more from our failures than from our successes. Thanks

[@BuyitFixit]

Thanks 🙂Check out the circuit vinyl plotter or the Dyson fan or circular saw. Although I did manage to fix two of those items once I was sent parts from a donor unit 👍

[@MrMaxeemum]

It's always nice to make the numbers match what you expect. It gives that nice warm glowing feeling knowing that you worked it out. Your soldering skills (sodering for the Americans watching) are top notch, If that was me the PCB would be destroyed after 3 or 4 removals (I must do some more practice)

[@BuyitFixit]

Thank you 👍🙂

[@marcseclecticstuff9497]

I had to do something similar on my Chevy Avalanche gauge cluster when the memory got corrupted from rapidly power cycling the key while troubleshooting the fuel system. Used gauge clusters were $$$ and the now permanent error message tweaked my OCD. I didn't want to be soldering/desoldering the chip a million times so I soldered a 8-pin DIP socket on the board so I could directly plug the zif socket adapter from the MiniPro straight onto the dash for testing. The data was obfuscated and stored in several different places in memory. I didn't take the time to reverse engineer the obfuscation method, I simply played around with the data until the mileage was correct. I wasn't sure what the exact mileage was so I just rounded up to 150,000 so I knew I wasn't putting less on it than it had. It was a great bit of fun!

[@BuyitFixit]

Nice, I also did something similar with a tractor dashboard a few video's back.The video is called "helping someone 10,323 miles away" as it was someone that needed a dump from my tractor dashboard who lived in Australia as he had a unit that wouldn't power up due to a corrupt EEProm. I managed to find the mileage in that, and it was stored as binary coded decimal.

[@Dime_Bar]

Back in the day i worked in a factory making fire alarms and there was a certain range of panels you could change the engineer code, and if you forgot it you had to send it back to us. We would then take out the eprom and read the data then using a chart we would look at a certain part of the code which was in hex then convert it to decimal to get the code.

[@BuyitFixit]

Nice 👍

[@fastfourier666]

Good video, thanks! I think you mentioned it briefly but if you are going to be pulling the EEPROM off the board repeatedly it's worth soldering a switch to the processor's reset line and some flying leads to the programmer. USually only need GND, SCL and SDA. Processor in reset typically puts all its pins in a high impedance state, allowing you to read/write the EEPROM from the programmer

[@BuyitFixit]

Thanks, yes I had considered it but I'm pretty used to taking chips off and on now. I've not had much success in the past with EEPROMS in circuit, but thank you for the suggestion 👍

[@renakunisaki]

Or replace the chip with a socket.

[@loopdemack]

I think this is your best video, especially because you tried it for 30 times.

[@BuyitFixit]

Thanks 👍🙂

[@Jesselovespinball]

You really do know your stuff! I’ve commented before that swapping components is easy for me , but when it comes to programming chips and decoding them , that’s a whole different level of cool! Well done 👍

[@BuyitFixit]

Thanks 🙂👍

[@fixitagaintomorrow3132]

You are such a clever fella! Another great vid.

[@BuyitFixit]

Thank you 👍

[@dosgos]

Fascinating video! More of these chip analysis videos if possible.

[@BuyitFixit]

Thanks, will do!

[@sean9595]

I wish you were my next door neighbour and I would never have a problem again 👍🏼👍🏼👍🏼😎

[@BuyitFixit]

My neighbours think so too 😂😂😂👍

[@rory9174]

Blown away, that's repair on another level. I'm guessing this is similar tech knowhow to car clocking. Great video, thank you.

[@BuyitFixit]

Thanks, yes exactly. Check out the video I did on the tractor it was called helping someone 10323 miles away, it is very similar 👍

[@MrBaldypete1]

That was thoroughly enjoyable to watch mate! It's always satisfying working out little company secrets like this!

[@BuyitFixit]

Thank you 👍🙂

[@nickdaria]

Very good work. This feels very similar to reverse engineering my CAN bus on my car. Hunting for data in the seemingly random raw output.

[@BuyitFixit]

Thanks 👍Yes I've messed around with CAN bus stuff ages ago when messing with an old VW dashboard.

[@mitchellhw2006]

I have an embedded controller from a correctional facility door control panel that one of the techs bricked the IP address. Hoping the flash memory chip I spotted on the board holds the IP address.... Great video. Makes me want to give it a try.

[@BuyitFixit]

Thanks 👍Worth a try, what's the worst that can happen it's bricked anyway? Alternatively if that didn't work and you have another unit you could always read that chip from that one and use the data to re-program the other one.

