Pioneer AVIC-F930BT code - GSM-Forum

melvin v/d berg · 10-15-2011, 20:41

Hello,

I have an pioneer avic-f930bt where I lost my password

I already opened the radio and have read the 93c56 smd chip.
The password in this radio can be changed in the menu. It can have letters, numbers and a space. I though it should be in the serial CMOS 93c56 chip but I'm not sure. This are the chips in the pioneer:
CMOS serial E2PROM (256):
IC1303
S-93C56BD0I-I8

e-nand (4gbyte):
IC4501
PEN002A
hynix H26m31001EFR

flash rom (8mbit):
IC4403
CXX3406
spansion al008j70bf102

sram (4mbit):
IC4406
CY62147EV30LL45BVA

I readed the 93c56 chip and here is the zip file. Inside the zip file there is an e2p and bin file. I hope that someone of you guys can find the code there

Hotfile.com: One click file hosting: pioneer.zip

There was pretty difficult to solder such smd chip.

zlix · 10-16-2011, 14:43

welcome good post!!! THX for it
so it is a new model , you say pass can be letters and numbers let we see how long it is 4 or 5 letters ,and it is not probably in 93c56 cause i think it will act same if you remove it and power it to work
try to read nand flash
regards

melvin v/d berg · 10-16-2011, 18:39

You can enter a password up to 20 characters. In the manual it says it can be 5 to 16 characters. If I disable the power to the 93c56 the radio gives no display anymore. I tried to enter a password. After that I readed the 93c56 again and there is no difference with me previous dump. Maybe the counter is stored somewhere else or maybe there is no counter.
I don't know how to read the nand. It is BGA. It is really difficult to trace because I think the PCB is triple sided.
Here is an service manual with all the traces and every chip

AVIC-X930BT Service Manual (EN).pdf - 4shared.com - document sharing - download
It is for the X930BT but is exactly the same for the F930BT every trace is the same.
If someone can find how to read this chip I would be very happy. I have an Olimex LPC-H2148 to read some nand chips.
There is also an test mode in this radio. For that I need this: "Download GGS1098 from the Service Site". Maybe someone can access the pioneer service site and provide that zip/rar?

melvin v/d berg · 10-16-2011, 19:36

I found some traces to get to these pins of the nand:
CLK
CMD
DAT0-7
NAND3 (VCC)
CCD3_IOON (VCC?)
A lot of grounds

This nand chip is an e-mmc. How do I read that chip? :S
I really think the password is in there. Also all the sofware is in there

Maybe it could also be in the flash rom? If I look at the user manual I don't think it is in the flash rom. All other data is there that you can reset from the system menu. The flash rom has also an reset pin. I don't really think the password is in there but maybe someone can tell me that?

oemrepair · 10-16-2011, 20:02

Quote:

Originally Posted by melvin v/d berg

I found some traces to get to these pins of the nand:
CLK
CMD
DAT0-7
NAND3 (VCC)
CCD3_IOON (VCC?)
A lot of grounds

This nand chip is an e-mmc. How do I read that chip? :S
I really think the password is in there. Also all the sofware is in there

Maybe it could also be in the flash rom? If I look at the user manual I don't think it is in the flash rom. All other data is there that you can reset from the system menu. The flash rom has also an reset pin. I don't really think the password is in there but maybe someone can tell me that?

code in flash package:BGA

i will decode it on my table in 5 minutes.

wbr

melvin v/d berg · 10-16-2011, 20:12

So do I need to read the nand and send the 4gb?
http://rere.qmqm.pl/~mirq/JESD84-A44.pdf
It seems the password is really in the nand.
How do I wire up the nand to the lpc-h2148? And what software do I need?

melvin v/d berg · 10-17-2011, 00:22

I searched my self blind. The radio didn't even had to open. And yes the key is in the nand. Al I had to do is find this page Condi's HACKMODE v1.4 - DiskRW, GpsGate, TextFiller, RegEditor with .reg files associated! [updated: 13.06.2011] - AVIC411.com

On user/system/security/password there is a plain text file with your password

play7 · 10-18-2012, 23:33

Quote:

Originally Posted by melvin v/d berg

I searched my self blind. The radio didn't even had to open. And yes the key is in the nand. Al I had to do is find this page Condi's HACKMODE v1.4 - DiskRW, GpsGate, TextFiller, RegEditor with .reg files associated! [updated: 13.06.2011] - AVIC411.com

On user/system/security/password there is a plain text file with your password

Hey man thank you, i tried but can't find a file inside the maps.

