Hello,

I have a 2014 Aprilia RSV4 with 1 black user key, I did not know they had PIN codes when I bought her. Anywho, after a week of fun riding the bike went into limp mode and is now demanding "Insert the code" everytime I start her up. I am the 4th owner, the 3rd is the shop that sold her to me and I believe there were 2 previous owners. I can't get into contact with the previous owners and the shop doesn't know about the personal code.

The key is most likely failing as the ring antenna appears to be fine when compared to manual specs.

I am trying to read the EEPROM to get the PIN code so I can unlock it. I know somebody is going to freak out over this so first things first:
-I have the papers
-I am in Korea(IYKYK)
-and the likelihood of a criminal towing the bike to his parking lot, taking off all the fairings/headlight assembly, disassembling the dash, identifying all the semiconductors and then trying to read the EEPROM is unlikely. I also have the papers.

If you want to gatekeep and not help, that is fine, just don't dirty up the post with "bUt WhAt iF iTs StOlEn" nonsense.
I believe another user (Ollie)had a similar post for a RS125 a few years back.

I know of 2 places that will unlock the dash for a hefty fee, around 1k usd and 3-4 weeks time). I'd rather invest the time and money into gear and learning the process.

Thanks ahead of time to those that help!

.
Current tools available:
-Dash - Digitek D06L32R3
-EEPROM appears to be a AK93c51a

-CH341a reader - black, drivers have been installed

-8 pin clip
-Desktop pc with asprogrammer and neoprogrammer
*I may invest in a Xeltek superpro 610p as it natively supports the 93c51a but I'd rather not right now. Most of my funds have been used to get this bike up and running mechanically.
.
Issue:
-Asprogrammer and neoprogrammer both show all 00s or FFs, I know the memory isn't empty as when I reconnect the dash it lights up and goes through the start up sequence just fine but then demands the PIN.

-I have tried using jumper cables like Golf Wagen to try and read the eeprom but got 00s or FFs.
.
Questions:
-What can I do with the ch341a to read the 93c51a eeprom? I have a limited understanding of this process. I can solder things just fine.
-Do I need to buy the Xeltek Superpro 610p?

Kind regards,
Kim

 

Welcome to AAC.

What makes you think the PIN code will be stored unencrypted?

Have you tried the common dealer codes of 00000 or 00001 or the last 5 digits of the VIN?

In theory you can use the CH341a to read the serial memory, but its not so easy to configure, especially if its 'in circuit' as you need to power the memory up without powering the rest of the circuit. The other problem I'm having is correlating the pin-out of the 51A with its alleged datasheet. See below, neither orientation makes sense...



Other devices on board:

Fujitsu MB90340 16bit CPU with 32kHz RTC xtal and 4MHz clock xtal
Infineon TLE6209R motor driver (for rev/speedo)
Infineon TLE4278G voltage regulator
Infineon TLE6250G CAN transceiver
Philips PCF7991AT RFID Tag interface/immobilizer

 

Hello, thank you for replying. One of the reasons I believe that they are unencrypted is corporate laziness, they have previously engineered their dashboard eeproms without encryption, and the fact that PIN download services exist albeit for a hefty fee.

The odometer has a checksum but I have no interest in that (already low kms).
*the majority of this information is gleaned from tidbits on the Aprilia forum
**I currently have an immobilizer issue, key currently not recognized. However, immobilizer antenna meets diagnostic specs. Most likely key in my opinion (I had 2 other keys on the keychain).

And yes, I've tried 00000, 11111, 22222, 9999, 00001, 88888, 1000, vin number, last owner's birthday, his SSN, etc, none work.

Could you please clarify on what you mean by the orientation not matching up? To me they appear to be the same. There was another person on another forum who thought the PIN might be stored on the MCU's flash memory. Could that be a possibility?

My understanding of electronics and eeproms is rudimentary at best. My current knowledge is from when I was a boy soldering with my dad (we built dial ups, Amiga PCs, NEC PCs, Commadore, etc). Please excuse the misuse of terminology and lack of understanding.

And if you're interested I have a video of me riding her on Instagram; ID riding_seoulless2.0

Cheers,

 

Could you please clarify on what you mean by the orientation not matching up? To me they appear to be the same. There was another person on another forum who thought the PIN might be stored on the MCU's flash memory. Could that be a possibility?

Looking at the way the pins are connected to the rest of the circuit, neither orientation makes sense. For example take pin 4 - Data out The most likely orientation is pin 1 bottom right so pin 4 is top right - but that's clearly connected to ground on the PCB. The other option is pin 1 top left, so pin 4 is bottom left, but that's connected to a diode which is unlikely. It also means, from the PCB, that pins 2 (clock) and 3 (data in) are connected together, and that can't be right. So neither option fits the chip on the board, raising the obvious possibility this isn't a memory chip, or at least not THAT memory chip. The AK93C51A is only available in a TSSOP package but this is clearly a SOIC package but I can't find any 93C51 device in a SOIC package.

 

that IC is likely not an EEPROM, looks like LP3951 LP2951... pinout matches, extra copper areas and around it there are two SOT-23 parts marked Z3W which are almost certainly BZX84C5V6 (a 5.6V Zener).

why not take a good picture of entire board, both sides? that way we can take a look ourselves and decide if something is plausible or not.

 

There was another person on another forum who thought the PIN might be stored on the MCU's flash memory. Could that be a possibility?

Its certainly possible. But that's a much harder location to access.

 

that IC is likely not an EEPROM, looks like LP3951.

Good call - I was fast coming to that conclusion, just not what device it was...

