logo elektroda
logo elektroda
X
logo elektroda

[Solved] GM Famar DC441 code unlock from 24C02CB6 dump, serial 1305007

andyrs 561 12
ADVERTISEMENT
  • #1 21893735
    andyrs
    Level 3  
    Posts: 5
    Hello,

    Can anyone help me? I have a car radio GM Famar DC441 that is blocked with a code. I've tried using a CH341a to read the IC 24C02CB6 and AI to read the dump in order to find the code, but didn't have success.
    Can anyone check the dump I have or have any other idea how I can unlock this device?

    Info I have:

    DC441 GM Famar

    SERIE A.B PRODUCIDA EN A.A.E
    AI: Can you upload/paste the 24C02 dump file (or hex content) so others can check if the read is valid and try to find the code?
    yes i can
    AI: Did you read the EEPROM in-circuit or removed from the board, and did you make 2–3 reads that are exactly the same?
    Yes
  • ADVERTISEMENT
  • Helpful post
    #2 21893787
    rutra111
    Level 23  
    Posts: 634
    Help: 84
    Rate: 144
    andyyfix wrote:
    Can anyone check the drop

    Hello.
    Please post this screenshot.
  • Helpful post
    #3 21893789
    damiancz
    Moderator of Car Radios
    Posts: 4949
    Help: 475
    Rate: 1394
    9. In the service sections of the forum it is not allowed to ask questions about calculating the code from a specific serial number - they are worthless to other users. Such a question - an order can be placed in the section "Car radios Bazaar". ([Commissioning] decoding ...)

    The exact serial number has been removed.
  • ADVERTISEMENT
  • #4 21895274
    andyrs
    Level 3  
    Posts: 5
    >>21893787
    GM Famar DC441 code unlock from 24C02CB6 dump, serial 1305007

    Added after 45 [s]:

    @rutra111 Done
  • ADVERTISEMENT
  • Helpful post
    #5 21895368
    adam white
    Car audio specialist
    Posts: 1099
    Help: 187
    Rate: 314
    Please check code 3353.

    I see that you are learning. So I'll give you a hint - in the programmer menu, please select the memory type specific to the memory you are reading - here NOT 24C16 but 2402 or 24C02.

    Additionally, in the editor, there should not be 30 bytes in a line as in your case - that is 00-1D but ONLY 16 - that is 00-0F. For example - the 2402 memory readout is 16 lines of 16 bytes and this is an understandable readout for all.

    One last note - your programmer has a selectable voltage for the memory. While reading is successful even when a lower voltage is selected (here it was 3.3V) it is better to select 5V when writing older memories. To be safe, you can always check the power supply of the memory in the device or its catalogue note.
  • Helpful post
    #6 21895387
    rutra111
    Level 23  
    Posts: 634
    Help: 84
    Rate: 144
    According to what you wrote @adam white the file should look like this :
    Attachments:
    • phildc441.rar (226 Bytes) You must be logged in to download this attachment.
  • ADVERTISEMENT
  • Helpful post
    #7 21895436
    adam white
    Car audio specialist
    Posts: 1099
    Help: 187
    Rate: 314
    rutra111 wrote:
    According to what you wrote @adam white the file should look like this :


    Well unfortunately adamwhite must correct. rutra111 - there is an e2p format file in the archive. There used to be such a popular program called PonyProg and it, among other things, also saved binary files that way (it was probably the default choice and was often saved that way, not knowing that you could do otherwise). It created files in which, in addition to the actual data dump from memory, some description could be added. Such a file was, of course, of a different size and thus had different addresses.

    The typical notation understood and recognised by all is this - your file converted from e2p to bin format.
    Attachments:
    • DC441 CODE 0761.zip (231 Bytes) You must be logged in to download this attachment.
  • #8 21896609
    andyrs
    Level 3  
    Posts: 5
    >>21895436
    adam white wrote:
    I see that you are learning. So I'll give you a hint - in the programmer menu, please select the memory type specific to the memory you are reading - here, not 24C16 but 2402 or 24C02.

    Yes, I started to learn how to unlock this kind of device in order to install a Bluetooth module on it, but it's the first one that I don't have the code.

    adam white wrote:
    One last note - your programmer has a selectable voltage for the memory. While reading is successful even when a lower voltage is selected (here it was 3.3 V) it is better to select 5 V when writing older memories

    I saw in the software, but I thought it could damage the chip. My reading device has the option to change between 3.3 V or 5 V. So, if the memory chip can handle 5 V, it's better for write?

