Am I on a hiding to nothing? trying to crack a device with unavailable remote control, and no button functions to speak of. Is there a technique of sniffing a microcontroller to at least find the basic pulse repition rate? perhaps inductive loop over the package or monitoring to nA level in supply current would register a blip, or is it all or nothing? Anyway First tried this with Mitsubishi BD 512 "universal" rc Removed the 4MHz resonator and fed in a sig gen of about 1.5V pk-pk (previously scoped), floating from the rc battery levels. With a known receiver and transmitter code selected, then functions would work over range
3.3 to 5.8M then fail outside that. The rc would work with 1.5V sine between 300K and 10.5M. Didn't continue with that one as you had to manually step through each in-built code.Got a few no-name URCs from UK Poundland "pound shop" , badged as Signalex ,
81415, 10 in 1 . 1 GBP for all the functionality of a URC. This type you can set it to flicker away to itself until it reaches the end of a batch of codes. Removed the 3.58MHz resonator (why so apparently accurate?) . With 1.5V pk-pk locked in with receiver over range 2.7 to 5.1M, and again about 300K to 11M would operate using 1.5V. So far have only used with original 3.58M , 6M and 7.5M sine inputs. Am I serendipitously likely to get a hit somewhere, at least the unit on/off model recognition code if not function code plus the model codeSo 2 out of 2 of these URC have been amenable to this mod but no match to the unit in question found so far. Is there any general guidelines for makers to choose certain types/ranges of coding for different types of equipment or is it totally open for them to choose? Assorted bits of kit show at least partial responses to some of these off-spec codes, but not my target one so far.