The interior of the Blaupunkt MS8BK radio, Flash memory analysis and the second life of the display

p.kaczmarek2 18 Dec 2025 14:35 4 1569 Cool? (+11)

📢 Listen (AI):

TL;DR

A teardown of the Blaupunkt MS8BK radio/CD/USB unit examines its motherboard, flash memory, display board, amplifier, and front-panel controller.
The flash dump is loaded into Ghidra as 8051 code, exposing interrupt vectors, timer setup, and a firmware layout very similar to MT1369 firmware.
The board centers on a Mediatek MT8309QLN MCU, 2 MB flash, a PT7314E four-channel audio processor, and a TDA7266SA dual 7W+7W amplifier.
The CD1628 display/keypad controller was reverse engineered and driven from Arduino through its DIO, CLK, and STB pins.
A simple SDCC blink test produced no visible port activity, and the radio apparently was already not starting before the analysis.

Here is a short presentation of the inside of the Blaupunkt model MS8BK microwave with CD and USB player. I will check here how it is built, try to analyse its firmware from an unknown microprocessor and determine its architecture in Ghidra, and then run its display with Arduino.

Rear label of Blaupunkt MS8BK micro system with power and model information

Interior of the MS8BK
The equipment came to me decomposed, so the presentation does not include the power supply. I can infer from the board itself that it provided standard voltages such as 5 and 12 volts. It was probably already a switching power supply in a flyback topology - the type I see in modern equipment. Older audio towers used to have the classic 50/60 Hz transformers, but I see them less and less nowadays.

Disassembled Blaupunkt MS8BK micro hi-fi with mainboard and CD drive visible

Blaupunkt MS8BK micro stereo front and main PCBs with display and buttons

The motherboard rests on a Mediatek processor, I'll leave it for last. Right next to it you can see the 2 MB Flash memory, which perhaps houses the software, and in the corner there is also an EEPROM - maybe for configuration.

Close-up of PCB with PT7314E chip and connector with red and black wires

There is a separate four-channel processor for audio on the board - the PT7314E, the main CPU controls it via I2C:

Datasheet of PT7314E audio processor with description and features list.

Separately, we have the amplifier - a dual 7W+7W, TDA7266SA, mounted on a large heatsink for adequate cooling:

Heatsink on TDA7266SA chip mounted on Blaupunkt micro system PCB

TDA7266SA amplifier datasheet showing specifications and package illustration

A watch quartz resonator and a small circuit in the corner still caught my eye - at first I thought it was an RTCC, but there's an antenna leading there. It's probably the radio's receiving circuit. Perhaps it would be possible to run it in bulk?

Close-up of a PCB with a resonator, connector, and IC near labeled components

Well, that leaves the main MCU:

Close-up of PCB with Mediatek MT8309QLN chip and SMD components visible.

Mediatek MT8309QLN. I haven't found specific information about it on the web, although someone has already posted a batch from it on another forum:

Spoiler:

https://remont-aud.net/dump/audio/blaupunkt_m...ssi_main_board_mt8309_05w_002_b/73-1-0-152260

So the MS12BT has a very similar design.

The display board is much simpler. The laminate is single sided, with only the main controller, the CD1628, surface soldered on the track side. It operates the buttons and the 7-segment display. In addition, we have an IR receiver, an encoder and a standby diode on the board.

Flash memory analysis
I soldered the Flash memory using hot air and read it with the CH341 programmer.

Blaupunkt micro hi-fi mainboard with connected CH341 programmer

Binwalk found nothing interesting in it. I started looking through it in xvi32 . No header or partition structure is visible. The memory starts at bytes 02 1F E0, which is reminiscent of the 8051 jump instruction:

Hex editor screenshot showing binary Flash memory data

0x02 is the instruction code, 0x1FE0 is the jump address.