    By the way, I've used the .bin file with code 0761 and it worked nicely. Thank you very much!

    My question now is: how do you guys know how to find out the code in the dump, and how do you change the code? It would be great to learn that, so if you guys can help me at least with the basics, it would be very helpful
  • Helpful post
    #9 21896759
    adam white
    Car audio specialist
    Posts: 1099
    Help: 187
    Rate: 314
    andyrs wrote:
    So if the memory chip can handle 5 volts, it is better for writing?


    Here, I'm more concerned with the fact that the memories produced in the past - here about 30 years ago - were designed to operate at 5V (often the 4.5-5.5V operating range was quoted). From experience - reading at lower voltages was often even correct (a lot depended on the design and software of the internal programmer), but for correct writing you needed the native voltage of the memory. Simply put, not all memory cells were correctly programmed at lower voltages. This is why write verification is done.

    Nowadays, the EEPROMs found in SMD housings have lower operating ranges even below 2V and here there is no such problem and you can select a voltage of 3.3V. To be safe, it is worth either measuring in the device or reading the datasheet.

    andyrs wrote:
    My question is: how do you know how to find the code in the dump and how to change the code?


    This and similar Philips radios are fairly straightforward. The code is explicit, a little heterogeneous - 2 digits of the code, 2 other digits which also have their own meaning (one is a so-called error counter which tells you how many wrong attempts to enter the code) and again 2 digits of the code. Please look in the file.
  • #10 21897419
    andyrs
    Level 3  
    Posts: 5
    >>21896759
    adam white wrote:
    To be safe, it is worth either measuring in the device or reading the datasheet.

    Yes, and it makes lot sense. Measuring on the circuit board and I'm getting 5 V going to the IC. I will keep that in mind in the next one.

    adam white wrote:
    This and similar Philips radios are fairly straightforward. The code is explicit, a little heterogeneous - 2 digits of the code, 2 other digits which also have their own meaning (one is a so-called error counter which tells you how many wrong attempts to enter the code) and again 2 digits of the code. Please look in the file.

    Sorry for my ignorance, but when I look in to the file, I can't see wich numbers are the code or another thing. I can see in the file that you sent to me the number 10 74 16 11 that, in my mind, are the number you're talking about, but to be very honest I don't know why those are the code.

    Because I'm starting to work with this kind of device I really need to know how to read the file on the EEPROMs, so this way I can do it by myself instead to ask and bothering people all the time when I need it.

    So what I need to learn is where to look or I need an specific software or hardware to do that? If you guys can teach me that I will appreciate very much. Here in Brazil most people that know how to do that don't like to teach or help.

    I will keep practicing with what I have till now.
  • #11 21897996
    adam white
    Car audio specialist
    Posts: 1099
    Help: 187
    Rate: 314
    andyrs wrote:
    Because I'm starting to work with this kind of device, I really need to know how to read the file in the EEPROM, so this way I can do it myself instead of asking and bothering people all the time when I need it.


    The code was supposed to protect the radio from unauthorised use after theft. In reality, coded radios caused more problems for their legitimate users. Initially, the security features were quite simple, because the processors involved in verifying the code had major limitations. The storage of the code pattern in memory could be explicit, but more often more or less sophisticated encryption was used - e.g. in Grundig radios on memories. To make access to the code more difficult, memories were also used (e.g. in Ford radios) that could not be read by normal programmers. Then came processors with internal EEPROMs - TMS370, Motorola 68HC05 or 68HC11 and others later. The Motorola's could be additionally protected against communication attempts - they could not be read or - worse - when a communication attempt was made, the contents of the internal memory were erased and you had a really big problem. Later radios or especially navigations have even stronger protections.

    There is a relatively large amount of information about encrypted radios on our Forum. Users upload files - they get information about the code. There is also a database of files from various radios. Some contain information about the code addresses. You can find all sorts of calculators on the Internet for free - codes from files or serial number. Here, however, you have to be very careful about security - many of these files are fake or even nasty viruses capable of damaging data on your computer.

