Bypassed TheftLock on GM Chevy Class II MP3 CD HU

[nuku]

This is an update to my post on:
http://www.automotiveforums.com/vbul...d.php?t=472260

Yes, I was able to bypass theftlock in the mp3 CD Head unit

Sorry for the disorganized text, it is close to 2am but I have received a few questions about the outcome and wanted to post for all.

I have an 01 Impala with the Class II CD/RDS radio and it turned out the 15216905 mp3 radio I bought was from a S10
(these vehicles belong to different body platform and have different body control modules, the dealer wasn't able to reprogram the vin with a TechII... this didn't work under neither vehicle's platform/body choices in the techII)

Anyway long story short, I was looking at the circuit boards of both radios and found a small 8 pin chip that was a 4Kb EEProm .
I figured this could be where the vin is stored and maybe other vehicle settings that can be changed by through the radio.

I tried to exchange these EEProms between both radios with the rationale that I would bring the vin and settings from one to the other but this did not work.
It results in a 'CAL ERROR' message for ~1-2 secs when the radio is on.
An interest side effect is that Theftlock was completely bypassed

So I returned each EEPROM to the radio they belonged to
but left pin 8 of the EEPROM not soldered/connected. (pin eight is power to the EEPROM)

Except for the CAL ERROR message for a 1-2 secs when I turn on the radio, all works perfect.
All sound settings, bass, treble, radio stations, resume place on the cd/mp3 are stored when the vehicle is shutdown too.
All integration/Class II features:
Chimes, OnStar, dimming, off when door open etc work fine too

Bottom line, just find the 9355093 8 pin serial EEPROM, take a soldering iron and a very small screwdriver/knife.
Heat pin #8 and lift/pry *very* carefully so it no longer contacts board.

that's it.

http://www.tranzistoare.ro/datasheets/134/80474_DS.pdf
Here is a datasheet to the chip if you need help figuring out which is pin 8
(9355093 = 24c08 EEPROM)



On the MP3 Head Unit circuit board there are two small 8 pin EEPROMS near the pushbutton/tone button area.
One that says AMI, the other says 9355093

The one you want is 9355093 .

BTW, with a new HU I obviously lost the Impala specific 'hold display' button to customize the impala body module settings.
Nevertheless it still retains the settings I last programmed with the previous HU. (which can be plugged again in a pinch if needed to alter any of these settings)
On the new HU, if you hold '6' for a while you can THANKFULLY switch the chimes to a lower volume.


Disclaimer: I have not tested this in any other scenario other than the above
(15216905 MP# HU from a Chevy S10). YMMV but in my opinion, provided you have some soldering skills and follow ESD precautions, the risk of lifting the power pin on the EEPROM is low and can be reversed easily if any issues.

[Nebular]

Thanks for the reply, It's good to know that I possibly didn't buy a paper weight for $130. It'll probably be a little while before I can tell you the results but I'll befinately have my father who's an engineer do that for me. I asked so many people about this problem and this is the only reply that has made any sense. I look foreward to testing it and letting you know what happens. Thanks again

[mattman134]

I read your post and I just performed the fix. I will get back to you tomorrow to tell if it works or not. Ive been driving myself crazy over it.



Thanks
Matt

[mattman134]

YAY it works!

I cut pin 8 on the eeprom and the radio works. I put it in my 1986 fiero.

Thanks

[brad98vr6]

Just did this on an RDS non-MP3 AM/FM CD unit out of an 03 Cavalier LS Sport (for my 04 Cavalier base) with a few ill-side effects. Maybe it was just the way I did it. The unit works (with the CAL ERROR display). The screen shows the tape icon (tho there is no tape player). The CD button doesn't function properly, and over a long period of time, it doesn't remember my radio stations or sound settings. The time, and CD position did however stay in memory. Overall, It works so I'm happy, my base CD player got busted up and stopped working.

[docbenway]

Yo - thanks, man. I bought an ebay radio for my 2000 Montana - no wonder the guy took 27.50 - the local gm dealers (and by the way there are only 2 left out of probably 10 in the area a few years ago) are not real eager to help - talked to them on the phone, they weren't even clear on the diff between theftlock 1 and 2 (they were asking if I had pressed buttons 2 and 3, etc) and they wanted $100 plus just to look at it - no guarantees. I was figuring to throw in the towel and buy another aftermarket radio.

To get to the point, I found the little eprom you so precisely described, popped loose what I hoped was pin number 8 (check out the link if you are scoping this out), and now it works perfectly. The cassette player is a little marginal, but I can pull the one from the old receiver - at this point I've had them both apart about 5 times, I can do it like a lrrp field stripping an M16. My wife is totally annoyed with me for spending countless hours on an old radio, but it is such a pleasure when it finally clicks in. The internet (and anonymous geniuses) have changed my life again. Very gratifying. It's a tinker guy think - she wouldn't understand.

