eeprom-programmer icon indicating copy to clipboard operation
eeprom-programmer copied to clipboard

Write protected EEPROMS from China

Open Sakvojage opened this issue 5 years ago • 3 comments

Hi, I've received several EEPROMs from Ebay, but I'm only able to program one of seven AT28C256. Of course these are weird fakes or old dead ones, but I have tried to software erase those or disable protection. No luck yet. Am I doing it right?

Docs: CHIP erase - http://ww1.microchip.com/downloads/en/Appnotes/doc0544.pdf Protection - http://ww1.microchip.com/downloads/en/Appnotes/DOC0543.PDF

unsigned long time;
void setup() {
 pinMode(SHIFT_DATA, OUTPUT);
 pinMode(SHIFT_CLK, OUTPUT);
 pinMode(SHIFT_LATCH, OUTPUT);
 digitalWrite(WRITE_EN, HIGH);
 pinMode(WRITE_EN, OUTPUT);
 Serial.begin(230400);

 Serial.print("\nUnlocking EEPROM... ");
 time = millis();
 writeEEPROM(21845, 0xaa);
 writeEEPROM(10922, 0x55);
 writeEEPROM(21845, 0x80);
 
 writeEEPROM(21845, 0xaa);
 writeEEPROM(10922, 0x55);
 writeEEPROM(21845, 0x10);
 
 writeEEPROM(1, 0x55);
 writeEEPROM(2, 0xaa);
 writeEEPROM(32767, 0x55);

 time = millis() - time;
 Serial.print("...done in ");
 Serial.println(time);
 
 printContents();
 writeEEPROM(1, 0x55);
}

It finished in 12 ms as I have reduced WRITE_EN cycle:

 digitalWrite(WRITE_EN, LOW);
  delayMicroseconds(1);
  digitalWrite(WRITE_EN, HIGH);
  delay(1);

Any thoughts?

Sakvojage avatar Jun 06 '20 21:06 Sakvojage

Have you tried disabling the write-protect?

unsigned long time;
void setup() {
 pinMode(SHIFT_DATA, OUTPUT);
 pinMode(SHIFT_CLK, OUTPUT);
 pinMode(SHIFT_LATCH, OUTPUT);
 digitalWrite(WRITE_EN, HIGH);
 pinMode(WRITE_EN, OUTPUT);
 Serial.begin(230400);

 Serial.print("\nUnlocking EEPROM... ");
 time = millis();

 // three-write command prefix
 writeEEPROM(0x5555, 0xAA);
 writeEEPROM(0x2AAA, 0x55);
 writeEEPROM(0x5555, 0x80);

 // three-write command to disable protection
 writeEEPROM(0x5555, 0xAA);
 writeEEPROM(0x2AAA, 0x55);
 writeEEPROM(0x5555, 0x20);

 delay(20) // tWC - wait for the EEPROM to finish

 // Write new data to the EEPROM
 writeEEPROM(0x0001, 0x55);
 writeEEPROM(0x0002, 0xAA);
 writeEEPROM(0x7FFF, 0x55);

 time = millis() - time;
 Serial.print("...done in ");
 Serial.println(time);
 
 Serial.println("Reading EEPROM");
 printContents();
}

GregEakin avatar Aug 09 '20 16:08 GregEakin

I had the same problem and believe the issue is that in order to remove SDP you not only need to write the disable byte sequence, but you have to do it within a paged operation (If you think about it, the only way the chip knows you're writing the code sequence is if it sees them all at once).

Anyway, Ben's code uses high-level Arduino functions, which are fine if your chip is unlocked, but these are terribly inefficient (Arduino's fault - not Ben's) and can't write multiple bytes within the 150us timeframe allowed. When I re-wrote my version of the programmer to use port manipulation instead I received a huge performance boost, and successfully removed SDP. Now I can write whatever data I like.

I've only just achieved this but wanted to help others ASAP because I know how frustrating it is to be locked out. Here's my code, warts and all: https://github.com/jfigge/arduino-28c256-programmer

Good luck, and this comes with no warrantees (but is free to use and abuse :) )

jfigge avatar Aug 21 '20 16:08 jfigge

I'm having the same problem. I think I accidentally destroyed one of two eeprom's while testing. I ordered new ones, but they need some time to arrive... If I have time, I am going to checkout jfigge's programmer...

felbinger avatar Oct 21 '21 22:10 felbinger