[@marklatimer7333]

You've got a lot more patience than I would have taking that chip on and off so many times, not to mention potential PCB damage. I noticed what looks like two serial resistors on the data line between the CPU and the EEPROM, these are usually fitted so you can back drive the EEPROM when the CPU is off, I would suspect that the EEPROM can be programmed in-situ via the header just below it.

[@BuyitFixit]

Yes, I noticed them too when I was editing the video, but sometimes it's a lot easier to spot things when watching the video back than when you are actually working on something. The header is for the display, but it seems the i2c lines go there to drive the display too.

[@AubsUK]

At 15:18 thank you for showing the 'Programmer' option on the calculator. You've no idea how many times I've used a website converter (because I'm lazy) to convert Hex to Dec. Now I have it on my calculator. And I'm an advanced computer/server tech, but never realised it was that simple! I feel like an idiot right now.

[@AubsUK]

Great video too, thanks for continuing to share :-)

[@BuyitFixit]

You're very welcome 👍

[@BuyitFixit]

Everyday is a school day 👍I'm glad you got something useful from it 🙂

[@roneckler9937]

In a way, it goes to show people that their data really isn't as secure as they think, although, you do have to have some knowledge in doing what you do. I don't have a chip reader, but if I did, the chip would have probably started playing a tune by time I got done with it. It's been a long time since I played with HEX or Binary codes. Once again, you never disappoint in your videos.

[@BuyitFixit]

Thanks Ron 👍

[@brianvincent6266]

You analytical skills are exceptional.

[@BuyitFixit]

Thanks Brian 👍

[@mitumkallidin3464]

On a AUTEL IM608 key programmer, we read an eeprom and dump the file on the Immo side of the machine, the pin code comes up on the bottom corner. Makes key programming easy with the pincode👌

[@BuyitFixit]

Nice 👍

[@blacklisted4885]

Great work! If only we all had such pals

[@BuyitFixit]

Thanks 👍🙂

[@DB25k]

Absolutely technical artist at work. This was a fantastic marvel and reminds me of develing into code years ago.. thanks so much for sharing....

[@BuyitFixit]

Thank you 👍

[@hammer313]

amazing. I wouldn't have thought it was possible until you did it. I learnt a lot. potentially using the number guessing algorithm sometimes taught in programming 101 classes might have been quicker. blank the top half of the area, if the pin is still set, it's in the bottom half, repeat with blanking half of the bottom half, repeat, repeat, my names on my feet, I'm pete, pete repeat,.

[@BuyitFixit]

Thanks 👍Yes that approach may have been quicker! It looked like the config data started at 0350 in the EEPROM so blanking the top half, and then the bottom half of that block might have narrowed it down quicker.

[@davidchang-yen1256]

Once again I am just astounded at your sleuthing skills - the Sherlock Holmes of electronics you are 😂 Excellent work as always!

[@BuyitFixit]

Cheers David 👍

[@dont-want-no-wrench]

beautiful! i just love this kind of detective work.

[@BuyitFixit]

Thank you very much!

[@derekholme6922]

Now then Bonny Lad, I thouraley enjoy your videos, understand some of it but love the way you work around to find a solution, Thank you.

[@BuyitFixit]

Thanks 👍

[@axelbrendel4091]

Great sleuthing! What always amazes me is how much heat (and thermal cycles) those SMD chips can take! I'd be worried about destroying it after only one or two removals.

[@BuyitFixit]

Thanks 👍I don't think I've managed to kill a chip yet due to removing / refitting.

[@renakunisaki]

I'd be worried about how many pins are left after a few cycles 😂

[@robertbackhaus8911]

First thing I noticed was that the serial data pins from that EEPROM continue on to that debugging header. Companies doing this commercially would likely be using that header. With series resistors between the EEPROM and the processor, you could probably edit the EEPROM live.

[@BuyitFixit]

Yes, I noticed the i2c pins went to that header too when I was editing. However that isn't a debug header. There is an unpopulated debug header elsewhere. The white header is where the display fits, so I guess that the display is using i2c also.

[@309electronics5]

That was quite interesting! I also love some messing arround with raw bytes. I already changed the name and number of a product by overwriting the bytes associated with it. Interesting and i love messing with bytes in a eeprom or flash

[@BuyitFixit]

Thanks 👍Yes you and me both. I used the same programmer with the Stihl headset I just repaired, and with the Tractor dashboard I looked at (helping someone 10,323 miles away). If you like this type of stuff also check out the video I did called "no password no problem" 😉

[@kentswan3230]

well done! It just prooves that going down some rabbit holes is productive.

