Can anyone get a program off a chip please?

[orange1234]

Hello, I have 4 remote controls for a bed and they no longer work. I took them to a repair shop and they have said the chip needs replacing. Unfortunately they don't have the ability to get the program off the chip, although if they had the program they can put it onto a new chip. The chip is MCU cct U1 PIC 16F57 DIP28 Does anyone know anyone or anywhere that can take the program off the last working remote control and copy it to 4 chips, so I can get the others working? Any help or suggestions will be gratefully received. Thanks.

P.S The manufacturer no longer makes this, and has given me permission.

 

[barry]

I think that you should be able to use the Microchip tools (PICKIT, for example) to read back the program, as long as it hasn't been protected.

BUT, if the shop told you "the chip needs replacing" (which I'm really skeptical of to begin with) that would imply that the chip is bad, right? And if the chip is bad, how can you read the program off of it?

 

[ads-ee]

BUT, if the shop told you "the chip needs replacing" (which I'm really skeptical of to begin with) that would imply that the chip is bad, right? And if the chip is bad, how can you read the program off of it?

They said in their first post they have one working remote, the others are bad. I'm also pretty skeptical of the repairs shop knowing the uC is bad, unless this is a common problem due to a design flaw in the remote.

 

[barry]

I guess I should read the entire post. Still, why would 4 out of 5 remotes fail the same way unless, as you say, there's an intrinsic flaw.

I'm also trying to imagine a microprocessor-based remote-controlled bed. With five remotes. That must be a BIG bed.

 

[betwixt]

PICs, even 'old' ones like the 16F57 are quite hard to damage so I too am skeptical about it being the cause of failure.

However, if they are dead and you have one surviving one, it doesn't necessarily mean you can make copies of it to replace them. Almost all PICs have a copy protection mechanism in them which allows them to be verified after programming without reading the real data back. There is no obligation to use copy protection but almost every manufacturer uses it to prevent their software being copied. The only way to find out is to read the good PIC and see if what it contains makes sense when disassembled.

It would be interesting to see if the bad PICs still contain good code, they may have failed by damage to the pins while the core inside is still workling perfectly.

Brian.

 

[orange1234]

Thanks guys, I'm greteful for your replies. Let me answer a few questions. Each bed has one remote control, the bed has a sink at the end so over time water gets into the remote and the repair shop said the chip is damaged. She checked the chip and it's protected so she can't pull the program off a working chip and copy it over. She doesn't have the warewithall to copy a protected chip, but said maybe someone else may? I have one good remote left with a working chip.

I contacted the factory in China and they stopped making this 2 years ago, have no spares, or codes or anything. They have given me permssion to do whatever needed to repair them.

Can anyone helpor does anyone know anyone who could help with this. If we can't get these remotes fixed then 5 x £1000 beds will have to go to the tip.

 

[c_mitra]

If the chip is protected can it be updated? Most update software first make a backup and then write the new code. But I am wondering how does it work if the chip is protected.

I have a motor driver (the driver IGBTs- one of them) driven by a PIC. There is a socket for updating the software.

 

[betwixt]

The 'F' in the PIC type tells us it uses Flash memory so it can be erased and reprogrammed. Erasing does just that, it wipes the exitisting memory and also the protection bit so it can be used as though it was brand new. However, the existing program probably can't be read from a protected device, there are companies that claim to be able to do it but they give no guarantee and they are expensive. They don't use conventional programming tools, they have special forensic methods for reading the memory, including in some cases actually dissolving the IC body away so the fuse bit can be directly targetted.

I still think it odd that water would damage the PIC though. It isn't impossible of course, the most likely cause would be water in the PSU circuits zapping it with too much voltage. I would have to see one of the units to be sure. Is the PIC in a socket or is it soldered to the PCB?

Brian.

 

[ads-ee]

Well depending on the packaging I've seen corrosion of the leads that broke the connection of the part to the PCB. It's why designs that are exposed to harsh environmental conditions are typically conformal coated.

 

[E-design]

One company I had dealings with some years ago lost the code files to one of their old PIC projects, but had some of the flash code-protected working chips. They shipped it to a Chinese firm which extracted the code for about $US150. So it can be done at a price. They only required one working chip to do the extraction.

 

[hexreader]

Why not tell us which country you live in?

Might get better responses....

 

[orange1234]

One company I had dealings with some years ago lost the code files to one of their old PIC projects, but had some of the flash code-protected working chips. They shipped it to a Chinese firm which extracted the code for about $US150. So it can be done at a price. They only required one working chip to do the extraction.

Do you by chance have any contact details for this Chinese company. This sounds promising.

Hi hexrader I'm in Liverpool UK.

- - - Updated - - -

PICs, even 'old' ones like the 16F57 are quite hard to damage so I too am skeptical about it being the cause of failure.

However, if they are dead and you have one surviving one, it doesn't necessarily mean you can make copies of it to replace them. Almost all PICs have a copy protection mechanism in them which allows them to be verified after programming without reading the real data back. There is no obligation to use copy protection but almost every manufacturer uses it to prevent their software being copied. The only way to find out is to read the good PIC and see if what it contains makes sense when disassembled.

It would be interesting to see if the bad PICs still contain good code, they may have failed by damage to the pins while the core inside is still workling perfectly.

Brian.

The 'F' in the PIC type tells us it uses Flash memory so it can be erased and reprogrammed. Erasing does just that, it wipes the exitisting memory and also the protection bit so it can be used as though it was brand new. However, the existing program probably can't be read from a protected device, there are companies that claim to be able to do it but they give no guarantee and they are expensive. They don't use conventional programming tools, they have special forensic methods for reading the memory, including in some cases actually dissolving the IC body away so the fuse bit can be directly targetted.

I still think it odd that water would damage the PIC though. It isn't impossible of course, the most likely cause would be water in the PSU circuits zapping it with too much voltage. I would have to see one of the units to be sure. Is the PIC in a socket or is it soldered to the PCB?

Brian.

Hi Brian, I think the chip is in a socket. The repair shop I used repairs TV's and all sorts of electronics at component level. She says she is certain the chip needs replacing. If you'd like a look at one let me know. I'm willing to pay to get this sorted. Will photo's help of the circuit board help? Let me know.

 

[c_mitra]

To get to the code, you need to figure out:

1. The protection method being used;
2. Reading byte-wise and uncompiling;
3. Guess the compiler directives used in compilation.

All easier said than done but not impossible. First you need to get hold of some source code that does the encoding and memory writing.

Try with similar software and see if one works.

Lot of work and not worth it. But you already have the microprocessor model and that limits the choices quite a bit.

It is a kind of hacking or reverse engineering.

 

[betwixt]

Hi Brian, I think the chip is in a socket. The repair shop I used repairs TV's and all sorts of electronics at component level. She says she is certain the chip needs replacing. If you'd like a look at one let me know. I'm willing to pay to get this sorted. Will photo's help of the circuit board help? Let me know.

Photos will certainly help but a schematic would be best if you have one.
I have several PIC readers and programmers here which I can try if you wish but I make no promises (and make no charge!) if you want to send a good and bad sample to me.
The timing isn't good, I was in Liverpool recently (at Police HQ - but on a database training course - not for being naughty!) so I could have met up with you. I have no dates for going back unfortunately, despite having relatives in Belle View who are overdue for a visit.


Brian.