Your Universal Remote Control Center
RemoteCentral.com
General Consumer Remotes Forum - View Post
Up level
Up level
The following page was printed from RemoteCentral.com:

Login:
Pass:
 
 

Original thread:
Post 1 made on Friday October 6, 2000 at 02:48
HW Hackr
Historic Forum Post
I've hacked the hardware details for the JP1 jumper in the RS 15-1994. I've successfully read the internal EEPROM, and monitored its reads/writes while pushing various buttons. I haven't tried writing the EEPROM, but it should be trivial.

There are 2 ICs on the board: U1 is the microcontroller, and U2 is a 2048x8 bit serial EEPROM (ATMEL 24C16N - datasheet available online). Only a few bytes in U2 are used, so I believe that the main code database is stored in a hardwired ROM in U1. U2 holds your customizations (device numbers, macros, key remaps etc.)

JP1 pin definitions:
1 - VCC(U1) (leave unconnected if using batteries)
2 - VCC(U2) (leave unconnected if using batteries)
3 - GND
4 - SDA (U2 data input/output)
5 - input to U1 (unknown function)
6 - SCL (U2 clock)

The SEEPROM is read/written by following the protocol in the datasheet. Until the software memory use is understood, we can't do much more than copy settings from one remote to another. I can already tell that there are various pointers, and it seems like the software calculates a checksum of the entire EEPROM contents after any operation that does a write.

I believe that a devices code upgrade stores the new codes in U2. The easiest way to crack this would be to look at an upgraded remote (maybe the OFA remotes are close enough to be of help).


Hosting Services by ipHouse