Reading EEPROM kills head unit? KDC-PS909

[Tim H.]

Hello,

I took on a friend's Kenwood head unit (KDC-PS909) with the intention of
reparing it. It would power up correctly, ask for the security code (which I
have) and turn on but no audio. I cracked it open and noticed a chip,
TC7662, pretty hot Turns out, this is a DC-DC converter. Upon power-up, it
would output roughly -8VDC but soon drop off. Odd, I thought. There was also
a ground PCB track on the solder side that was toast. It's in the vicinity
of the DC-DC converter chip. I have a new chip coming to me in hopes that
that will fix it.

However, I've created a new problem. While waiting on this chip, I asked
myself, "where is the security code stored? Internal EEPROM, external?"
Then, I noticed an 8-pin chip sitting next to the NEC MCU marked KKZ01.
After a little research, it turns out that this is a 93C46 EEPROM.

Long story short, I removed the eeprom, put it in my programmer and
proceeded to dump the contents. I solder the chip back in and now I have NO
display whatsoever. So, if the chip was inadvertently written to, would this
cause the MCU to not display anything in an attempt to fool a would-be
thief?

I've also noticed that there's a transistor used as the +8VDC supply
(2SD2396). If I put my meter on it, power up the unit, it'll show about
+7.5VDC for maybe 11 seconds and bam, it dies out. I'm thinking is probably
related to the DC-DC chip not doing its thing. Although, it seems to be
under microprocessor control because if I reset the chip, it'll come back to
+7V and zero out after 11 seconds.

So, the only thing I'm after is a copy of the EEPROM's contents so I can
re-burn it. However, if a corrupt EEPROM won't prevent the unit from even
turning on, I'll pursue other avenues.

Thank You and Good Night,

-Tim

 

[Jack]

You probably corrupted the EEPROM when you read it. I just learned about
this when I was reading an article about security chips. If you try to read
them with normal reader/writers, they get corrupted due to the fact that
during the read process, the reader tries to write something on the chip, to
test it out and this corrupts the chip.
Probably the only way out of it is a new head unit, since you probably
cannot get just a replacement chip.

 

[Tim H.]

You probably corrupted the EEPROM when you read it. I just learned about
this when I was reading an article about security chips. If you try to read
them with normal reader/writers, they get corrupted due to the fact that
during the read process, the reader tries to write something on the chip, to
test it out and this corrupts the chip.
Probably the only way out of it is a new head unit, since you probably
cannot get just a replacement chip.

What's weird is I can scope the EEPROM lines (CS, SCLK, etc) and I'm not
seeing the micro making any kind of queries.

FWIW, the programmer is of my own design. It's been thoroughly tested and I
don't have it set up to write to EEPROMs to "test" them. I realize asking
for repair help is a bit like asking, "...my engine is making this
noise...what is it?"

But if anyone has a dump of the EEPROM, I'd appreciate it!

-Tim

 

[Jerry G.]

Your reader corrupted the chip. The system is infact designed this way to
avoid being tampered with. You can only have this re-programmed by the
authorized service rep for Kenwood radios. They infact do not support
outside service or any outside parts sales for their products. They will
tell you to send them the radio for service only. Otherwise, no parts...

--

Greetings,

Jerry Greenberg GLG Technologies GLG
=========================================
WebPage http://www.zoom-one.com
Electronics http://www.zoom-one.com/electron.htm
=========================================


Hello,

I took on a friend's Kenwood head unit (KDC-PS909) with the intention of
reparing it. It would power up correctly, ask for the security code (which I
have) and turn on but no audio. I cracked it open and noticed a chip,
TC7662, pretty hot Turns out, this is a DC-DC converter. Upon power-up, it
would output roughly -8VDC but soon drop off. Odd, I thought. There was also
a ground PCB track on the solder side that was toast. It's in the vicinity
of the DC-DC converter chip. I have a new chip coming to me in hopes that
that will fix it.

However, I've created a new problem. While waiting on this chip, I asked
myself, "where is the security code stored? Internal EEPROM, external?"
Then, I noticed an 8-pin chip sitting next to the NEC MCU marked KKZ01.
After a little research, it turns out that this is a 93C46 EEPROM.

Long story short, I removed the eeprom, put it in my programmer and
proceeded to dump the contents. I solder the chip back in and now I have NO
display whatsoever. So, if the chip was inadvertently written to, would this
cause the MCU to not display anything in an attempt to fool a would-be
thief?

I've also noticed that there's a transistor used as the +8VDC supply
(2SD2396). If I put my meter on it, power up the unit, it'll show about
+7.5VDC for maybe 11 seconds and bam, it dies out. I'm thinking is probably
related to the DC-DC chip not doing its thing. Although, it seems to be
under microprocessor control because if I reset the chip, it'll come back to
+7V and zero out after 11 seconds.