10-15-2011, 20:41	#1 (permalink)
melvin v/d berg Junior Member Join Date: Oct 2011 Location: Netherlands, Utrecht Posts: 5 Member: 1672284 Status: Offline Thanks: 2 Thanked 3 Times in 1 Post	Pioneer AVIC-F930BT code Hello, I have an pioneer avic-f930bt where I lost my password I already opened the radio and have read the 93c56 smd chip. The password in this radio can be changed in the menu. It can have letters, numbers and a space. I though it should be in the serial CMOS 93c56 chip but I'm not sure. This are the chips in the pioneer: CMOS serial E2PROM (256): IC1303 S-93C56BD0I-I8 e-nand (4gbyte): IC4501 PEN002A hynix H26m31001EFR flash rom (8mbit): IC4403 CXX3406 spansion al008j70bf102 sram (4mbit): IC4406 CY62147EV30LL45BVA I readed the 93c56 chip and here is the zip file. Inside the zip file there is an e2p and bin file. I hope that someone of you guys can find the code there Hotfile.com: One click file hosting: pioneer.zip There was pretty difficult to solder such smd chip. Last edited by melvin v/d berg; 10-15-2011 at 20:47.

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Similar Threads
thread	Thread Starter	Forum	Replies	Last Post
PIN1/PIN2 CODE	Jon	Nokia Legacy Phones ( DCT-1 , DCT-2 , DCT-3 , DCT-L )	1	12-26-2012 03:40
Help: Forgot my 6110 user lock code!!	GByte9	Nokia Legacy Phones ( DCT-1 , DCT-2 , DCT-3 , DCT-L )	5	05-10-2012 14:14
5110 Security Code Help!	cahrisma	Nokia Legacy Phones ( DCT-1 , DCT-2 , DCT-3 , DCT-L )	6	07-05-2010 09:04
Orange IL, Nokia 5110 GSM codes...	rosso11	Nokia Legacy Phones ( DCT-1 , DCT-2 , DCT-3 , DCT-L )	0	11-05-1999 20:38
Pin Code	Verdonn	Nokia Legacy Phones ( DCT-1 , DCT-2 , DCT-3 , DCT-L )	0	10-23-1999 15:35

10-16-2011, 14:43	#2 (permalink)
zlix No Life Poster Join Date: Apr 2007 Location: Serbia Vrbas Posts: 2,058 Member: 493754 Status: Offline Thanks: 1,731 Thanked 611 Times in 438 Posts	welcome good post!!! THX for it so it is a new model , you say pass can be letters and numbers let we see how long it is 4 or 5 letters ,and it is not probably in 93c56 cause i think it will act same if you remove it and power it to work try to read nand flash regards

10-16-2011, 18:39	#3 (permalink)
melvin v/d berg Junior Member Join Date: Oct 2011 Location: Netherlands, Utrecht Posts: 5 Member: 1672284 Status: Offline Thanks: 2 Thanked 3 Times in 1 Post	You can enter a password up to 20 characters. In the manual it says it can be 5 to 16 characters. If I disable the power to the 93c56 the radio gives no display anymore. I tried to enter a password. After that I readed the 93c56 again and there is no difference with me previous dump. Maybe the counter is stored somewhere else or maybe there is no counter. I don't know how to read the nand. It is BGA. It is really difficult to trace because I think the PCB is triple sided. Here is an service manual with all the traces and every chip AVIC-X930BT Service Manual (EN).pdf - 4shared.com - document sharing - download It is for the X930BT but is exactly the same for the F930BT every trace is the same. If someone can find how to read this chip I would be very happy. I have an Olimex LPC-H2148 to read some nand chips. There is also an test mode in this radio. For that I need this: "Download GGS1098 from the Service Site". Maybe someone can access the pioneer service site and provide that zip/rar?

10-16-2011, 19:36	#4 (permalink)
melvin v/d berg Junior Member Join Date: Oct 2011 Location: Netherlands, Utrecht Posts: 5 Member: 1672284 Status: Offline Thanks: 2 Thanked 3 Times in 1 Post	I found some traces to get to these pins of the nand: CLK CMD DAT0-7 NAND3 (VCC) CCD3_IOON (VCC?) A lot of grounds This nand chip is an e-mmc. How do I read that chip? :S I really think the password is in there. Also all the sofware is in there Maybe it could also be in the flash rom? If I look at the user manual I don't think it is in the flash rom. All other data is there that you can reset from the system menu. The flash rom has also an reset pin. I don't really think the password is in there but maybe someone can tell me that?

10-16-2011, 20:12	#6 (permalink)
melvin v/d berg Junior Member Join Date: Oct 2011 Location: Netherlands, Utrecht Posts: 5 Member: 1672284 Status: Offline Thanks: 2 Thanked 3 Times in 1 Post	So do I need to read the nand and send the 4gb? http://rere.qmqm.pl/~mirq/JESD84-A44.pdf It seems the password is really in the nand. How do I wire up the nand to the lpc-h2148? And what software do I need?

10-17-2011, 00:22	#7 (permalink)
melvin v/d berg Junior Member Join Date: Oct 2011 Location: Netherlands, Utrecht Posts: 5 Member: 1672284 Status: Offline Thanks: 2 Thanked 3 Times in 1 Post	I searched my self blind. The radio didn't even had to open. And yes the key is in the nand. Al I had to do is find this page Condi's HACKMODE v1.4 - DiskRW, GpsGate, TextFiller, RegEditor with .reg files associated! [updated: 13.06.2011] - AVIC411.com On user/system/security/password there is a plain text file with your password