Need some help searching identification

["Pierre-François (f5bqp_pfm)"]

Hi the Group,

On the following module (see the picts into the links below) I'm
searching to identify the following components:

IC1: L02
BV67W
Probably a PIC (?), nevertheless for sure a programmable component.

D4: 6F
42

D3: R12

D2: 6.2B
or
8.2B
93
Difficult to read clearly even under the binocular.

Here are the picts:

Pile: http://cjoint.com/?AKwxdrhymgr

Face: http://cjoint.com/?AKwxfvUq7kI


The most important is IC1.

D3 has six pins, very strange for a rectifier, my smd code book doesn't
have an "R12".

Many thanks for your help.
Pierre-Francois, f5bqp

[Piotr Piatek]

On 23.11.2011 07:57, "Pierre-François (f5bqp_pfm)" wrote:

> On the following module (see the picts into the links below) I'm
> searching to identify the following components:
>
> IC1: L02
> BV67W
> Probably a PIC (?), nevertheless for sure a programmable component.

Serial EEPROM with I2C bus, some variant of 24C02, perhaps BR24L02

> D4: 6F

npn transistor BC818-25

[Morten Leikvoll]

""Pierre-François (f5bqp_pfm)"" <pfm...@wanadoo.fr> wrote in message
news:4ecc995b$0$2531$ba4a...@reader.news.orange.fr...

Here are my guesses.
D2: 6.2 zener or tranzorber (protection) diode.
C2 looks like a high voltage cap. Is this module connected to some
transmission (tele) medium?
It would help with a description what this module does and/or where it came
from.
If IC1 is a serial eeprom, there must be some logic int (or ext) to
read/write it. If int, maybe d3 is some tiny cpu, if ext it may be some dual
port logic. Or maybe a hall sensor? It looks like the i2c bus (from the L02
chip) is also connected to this chip, so my guess is a sensor or maybe even
a unique serial number chip (check dallas, now ti)

The wires seems to be gnd,power,scl and sda.

You could also try http://www.smdok.com/ or
http://www.marsport.org.uk/smd/mainframe.htm (google for smdcode)

If you also could remove the white label, we could try to reverse engineer
the netlist and get more out of it. I see there is a lot of 51R resistors
there..

["Pierre-François (f5bqp_pfm)"]

Hi the Gang,

Many thanks for these first replies, I'll continue to investigate, your
guesses are interesting and bring me on the good direction.
If any other ideas don't hesitate, you're welcome.

All the bests and thanks again.
pf, f5bqp

["Pierre-François (f5bqp_pfm)"]

Hi Morten & the Gang,

I forgot to answer your question, so here it's:
This small module is a dongle associates to a DVDROM which contain the
update of the cartography for a car GPS.

When you open the motorized screen which flip from 90°, you have on the
side of the GPS screen a 3.5mm jack socket to plug this dongle.
then you insert your DVDROM to update the hard-disk of the GPS unit.
The 3.5mm jack is a 4 pins jack going to the 4 color wires you can see.
The 3.5mm jack isn't on the picture.

Hope you understand better the functionality of this small module.
This is a key, you update once then you cannot update another GPS system...
The problem is that I'm going to add from time to time some remarkable
points to the cartography, then I'll update much more than once!
So I need to find a way to update that dongle.

Tomorrow I'll remove that white label to do another pict for you.

All the bests
pf

[Franc Zabkar]

On Wed, 23 Nov 2011 07:57:27 +0100, "Pierre-François (f5bqp_pfm)"
<pfm...@wanadoo.fr> put finger to keyboard and composed:

>D4: 6F

>D3: R12

>Here are the picts:
>
>Pile: http://cjoint.com/?AKwxdrhymgr
>
>Face: http://cjoint.com/?AKwxfvUq7kI

D4 looks like a dual diode with common cathode, or could it be a dual
zener with common anode ???

If D3 is some kind of diode array, then your multimeter may be able to
tell you where the PN junctions are.

- Franc Zabkar
--
Please remove one 'i' from my address when replying by email.

