The EEPROM of a Philips DC 5xx carradio
![[+]](/images/downarrow.png){kind=small}
A friend of mine bought a car in 2001. There was a Philips DC501 carradio inside, but he forgot to ask the security code. Thus the carradio was pratically unusable. But we saw the radio pcb contains a 24C02 IIC EEPROM, so the least we could do is having a look at it's contents...
I'm not going to explain here in detail how to circumvent the security code of the radio. If you are able to read and write the non-volatile memory, finding the information on this page is only a matter of time.
The 24C02 is a IIC serial EEPROM with 2k of memory (datasheet). This memory is used to store channel frequencies, the security code and status and some other things. You can find below what I've found out.
Channel presets
There is space for 5 bands in the memory area 0x00-0x4f (band 0 starts on 0x00, band 1 on 0x10, etc.). My radio only had 3 FM bands, other models probabely also have two AM bands. Each band can use 16 bytes of memory (see table). The currently selected band can be found in the high nibble of byte 0x72. A 16-byte band memory block is used as follows:
| Byte offset | Function |
|---|---|
| 0x00-0x01 | Frequency preset 1 |
| 0x02-0x03 | Frequency preset 2 |
| 0x04-0x05 | Frequency preset 3 |
| 0x06-0x07 | Frequency preset 4 |
| 0x08-0x09 | Frequency preset 5 |
| 0x0a-0x0b | Frequency preset 6 |
| 0x0c-0x0d | Current frequency for manual tuning |
| 0x0e-0x0f | Unused (0xffff by default) |
I don't know the relation between the 16-bit number of the frequency and the frequency in Hz.
Security
| Byte# | Bit# | Function |
|---|---|---|
| 0x59 | 4-7 | =1: display shows 'Cod <>', code cannot be entered until
some time has passed. =2: display shows 'Cod', code can be entered. |
| 0x59 | 0-3 | First digit of security code |
| 0x5a | 4-7 | Second digit of security code |
| 0x5a | 0-3 | Time to wait before code can be entered (when display shows 'Cod <>'). 0x0f=1min, 0x0E=2min, 0x0D=4min, .... |
| 0x5b | 4-7 | =1: Radio is locked, code has te be entered =2: Radio is unlocked, no code has to be entered. |
| 0x5b | 0-3 | Third digit of security code |
| 0x5c | 4-7 | Fourth digit of security code |
Current radio settings
| Byte# | Bit# | Function |
|---|---|---|
| 0x72 | 4-7 | Radio band (0=FM1, 3=FM2, 4=FM3) |
| 0x78 | 4-7 | Selected preset channel for band 0 |
| 0x78 | 0-4 | =0x0d: Preset selected, =0x04: manual tuning [band 0] |
| 0x7b | 4-7 | Selected preset channel for band 3 |
| 0x78 | 0-4 | =0x0d: Preset selected, =0x04: manual tuning [band 3] |
| 0x7c | 4-7 | Selected preset channel for band 4 |
| 0x78 | 0-4 | =0x0d: Preset selected, =0x04: manual tuning [band 4] |