Working solution to MB SD Connect C4 unlock dump

This is a dump read out from PIC16LF88 chip of my own MB SD Connect C4 device (4-5 years old). It’s 100% working.

Mbstarshop engineer know it exactly because I’ve succesfully unlocked 3 units for last 2 days using it. Each one works fine.

You don’t need to buy a new one PIC16FL88. You just have to program chip from your own device.

After that when you run your SDconnect you will probably see that serial number, OS version of your device are changed into zeroes “0000”.
Don’t worry. Just change your C4 to factory state using buttons near by LCD (no need to explain “How to…” because it’s quite clear). After rebooting you’ll see actual SN, OS version and so on.

Also you can change serial number of your device. 24c02 contains it. After changing number just run “factory settings” function…other way it will not change. After reboot you’ll probably see (on lcd of your device) your SN looks like “the number you’ve programmed into chip +1″… I mean 10001 inspite of 10000 for example and so on, but in SDNC tool kit you’ll see the real SN (10000), and after succesfull reconfiguring your device you’ll see the right number on LCD of your MB SD C4.

I was using cheap ssop28 (0.65mm step) adapter and Pickit3 programmer to read/write PIC16lf88. This scheme made for Pickit3 OEM socket(ICSP).

Also I’ve got dumps of both flashes 29f016 and PIC18lf8680 if somebody need it.

Somebody asked me if I have dumps of both flash memories 29f016. Finally I’ve found them. In the picture below you can see marks A & B made with pencil and dumps in archive are also named according to signs in the picture.
One of archives (probably – device1) contains dumps from device which didn’t support command CE_flash_loeschen and the other one ( it seems device2) contains dums from working SDConnect.

I read them both using Triton 5.7 programmer with hand-made adapter for 8-bit flash memories (29XXXX).

If you try to read-write them using TL866/wizardprog/willem…then don’t waste your time. These programmers won’t dothis job. But it was few years ago, so probably something changed.

Attachment download from:
http://down.uobd2.net/working-solution-for-sdconnect-unlock-dump.zip
Attachment “pic18f8680.rar” Password: uobd2net