logo elektroda
logo elektroda
X
logo elektroda

Delphi B420 Low SS Radio Code Extraction from 24LC32 EEPROM Dump (Ford Ka/Fiat 500)

Don_Ughetto 78 3
ADVERTISEMENT
  • #1 21863515
    Don_Ughetto
    Level 1  
    Hello everyone,

    I’m trying to recover the radio code from a **Delphi B420 Low S&S** unit removed from a **Ford Ka (2009–2012 platform, shared with Fiat 500)**.
    The radio requested the code after a battery disconnect, and unfortunately the original code card is missing.
    I decided to read the EEPROM directly to try to recover the code.

    Radio information


    Model:
    Delphi **B420 Low S&S**
    Part numbers found on the unit:
    ```
    Prod Date : 1312
    Serial Number : 7355597070
    HW Ver : 28346965
    28316510
    ```
    EEPROM type:
    24LC32 (I²C)
    ---

    Tools used


    Programmer: CH341A USB programmer


    Software used to read EEPROM:
    NeoProgrammer
    Connection method:
    SOIC8 clip directly on the EEPROM (in circuit)

    The radio was completely disconnected from the vehicle during the reading.

    Dumps obtained


    Dump1–first read original B420 unit selled with car Dump1.bin (4 kB)You must be logged in to download this attachment.
    Dump2 – second read (identical to Dump1, confirming good contact) Dump2.bin (4 kB)You must be logged in to download this attachment.
    Dump3 – dump from a second identical B420 unit, buyed to compare if the first one have any problem. Dump3.bin (4 kB)You must be logged in to download this attachment.

    All dumps are **4096 bytes** (24LC32).

    The first two dumps are identical, so the read should be correct.

    I noticed a repeated block around address
    0x0B30
    in the dumps:

    80 02 32 14 64 00 14 19 6F 03 E2 1E 40 1F 32 06
    00 80 02 32 14 64 00 14 19 6F 03 E2 1E 40 1F 32

    ASCII view looks like:
    ..2.d...o...@.2.

    This block is identical between different radios, so it probably isn't the code itself.

    Large differences between dumps appear mostly in areas containing **RDS station names**, so those are probably user presets.

    I would like help with one of the following:

    1. Extracting the **radio code directly from the EEPROM dump**, or
    2. Identifying the **offset/algorithm used by Delphi B420 Low units**, or
    3. Confirming if the code is **calculated from an internal identifier rather than stored directly**.

    If needed I can also provide:

    * full EEPROM hex view
    * pictures of the radio PCB
    * EEPROM location

    Thanks in advance for any help or guidance.
    AI: Can you share the serial number from the radio’s label (not just the part numbers), as some code algorithms require it or use it as a basis for calculation?
    7355597070283469651209001020
  • ADVERTISEMENT
  • Helpful post
    #2 21863583
    JayRo
    Level 38  
    Dump1, dump2 - 3614, dump3 - 5451.
  • ADVERTISEMENT
  • #3 21863632
    Don_Ughetto
    Level 1  
    >>21863583 Hello JayRo,
    I'll try tonight and I'll tell you the result. Thank you for the quick answer.

    Have a nice day!
  • #4 21863688
    JayRo
    Level 38  
    By the way, the code is located in offset #10-#11 (EA A7) encrypted by Grundig algorithm. Good luck!
ADVERTISEMENT