["Pierre-François (f5bqp_pfm)"]

Hi Piotr,

I've checked the BC818-25 datasheet, they're saying 6Fs for the marking,
so I don't know.

Concerning the 24C02 & the BR24L02 these are serious possible
candidates, however the both datasheet don't mention any marking code so
I don't know either.
But it's very probable it's an I2C EEPROM thinking to the function this
small dongle is doing.

All the bests.
pf, f5bqp

[Piotr Piatek]

On Thu, 24 Nov 2011 08:53:52 +0100, "Pierre-François (f5bqp_pfm)"
wrote:

>I've checked the BC818-25 datasheet, they're saying 6Fs for the marking,
>so I don't know.

The marking 6F looked familiar to me, because we use these transistors
at work, but I think that I was wrong. It's more likely some dual
diode, as Franc Zabkar suggested.

[Morten Leikvoll]

Here is a 6pin serialnumber IC.. Could be something similar.
http://www.maxim-ic.com/datasheet/index.mvp/id/2903/t/al

Based on your description of the board, it may be a fit.

["Pierre-François (f5bqp_pfm)"]

Le 23/11/2011 15:17, Morten Leikvoll a écrit :

Hi,

Here is as promised yesterday night the pict with the white sticker
removed, we can see that D2 is in // with C2, so D2 could be a transient
suppressor on to the power lines "just in case"?... Or a Zener at 6.2v
as you mentioned earlier.

http://cjoint.com/?AKyoKzTaOsx

Another pict showing the 3.5 jack:

http://cjoint.com/?AKyoS7CQtgN

pf

["Pierre-François (f5bqp_pfm)"]

Hi Piotr,

No problem, the investigation is continuing... :-)

pf

["Pierre-François (f5bqp_pfm)"]

Le 24/11/2011 11:40, Morten Leikvoll a écrit :
> Here is a 6pin serialnumber IC.. Could be something similar.
> http://www.maxim-ic.com/datasheet/index.mvp/id/2903/t/al
>

Hi Morten,

Wouhaa! First time I see such a silicon registering tool!
Today you make me less crazy than this morning! Thanks for that... ;-)

> Based on your description of the board, it may be a fit.

Yes and no, because each time you get a new DVDROM you get a new dongle,
so the serialnumber IC isn't attached to the GPS.

May be to the DVDROM itself, could be, but the DVD production should be
a mess in that case...

pf


>
>

[Morten Leikvoll]

The pinout of the 6pin matches this
http://ww1.microchip.com/downloads/en/DeviceDoc/41239D.pdf
That means its a programmed cpu sharing the i2c line on the connector. I
guess it can be custom labeled (see packaging information)

""Pierre-François (f5bqp_pfm)"" <pfm...@wanadoo.fr> wrote in message

news:4ece4ac1$0$2495$ba4a...@reader.news.orange.fr...

["Pierre-François (f5bqp_pfm)"]

Hi Again Morten,

I measured precisely the D3 packaging with a caliper, and it's smaller.
1.3mm large , 2.0mm Long

The PIC10F is SOT23 packaging which is 1.3mm large BUT 2.7mm Long.
On the same side of this tiny board where D3 we're trying to identify is
you have D4 which is an SOT23 packaging, you can see it's bigger.

pf

[Franc Zabkar]

On Thu, 24 Nov 2011 15:47:03 +0100, "Pierre-François (f5bqp_pfm)"

<pfm...@wanadoo.fr> put finger to keyboard and composed:

>Hi Again Morten,
>
>I measured precisely the D3 packaging with a caliper, and it's smaller.
>1.3mm large , 2.0mm Long
>
>The PIC10F is SOT23 packaging which is 1.3mm large BUT 2.7mm Long.
>On the same side of this tiny board where D3 we're trying to identify is
>you have D4 which is an SOT23 packaging, you can see it's bigger.
>
>pf

ISTM that the whole thing may be as simple as a solitary I2C EEPROM.

I'm guessing D3 is a diode array that protects the clock and data
inputs from ESD.