[@BuyitFixit]

Thanks 👍Yes indeed 😂😂

[@tiggydorset9041]

Quality stuff. Thanks for the education. I thought you were just playing around just for kicks when changing the other values, but then you gave a legitimate reason why someone would actually want to change them. Nice work.

[@BuyitFixit]

Thanks 👍Yes, that's a legitimate use case, but as with anything, there are also some not so legitimate use cases too..

[@ThriftyToolShed]

Well done! I enjoyed watching it, thanks for sharing!

[@BuyitFixit]

Glad you enjoyed it, Cheers Thrifty 👍

[@FuzzyTekShow]

Great video, love that you got carried away and started changing other bytes to satisfy the curiosity! :P

[@BuyitFixit]

Thanks 👍The same thing happened when I looked at a medical ultrasound scanner, I ended up unlocking a ton of stuff and running doom on it. (video is on here too) and similar to the "No password, no problem" solar inverter video too where I found tons of hidden stuff 😉

[@FuzzyTekShow]

@@BuyitFixithaha love it, I'll check it out!

[@DemetryRomanowski]

If anyone is interested this is pretty much exactly how we OEM engine ecm tuners do our thing, simply put read the eeprom, mess with values on a bench see what changes then create a "map" file for the data, that way we know what bytes to change to change the tuning of the engine in the same vehicle. Gets much trickier with modern vehicles now though, nasty checksums and data signing.

[@kurdm1482]

This guy didn't share how he figured out the values efficiently. He definitely skipped a part. But still good video

[@BuyitFixit]

Yes signing and CRC's can be tricky. Sometimes it's easier to get rid of the checks in the code 🙂👍

[@BuyitFixit]

Thanks 👍The values were just converted from hex to decimal with the calculator. I showed the values on the screen. If you open calculator on windows and change it to programmer mode you can select hex and enter one of the hex values and it will show it in decimal.

[@cecildramat-ps9eq]

Hi hope you doing well and thank you for another great video that flabbergasted me from normal electronic repair, programming, binary and converting to hexadecimal and be able to change values, you are just a genius man there is nothing else to it. 😅🥶

[@BuyitFixit]

Hi, thank you for your kind comment 👍

[@richb419]

Hi, good video! I thought that device looked familiar, I used to take care of many large generator dry land sets and some of them had that control panel.

[@BuyitFixit]

Thanks 👍and also thanks for the info 🙂

[@madrafboy]

Nice bit of forensic electronics.

[@BuyitFixit]

Thank you 👍

[@Marshmish]

Nice work Mick, you make it look so easy! suppose it is if you know what your doing.

[@BuyitFixit]

Thanks 👍 Yes, I'm pretty good at working things out 🙂

[@Marshmish]

@BuyitFixit Looking forward to a catch up with your other content.

[@mattsmalley5780]

As always mate, absolutely amazing. Love your videos 👏

[@BuyitFixit]

Thanks a ton!

[@mazafreno]

As usual unbelievable job, thank you for your videos.

[@BuyitFixit]

Many thanks!

[@tujuprojects]

DSE has quite neat models, some of them can be networked to cluster of generators. You can set what state the unloaded gensets are, are they running or shutdown standby. Once they’re needed, it will use syncroscope to sync phasing and once they overlap, the main contactor will connect the genset to load (grid). They use these in developing coutries where they don’t have large powerplants.

[@BuyitFixit]

Interesting, I'm no expert on generator (or anything for that matter 😂😂) but I do like to figure interesting devices out. Thanks for your insight!

[@tujuprojects]

@@BuyitFixit see video ”synchronizing DSE 8660 & 8610”, its shows syncroscope.

[@tujuprojects]

@@BuyitFixit they use rs485 and modbus to daisy chain them kzbin.info/www/bejne/bKuuhWSmp7Ccb9ksi=iON9GQQYsVaxas-x

[@rogerbailey7301]

The 5310 is a more basic controller. The 8660 is a mains controller and controls other genes via there own controller like a 8610.

[@maxvideodrome4215]

I have an old 286 PC with no manual available. Same method here with EPROM .. hardcoded HDD types (cylinders/heads/sectors). Took a lot of work but reverse engineered it!

