Fiat Punto Low- Car Radio Decoding
I got a “Fiat Punto Low” car radio today to my service for repairing. Exactly, the problem was does the device was locked. The car owner was in a service garage, where the mechanical technicians disconnected the car battery but did not realized does the radio have a security mechanism. When he put back the battery terminals then he sow does the radio ask for the code. What he was done? Tried a fever attempt to unlock the radio but see what happened after entering a fever time the wrong code:
Do you know why this “WAIT” is on the screen?
It is on the screen because the unprofessional, mechanical technicians tried several times to unlock the radio without the good code. The radio has a security mechanism in the firmware, which will count more and more time to let enter the code again.
This type of security is to avoid of so called “brute-force attack” unlocking.
Brute force attacking is a hacking technique to crack the code by systematically change and trying the code like this: 0000, 0001, 0002…0010,..0011,..0100,..until the code is 1111. Let’s say the pin code is 1111. If the device have no anti brute-force attack mechanism then it is possible to easy crack the code.
In this case, the anti brute-force cracking mechanism is the time shifting technique.
What this mean? Lets se on the next diagram what I made for you:
If you enter the first time, the wrong code then you will get “WAIT” on the screen for 1 min. If you put the second time again a wrong code the you have to wait 2 min. If you enter the wrong code after a 10 time too then you have to wait 12 hour until the device let you again enter the code. On most of device, if you entered 12 times the wrong code, then they will go into a “SAFE” mode and you can wait a life long to get again the chance to enter the code.
The customer asked me to unlock his radio if it is possible but not to wait several hours or so. I said ok. Let the unit by me for 1 hour and I will finish the job.
What I have to do is to find the eeprom inside the device and reprogram it with content where I know the code and the time counter is set to zero.
After I opened the device, I found the tiny IC so called 95160 eeprom.
It is an SMD ( Surface Mounted Device ) and I have to desolder them from the main board.
Let’s check the pictures:
This is the inside of the radio from top, when you remove the top cover.
The bottom side of the radio.
Right and Left side. You have to take out these two bolts.
Remove the front cover gently.
Separate the mechanism of the cassette player from the main board-see the above picture:
This is the PCB without the cassette player mechanism.
This is the close up picture of the eeprom and his orientation on the board.
Now I have to remove this tiny eeprom from the board and put it into my favorite Seeprog eeprom programmer. Take care how you remove the IC because of other small components around. I will use my SMD rework station with hot air for this purpose. Please focus on the other side of the PCB on the part under the eeprom. If you lost this component, than maybe, the radio is damaged or something won’t work.
Here is my home made SMD to DIL adapter:
I made it years ago, and this is working well today and never made any mistake. I used a DIL8 IC socket, a peace of HDD data cable and nothing else.
This is the DIL8 IC socket This is the targeted 95160 eeprom
As you can see, I solder the SMD IC to the blank wire of the HDD cable. I used many times that famous SMD crocos but that made to me too much problem with the contact. I had time-to-time worse contact and that drive me crazy. I decide to solder the target IC to the wire and the end.
After I reprogrammed the eeprom and put it back to the PCB. Pressed the power button and entered the code, the radio came back to life without to waiting a couple of hours.
This is a long story got short, but I hope this tutorial will be helpful and save lot of repair time for someone. I can remember the time, when I started with stuff like this, how many hours I spent to solve small and simple problems. These are stuff what wee never will learn in the school. Now I decide to share knowledge and experience as good as I can.
This article was prepared for you by Christian Robert Adzic from Novi Knezevac-Serbia.
Please give a support by clicking on the social buttons below. Your feedback on the post is welcome. Please leave it in the comments.
P.S- If you enjoyed reading this, click here to subscribe to my blog (free subscription). That way, you’ll never miss a post. You can also forward this website link to your friends and colleagues-thanks!
Note: You can check his previous post in the below link: