Need some help searching identification

Fri Nov 25, 2011 9:29 am   

On Fri, 25 Nov 2011 19:24:11 +1100, Franc Zabkar
<fzabkar_at_iinternode.on.net> put finger to keyboard and composed:


It's not the same part, but it has an R12 marking:

SR12, RailClamp, Semtech, Low Capacitance TVS Diode Array:
http://www.semtech.com/images/datasheet/sr12.pdf

- Franc Zabkar
--
Please remove one 'i' from my address when replying by email.

Fri Nov 25, 2011 10:06 am   

On Fri, 25 Nov 2011 19:24:11 +1100, Franc Zabkar
<fzabkar_at_iinternode.on.net> put finger to keyboard and composed:


Try pulling up the EEPROM's Write Protect pin to Vcc. That should
disable any writes.

BTW, there is a 51 ohm resistor in series with the Vcc input. This
would suggest that the current draw of the entire PCB needs to be very
low. For example, a current draw of 10mA would result in an
unacceptably high voltage drop of 0.5V. According to the data sheet of
the BR24L02, the voltage drop across the 51 ohm resistor during write
mode would be about 60mV. That sounds OK.

256×8 bit electrically erasable PROM
BR24L02-W / BR24L02F-W / BR24L02FJ-W
BR24L02FV-W / BR24L02FVM-W:
http://www.rohm.com/products/databook/eeprom/pdf/br24l-e.pdf

- Single power supply (1.8V to 5.5V)
- Write (5V) : 1.2mA (Typ.)
- Read (5V) : 0.2mA (Typ.)

- Franc Zabkar
--
Please remove one 'i' from my address when replying by email.

Fri Nov 25, 2011 11:16 am   

Le 25/11/2011 09:29, Franc Zabkar a écrit :

Hi Franc,

The Semtech could be a good candidate for the function, however it has
only 4 pins, D3 has 6, and D3 is much more tiny, the Semtech is SOT143
2.8mm long .

pf

Fri Nov 25, 2011 9:06 pm   

On Fri, 25 Nov 2011 11:16:24 +0100, "Pierre-François (f5bqp_pfm)"
<pfmonet_at_wanadoo.frospam> put finger to keyboard and composed:


That's why I wrote that "it's not the same part". Nevertheless I
suspect your part would have a similar function. In any case, what is
preventing you from performing a simple test with a multimeter? AISI
the circuit is essentially just an EEPROM on a stick and should not
require much effort to "reverse engineer".

- Franc Zabkar
--
Please remove one 'i' from my address when replying by email.

Sat Nov 26, 2011 11:58 am   

On Wed, 23 Nov 2011 07:57:27 +0100, "Pierre-François (f5bqp_pfm)"
<pfmonet_at_wanadoo.fr> put finger to keyboard and composed:



Here is my best guess as to your circuit layout:



Vcc 51R 51R
___ Vcc1 ___ Vcc2
Red (4) o-|___|--+---+-----|___|---+--------> to EEPROM pin #8
R1 | | R2 |
| | |
| | D2 |
--- z ---
C2 --- A 6.2B --- C3
| | |
R10 | | R11 |
___ | | ___ |
Blk (2) o-|___|--+---+-----|___|---+--------> to EEPROM pin #4
51R Gnd1 51R Gnd2
Gnd



Vcc1
-+-
|
|
-
SDA 51R ^ 51R
___ D3-A| ___
Yel (1) o-|___|--------+--------|___|----+---+------> EEPROM pin #5
R8 | R4 | |
- - ---
^ D4-A ^ --- C5
| | |
| --+--
-+- |
Gnd1 -+-
Gnd2



Vcc1
-+-
|
|
-
SCL 51R ^ 51R
___ D3-B| ___
Blu (3) o-|___|--------+--------|___|----+---+------> EEPROM pin #6
R7 | R3 | |
- - ---
^ D4-B ^ --- C4
| | |
| --+--
-+- |
Gnd1 -+-
Gnd2



Vcc2
-+-----------------------+---+----+
| | | |
| | R5| |R6
.-. | .-. .-.
1K | | R9 | | | | | 2K2
| | | | | | |
'-' .-------V-------. | '-' '-'
| | | | | |
-----| 1 A0 Vcc 8 |--- | |
| | | |
.--| 2 A1 WP 7 |--. | |
| | | | | |
|--| 3 A2 SCL 6 |--)---'----)------> to D3-B via R3
| | | | |
|--| 4 Gnd SDA 5 |--)--------'------> to D3-A via R4
| '---------------' |
| BR24L02 |
| +--'-+
| | |
| .-. |
| R12 | | --- C1
| 10K | | ---
| '-' |
| | |
'------------------+----+
Gnd2


(created by AACircuit v1.28.6 beta 04/19/05 www.tech-chat.de)


I suspect that the pinout of D3 is as follows:


D D
pin2 ---|<|---o---|<|--- pin1 D3-A
|
pin3


D D
pin5 ---|<|---o---|<|--- pin4 D3-B
|
pin6


I confess that I don't understand the purpose of D4.

- Franc Zabkar
--
Please remove one 'i' from my address when replying by email.

Sun Nov 27, 2011 4:10 pm   

Le 26/11/2011 11:58, Franc Zabkar a écrit :

Hi Franc,

Back to home after two days outside I'll look at that, thanks for your
work, I appreciate very much.

All the bests.
pf

Sun Nov 27, 2011 4:12 pm   

Le 25/11/2011 21:06, Franc Zabkar a écrit :

Yes I'm going to do it.
pf

AISI

Sun Jan 15, 2012 6:58 pm   

On Thu, 24 Nov 2011 14:58:10 +0100, "Pierre-François (f5bqp_pfm)"
<pfmonet_at_wanadoo.fr> wrote:


Production is simple.
WIth a 64-bit keynumber and a counter.
You get a key escrow system.
The dvd either gets or contains a control sequence.
It reads the key, does some function on it combind with a simple
counter, passes it on.
Though the counter may be signed as well.

A 64-bit DES block would be simple to do.
Have the DES block info in the flash onboard the PIC.
Do the whatever once to get an update validation key.
Then write garbage to the DES block info.

If that is the case you can either reverse engineer the serial protocol
or the update code on the disc.

You'll need a way to watch or record the data being sent back and forth.
You might try sparkfun or seed studios for a bus pirate or logic
analyser setup.
The USB ones not the standalones.

Good luck.
















--
Doors - Dont look at the future in a window.
Walk to a door - Open it, and go there.

http://www.freedoors.org
http://ata.freedoors.org

http://baencd.freedoors.org
AntiSpam in affect.
doorsremove_at_freedoors.org
mailto:doorsremove_at_freedoors.org