BLAUPUNKT VW GAMMA REPAIRING & UNLOCKING
I got yesterday into my service center a nice job from a customer. He brought his car radio to me for repairing the tape mechanism because the tape player cannot play the tape and the mechanism gives a squeeze noise. I decide to let a try even if it is an old model of car radio but! be careful with car audio equipment repairing! Why? it can be a trap, because of the security code of the radio equipment .I know from my experience this model of car radio have a security code and it will be activated if the device is disconnected from the car or the car battery is disconnected for some reason from the car.
Therefore, I call back the customer and asked for the radio code, he told me, he does not have any code and he does not know his radio have a code…This part is the trap. The car radio can be stolen or you have to do extra job for the customer because he/she maybe doesn’t know there is a code, and wish to repair the radio and use the car radio as before, but won’t pay for the decoding of the device. In some newer cars, it is very hard to unlock the audio-video equipment if you have no experience and no tools. This could be very expensive for you, if the customer says it is locked because of your fault, and it was not locked before disconnected from the car.
Ok, let us go!
This is the equipment:
When I connected the power source to the equipment, I got as I supposed the SAFE on the LCD that is meaning the car radio is locked and has to be unlocked with the code which should be entered by the owner or have to unlocked by a specialist if the owner don’t know the code.
Unlocking process is coming later in this article.
I pull out that piece of tape. Inspected the other parts for other mechanical problems, I found everything was fine. Now we go to the part two. We unlocking the car radio, because the user does not know the right code. In this device the unlock code is stored in the SPI (Serial Peripheral Interface) eeprom.
For first, we have to find that tiny SMD (Surface Mount Device) IC, which name is ST95160 it is located under the tape mechanism, so we have to pull out the mechanism. Be careful, you have four screws to take out. Then pull up with the fingers the flat cable on the left side. You do not have to disconnect the white cable bond on the right side.
My method to read and write an eeprom is to take it out from the circuit, so you can avoid “waking up” the CPU and damaging the firmware. You can even shorten the oscillators on the board but all this stuff is too sketchy for me and I always take out the eeprom and put it in the programmer.
In this case, this is an ST95160 SPI eeprom and I use the PonyProg eeprom programmer. I have to build quickly a programmer, which you can see in the picture. This is a simple programmer for 95XXX and 25XXX eeproms. With this programmer, you can use the PonyProg software on Windows XP or Windows 7 OS.
In the device list, select the 25160 device because the 95160 is the same IC and there are no 95160 in PonyProg.
You can download PonyProg from www.lancos.com
I made a backup of the original eeprom.
ALWAYS BACKUP THE CONTENT OF THE ORIGINAL EEPROM!
I wrote content into the eeprom, with a known code. I put into the four digit code by pressing the numbers 1, 2, 3 and 4 on the number pad on the radio. The first number pad is the first digit of the code, the second number pad is the second digit and so on to the last digit. After that you have to press the right arrow on the radio and wait until on the LCD writes “Learning”, then you hade correctly entered the unlock code.
The car radio still plays tapes and the code no more mystery for the owner. If there is a section, where I can upload the eeprom content for these device please let me know and I will share it.
The job is finished. Below is the link to the eeprom file:
https://drive.google.com/file/d/0BzCmxPSYmVj2eXMta1NEaXhnNUE/view?pli=1
This article was prepared for you by Christian Robert Adzic from Novi Knezevac-Serbia
Please give a support by clicking on the social buttons below. Your feedback on the post is welcome. Please leave it in the comments.
P.S- If you enjoyed reading this, click here to subscribe to my blog (free subscription). That way, you’ll never miss a post. You can also forward this website link to your friends and colleagues-thanks!
(209)Dislikes
(1)
33 Comments
Leave a Reply
Anwar Shiekh
May 22, 2015 at 10:30 am
One impressive fix; how may repairers would be willing to reprogram the EEPROM for a customer
Randy
May 22, 2015 at 11:21 am
excellent and informative article Christian! I learned a lot from your work, good job!
Robert Calk
May 22, 2015 at 12:25 pm
Good job Christian. Thanks for the article. Do you think the cassette tape itself was bad for why the tape player ate it?
Chris
May 30, 2015 at 4:18 am
I don't know.
Maybe. But I think does the major problem was with the mechanism.
