Your Universal Remote Control Center
General Consumer Remotes Forum - View Post
Previous section Next section Previous page Next page Up level
Up level
The following page was printed from


Page 1 of 7
RS 15-1994 JP1 details revealed
This thread has 99 replies. Displaying posts 1 through 15.
Post 1 made on Friday October 6, 2000 at 02:48
HW Hackr
Historic Forum Post
I've hacked the hardware details for the JP1 jumper in the RS 15-1994. I've successfully read the internal EEPROM, and monitored its reads/writes while pushing various buttons. I haven't tried writing the EEPROM, but it should be trivial.

There are 2 ICs on the board: U1 is the microcontroller, and U2 is a 2048x8 bit serial EEPROM (ATMEL 24C16N - datasheet available online). Only a few bytes in U2 are used, so I believe that the main code database is stored in a hardwired ROM in U1. U2 holds your customizations (device numbers, macros, key remaps etc.)

JP1 pin definitions:
1 - VCC(U1) (leave unconnected if using batteries)
2 - VCC(U2) (leave unconnected if using batteries)
3 - GND
4 - SDA (U2 data input/output)
5 - input to U1 (unknown function)
6 - SCL (U2 clock)

The SEEPROM is read/written by following the protocol in the datasheet. Until the software memory use is understood, we can't do much more than copy settings from one remote to another. I can already tell that there are various pointers, and it seems like the software calculates a checksum of the entire EEPROM contents after any operation that does a write.

I believe that a devices code upgrade stores the new codes in U2. The easiest way to crack this would be to look at an upgraded remote (maybe the OFA remotes are close enough to be of help).
OP | Post 2 made on Friday October 6, 2000 at 09:52
Historic Forum Post

Now I know what that WOOSH sound was over my head :)
I understand what you are saying, but would personally not have known where to begin. Must say that I am impressed you simply decided to hack this baby.

I suppose this could evetually lead to a whole new forum...and extension of Rob's site: how to upgrade your own RS-1994. Wonder if this violates any reverse-engineering rules by RS or UEIC?
OP | Post 3 made on Friday October 6, 2000 at 11:30
Historic Forum Post
This news is unbe-friggin-lievable [middle portion censored by Remote Central software] !!!!

The OFA format should be the same, so if you have access to a Producer 8 remote, you could check the EEPROM before and after an upgrade.

I have some info on the 3-pin protocol used in older OFA remotes on my site, if you think that might help shed some light on some of the finer points on the 6-pin protocol, it's in the John Wasser section.

Feel free to drop me a line privately if you like.

OP | Post 4 made on Friday October 6, 2000 at 17:45
Historic Forum Post
In hacking this puppy, is there any possibility of memory upgrades???

Greg :-)
OP | Post 5 made on Friday October 6, 2000 at 19:17
Historic Forum Post
That might not be as far fetched as you might think. If HW can figure out how to format the EEPROM, it's possible that we might be able to put a larger one in there. This kinda stuff is all way above my abilities, but I'll be really interested to see where he takes this. Maybe we can transplant some of the insides of a C7 with the 1994 so we can at least get a working punch through, a freed up P&P device button and loads of useful device codes that are MIA in the 1994.

I've posted links to this thread in several places, so hopefully some other folk might jump in and help out.

Here are some links to info on my site that might help out:



OP | Post 6 made on Friday October 6, 2000 at 22:25
Historic Forum Post
Hahaha. I'll be darned. A buzz going through the OFA/RS it perhaps possible to perfect a near perfect remote? Join us next time on "Code 90210".

This is pretty cool stuff. I'll be watchin' this thread...would this apply to the C7IQ as well? (which I recently bought...and really like)
OP | Post 7 made on Saturday October 7, 2000 at 16:33
Historic Forum Post
The trouble with the C7 is that there isn't a 6-pin connector on it, there's a space for it, there's even holes for the pins. Now, would it work if one where to solder in a connector, who knows?

OP | Post 8 made on Monday October 9, 2000 at 17:45
HW Hackr
Historic Forum Post
So far, I've determined part of the EEPROM memory map and all keycodes. To make more progress, I'll need access to an upgraded remote (URC8800 or 9800) to see how the upgrade codes are stored.

Or maybe I'll release my software in the hopes that an advanced electonics hobbyist with an upgraded remote can post the memory dump. I've been using a Linux kernel driver I wrote to capture the EEPROM signals through the parallel port. I wrote another program to process the raw signal data and show the Serial-EEPROM operations (read/write address & data, etc.). I'm reluctant to do this though, because parallel port projects aren't for beginners and I don't want someone burning out their PC's parallel port (or remote).