Description of the LJMP instruction in 8051 assembly with byte encoding and example

At offset 03 we again have jump instruction 02 21 D0. This matches with the interrupt position of the 8051. It looks like we do indeed have this classic core used here.
We'll try to decompile it, but it's still worth looking for ASCII captions, they can reveal a lot about the firmware.

Hex editor view showing binary data from the Flash memory of Blaupunkt MS8BK micro stereo system

XVID, 3IV1, MP4S, M4S2 codecs.

ASCII table from hex editor showing Flash memory data from Blaupunkt MS8BK

There's nothing more about booting or command line, so we probably won't run UART. UPGRAD only suggests batch updates. I wonder where SCOTT came from there - is that the author's signature?

Binary data dump from FLASH memory shown in XVI32 editor, with visible ASCII strings

MT1369? The internal name of the chip? There seems to be something wrong? Although here and here Mediatek....
https://www.elektroda.pl/rtvforum/find.php?q=MT1369
Looks like the chip from the DVD, strange. Maybe internally it's the same processor.

Time to move on though. I loaded the flash into the Ghidr decompiler and decoded it as 8051 instructions. The operations look correct, first we have a jump to the actual program from address 0x0, because we have interrupt vectors at the beginning:

Screenshot from the Ghidra decompiler analyzing assembly 8051 code

The first function resembles the initialisation of the three pins and the memory:

I also managed to find a separate function to initialise the timer, this clearly shows that the instructions are decoded correctly:

Ghidra screenshot showing disassembled 8051 code and decompiled function view

Screenshot from a decompiler showing a function configuring 8051 microcontroller registers

I've also looked for UART related commands, but haven't found anything that directly resembles sending or receiving, even though the standard UART registers of the 8051 are well documented and known.

Compare with the batch from MT1369?
However, I was curious as to why, according to our forum, the same writing appears in the memory dumps from the DVD.
I downloaded a copy of the batch from this post:
https://www.elektroda.pl/rtvforum/topic467658.html#2627620

Side-by-side assembly code comparison in Ghidra; left and right show 8051 firmware

It seems to be the same initialisation process (or bootloader). A quick comparison of the two firmwares in Ghidra shows a very strong similarity.

This confirms the strong connection between the two firmware and the chips, although I did not perform a deeper analysis anymore.

I still made an attempt to compile a simple blink in SDCC for the 8051 but failed to detect any blink on the ports of my unknown processor. However, I don't know if it worked before - the radio supposedly had power and didn't start, so maybe there was something wrong with it before.

First step with the display
The display module is very attractive and useful - it doesn't require many pins to control, and it fits the watch just right. There are lots of digits, there are two colons, it will be worth the struggle.
You need to start with the CD1628 datasheet note. Fortunately, it is available:

Part of the CD1628 datasheet showing LED driver features and description

The CD1628 is controlled by three pins - DIO (data I/O), CLK (clock) and STB (strobe, chip select).

Block diagram of CD1628 display and keypad controller with labeled inputs and modules.

The protocol is described in the PDF:

CD1628 command table showing display modes and data configuration settings

A quick read of the note tells us that this is essentially the same circuit as the well-known TM1628 family, TM1637, TM1650, etc:
We are running the HD2015 display/button controller after reverse engineering, comparison with TM1637itd
7-segment displays on TM1637 - 4 and 6 digits - Arduino, protocol
The main difference is that instead of generating I2C-style start and stop conditions here, we operate the STB pin here.
It's time to put this into code - I've chosen Arduino for simplicity:
First pins - 0 and 1 are RX/TX, so I started with 2:

Then sending data - according to the datasheet note.

CD1628 serial transmission format with three signal lines: STB, DIO, CLK

The bits are loaded on the rising edge of the clock, so I first set the clock to the LOW state, then set the DIO state, then wait a moment and reset the clock to the high state.