[@BuyitFixit]

Very nice! Thanks for sharing 👍

[@jasonputtock4428]

I would really really love you to take apart a washing machine rom and inspect those. You are bloody brilliant at this. We just had to go out and spend 1300 on a new appliance because our old one is draining to much energy. We do suffer alot of power outages, I believe the programmer is up the spout. This is not the only machine that failed on us in the last 6 years. So i would like to inspect the rom files.

[@BuyitFixit]

Interesting, a lot of stuff doesn't have an external eeprom. Even this device has a microcontroller with memory that stores the actual program and other data.

[@diemaschinedieviereckigeei2941]

For washing machine controllers it is not uncommon to have a masked rom

[@jasonputtock4428]

ohhhh hoooo. Would this cause programmers to cause issues. If yes, what issues could we expect.?@@diemaschinedieviereckigeei2941

[@luminousfractal420]

Brownout (dips in the supply rather than no supply) cause a lot of damage to component chips. Probably worth you buying a small ups for your machine. That said I found the reason we had massive power usage and my pc's kept dying was poor house wiring, the breakers and cables were all 1950's and random, turned out that 3 electrical outlets had the live wire touching the case, we had a 120v earth/ground. Once I replaced the sockets the power drain stopped, I stopped getting shocks off the switch screws and I narrowed down one safe circuit I could connect my pc to. I went through so many ups devices because none of them expected a live ground cable. Or for the entire house to be run through a single breaker 🤦 lights and sockets both.

[@jasonputtock4428]

We have moved the washing machine to another power line. We are seeing max 2 amp draw on this line. Not the 9 amp or more. When money permit I will have to take down the ceiling to see where the wires are going@@luminousfractal420

[@artursmihelsons415]

Great job! Nice, that there wasn't a crc.. I did similar things with different devices.. 😂 It's always a fun to figure out meaning of stored data.

[@BuyitFixit]

Thanks 👍yes, I've worked on stuff before where there was a CRC and there are quite a few different methods for calculating them.

[@mikecass8306]

A man of many talents, thanks Mick 😀

[@BuyitFixit]

Cheers Mike 👍

[@ginbot86]

Nicely done! Given how generator runtime statistics are saved to EEPROM, I wonder how frequently it does so, given EEPROM's limited write cycle endurance. Then again, with a typical rating of at least a million write cycles, it's probably plenty enough to last the lifetime of the generator it's controlling.

[@BuyitFixit]

Thanks 👍I'm not too sure, I think we worked out that the tractor dashboard I looked at updated once every 10 seconds, but don't quote me on that!

[@101thenuke]

Must admit I really enjoy all your video's. Informative and a nice pleasant manner, thanks

[@BuyitFixit]

So nice of you 👍 Thanks 🙂

[@kareno8634]

*Really Coo,l* but confusing. lol Seeing you master these chips brings the whole *marvel of knowledge* i sadly missed.

[@BuyitFixit]

Thanks 👍

[@neiltheplayer]

Once again (you've heard it before) Brilliant!! thanks for posting

[@BuyitFixit]

Thanks 👍I might have another video similar to this in the next few weeks... 🙂

[@mariemccann5895]

Awesome work!

[@BuyitFixit]

Thank you! Cheers!

[@johnhousego9218]

Another really interesting video and very informative, thank you.

[@BuyitFixit]

Glad you enjoyed it👍

[@e42_channel]

Great video - as always. Two more comments from me: The SOIC clip is a bit risky because parts or the whole circuit containing the serial EPROM is powered by the programmer during read/write which could lead to overload. But I think you have this in mind. Another option would be to use a logic analyzer (Salea cheap ones) to record the I2C bus for reengineering.

[@BuyitFixit]

Thanks 👍Yes that was my thoughts, so it was easier to just remove the chip. I've tried programming them in circuit before (I think it was a Landrover ECU that needed the immobiliser removed) and just ended up removing the chip as I couldn't get it to program in circuit. I had thought about using my LA. I've got one and used it when I was reverse engineering the Milwaukee battery protocol over on Reddit about 9 months ago. I had been thinking about waiting to enter the pin and seeing what addresses it read from the EEProm but because it seemed it was constantly writing logs because of the missing sensors I didn't bother. Thanks again for commenting 🙂

[@mrfrenzy.]

The danger with using the clip is usually if the MCU powers up and sets the write flag for some reason, which leads you to corrupt data that you need. As long as you have a good dump from the same unit it's not very scary. For some units you can solve it by jumping the reset pin on the MCU so it does not start, also some nice programmers can keep the voltage low enough so the MCU does not start but the EEPROM does.