    There are also paid programs, e.g. Martech, which even in the cheapest version do a lot of older radios.

    andyrs wrote:
    I see in the file you sent me the number 10 74 16 11


    This is exactly how the code is written in many Philips radios. You can experiment - see how the error counter changes, change the code, even turn it off. You can also see how the radio behaves with differently cleared (FF) memory addresses. Please note that there is more to the memory contents than just code and radio stations. Often there are unique settings stored during e.g. radio tuning. The biggest mistake is to replace the original file with one found on the Internet with a known code. You may not notice any deterioration in performance or functionality with many older radios, but you can really cause yourself a big problem and incur unnecessary costs.
  • #12 21901317
    andyrs
    Level 3  
    Posts: 5
    adam white wrote:
    In reality, coded radios caused more problems for their legitimate users

    That's for sure. In my case, I see people who have old radio cars sell it on intenet and of them ask me to install Bluetooth module on it. That part is easy for, but find the codes aren't.

    adam white wrote:
    There is a relatively large amount of information about encrypted radios on our Forum. Users upload files - they get information about the code. There is also a database of files from various radios. Some contain information about the code addresses

    Good to know. I will look for it because I'm starting to get more clients that want this kind of service.

    adam white wrote:
    Here, however, you have to be very careful about security - many of these files are fake or even nasty viruses capable of damaging data on your computer.

    Alright, I will keep an eye on it. Thank you so much for the help.
  • #13 21901371
    damiancz
    Moderator of Car Radios
    Posts: 4949
    Help: 475
    Rate: 1394
    Resolved = closed

Topic summary

✨ Discussion about unlocking a GM Famar car radio DC441 protected by a code, using a CH341A programmer to read a 24C02CB6 EEPROM dump. The requester provided device identifiers and asked for help verifying the dump or finding another method to recover the code. A forum reply requested a screenshot, and another response noted that calculating codes from a specific serial number is not allowed in the service section; the serial number was removed.
Generated by the language model.

FAQ

TL;DR: For GM Famar DC441 owners and beginners reading a 24C02CB6, the safest path is: use 24C02/2402, not 24C16; format the dump as 16×16 bytes; and remember the working code reported in-thread was 0761. An expert note says, "the code is explicit" in this Philips-style dump. [#21896609]

Why it matters: Correct EEPROM type, voltage, and file format decide whether you get a usable dump or a misleading one.

Item Correct choice Wrong choice Practical effect
EEPROM type in CH341A 24C02 / 2402 24C16 Wrong addressing and confusing dump layout
Hex view layout 16 bytes per line 30 bytes per line Harder to read and compare addresses
Old-memory write voltage 5 V 3.3 V Reads may pass at 3.3 V, but writes can fail
Exchange format .bin .e2p without conversion Extra description changes file size and addresses

Key insight: Do not chase the serial number first. This thread solved the radio by fixing the EEPROM workflow: correct chip type, correct dump format, and correct voltage expectations.

Quick Facts

  • The EEPROM discussed is 24C02CB6, and the thread explicitly says the programmer should use 24C02 or 2402, not 24C16. [#21895368]
  • A readable 24C02 dump should appear as 16 lines of 16 bytes, with offsets 00–0F per line, not 30 bytes shown as 00–1D. [#21895368]
  • The poster confirmed a 5 V supply measured on the board at the IC, which matched the advice to prefer 5 V for writing older memories. [#21897419]
  • The radio accepted a .bin file and the working unlock code reported by the poster was 0761. [#21896609]
  • The thread explains that an .e2p file from PonyProg can include descriptive data beyond raw EEPROM contents, so file size and addresses differ from a normal .bin dump. [#21895436]

How do I unlock a GM Famar DC441 radio using a 24C02CB6 EEPROM dump when the unit is code-blocked?

Use a valid 24C02CB6 readout, convert it to a normal .bin if needed, and extract the code from the Philips-style data pattern. In this case, the poster confirmed that the radio unlocked successfully with code 0761 after using the corrected .bin file. That makes the practical fix a dump-based recovery, not a serial-number calculation. [#21896609]

What is the correct EEPROM type to select in CH341A software for a GM Famar DC441: 24C02/2402 or 24C16?

Select 24C02 or 2402, not 24C16. The thread states this radio uses a 24C02CB6 memory, and the helper explicitly corrected the programmer setting to 2402 or 24C02. Using the exact memory type gives the expected address map and makes the dump understandable to others. [#21895368]

Why can a 24C02 dump look wrong if the programmer is set to 24C16 instead of 24C02?

It looks wrong because the programmer applies the wrong memory geometry and address interpretation. The helper pointed out that the posted readout was confusing partly because 24C16 had been selected instead of 24C02, and the display showed 30 bytes per line rather than the standard 16. That combination makes offsets and code locations hard to recognize. [#21895368]

How should a valid 24C02 binary dump be formatted in a hex editor, and why do 16 bytes per line matter?