The strobe needs to be in the low state for communication, so I added an auxiliary function to send the command:

This is the basic build of sending.
Now the question is what to send.
The register addresses and commands are the same as in the TM1650 and similar .
Sequentially:
- Command 1 - setting the display mode (how many segments, how many grids)
- Command 2 - setting the operating mode (normal mode)
- Command 3 - setting display address and data (segments)
- Command 4 - setting the display control (brightness level, on/off status)

Here the only unknown is the first command - because we have four modes, how do you know which one is used on the board? Is it necessary to trace the paths?

Configuration table for segment and grid modes in CD1628 display controller

In my opinion, not necessarily - I just checked each of the 4 options and settled on the one that, with my test code setting all data alternately to 1 and 0, lights and extinguishes all fragments.

Result - first without setting the correct grid/segment configuration (0x03):

Blaupunkt MS8BK micro hi-fi display showing active icons and 7-segment clock

With correct configuration:

Blaupunkt micro hi-fi clock display with blue backlight and audio source icons

Segments
I then started experimenting with how to control the segments. It turned out that the segments of a single digit are scattered over different registers. That is, code like this:

puts out the first digit:

Blaupunkt micro hi-fi LED display with active mode icons and highlighted digit

All that remains is to manually check which position corresponds to which segment - then digit masks can be created based on this.

CD1628 7-segment display with active digits and icons on mounted circuit board

Digits
I also then identified which registers are associated with the digits at all - not all, basically every other register:

A simple scrolling of the digits is realised above.

Blue-lit CD1628 7-segment display with digits and labeled icons active

Transform to a common buffer, icons and countdown
Now you could already do a normal countdown or timer, but you still need to separate the buffer so that it is shared with the icons. This is because the array that is there now represents all the segments - not just the digits themselves.
The array on is now global, and the function drawText lights or extinguishes all digit segments accordingly. Additionally i have isolated a helper function setIcon that lights or extinguishes a given segment defined by byte and bit index.
Most importantly, setIcon can be called once and subsequent drawText will not overwrite the changes.
We also managed to find both colons.

Auxiliary functions for icons:

Blue 7-segment display showing scrolling digits 032754.

Decode the keys.
The reading is very simple. We simply send the appropriate command and then read the data from the same pin we sent it with. The controller outputs the data on the falling edge.

Timing diagram of data read using STB/DIO/CLK interface for display driver

There's an interesting issue here too, because the CD1628 returns 5 bytes to us, and only selected bits of these relate to the keys - the rest are meaningless. I don't know where this design decision came from.

CD1628 key scan RAM table showing byte and bit mapping

I've done away with specifying these bits, I just keep an array of five bytes and with each read I check which bits have changed, and then call the functions that handle the events, key press and key release separately.

Result:

Key log data from Arduino serial monitor showing CD1628 button presses/releases

In this way you could make a functional clock or device controller with a display. You could still run an encoder and harness it too.

Summary
The equipment came to me incomplete, although I certainly know that the power supply was in working order and useful to the original owner.
In addition to the power supply there was the motherboard and front display PCB.
The motherboard turned out to be quite interesting, I was able to rip the Flash memory, determine the MCU architecture, analyse its firmware and even find its links to chips from DVD players. I also wanted to upload a simple "blink LED" to it, but unfortunately this one didn't start - I didn't experiment with it further, though, as I suspect something may have been corrupted earlier.
The front panel also caught my interest, and in this case managed to get it working easily from the Arduino. Almost all of it is realised using the CD1628 chip, a unified display and keyboard controller similar to the more popular TM1650, TM1637, TM1636, etc. Even the register addresses match.
All in all, the adventure was interesting.
I'm attaching the ripped 2MB batch, maybe someone wants to open it in Ghidra too:
https://github.com/openshwprojects/FlashDumps/commit/dae69584d40094af235c3fbebc51254746f39f4e

About Author

p.kaczmarek2 wrote 14221 posts with rating 12114 , helped 647 times. Been with us since 2014 year.