The user do not use the type player often and maybe there was dust or whatever...
Yogesh Panchal
May 22, 2015 at 2:40 pm
Congratulations! for saving equipment from junk yard.
Drew Roberts
May 22, 2015 at 6:10 pm
Hello Christian - very nice description! I wanted to know what you modified in the EEPROM to change the code. It's a 16kbit device (2kByte) - where do you find the code? (I am assuming there is other data stored on the EEPROM??)
I have a few of these "locked" radios that have been collected from a local salvage yard. It's not worth it to pay to get them unlocked, but if I could do it myself, they'd be nice replacement radios.
Thanks again for the information!
Albert
May 22, 2015 at 7:26 pm
Good question Drew, that's exactly what I wanted to know. How put back the original Flash Eeprom content and knowing the code is 1,2,3,4 ?
It is probably a default Blaupunkt VW Firmware to unlock this device?
Cheers
Albert.
Chris
May 24, 2015 at 2:30 am
Hi Drew, I appreciate your supporting my article, thank you.
I can not explain exactly how the decoding stuff work, because you have to crack the algorithm of the cpu of the radio and there is a lot of think trust me. But, I can help you and all other people to share my eeprom content whit you and you have to write it to your radio and you will get the code too from me for that eeprom.
The code is written into the eeprom on the offset address 4B0-4B3. There are four bytes which are scrambled whit an algo of Blaupunkt.
Read out the eeprom and give me that four bytes I will send you back the code.
But the best way is if I share whit you my eeprom dump whit the code.
We have to ask Jestine how can I share whit this community this eeprom dump and then you can download it.
I hope it is not a problem for Jestine.
Chris
May 24, 2015 at 2:33 am
Or, you can write this hex numbers to your eeprom on the offset 4B0-4B3:
1C 1D 23 21 and your unlock code is 1807.
Albert
May 22, 2015 at 7:32 pm
Very Nice article Christian Robert Adzic ! Nice programmer schematic too! This is great stuff ! I have build some like the USBasp for Pics and others for AVR too.
But for these kind of serial flashable chips I use a Universal programmer for these IC's and many other cpu's,Eeproms/eproms,TTL and CMOS ic's : The Genius G540 from Shenzhen China (Ebay and 'stg51.com').
This Genius programmer has one big advantage and that is that it has pincheck controlled Reading, Programming and Verifying ! So if one or more pins have a bad galvanic contact it Holds and gives a warning message to the User!
Loved reading your article Christian Robert Adzic !
Albert.
Chris
May 24, 2015 at 9:05 pm
Thanks Albert for supporting my article. This eeprom programmer what I build up is a modified SI-programmer. I always made my eeprom programmer. The unevarsal programmer in most situation did not support writing/reading of eeproms whit data protection function. That are special eeproms for the industry like vehicle industry, medical, military and so on. Wen I was younger, in my country was war zone, and then I could not buy any programmer but I made my programmers and after so many years I use them or I build a new one. Check for the eeprom 93CS46 datasheet. Sometime I have to brake the limit, and physically brake into that small IC and make a connection so I can read or write some data in/out...
I appreciate the universal programmers too. I will buy one. Its cheap today and do a lot of work in many electronic device.
Albert
June 3, 2015 at 5:29 am
Thanks for your clear answer Christian Robert Adzic. Maybe you also are able to read the chips in ink cartridges that are encrypted somehow?
In China they sell new ink cartridges and new replacement chips or even the little programmers that can reprogram those protected ink caps.
If I'm not mistaken the used chips inside are also 8 pin soic Serial Flashable Eeproms.
(With Sin, Sout, Clock, Reset and Vcc and GND).
Greetings,
Albert.
faical
February 24, 2018 at 3:42 am
bonsoir je cherche mon code slvp le probleme j'arrive pas a lire mon eeprom je ne sais pas laquelle je vais vous envoyer la photos si c'est possible
==================
good evening i am looking for my code slvp the problem i can not read my eeprom i do not know which i will send you the pictures if it's possible
edgar
May 22, 2015 at 7:42 pm
Your problem diagnostic and repairing skills articles are very interesting, my wish is to be like you one day. I'm learning electronics out of interest, and attained a certificate with Speciss college, but lack the practical side of it. So your articles are helping me quite a lot. Thank you a lot.
