Whats in a VDR VDO 500 dump

[VectraPwner]

Hi,
I've got an image for my CDR VDO 500

What does it contain? There are some obvious serial number stuff, and some tuning presets.... What else?
Where is the unlock code/security counter?
Are the runs of FFs unused? Can I write my sig in them?

[kmajor1]

Originally Posted by VectraPwner

Hi,
I've got an image for my CDR VDO 500

What does it contain? There are some obvious serial number stuff, and some tuning presets.... What else?
Where is the unlock code/security counter?
Are the runs of FFs unused? Can I write my sig in them?

i think you to read this dump from eeprom 24c16 and send it here for code help .

[VectraPwner]

I've got the image and dumped it to a file.
24c16s are cheap and easy.

I've found the unlock code stored across two bytes and I'm building a lookup table because it looks like the digits are stored in an odd order.

I don't need code help, but I can post the image if needed.

I'd like to know what else is on the chip, if anybody knows.

[stt]

24c16 it'a a chip solder on board in radio
read this with eeprom programmer
and post dump here

[VectraPwner]

I know the 24c16 is a chip. I've unsoldered it, read it with my read/writer, examined the hex dump. I've Compared it to other dumps, and discovered the address of the code and will probably write an app to quickly extract/reset the code before you burn it back.

I already know the code for my unit. I'm NOT asking for a code. I can post the dump if you want it, but its basically the same as all the other VDO CDR500 codes except some of the numbers are different. The code is stored as big-endian nibbles in 0x79,0x7a.

I've found the serial number and some of the tuner presets, i'm interested in what else is in the dump.

[kmajor1]

Originally Posted by VectraPwner

I know the 24c16 is a chip. I've unsoldered it, read it with my read/writer, examined the hex dump. I've Compared it to other dumps, and discovered the address of the code and will probably write an app to quickly extract/reset the code before you burn it back.

I already know the code for my unit. I'm NOT asking for a code. I can post the dump if you want it, but its basically the same as all the other VDO CDR500 codes except some of the numbers are different. The code is stored as big-endian nibbles in 0x79,0x7a.

I've found the serial number and some of the tuner presets, i'm interested in what else is in the dump.

send your dump and lets all see what you are talking about .

[VectraPwner]

Ok, here is a CDR500 bin file - I'm not sure if its the image off the CDR in my car or another one I've downloaded. I think its one that is locked from incorrect code entry.
If you are familiar with the image type, you'll spot the serial, tuner presets and the unlock code without too much trouble.

I want to know what the rest is... For example, a new 24c16 comes as 0xff,0xff across every address so I was wondering if the long ff stretches are unused, and if so can I add my sig to the image without the stereo overwriting it?

[kmajor1]

Originally Posted by VectraPwner

Ok, here is a CDR500 bin file - I'm not sure if its the image off the CDR in my car or another one I've downloaded. I think its one that is locked from incorrect code entry.
If you are familiar with the image type, you'll spot the serial, tuner presets and the unlock code without too much trouble.

I want to know what the rest is... For example, a new 24c16 comes as 0xff,0xff across every address so I was wondering if the long ff stretches are unused, and if so can I add my sig to the image without the stereo overwriting it?

0230 is the code from your dump , but i dont understand what exactly help did you need if you still can expain better to me .

[VectraPwner]

Thankyou,
As I already said, I know the code - Its stored in what looks a bit like big-endian four bit sequences in some rotated cypher across address 0x79 and 0x7a in the dump. I did that for fun - I don't need help with the code.

My question is, what else is stored in the image? I can find the code, I've broken the cypher and I can set it to anything I want.

Where is the error counter stored? How do I reset it?
Whats the stuff before the channel preset names?
Can I safely sig to the ff streams?

[spider-man]

@VectraPwner

There is no Cypher on this Dumped File .

Code is allowed to read in Hex , u can see it just some bytes .

Until now i seen one model Philips where there is a cypher , a Xor Function between Two bytes .

About the reset counter , there is a bit who change every time who we make an error , his adresse change from a Radiocar cpu to other .

We find couter on a hex adresse like this for Example :

0x01 : FF FF FF FF FF FF FF FF FF FF F1 FF FF FF FF FF

Here is can be The adresse 01Ah is the Counter who is 1 , we must change it to F or 0 or what can the CPU or radio accept !

I hope i was clear

[VectraPwner]

@Spider-Man.
No, you've not made yourself entirely clear, but thank you for your contribution.

The value in 0x1a appears to be part of the ascii-encoded serial number information and very unlikely to be the error-counter. Also, In the data you provided, the value in your 0x1a address was 0xf1 (241).

In danger of repeating myself, I'm pretty sure that the two bytes 0x79 0x7a are the security code, and that code is stored in big-endian as four four-byte codes. Each digit appears to map through a different sequence such that 0100 on the first digit does not produce the same decimal value as 0100 in the second digit and so on.
I'm no expert, but this kind looks like a non-keyed cypher, such that a rudimentary code book can be used as a look up table to determine the result.

What I was asking is the address of the error counter and anything else of significance, in a 24c16 image from a VDO CDR500. Origionally I was asking for the location of the security code but found that through my own methods.

[spider-man]

ur not very clear , this is too easy

Why u search about Encoded ASCII ?
All is storred on Hex Format , dont use décimal or anyother encodage !!

Easy