Comments

Add a comment

Nepto 19 Dec 2025 19:18

Maybe it's the RDA5807, the 10 pin chassis and quartz might suggest it. Could you take a clearer photo of this area so you can see the tracks? Maybe that would help confirm if it's this chip. [Read more]

p.kaczmarek2 19 Dec 2025 20:45

The RDA5807 could come in handy, from what I can see it has I2C communication, so you could also check with an I2C scanner. What makes things a bit difficult for me is that the PCB there is covered... [Read more]

Nepto 19 Dec 2025 21:18

Oh, great pictures. I'm 90% sure it's the RDA5807: https://obrazki.elektroda.pl/5394721600_1766174943_bigthumb.jpg https://obrazki.elektroda.pl/5506568000_1766175419_bigthumb.jpg You... [Read more]

p.kaczmarek2 19 Dec 2025 21:50

That electrolytic capacitor there is from the power supply, but the power supply switches on transistor U2, so there is no direct continuity to 5 V. They probably switch off the power supply to the RDA... [Read more]

FAQ

TL;DR: 2 MB flash was dumped and decompiled; “instructions decode correctly as 8051,” enabling Arduino control of the CD1628 display. [Elektroda, p.kaczmarek2, post #21783892]

Why it matters: This FAQ shows how to reuse the MS8BK radio’s display/keys and understand its firmware without vendor docs—perfect for repair, modding, or hobby builds.

Quick Facts

Main SoC: Mediatek MT8309QLN; firmware strongly matches MT1369 DVD boot code. [Elektroda, p.kaczmarek2, post #21783892]
External memories: 2 MB SPI/NOR flash plus an EEPROM for configuration. [Elektroda, p.kaczmarek2, post #21783892]
Audio path: PT7314E 4‑ch processor (I2C) and TDA7266SA 7W+7W power amp on heatsink. [Elektroda, p.kaczmarek2, post #21783892]
Display/keys: CD1628 controller, 3‑wire bus (DIO/CLK/STB), TM16xx‑style register map. [Elektroda, p.kaczmarek2, post #21783892]
Power: Typical 5 V and 12 V from a flyback SMPS; tuner power is transistor‑switched. [Elektroda, p.kaczmarek2, post #21785135]

What chips are inside the Blaupunkt MS8BK mainboard?

The board hosts a Mediatek MT8309QLN SoC, a 2 MB flash, a small EEPROM, a PT7314E audio processor on I2C, and a TDA7266SA 7W+7W amplifier mounted to a large heatsink. A crystal and 10‑pin RF section implement the radio frontend on the same PCB. [Elektroda, p.kaczmarek2, post #21783892]

What CPU architecture does the firmware use?

Flash starts with 8051‑style jumps, and Ghidra decoding confirms valid 8051 instructions and timer setup. The author notes, “instructions look correct,” after disassembling vectors and init code. This aligns with similar MT1369 DVD dumps, indicating a shared code base or toolchain. [Elektroda, p.kaczmarek2, post #21783892]

How was the 2 MB flash dump obtained?

The flash IC was hot‑air desoldered and read using a CH341 programmer. Binwalk found no filesystems, so analysis continued in a hex editor and Ghidra. The dump begins with 0x02 long jumps typical for 8051 vectors. A public 2 MB image is linked for study. [Elektroda, p.kaczmarek2, post #21783892]

Is MT8309 firmware related to Mediatek MT1369 DVD players?

Yes. Function graphs show near‑identical init loops and bootloader behavior when comparing the MS8BK dump to an MT1369 DVD batch. This strongly indicates a common platform or reused ROM code, aiding signature‑based reversing and peripheral mapping. [Elektroda, p.kaczmarek2, post #21783892]

How do I drive the MS8BK CD1628 display with Arduino?

Wire three pins: DIO to D2, CLK to D3, STB to D4. Send 0x03 (mode), 0x40 (write), then 0xC0 + 14 data bytes, and finish with 0x8F (display on, max brightness). Bits latch on CLK rising edge. Use provided writeBit/writeByte helpers for timing. [Elektroda, p.kaczmarek2, post #21783892]

Quick how-to: light all segments, then clear them?

