Customer Sharing 100% working solution for SDConnect unlock dump

This is the real articl one of our customer send back to us about the MB SD C4

mb-sd-connect-compact4-star-diagnois-new-a[1]

This is a dump read out from PIC16LF88 chip of my own SD Connect C4
device (4-5 years old). It’s 100% working.
I know it exactly because I’ve successfully unlocked 3 units for
last 2 days using it. Each one works fine.
You don’t need to buy a new one PIC16FL88. You just have to
program chip from your own device.
After that when you run your SD connect you will probably see that
serial number, OS version of your device are changed into zeroes “
0000″.
Don’t worry. Just change your C4 to factory state using buttons
near by LCD (no need to explain “How to…” because it’s quite
clear). After rebooting you’ll see actual SN, OS version and so
on.
Also you can change serial number of your device. 24c02 contains
it. After changing number just run “factory settings” function…
other way it will not change. After reboot you’ll probably see (on
lcd of your device) your SN looks like “the number you’ve
programmed into chip +1″… I mean 10001 inspite of 10000 for
example and so on, but in SDNC tool kit you’ll see the real SN
(10000), and after successful reconfiguring your device you’ll see
the right number on LCD of your C4.
I was using cheap ssop28 (0.65mm step) adapter and Pickit3
programmer to read/write PIC16lf88. This scheme made for Pickit3
OEM socket (ICSP).
Also I’ve got dumps of both flashes 29f016 and PIC18lf8680 if
somebody needs it.

sd-c4-share-1

sd-c4-share-2

Somebody asked me if I have dumps of both flash memories 29f016. Finally I’ve found them. In the picture below you can see marks A & B made with pencil and dumps in archive are also named according to signs in the picture.
One of archives (probably – device1) contains dumps from device which didn’t support command CE_flash_loeschen and the other one (it seems device2) contains dumps from working SD Connect.
I read them both using Triton 5.7 programmer with hand-made adapter for 8-bit flash memories (29XXXX).
If you try to read-write them using TL866/wizardprog/willem…then doesn’t waste your time.

These programmers won’t do this job. But it was few years ago, so probably something changed.

(Visited 176 times, 1 visits today)