Ideas for Reading Locked PIC

[MotoDan]

Hello all,

I have an old ham radio accessory that uses a PIC16Cxxx which is code locked. I need to change a few bytes of program memory to ft my needs. The company has long since closed and the owner has also passed away so there is zero chance of having the device modified by anyone who knows anything about it. I've been searching for possible ways of accomplishing this, but am not having much luck. I have seen companies mentioned who will reverse engineer an MCU, but I'm sure that would be very expensive and possibly risky. Without the PIC, this device is of course useless so sending the chip off to someone and having it destroyed is not a very good option. I've tried reading the program memory using both a Pro Mate II as well as a CCS ICD-U64. The PM2 refused to read the device while the U64 didn't seem to care, however the contents did not resemble program code. Instead it was just some repeating bytes throughout the entire file.

Thanks

 

[betwixt]

The locking system used on 16C devices was to XOR the tops and bottoms of each address together when trying to read their contents back. It gave good confidence when verifying contents during programming but made the actual instructions impossible to reconstruct.

Some companies claim to be able to 'unlock' the program (for a price) but I'm not sure I would want to trust them. What is the actual PIC type and what does it do in the equipment? It might be easier to start afresh with a newer but pin compatible PIC device.

Brian.

 

[ALERTLINKS]

I know a case when a person flew to china to get the code of $400 machine and was able to get it for a fee of $1000, work done in two days. He had only one machine, he took the risk and now he is manufacturing it. It was PIC16F72 in a static voltage stabilizer.
If you the detail of inputs/outputs and processing requirements, it can be developed fresh from the begging.