Initialize pins, set CLK/STB/DIO HIGH.
Call writeDisplay(on[14]=0xFF each) to light all segments.
After 1 s, call writeDisplay(off[14]=0x00 each) to clear. This validates your wiring and CD1628 mode selection. [Elektroda, p.kaczmarek2, post #21783892]

Which command controls brightness and how many control wires are needed?

Use command 0x8F for display ON at maximum brightness. You can reduce brightness with the lower nibble per CD1628 control scheme. The interface uses three wires total: DIO, CLK, and STB. “The main difference is STB instead of I2C start/stop.” [Elektroda, p.kaczmarek2, post #21783892]

Why don’t single bytes map to single digits on this display?

Digit segments are interleaved across alternating addresses. The author built segment masks and a drawText() that composes seven segment bits per digit into the 14‑byte frame. Expect to map each segment bit to its byte/bit position first. [Elektroda, p.kaczmarek2, post #21783892]

How do I read the front‑panel keys from the CD1628?

Send 0x42 with STB low, switch DIO to input, then read five bytes on CLK falling edges. Only selected bits represent keys; unchanged bits are ignored. Maintain a 5‑byte state, diff it, and emit onKeyDown/onKeyUp events. Statistic: it always returns 5 bytes. [Elektroda, p.kaczmarek2, post #21783892]

Which FM tuner IC is on the board, and how can I confirm it?

Photos and pin tracing indicate an RDA5807 in a 10‑pin package with adjacent crystal. Confirm by measuring VDD at pin 7 near the resonator and scanning I2C. The RF area’s coating obscures silkscreen, so pin‑level checks help verify identity. [Elektroda, Nepto, post #21785101]

Why is tuner power not always present on its rail?

Power to the tuner section is switched by a transistor labeled U2. The electrolytic nearby is on the supply, but continuity to 5 V is intentionally gated. This saves idle power and isolates RF when unused, affecting measurement expectations. [Elektroda, p.kaczmarek2, post #21785135]

Does the firmware expose a UART for easy logs?

No UART strings or register access patterns were found in the dump. The analysis scanned for TX/RX routines and common 8051 SCON patterns without hits. Focus instead on display, keys, and I2C peripherals for interaction and testing. [Elektroda, p.kaczmarek2, post #21783892]

My test blink for the MCU didn’t run. What’s the likely cause?

A simple SDCC 8051 blink failed too. The unit previously had power issues and may be non‑booting. Edge case: boot may depend on external AM/FM or audio IC init pulling lines to expected states, so a bare test can stall early. [Elektroda, p.kaczmarek2, post #21783892]

What voltages and audio stages should I expect when powering the board?

Expect 5 V and 12 V rails from a flyback SMPS. Audio control uses PT7314E over I2C, and power amplification uses a TDA7266SA rated 7W+7W with a dedicated heatsink. Check thermal compound and sink seating before extended tests. [Elektroda, p.kaczmarek2, post #21783892]

What is Arduino in this context, and why was it chosen?

Arduino provides a simple GPIO‑bit‑bang approach for the CD1628’s 3‑wire protocol. The example uses digitalWrite and delayMicroseconds to meet timing. It avoids custom libraries, making the code portable to UNO, Nano, and similar 5 V boards. [Elektroda, p.kaczmarek2, post #21783892]

Can a small PIC (e.g., PIC12F) control the suspected RDA5807 tuner?

Yes, if it supports I2C and has enough program/data memory for station storage and UI. The author considers a PIC12F for this, noting I2C control and memory constraints. Keep UI minimal or offload display logic to the CD1628 host. [Elektroda, p.kaczmarek2, post #21785135]

Where can I download the 2 MB firmware image for analysis?

A GitHub commit link to the full 2 MB flash dump is provided in the thread. Load it into Ghidra with an 8051 processor selection to reproduce the decompilation and compare with MT1369 boot snippets. Validate vectors before deeper work. [Elektroda, p.kaczmarek2, post #21783892]