Vcc ---|<|---o---|<|--- Gnd
|
|
|

SCL / SDA

I think you're correct in that D2 appears to be a transient voltage
suppressor (or maybe a zener). Its breakdown voltage is probably 6.2V
whereas the supply voltage for the EEPROM would be 5V or 3.3V.

[Franc Zabkar]

On Fri, 25 Nov 2011 19:24:11 +1100, Franc Zabkar
<fza...@iinternode.on.net> put finger to keyboard and composed:

>I'm guessing D3 is a diode array that protects the clock and data
>inputs from ESD.

It's not the same part, but it has an R12 marking:

SR12, RailClamp, Semtech, Low Capacitance TVS Diode Array:
http://www.semtech.com/images/datasheet/sr12.pdf

[Franc Zabkar]

On Fri, 25 Nov 2011 19:24:11 +1100, Franc Zabkar

<fza...@iinternode.on.net> put finger to keyboard and composed:

>ISTM that the whole thing may be as simple as a solitary I2C EEPROM.

Try pulling up the EEPROM's Write Protect pin to Vcc. That should
disable any writes.

BTW, there is a 51 ohm resistor in series with the Vcc input. This
would suggest that the current draw of the entire PCB needs to be very
low. For example, a current draw of 10mA would result in an
unacceptably high voltage drop of 0.5V. According to the data sheet of
the BR24L02, the voltage drop across the 51 ohm resistor during write
mode would be about 60mV. That sounds OK.

256×8 bit electrically erasable PROM
BR24L02-W / BR24L02F-W / BR24L02FJ-W
BR24L02FV-W / BR24L02FVM-W:
http://www.rohm.com/products/databook/eeprom/pdf/br24l-e.pdf

- Single power supply (1.8V to 5.5V)
- Write (5V) : 1.2mA (Typ.)
- Read (5V) : 0.2mA (Typ.)

["Pierre-François (f5bqp_pfm)"]

Le 25/11/2011 09:29, Franc Zabkar a écrit :
> On Fri, 25 Nov 2011 19:24:11 +1100, Franc Zabkar
> <fza...@iinternode.on.net> put finger to keyboard and composed:
>
>> I'm guessing D3 is a diode array that protects the clock and data
>> inputs from ESD.
>
> It's not the same part, but it has an R12 marking:
>
> SR12, RailClamp, Semtech, Low Capacitance TVS Diode Array:
> http://www.semtech.com/images/datasheet/sr12.pdf
>
> - Franc Zabkar

Hi Franc,

The Semtech could be a good candidate for the function, however it has
only 4 pins, D3 has 6, and D3 is much more tiny, the Semtech is SOT143
2.8mm long .

pf

[Franc Zabkar]

On Fri, 25 Nov 2011 11:16:24 +0100, "Pierre-François (f5bqp_pfm)"
<pfm...@wanadoo.frospam> put finger to keyboard and composed:

That's why I wrote that "it's not the same part". Nevertheless I
suspect your part would have a similar function. In any case, what is
preventing you from performing a simple test with a multimeter? AISI
the circuit is essentially just an EEPROM on a stick and should not
require much effort to "reverse engineer".

[Franc Zabkar]

On Wed, 23 Nov 2011 07:57:27 +0100, "Pierre-François (f5bqp_pfm)"

<pfm...@wanadoo.fr> put finger to keyboard and composed:

>Pile: http://cjoint.com/?AKwxdrhymgr
>
>Face: http://cjoint.com/?AKwxfvUq7kI

Here is my best guess as to your circuit layout:



Vcc 51R 51R
___ Vcc1 ___ Vcc2
Red (4) o-|___|--+---+-----|___|---+--------> to EEPROM pin #8
R1 | | R2 |
| | |
| | D2 |
--- z ---
C2 --- A 6.2B --- C3
| | |
R10 | | R11 |
___ | | ___ |
Blk (2) o-|___|--+---+-----|___|---+--------> to EEPROM pin #4
51R Gnd1 51R Gnd2
Gnd



Vcc1
-+-
|
|
-
SDA 51R ^ 51R
___ D3-A| ___
Yel (1) o-|___|--------+--------|___|----+---+------> EEPROM pin #5
R8 | R4 | |
- - ---
^ D4-A ^ --- C5
| | |
| --+--
-+- |
Gnd1 -+-
Gnd2