[@e42_channel]

@@mrfrenzy. You are right. But in this case it is an i2c EEPROM and all transfers are handled by the bus protocol. And the write protection (WP, pin7) is tied to ground and not switchable, as you can see at 3:25.

[@Karthor.]

I like these videos, did something similar with an old Volvo radio i had found outside that had a pincode on it, found dumps online and i knew the password to the dumps so i could figure out where the password where stored in it

[@BuyitFixit]

Thanks 👍 and nice 🙂

[@ion3lm588]

i have no ideea what is happening there 😁 i do instead watch Louis Rossman videos but only cos i really believe in right to repair,obviously not by me...very enjoyable thump up 👍

[@BuyitFixit]

Thanks 👍

[@MrWaalkman]

I wondered why you kept pulling the chip rather than use a chip-clip. :) While working on a rooted firmware on my buddy's Dell I had to buy a second chip-clip as the one that came with the kit simply would not work. Otherwise, no problem reading and writing the chip in circuit on the Dell (YMMV). Nice soldering and troubleshooting skills you have there too!

[@BuyitFixit]

Thanks 👍

[@pgsss6354]

As always, excellent job! You 're a genius. Congrats!

[@BuyitFixit]

Thank you very much!

[@ducatisteve20081]

Your knowledge is so vast love the vids keep up the good work .

[@BuyitFixit]

Thanks, will do!

[@Actual_electrical_content]

Proper hooked me in this video in to trying to things have not done before

[@BuyitFixit]

Nice, nothing to loose by trying and you'll gain experience if nothing else 👍

[@Actual_electrical_content]

Oh I’ll be buying a reader for sure great content

[@BuyitFixit]

Thank you 👍

[@snaggglepus]

The newer Deep Sea controllers just have a usb port on the back and they make the software available on their website. you can change all the config, hours and totals very easily

[@BuyitFixit]

Nice 👍I wonder if they require you to send it back still for the pin on newer models?

[@rogerbailey7301]

Yes they do

[@brianwood5220]

You are becoming a bit of a whiz at this programming lark. Great video as always, very interesting. Thanks for sharing.

[@BuyitFixit]

Thanks Brian👍, I've done loads of stuff like this in the past, just not on KZbin 🙂

[@Stefan_Van_pellicom]

That’s some serious skills right there! 👍

[@BuyitFixit]

Thank you 👍

[@colingale]

while a little harder to use the SOC clip are usefull. also note the white header had i2c pins and jtag ( including reset ) for cpu so from there you can read the eeprom without the MCU getting in the way.

[@BuyitFixit]

I did notice the white connector had i2c when I was editing the video. This is actually the connector that the front panel connects to, so the display is probably driven by i2c also.

[@599miata]

By the looks of it, you had great fun there, mate.😊😊

[@BuyitFixit]

Yes, thanks👍

[@MarkLemanUK]

Another (possibly quicker) approach might have been to connect an i2c analyser to the bus and see what went on when the pin was entered. Still, i admire your balls for getting in there with the hot air first 👍

[@BuyitFixit]

Thanks 👍I had thought of that approach too, and did poke the scope onto the lines to see what if they were accessed when the pin screen came up. The issue was because there was loads of sensors not connected it was constantly activity as I think it was writing to the log files, also I the lines go to the display so there it could have also been updating the display as well.

[@schlollepop]

@@BuyitFixitUnderstandable, but filtering for the I2C address of the EEPROM might have made it easy enough. Would likely require some tinkering with sigrok, though.

[@philphil3707]

Your so smart at what you do, I wish I could learn to do what you do, how did you learn to do what you do?

[@BuyitFixit]

Thanks 👍Mostly just messing about with things, I've done stuff like this for years. I've always been curious how things work.

[@salehsalehi8955]

Loved it ..Thanks

[@BuyitFixit]

Glad you liked it!

[@Gr3mI1n]

Not gonna lie, this looks fun! :D

[@BuyitFixit]

😂😂😂😂👍

[@K6WRF]

This was a great video and loved how you went above and beyond to determine what each data entry corresponded to. My questions is how did you determine that was the chip to pull and read? Were there other suspects on yor radar or is there something to gleen from this video as to why you chose that chip over the many others on that board. Thanks

[@BuyitFixit]

Thanks 👍The pin code has to be stored in memory somewhere, so either a battery backed up ram chip, an eeprom or the internal flash or eeprom of the microcontroller. Most of the chips on the board were either op amps for sensors, or interface ICs for external communication, so I started examining the board for memory type chips.

