With help from Greg I was help to open up the MX-500 without damaging it. Thanks Greg.

I found the 7-pin connector (CN2) has labels on the circuit board as follows:

The right hand three were GND as I thought.
Starting at the top of the four pins on the left, and going down, there are labels that say 37, 39, 40 and VCCVX2. The first three numbered pins go to resistor/diode static protection circuits (R11 thru R13 and D3 thru D8) and then to pins of the same number on what is obviously the controller. This is the largest chip on the board and is labeled

127
OHS1002P
OHSUNG

I cannot find data on this IC although OHSUNG do make remotes - see [Link: 202.31.143.8] . Without this data I cannot determine which of these pins do what.

The fourth signal, VCCVX2, passes through a diode and drives the 3.7V VCC to the remote. It also passes through another diode but I didn't trace where that went. By applying approximately 4.2 to 4.3V between this pin and GND one can power the remote externally after removing the batteries. So access to the connector and powering the remote is possible when the batteries are removed.

The second largest IC is the PROM and it is labeled SST 39VF010. The data sheet can be found at [Link: ssti.com] .

Unfortunately this is a parallel PROM, not serial, and it only interfaces with the controller. The PROM is 128K by 8 bits. According to the data sheet his PROM needs special codes to access it. I haven't read the data sheet in detail to see if they are user selectable or fixed as yet.

Clearly accessing the PROM is done by the controller and communicated to the CN2 connector via pins 37, 39 and 40. And vice-versa of course. There will be a software protocol that needs to be followed to cause the controller to read or write to the PROM. I don't think we'll find out by hacking it unless there is someone with knowledge of this chip who is prepared to share it. Assuming the software for the controller is stored in this PROM it might be possible to take it off and read it on the bench. However there is sometimes another PROM inside controllers which contains the program so it may not be stored in the 39VF010 at all. You could also put a logic analyzer on the PROM and capture its contents as they are executed. That really is hacking it and I don't know if that is legal or not. But even if you can do that you still need to know the instruction set of the controller to understand it.

I might pursue the electrical approach further but the IR approach seems the best bet at present. Sorry I can't give you better news.

Mike