Chris
May 24, 2015 at 3:10 am
The most important think is to figure out why that think die. I'm always do a profile analyzing of the owner, it says a lot of thinks. Then I ask question so I take infos from the owner is he/she speaking the truth or is something hiding.
I like to feel the thinks before I start to repair or make some new stuff.
Remember, always find the source of the problem then repair.
this is my philosophy.
Humberto
May 23, 2015 at 1:42 am
Congratrulations, you are an expert.
Florin
May 23, 2015 at 2:34 am
Christian
The information about unlocking codes is too vague. There are many unknowns for a first time repairer. I think you should write a series of articles about it. The more detailed, the better.
Chris
May 24, 2015 at 2:51 am
Thank you Flory, maybe I write some texts about unlocking. I will see...
Albert Hoekman
May 23, 2015 at 4:50 am
Nice job, thanks for sharing.
Dr Ramesh Yadav
May 23, 2015 at 8:37 pm
Very nice articles...Informative and of day to day usefull.
Thanks a lot.
Keep updating
Suggesting for some article on medical equipment Repair...like monitor/ECG/Ventilator etc
Debirt Maynard
May 24, 2015 at 5:20 am
Great work... programming or reprogramming eeprom is an area most venture with trepidation but positive results are always a confidence booster. Thanks again.
Chris
May 24, 2015 at 9:21 pm
For me is eeprom and firmware content modification like genetic engineering.
I like that stuff. 🙂
Chris
May 26, 2015 at 1:30 pm
Hi folks!
Jestine put the link for the eeprom binary file.
Thanks Jestine.
Now you have to download the file.
Desolder your eeprom from the radio.
Backup the original eeprom content.
Load the downloaded file into your eeprom programmer software.
Write it to the eeprom.
Sloder back the eeprom to the radio.
Power on the readio end enter this code: 1807
If you go somewhere problem let me know, I will help you.
I hope this will help and save from junk your or your customers radios.
I wish to you a nice repairing.
Elphius Gaseemeloe
May 26, 2015 at 6:35 pm
i m very impressed with your article,it really inspires me,to be more technically minded,i will try this,since i have got many radios.
Taring K Arioka
June 11, 2015 at 3:24 pm
Programming is new to me, however thanks again for sharing
Om Arya
July 7, 2015 at 1:48 am
Wow what a tacky repair made Chris you are a true programmer and professional repairer. Great effort and thinking put into just to repair a car radio love and appreciate it.
Bulent Nur
July 25, 2015 at 8:13 pm
Good job, thanks for information. Greetings of Turkey.
antonio
December 26, 2015 at 10:56 am
Hello, very nice tutorial .I did dump the EPROM, now how do I know the unlock code? ... Where I can send the dump?
Dave
May 18, 2016 at 5:30 pm
Thank you very much for your precious instructions. I have de-soldered the eeprom but forgot to take pin#1 ref. By checking the circuit, I am almost sure pin#1 is where the "st" logo is and torward the big "ti" chip (e.g. where your red arrow points in the pic you shared).
Can you help?
Thank you so much,
Dave.
Dave
May 19, 2016 at 1:52 pm
Hello,
I don't know whether this message has already reached you or not as I have typed in it twice. If so, please disregard this last one.
I wanted to say thank you for your very interesting article. At the moment I only want to practice and I came across a VW Gamma radio with a SAFE code, followed your article and now I am about to dump the eeprom content. I only need an information: pin#1 of the ST95160 should be exactly under the "ST" logo. Unfortunately, when I have de-soldered the ic, I didn't note the pin#1 ref. on the circuits board then I'd like to ask you if you can tell me where it is. I did some measurements and it appears to be where the red arrow (your circuit's picture) points. Would you be so kind to confirm that? Thank you very much indeed.
Dave.
Terry
December 7, 2017 at 8:02 am
Great stuff! It would be interesting to see the serial number of the radio you repaired to exercise my mind deducing the Blaupunkt algorithm and possibly awake my car boot Gamma this way without messing with the eeprom.
Adem
July 22, 2020 at 3:10 am
I wanted to say thank you for your very interesting article.
Adem
Luis
August 12, 2023 at 8:09 pm
Hello
Write Dump Address 4B0 - 4B3
HEX: 1C 1D 23 21
But Code no 1807