Brilliant piece of research on your part - this news must be spread - I see baffled querys about this all over, with the most reasonable responses being "you've got to go to the dealer to get the codes cleared". Which I would have been happy to spend $30, or maybe even $50 to do - if they were half way cool and said, "look, we'll figure it out and if we can't, give us $20 bucks. We are talking 15 minutes (and clean hands) max with a competent mechanic and the data analyzer. But since it is generally such a ream job, I strongly recommend snipping the little wire. And we should spread the good word.

Thanks,

Doc Benway
Harvard '06 (that's 1906, you whippersnapper)
Bob Hill

[Jbone32]

To the guy who put it in the 86 Fiero-

I bought a newer 6-disc in-dash changer that I'm trying to put in my 97 Grand Prix. The thing is I can't get the radio to turn on, since the class II radios lack a switched power wire in their harness. I hooked up the power and ground, and I can load discs and use the clock, put it won't turn on. Does the data wire supply some sort of ignition on signal?

How did you hook this up?

[mattman134]

Find a wiring pin-out diagram for the connector on the back of the radio. There are leads for the constant and switched power as a backup. It is backward-compatible.

[Jbone32]

Thanks for the reply. I did find one, and added a wire to the harness for the switched power, not surprisingly it's the pin right next to the constant power. However, it still won't turn on when I give it power on both the constant and switched pins. Did you have this problem? I cracked the radio open and as far as I can tell the switched power pin is attached inside and connected to some circuit on the board. I wonder if you have to desolder that eeprom before it will recognize a signal from the switched power source?

[Jbone32]

So- did you even attempt to install this using switched power without desoldering the eeprom? Or did you remove that pin first?

[Jbone32]

Went ahead and desoldered that eeprom, causes the radio display to not work at all? I'm about to give it up put this radio back on ebay unless anyone has any great ideas. Maybe the single-disc MP3 radios are an entirely different beast than the 6-discs. Oh well.

BUMP

[FromTheInside]

I have done this on a couple of radios. The MP3s act differently than the others and the layout is slightly different. On my MP3, the radio stations and sound settings are lost after the car is off for a little bit just as a previous poster stated. I am going to solder the pin back on and find a dealer and stop this. Note, the rest of my post deals with the eeprom soldered to the board in normal status: I noticed that when the car is in ACC, the radio functions perfectly and when the car is put into on, the radio locks after the signal from the class 2. However, what is actually telling the radio to communicate with class 2 at the moment the car is turned on? The reason I ask this is because if I unplug the class 2 and then turn the car to "on" right away, I can see the radio lock before the 10 seconds end and the screen turns off...however, if I have the key in ACC, I can pull the class 2 and the radio will go off in 10 seconds without locking....therefore, something is telling the radio to look at the class 2 and lock if the information does not match or if there is no information at all. I grounded out the class 2 with my multimeter and watched the voltage signals, when the car goes on, it spikes to 3V for a second and then keeps transmitting its serial data that shows up in varying voltages bouncing around from .1 to .4V.

I hope I am being clear.. =\

I know the radio gets its information through the data bus from the bcm, but the act of the radio locking when the data bus is unplugged and the car is turned on does tell me that another signal is being transmitted somewhere to the radio somehow... I grounded out all of my other wires with the multimeter and saw no changes from ACC to ON for any of them so I don't know what is changing in order to tell the radio "check out the data bus now to see if you're not stolen!" =P

Yeah, anyway.. You guys get the jist of it. If we can somehow figure out and stop this change going to the radio when the car is switched on from ACC, then we don't have to worry about anything. The radio will retain all of the information and we won't see any calibration signals. At least for me.... I don't see any calibration or anything as long as I keep using ACC (with the eeprom still connected, that is).

[GSandyD]

Thank U so much for this tip.

I already unlocked a RDS Delco Radio (this hasn’t MP3). I tried 2 times because the EEPROM was slight different and this was difficult to identify which was the pin 8…so when I lifted a wrong pin the radio was unlocked but without sound and many options were not working , so I soldered the pin again and tried with other pin and this time the radio was unlocked and 100% functional (the memories, sound, and all functions are working as expected and no CAL ERROR is displayed in the screen).

[ericakaren86]

Hey all! Trying to do this and it seems like we have been pulling all the wrong ones...we have pulled and reattached each of the corner ones and with 3 out of the four we got the "cal error" and then it went straight to error and didnt do anything. with one it stayed locked. we are trying to make the radio in a 2000 venture a cd player which came form a 2000 venture. any help would be appreciated! thanks!

[vince27]

all works fine accept am,fm presets lost when car is shutoff.any help there
Thanks