TV Mainboard EEPROM Hacking Plasma/Oled

[DIYFreak811]

Hi all.
I have something for you which is certainly out of ordinary even on this forum but it should be piece of cake for some people here. hopefully lol
I need help with accessing main eeprom on TV mainboards-full read and write access. Layout is very similar on these mainboards whether it's plasma,oled or even led.
Some of these boards are for 10+year old TVs,that can't be hard let alone impossible right?
OK,the first I'm interested in it's for over 10 year old TV-plasma. There should be about 3-5 ROMs and there's also service conector. Write protection is there 100%.
How to access them without desoldering? I can post more pictures if necessary and give some more info.

[DIYFreak811]

OK guys,show me what you got lol  There's no way some of you can't hack this. 
I'll help as much as I can. I have Arduino Uno,dunno if it's enough. Solution without desoldering preferred.

[jnk0le]

so8 in bottom right could be the flash memory (25qXX), can be accessed with special clips like the ones usually sold with ch341 programmers.

There could be also nand/emmc uder those heatsinks.

[pcprogrammer]

Better pictures with more detail of what is written on the IC's can lead to better feedback.

Be aware with CH341 programmers that jnk0le referred to. Even though they allow selection of the target supply voltage between 5V and 3.3V the signal levels may remain on 5V and destroy targets when they are 3.3V types.

Also check the board to make sure there is a diode in the FLASH power supply to protect against feeding the whole board when the programmer is connected. If not present then try reading the FLASH with the board powered the normal way and do not connect the supply pin of the FLASH to the programmer. You might have to keep reset of a MCU/CPU low.

Even better would be schematics of the boards. Knowing make and model of the TV's could help in getting these schematics.

So when trying to lure us in with a challenge, it is best to give us as much information as possible, otherwise we just don't bite that easily. 

[DIYFreak811]

OK here are more pictures of the board and screenshot of the service menu with listed ROMs.

[pcprogrammer]

Not really helpful information. 

The listing of the service menu just shows the versions of the software packages used in the TV, not pointing to actual ROM's.

The picture of the board also does not help, because it still is not possible to read the markings on the IC's. The ones I indicated with the red outline might be FLASH memories based on them being SOP8 or SOIC8 packages. Look at what is printed on the plastic of the IC and search on google or other search engine for a datasheet.

Also be aware that there are processors (microcontrollers) that have embedded FLASH memory, so any of the bigger IC's, with lots of pins can also have firmware in them.

Then there are also parallel memory devices, so the packages with more pins on both sides of the plastic can be memory devices to. (RAM or ROM)

There are so many options and for us it is just blind guessing without proper information.

[DIYFreak811]

Those chips are 2x 10803S-IC8704,9803 marked on board and rt72570h-IC 8705.
Here is also service manual,it's for Panasonic ST50 well known plasma.

[pcprogrammer]

With the service manual you have all the information needed to figure it out.

Page 34 shows that IC8902 is the EEPROM (X24CP65ST50E) for the peak chip (IC8000) and IC8900 is the NAND FLASH (TVRS622AG) for it. This one will be the one where the code is stored. The other one most likely only holds settings.

Page 35 shows IC9304 as an SPI FLASH (TVRS631AB) connected to IC9300 (C1AB00003813). This seems to be some secondary processor.

The part numbers are most likely Panasonic internal codes and no useful information is found based on them.

The IC's I marked in my previous post are power supply related so no memory chips.

Now it is up to you to see if you can do something with this information.

[DIYFreak811]

PEAK ROM is for picture settings and with 2 other ROMs it can be accessed via TV internal hidden memory editor and you can edit them freely.
The main one should be PDROM or something similar.
Can you check from the manual which chip is connected to service connector and how to access it? That should be the one.

[DIYFreak811]

Page 45 in service manual-Factory connector.
There are about 3 I2C connections and one of those should definitely access the chip I want to read and modify data.
I2C bus should run on 3.3V.
So how to access it and which controller?