[@K6WRF]

@@BuyitFixit Ahh ok .. I suppose that makes sense. Thanks for the quick reply and great job

[@nigelholland24]

Explained very well great video

[@BuyitFixit]

Thank you 👍🙂

[@johnpartridge7623]

Good job mate, way above my pay grade but it was still good to learn something new 👍

[@BuyitFixit]

Thanks mate 👍

[@dennishammond3126]

That was super informative, thank you Sir from TX

[@BuyitFixit]

Glad you enjoyed it👍

[@domonicwright681]

Amazing absolutely love the detail and fault finding skills! I have a SIP 03937 BATTER BOOSTER RESCUE PAC 3000 that’s giving me some trouble, would love some help if you’d be willing 😅!

[@BuyitFixit]

Thanks 👍What's it doing? or not doing?

[@domonicwright681]

So sorry I’ve only just seen you’ve replied! Thanks so much! So it’s not charging right , there is a voltage selector switch, 12/24 and then off. It’s meant to be in the off position to charge but only indicates charging when the switch is in the 12v position?! And the charge state indicator doesn’t work! Not sure if that makes sense, I could send you a video if you had time to look?

[@BuyitFixit]

You can drop me an email at the channel's name at out look dot com

[@jeroen5838]

Fascinating they set the password similar to DEIF (deepsea competitor), customer password is 2000, service 2001 and master 2002.

[@BuyitFixit]

Thanks 👍

[@rogerbailey7301]

DEIF are not as easy to use

[@wisher21uk]

Fantastic Mick, I’ve never looked into coding before, you have me interested now! You have a brilliant method of discovering and diagnosing problems keep it going thanks 😊

[@BuyitFixit]

Thanks Gary 👍

[@bobroberts2371]

Something to be aware of with industrial pin codes. Many times they are something that is on the machine so the factory service tech has a hint. Like the zip ( postal ) code of the maker, some combination of the model number.

[@BuyitFixit]

Thanks for that 👍

[@Dorff_Meister]

I'm only half way through the video, but I wouldn't think the hex values in the dump would be the PIN. Perhaps if you found four ascii characters... Update: Nicely done on finding the pin in the dump.

[@BuyitFixit]

Thanks 👍

[@crazycarl9484]

Great work as usual, clever bugger 🤣

[@BuyitFixit]

Cheers 👍

[@richbwarner]

That would be a deep sea controller from a ex aggreko machine, all the PIN codes were set as 2000, in the config suite using the p810 connector all the values can be edited.

[@BuyitFixit]

Thanks for the info!

[@VoeViking]

Another great fix. Cheers.

[@BuyitFixit]

Thanks 👍

[@Graeme_Lastname]

Have you ever had a go at a modern car radio/cassette/CD ? Many years ago I was fixing them for a job. The damn things were getting too complicated back then. Be well m8. Thanks for the vid. 😃👍🇦🇺

[@BuyitFixit]

Thanks for commenting 👍🙂

[@Graeme_Lastname]

@@BuyitFixit😃

[@andrewthornton5783]

Amazing deductive work 🤯

[@BuyitFixit]

Thank you 👍

[@melkiorwiseman5234]

Those "16 bit" values are probably actually at least 32 bit values, with the high bytes currently set to 00 00 in the following two bytes until/unless the value becomes too large to store in just two bytes.

[@BuyitFixit]

Yes, I did think of that when I was editing as the adjacent bytes did seem to be 00 00. Thanks for commenting 👍

[@torfinnsrnes6232]

Good detective work. Excellent work. 😊

[@BuyitFixit]

Thank you so much 👍

[@sw6188]

01:04 - "the personal identification number number ... " 🤣

[@BuyitFixit]

😂😂😂😂

[@LimbaZero]

Removing chip when you can see that I2C is also going to pin header next to it :) Most likely that is used to program it in factory. Soldering maybe faster if you have programmer that has socket for so-8.

[@BuyitFixit]

I didn't notice the i2c going to the header until I was editing the video. The header is where the display board connects so I guess it must be also using i2c for the display and buttons.

[@Belginator]

Very clever dude, very enjoyable

[@BuyitFixit]

Thank you 👍

[@greebo7857]

Very cool detective work.

[@BuyitFixit]

Thank you! Cheers!

[@paulmuff9883]

Yee Gods man you’re so clever I’m in ore 👍👍👍😀

[@BuyitFixit]

Thank you 👍