A valid 24C02 dump should display as 16 lines of 16 bytes. Each line should run from 00 to 0F, not 00 to 1D. That layout matters because technicians compare addresses visually, and 16-byte rows match the normal binary structure of a 2402 dump. The thread calls this the understandable format recognized by everyone. [#21895368]

What is an .e2p file from PonyProg, and how is it different from a standard .bin EEPROM dump?

".e2p is a file format that stores EEPROM data plus optional descriptive information, so its size and addresses differ from a raw binary dump." In the thread, it is linked to PonyProg, which saved files with extra description around the actual memory data. A normal .bin contains the raw dump only, so its addresses match standard hex views. [#21895436]

How can I convert an EEPROM file from .e2p format to .bin so the addresses match a normal 24C02 readout?

Convert the PonyProg .e2p file to a raw .bin before analyzing addresses. The thread explains that .e2p adds metadata, which changes file size and offsets, while the converted .bin restores the typical notation recognized by technicians. After conversion, the data aligns with a standard 24C02 readout and becomes easier to inspect. [#21895436]

What is the error counter in Philips-style car radio EEPROM data, and how is it stored alongside the code?

The error counter is a stored value that tracks wrong code-entry attempts. The thread says Philips-style radios keep 2 digits of the code, then 2 other digits with their own meaning, where one is the error counter, and then 2 digits of the code again. That means the code data is explicit but mixed with service-relevant status bytes. [#21896759]

How do experienced technicians identify the radio code inside a Philips or GM Famar EEPROM dump without using the serial number?

They read the code directly from the EEPROM pattern, not from the serial number. The thread says these Philips-related radios are fairly straightforward because the code is stored explicitly, with code digits split around other bytes such as the error counter. That is why the forum moderator removed the serial-number route and the solution came from dump analysis instead. [#21896759]

What steps should I follow to safely read and write an old 24C02CB6 EEPROM with a CH341A programmer?

Follow this workflow:
  1. Select 24C02/2402, not 24C16, before reading.
  2. Read the chip and check the dump in a 16-byte-per-line hex view.
  3. For writing older memories, use the memory's native voltage, verify the write, and confirm supply or datasheet first.
The thread also notes that the poster had measured 5 V on the board at the IC, which supported the safer write setting. [#21897419]

Why is 5 V often recommended for writing older EEPROMs while 3.3 V may still work for reading?

Older EEPROMs were often designed for 5 V operation, so writing at 3.3 V can leave some cells incompletely programmed. The thread says reads at lower voltage were often still correct, but proper writing needed the memory's native voltage, especially on parts from about 30 years ago. That is why 5 V was recommended here for write reliability. [#21896759]

24C02 at 3.3 V vs 5 V on a CH341A — which is better for reliable reading and writing of older memories?

For older 24C02 parts, 3.3 V can be acceptable for reading, but 5 V is the better choice for reliable writing. The helper explained that past-generation EEPROMs commonly worked in the 4.5–5.5 V range, and lower-voltage writing could miss cells even if the dump read looked fine. For safety, measure the device supply or check the datasheet first. [#21896759]

What is write verification in EEPROM programming, and how does it help catch incomplete programming at the wrong voltage?

Write verification is a post-write check that compares the programmed contents with the intended data. The thread explains that at too low a voltage, not all memory cells were correctly programmed, which is exactly why verification is performed. It catches partial or inconsistent writes that may not be obvious from a simple readback assumption alone. [#21896759]

Which software or hardware tools are commonly used to learn car radio EEPROM decoding, such as CH341A, PonyProg, or Martech?

The thread names CH341A for reading and writing, PonyProg for legacy .e2p files, and Martech as a paid option that covers many older radios even in a cheaper version. It also mentions forum databases and online calculators, but warns that some downloads are fake or malicious. For learning, start with raw dumps and trusted tools, not random executables. [#21897996]

What risks come from replacing the original radio EEPROM file with a random dump from the internet just to get a known code?

You can lose more than the code. The thread warns that EEPROM contents often include radio stations, unique tuning settings, and other stored data beyond the code itself. The helper calls it the biggest mistake to overwrite the original with an internet file, because the radio may appear to work while hidden functions or calibration data degrade and create extra cost later. [#21897996]

Where should I look in an EEPROM dump to start learning how radio code data, settings, and tuning information are stored?

Start by locating the explicit Philips-style code bytes, then compare nearby bytes that change after wrong attempts or retuning. The thread points to a pattern written as 10 74 16 11 and explains that this style stores code digits alongside the error counter. From there, experiment carefully, because the same dump can also hold station presets and unique radio-tuning information. [#21897996]
Generated by the language model.
ADVERTISEMENT