Hello,

I have a 2014 Aprilia RSV4 with 1 black user key, I did not know they had PIN codes when I bought her. Anywho, after a week of fun riding the bike went into limp mode and is now demanding "Insert the code" everytime I start her up. I am the 4th owner, the 3rd is the shop that sold her to me and I believe there were 2 previous owners. I can't get into contact with the previous owners and the shop doesn't know about the personal code.

The key is most likely failing as the ring antenna appears to be fine when compared to manual specs.

I am trying to read the EEPROM to get the PIN code so I can unlock it. I know somebody is going to freak out over this so first things first:
-I have the papers
-I am in Korea(IYKYK)
-and the likelihood of a criminal towing the bike to his parking lot, taking off all the fairings/headlight assembly, disassembling the dash, identifying all the semiconductors and then trying to read the EEPROM is unlikely. I also have the papers.

If you want to gatekeep and not help, that is fine, just don't dirty up the post with "bUt WhAt iF iTs StOlEn" nonsense.
I believe another user (Ollie)had a similar post for a RS125 a few years back.

I know of 2 places that will unlock the dash for a hefty fee, around 1k usd and 3-4 weeks time). I'd rather invest the time and money into gear and learning the process.

Thanks ahead of time to those that help!

.
Current tools available:
-Dash - Digitek D06L32R3
-EEPROM appears to be a AK93c51a

-CH341a reader - black, drivers have been installed

-8 pin clip
-Desktop pc with asprogrammer and neoprogrammer
*I may invest in a Xeltek superpro 610p as it natively supports the 93c51a but I'd rather not right now. Most of my funds have been used to get this bike up and running mechanically.
.
Issue:
-Asprogrammer and neoprogrammer both show all 00s or FFs, I know the memory isn't empty as when I reconnect the dash it lights up and goes through the start up sequence just fine but then demands the PIN.

-I have tried using jumper cables like Golf Wagen to try and read the eeprom but got 00s or FFs.
.
Questions:
-What can I do with the ch341a to read the 93c51a eeprom? I have a limited understanding of this process. I can solder things just fine.
-Do I need to buy the Xeltek Superpro 610p?

Kind regards,
Kim

 

Welcome to AAC.

What makes you think the PIN code will be stored unencrypted?

Have you tried the common dealer codes of 00000 or 00001 or the last 5 digits of the VIN?

In theory you can use the CH341a to read the serial memory, but its not so easy to configure, especially if its 'in circuit' as you need to power the memory up without powering the rest of the circuit. The other problem I'm having is correlating the pin-out of the 51A with its alleged datasheet. See below, neither orientation makes sense...



Other devices on board:

Fujitsu MB90340 16bit CPU with 32kHz RTC xtal and 4MHz clock xtal
Infineon TLE6209R motor driver (for rev/speedo)
Infineon TLE4278G voltage regulator
Infineon TLE6250G CAN transceiver
Philips PCF7991AT RFID Tag interface/immobilizer

 

Hello, thank you for replying. One of the reasons I believe that they are unencrypted is corporate laziness, they have previously engineered their dashboard eeproms without encryption, and the fact that PIN download services exist albeit for a hefty fee.

The odometer has a checksum but I have no interest in that (already low kms).
*the majority of this information is gleaned from tidbits on the Aprilia forum
**I currently have an immobilizer issue, key currently not recognized. However, immobilizer antenna meets diagnostic specs. Most likely key in my opinion (I had 2 other keys on the keychain).

And yes, I've tried 00000, 11111, 22222, 9999, 00001, 88888, 1000, vin number, last owner's birthday, his SSN, etc, none work.

Could you please clarify on what you mean by the orientation not matching up? To me they appear to be the same. There was another person on another forum who thought the PIN might be stored on the MCU's flash memory. Could that be a possibility?

My understanding of electronics and eeproms is rudimentary at best. My current knowledge is from when I was a boy soldering with my dad (we built dial ups, Amiga PCs, NEC PCs, Commadore, etc). Please excuse the misuse of terminology and lack of understanding.

And if you're interested I have a video of me riding her on Instagram; ID riding_seoulless2.0

Cheers,

 

Could you please clarify on what you mean by the orientation not matching up? To me they appear to be the same. There was another person on another forum who thought the PIN might be stored on the MCU's flash memory. Could that be a possibility?

Looking at the way the pins are connected to the rest of the circuit, neither orientation makes sense. For example take pin 4 - Data out The most likely orientation is pin 1 bottom right so pin 4 is top right - but that's clearly connected to ground on the PCB. The other option is pin 1 top left, so pin 4 is bottom left, but that's connected to a diode which is unlikely. It also means, from the PCB, that pins 2 (clock) and 3 (data in) are connected together, and that can't be right. So neither option fits the chip on the board, raising the obvious possibility this isn't a memory chip, or at least not THAT memory chip. The AK93C51A is only available in a TSSOP package but this is clearly a SOIC package but I can't find any 93C51 device in a SOIC package.

 

that IC is likely not an EEPROM, looks like LP3951... pinout matches, extra copper areas and around it etc. there are two SOT-23 parts marked Z3W which are almost certainly BZX84C5V6 (a 5.6V Zener).

why not take a good picture of entire board, both sides? that way we can take a look ourselves and decide if something is plausible or not.

 

There was another person on another forum who thought the PIN might be stored on the MCU's flash memory. Could that be a possibility?

Its certainly possible. But that's a much harder location to access.

 

that IC is likely not an EEPROM, looks like LP3951.

Good call - I was fast coming to that conclusion, just not what device it was...

Think you meant LP2951

 

Just scanned the 60 page user manual for the MCU. Sadly, due to age, no mention of SWDBG, JTAG or other standard program/debug interfaces. It has an 8-wire proprietary serial/control interface to a dedicated 3rd-party programmer and PC software. Chances are this is not easily available.