So, the only thing I'm after is a copy of the EEPROM's contents so I can
re-burn it. However, if a corrupt EEPROM won't prevent the unit from even
turning on, I'll pursue other avenues.

Thank You and Good Night,

-Tim

 

[Uns Lider]

What's weird is I can scope the EEPROM lines (CS, SCLK, etc) and I'm not
seeing the micro making any kind of queries.

Check your solder work on the EEPROM and adjacent to it. Also check to be
sure it's not in backwards!

-- uns

 

[Roy J. Tellason]

The system is infact designed this way to avoid being tampered with. You
can only have this re-programmed by the authorized service rep for Kenwood
radios. They infact do not support outside service or any outside parts
sales for their products. They will tell you to send them the radio for
service only. Otherwise, no parts...

Woo! Another one for my list...

Definitely want to stay away from this brand!

 

[Tim H.]

Your reader corrupted the chip. The system is infact designed this way to
avoid being tampered with. You can only have this re-programmed by the
authorized service rep for Kenwood radios. They infact do not support
outside service or any outside parts sales for their products. They will
tell you to send them the radio for service only. Otherwise, no parts...

Well, as I said in another reply, I'm not even seeing the CPU event attempt
to read the EEPROM. I did save the contents when I first read; the contents
were consistent. So, I'll work on trying to get that back into the EEPROM.
Maybe it sets a "do-not-work" bit somewhere....

The serial data from the buttons on the face is interesting...


Thanks for the reply,

Tim

 

[Bruce Esquibel]

Jack ([email protected]) wrote:
: You probably corrupted the EEPROM when you read it. I just learned about
: this when I was reading an article about security chips. If you try to read
: them with normal reader/writers, they get corrupted due to the fact that
: during the read process, the reader tries to write something on the chip, to
: test it out and this corrupts the chip.

I really don't think this is true of that family for the 93C46.

We used to used those things for something (think it was for alarm panels)
and although some in the family had the "protect bit", this "blowing of it"
to enable security only disabled reading the rom. Pretty sure you could sit
there all day and try reading it, nothing would happen.

It's a rather old device.

More likely the OP put it in wrong back into the socket, the socket itself
is bad or the socket into the circuit board. Maybe static discharge. I
really think it's a safe guess (although the datasheets have to be online
somewhere to prove it) that it has no "self destruct mode".

Pretty sure blowing the protect bit just internally disconnected the rom
address space from being accessed and sent out to the serial i/o.

-bruce
[email protected]

 

[Tim H.]

Jack ([email protected]) wrote:
: You probably corrupted the EEPROM when you read it. I just learned about
: this when I was reading an article about security chips. If you try to read
: them with normal reader/writers, they get corrupted due to the fact that
: during the read process, the reader tries to write something on the chip, to
: test it out and this corrupts the chip.

I really don't think this is true of that family for the 93C46.

We used to used those things for something (think it was for alarm panels)
and although some in the family had the "protect bit", this "blowing of it"
to enable security only disabled reading the rom. Pretty sure you could sit
there all day and try reading it, nothing would happen.

I tend to agree. If I did just a normal read on a protected chip, it would
most likely be all 0s/1s. I don't think Kenwood spent THAT much $$ on R&D to
protect this stereo.

It's a rather old device.

More likely the OP put it in wrong back into the socket, the socket itself
is bad or the socket into the circuit board. Maybe static discharge. I
really think it's a safe guess (although the datasheets have to be online
somewhere to prove it) that it has no "self destruct mode".

No, it wasn't put in backwards. The PCB has markings for pin 1, so I got
that right. I managed to get a datasheet for the EEPROM from a different
manufacturer; and I made sure it matched the pinout (pins 1 and 8 are N.C.).

ESD is possibility. I did take the bare board to my friend to show him which
chip was burnt up.

This head unit has an NEC microcontroller (uPD178018) which interfaces to
the EEPROM. If I reset the micro and scope the EEPROM pins, I just see the
data/clock lines go high and that's it. And yes, I have the trigger set up
right to capture it.

I would like to get ahold of a service manual for this unit in case it
mentions anything I've yet to find out.

Pretty sure blowing the protect bit just internally disconnected the rom
address space from being accessed and sent out to the serial i/o.

I made no attempt to blow the protect bit. As you say, if that security
feature had been implemented, I would've seen it when I initially dumped the
EEPROM.

Thanks,

Tim

 

[david nash]

you guys are doing it all wrong....
it is stored in a small e-prom....
and there is a way to program....but not the way you are doing it....
and the fave problem has to do with power supply....

 

[[email protected]]

Your reader corrupted the chip. The system is infact designed this way to
avoid being tampered with. You can only have this re-programmed by the
authorized service rep for Kenwood radios. They infact do not support
outside service or any outside parts sales for their products. They will
tell you to send them the radio for service only. Otherwise, no parts...

This doesn't make sense, an eeprom programer doesn't read the chip any
different than the cpu would. Right?