[pcprogrammer]

The wires within the red box are for the peaks eeprom, but which one is SCL and which one is SDA I can't tell for sure, due to not being able to zoom in far enough. I think the left one is SDA.

Get yourself a CH341 based EEPROM programmer and modify it to make sure the signal levels are 3.3V.



Search on the net for software to work with the programmer.

[MathWizard]

So what do u want to do exactly tho ? Do u want to see the data as it gets R/W to the chip by the TV ? Do you want to send data when it's turned on? Do u want to R/W some data to the chip when the TV is off ??

What data are you interested in seeing or changing ?? Do you know where it is on the chip ?

Do you know about I2C ? I just wrote a program to R/W I2C, and I'm surprised that the 24C02 EEPROM I was writing to, takes 5ms to write a byte.

[DIYFreak811]

R/W data when TV is off should be enough if possible.
I have an idea how to locate data I'm interested in and it shouldn't be hard.

OK,the chip I'm interested in should be rom for IC 9300 processor mentioned already here.
IC 9304 should be the Flash for it and it's Winbond 25Q1.
I2C lanes 8,9 on fact.connector are accesing that chip.
I can post better pictures of connector later if necessary.

So any idea how to connect to that Flash rom,either directly or by I2C bus?
I have spare boards and I can buy new programmer np.so I have nothing to lose,lol

[MathWizard]

For some IC on a PCB, I have a bunch of tinned test wires, maybe 4cm and 20cm, I think they are ~28AWG, so they fit most stuff I'm working on. And I soldered them into a proto-board, with 2 rows of pin headers. And if the pins on the chip are spaced wide enough, I'll just solder on as many wires as I need, to each pin, usually from the top. And then tape it all around and down, and make it nice and solid. Sometimes I'll solder onto other pads or parts, but on some PCB's and for some size parts, it's too easy too rip them of, if the wires can move all the time. But if it's all solid, then it should be ok.

And I can plug the PCB/pin headers into a breadboard too, for easy access, and even for added parts.

Then I can hook up my scope or for now, an $20 8CH logic analyzer, and a PC, could monitor and pins I want. Like right now, I'm modding 1 of my LCD DMM's, to use LED blocks, and I'm bare-metal programming an AVR MCU, to read commands and display data, from the DMM's MCU, and then output the display data.


Really all I'm using, is the datasheet for the ATmega169PA MCU, and the AVR instruction set manual. And really, I'm just improvising the codes, with no real training in ComputerSci, and trying to keep it stream-lined.

If I wanted to, I could re-try it all in C code, with something like ArduinoIDE. You should try and write a program to read/write a few bits over a clock. And then try to flesh out what real I2C does, for R/W to a super common EEPROM, like the 24Cxx series.

[NiHaoMike]

What exactly are you looking to hack or fix? Looks pretty ancient with that PCMCIA connector.

[DIYFreak811]

I want to take it apart and tinker with it,lol
But really I just want to locate certain Hex data and overwrite if possible.
I'm still waiting for CH341 delivery.
In the meantime any tips how to connect to that Winbond chip? seems pretty common
Will it work at 3.3V on powered off board?

[pcprogrammer]

I want to take it apart and tinker with it,lol
But really I just want to locate certain Hex data and overwrite if possible.
I'm still waiting for CH341 delivery.
In the meantime any tips how to connect to that Winbond chip? seems pretty common
Will it work at 3.3V on powered off board?

There are special clips that you can stick over the IC. Maybe it is included with your CH341. Many on Aliexpress come with it. See picture.

If the board is powered down, there is a change that it will be powered through your programmer (no diode in series with the IC VCC on the board.) and that it will draw to much current.

It might work best with the board powered up but make sure the IC is not communicated with by the connected processor. Either see if it is possible to hold the processor in reset state or monitor the lines to see if they become inactive.