RS 15-1994 EEPROM memory map (000-7ff):

000: EEPROM checksum
001: complement of checksum at 000

00a-00b: SAT device number (ex: 03 07 = 3*256+007 = 0775)

00c-00d: TV device number (ex: 10 b3 = 0*256+179 = 0179)
(ex: 14 7b = 4*256+123 = 1147)

00e-00f: VCR device number (ex: 20 43 = 0*256+067 = 0067)
(ex: 21 df = 1*256+223 = 0479)

010-011: CD device number (ex: 33 69 = 3*256+105 = 0873)

012-013: AUX1 device number (ex: 40 c3 = 0*256+195 = 0195)
(ex: 41 87 = 1*256+135 = 0391)

014-015: AUX2 device number (ex: 40 b0 = 0*256+176 = 0176)
(ex: 42 e8 = 2*256+232 = 0744)

016-017: PNP device number (ex: 30 a7 = 0*256+167 = 0167)
(ex: 31 a4 = 1*256+164 = 0420)

01b-0ff: advanced codes (fixed size, 5 bytes each) & macros
1st byte is keycode
3rd-4th bytes are copies of device number

100-105: pointers

3ff-???: learned code data structures (variable size, 13-14 bytes each for my examples)
1st byte is keycode
3rd byte is length of learned code
4th-nth bytes are the learned code

RS 15-1994 keycode map:


1S 21
2S 22
3S 23
4S 24
PIP 2d
VOL+ 04
VOL- 05
CH+ 06
CH- 07
1 15
2 16
3 17
4 19
5 1a
6 1b
7 1c
8 1d
9 1e
0 1f
REW 0b
REC 10

OP | Post 9 made on Monday October 9, 2000 at 17:54
Historic Forum Post
Hey HW Hackr,
If you send me an email I can help you out regarding upgraded remotes and I can point you to some work that has been done on the old 3-pin connector that might relate to this.

OP | Post 10 made on Monday October 9, 2000 at 20:01
Historic Forum Post

I have a 15-1925 that is modem-upgradable. You could take a 'snapshot' of it, then call in and have it upgraded, then take another snapshot... I don't know if this is any easier than getting before/after snapshots of the 8800/9800...

- Mike
OP | Post 11 made on Monday October 9, 2000 at 21:47
Historic Forum Post
The 15-1925 is perfect becuase it is the only telephone upgradeable remote that also has the 6-pin connector. I also have one of these available.

OP | Post 12 made on Tuesday October 10, 2000 at 09:44
Historic Forum Post
When you say copy settings from one remote to another, do you mean every setting? ie:learned codes/programmed keys/macros/device codes etc?? If so, why couldn't there be a program that would read the entire memory into the computer, make changes there, then re-submit the entire dump (changes and all)? I've been playing with the idea of chopping up a wireless mic I've got to try and fit its circuit board inside the 15-1994 to control my x10 via homeseer software ( It'd be cool to "backup" the remote before tinkering around inside the case. Also, have you found a way to take it apart without damaging the plastic?

Great job by the way!!

OP | Post 13 made on Tuesday October 10, 2000 at 09:46
Historic Forum Post
Hey Randy,
To answer your question regarding creating software to copy the EEPROM, that's the general idea. If you think you're up to the task by all means give it a go, or at least post any ideas you have to that thread in case someone else can pick up your idea and run with it.

As for opening the case, you do have to be careful but it can be done. You should go around the edge with a thin (but not too sharp) knife, and try and wedge it in between the top and bottom. I forget which side is the "female" side, I think it's the top.

OP | Post 14 made on Wednesday October 11, 2000 at 12:52
Historic Forum Post
If one knew the format of the EEPROM contents then it would be possible to create new in the computer. Mirroring from one device to the next is the first step in achieving this goal. Looks like excellent progress has been made.

Am confused about Randy's comments that he is chopping up a wireless mic to put inside a 1994 to control X-10 from a PC?
OP | Post 15 made on Wednesday October 11, 2000 at 19:40
Historic Forum Post
Okay, I know nothing about what you all are saying. It's gobeldy-gook to me :)

The bottom line - how far off are we from totally programming the 15-1994?
Find in this thread:
Page 1 of 7

Jump to

Protected Feature Before you can reply to a message...
You must first register for a Remote Central user account - it's fast and free! Or, if you already have an account, please login now.

Please read the following: Unsolicited commercial advertisements are absolutely not permitted on this forum. Other private buy & sell messages should be posted to our Marketplace. For information on how to advertise your service or product click here. Remote Central reserves the right to remove or modify any post that is deemed inappropriate.

Hosting Services by ipHouse