Think you meant LP2951

 

Just scanned the 60 page user manual for the MCU. Sadly, due to age, no mention of SWDBG, JTAG or other standard program/debug interfaces. It has an 8-wire proprietary serial/control interface to a dedicated 3rd-party programmer and PC software. Chances are this is not easily available.

 

I highly appreciate you both helping me out. I'll try to get a better photo of both the front and rear of the board tonight!

 

Leaving aside the legal/ethical issue involved, consider the implications of the service being available for $1000 USD and taking a few weeks.

Let's assume that you succeed. Would what prevent you from now offering this same service for $500 and only taking a few days?

More to the point, why haven't many other people already done that such that charging $1000 and taking a few weeks would be a non-starter from a business viability standpoint?

The possible conclusion that can be inferred is that this is likely going to be a very difficult undertaking, both to figure out how to do it and to actually do it even after you have it figured out. If both of those weren't the case, you would almost certainly be able to find a number of places offering this service at a fraction of the price and in a fraction of the time.

 

@tae1822
Assuming the content is readable, is it clear where to look for that PIN?

 

Think you meant LP2951

yup... it was a typo...

 

Its certainly possible. But that's a much harder location to access.

that is the catch...

so far investigation is about identifying which IC (and on which board) can be used to store data. next is how to actually extract the data. then it comes the harder part of identifying which part of the recovered data may be wanted code. one IC may hold a lot of data that is usually not ASCII. and even if it is, it will be challenge to identify exact location and length.

so suppose you have something looking like image below but it is 32k (or much more!), how would you determine which characters represent value you are looking for? and why do you think they would be consecutive chunks (bytes for example)?



the most obvious approach is to buy same bike, read each and every IC that may have NV memory, then set the new code (something you will know), then read everything again and compare with previous data. repeat as needed until the location is narrowed down... and if you are lucky, it will be in plain text. but, what if the chip cannot be read - many products have option to prevent this exact scenario by allowing burning the fuses in the IC (microcontroller). then, just about the only way out is to desolder IC, solder new one (fuses not yet blown), then write firmware... but obtaining the firmware is another problem. usually the only way would be to work for a company that makes the vehicle and steal the code... yet another approach may be to build and program custom hardware that uses brute force to try all codes until right one is found.even if onboard security is lax, without delays for retries, this still limits the rate at which new code can be punched in. if it takes 5 seconds to enter single code with assumed length of 5 digits, that adds up to 5*16^5 = 5242880 seconds or about two months. finally, there is an option to take the vehicle back to the authorized dealer to deal with this.

 

Just scanned the 60 page user manual for the MCU. Sadly, due to age, no mention of SWDBG, JTAG or other standard program/debug interfaces. It has an 8-wire proprietary serial/control interface to a dedicated 3rd-party programmer and PC software. Chances are this is not easily available.

Further to the above, it turns out that it might be possible to access the MCU memory.

This GITHUB entry is for a custom hardware add-on to a standard USB-RS232 dongle to connect to an MP90340 MCU, assuming an actual connector exists on the board. In conjunction with some proprietary Fujitsu software, apparently still downloadable, and a 3rd-party tool it may be possible to read and write the EEPROM on the MCU.

This isn't about accessing the software or rewriting it, its just to dump the 256kByte hex file and potentially reload it. Just getting all that working and tested will be a huge learning curve, and it still doesn't address all the difficulties discussed in posts #10, #11 and #13 above.

 

WBahn
If I put in the time and effort to learn a skill, why should I not offer it? Especially if I can offer the same skills at a better price? What ethical issue would there be? You spew utter nonsense. You work a job, why do you earn money? You weren't born with the skills you have, you learned them. Now you make money with those skills, you shouldn't based on what you wrote. Also, what legal issues? Stop making random junk up. You sound deranged if not jealous.

Name 1 legal issue.


atferrari
Based on the Aprilia forums, the readout seemed quite distinct and unencrypted. It could've possible been a screen shot of a decoded .bin file however I doubt it. Others have decoded it successfully. I'll try to find the link or picture so you can view it.

panic mode & Irving
The newer 2017+ Aprilias require PADS (Piaggio aprilia diagnostic system) to program new keys (I am not sure about the pin), this may be because they are encrypted hence requiring corporate intervention. I don't believe the Keys would be in the MCU, and I now believe the issue to be of another cause.

 

I don't believe the Keys would be in the MCU,

Well, where else would they be? Is there a separate CAN Bus connected ECU for the engine? That's where many cars store immobiliser codes, VIN, etc. Same issues apply though.

 

WBahn
If I put in the time and effort to learn a skill, why should I not offer it? Especially if I can offer the same skills at a better price? What ethical issue would there be? You spew utter nonsense. You work a job, why do you earn money? You weren't born with the skills you have, you learned them. Now you make money with those skills, you shouldn't based on what you wrote. Also, what legal issues? Stop making random junk up. You sound deranged if not jealous.

Name 1 legal issue.

You entirely missed the point. I'm trying to get you to look at the probable difficulty of your proposed task realistically so that you can make a more informed decision about whether your time and effort might be better spent on something else rather than going down this potential rabbit hole. But since your only response is to throw insults, I'm not even going to attempt to explain it to you again. Goodbye.

 

Dash unlocked, thanks all.

 

WBahn
"Leaving aside the legal/ethical issue involved, consider the implications of the service being available for $1000 USD and taking a few weeks.

Let's assume that you succeed. Would what prevent you from now offering this same service for $500 and only taking a few days?"

GTFO here with your pathetic gaslighting. Clown.

 

Again, thank you all.