Vcc1
-+-
|
|
-
SCL 51R ^ 51R
___ D3-B| ___
Blu (3) o-|___|--------+--------|___|----+---+------> EEPROM pin #6
R7 | R3 | |
- - ---
^ D4-B ^ --- C4
| | |
| --+--
-+- |
Gnd1 -+-
Gnd2



Vcc2
-+-----------------------+---+----+
| | | |
| | R5| |R6
.-. | .-. .-.
1K | | R9 | | | | | 2K2
| | | | | | |
'-' .-------V-------. | '-' '-'
| | | | | |
-----| 1 A0 Vcc 8 |--- | |
| | | |
.--| 2 A1 WP 7 |--. | |
| | | | | |
|--| 3 A2 SCL 6 |--)---'----)------> to D3-B via R3
| | | | |
|--| 4 Gnd SDA 5 |--)--------'------> to D3-A via R4
| '---------------' |
| BR24L02 |
| +--'-+
| | |
| .-. |
| R12 | | --- C1
| 10K | | ---
| '-' |
| | |
'------------------+----+
Gnd2


(created by AACircuit v1.28.6 beta 04/19/05 www.tech-chat.de)


I suspect that the pinout of D3 is as follows:


D D
pin2 ---|<|---o---|<|--- pin1 D3-A
|
pin3


D D
pin5 ---|<|---o---|<|--- pin4 D3-B
|
pin6


I confess that I don't understand the purpose of D4.

["Pierre-François (f5bqp_pfm)"]

Hi Franc,

Back to home after two days outside I'll look at that, thanks for your
work, I appreciate very much.

All the bests.
pf

["Pierre-François (f5bqp_pfm)"]

Le 25/11/2011 21:06, Franc Zabkar a écrit :
> On Fri, 25 Nov 2011 11:16:24 +0100, "Pierre-François (f5bqp_pfm)"
> <pfm...@wanadoo.frospam> put finger to keyboard and composed:
>
>> Le 25/11/2011 09:29, Franc Zabkar a écrit :
>>> On Fri, 25 Nov 2011 19:24:11 +1100, Franc Zabkar
>>> <fza...@iinternode.on.net> put finger to keyboard and composed:
>>>
>>>> I'm guessing D3 is a diode array that protects the clock and data
>>>> inputs from ESD.
>>>
>>> It's not the same part, but it has an R12 marking:
>>>
>>> SR12, RailClamp, Semtech, Low Capacitance TVS Diode Array:
>>> http://www.semtech.com/images/datasheet/sr12.pdf
>>>
>>> - Franc Zabkar
>>
>> Hi Franc,
>>
>> The Semtech could be a good candidate for the function, however it has
>> only 4 pins, D3 has 6, and D3 is much more tiny, the Semtech is SOT143
>> 2.8mm long .
>>
>> pf
>
> That's why I wrote that "it's not the same part". Nevertheless I
> suspect your part would have a similar function. In any case, what is
> preventing you from performing a simple test with a multimeter?

Yes I'm going to do it.
pf

[Doors]

Production is simple.
WIth a 64-bit keynumber and a counter.
You get a key escrow system.
The dvd either gets or contains a control sequence.
It reads the key, does some function on it combind with a simple
counter, passes it on.
Though the counter may be signed as well.

A 64-bit DES block would be simple to do.
Have the DES block info in the flash onboard the PIC.
Do the whatever once to get an update validation key.
Then write garbage to the DES block info.

If that is the case you can either reverse engineer the serial protocol
or the update code on the disc.

You'll need a way to watch or record the data being sent back and forth.
You might try sparkfun or seed studios for a bus pirate or logic
analyser setup.
The USB ones not the standalones.

Good luck.
















--
Doors - Dont look at the future in a window.
Walk to a door - Open it, and go there.

http://www.freedoors.org
http://ata.freedoors.org

http://baencd.freedoors.org
AntiSpam in affect.
doors...@freedoors.org
mailto:doors...@freedoors.org