| Author | Post |
|---|
Alfarusty
Member
| Joined: | Mon Jul 6th, 2009 |
| Location: | Leicester |
| Posts: | 11 |
| Status: |
Offline
|
| Mana: |  |
|
Posted: Tue Sep 29th, 2009 11:10 am |
|
Hi, just as a suggestion i wonder if reading and modifying the RAM is the solution. The EPROMs are not EEPROMS? so they can't be updated within the machine when the engineer unlocks it . The RAM is battery backed so would /could keep the status of the locked section of the code? I doubt if it would be conveniently labeled 'Locked=true' but comparing a locked vs unlocked unit may highlight the area.
Other things to try could be to replicate the first power on? Several possibilities here, if i were designing the machine it would default to working without being locked but it could default to locked. Either way if it didn't know the time the date related code would have to start from some point and maybe it is the other number you found?
The Engineer didn't imply that having a dead battery with the RAM was a big issue, but that is relative, if you have all the data nothing is a big issue.
Sounds like you are having fun, email me at Alfarusty@fsmail.net . I'm currently reverse engineering the Gas bench to fix the 'HCR' displayed in the calibration screen problem, usually £300 to fix.
|
Trev16v
Member
| Joined: | Mon Sep 14th, 2009 |
| Location: | |
| Posts: | 5 |
| Status: |
Offline
|
| Mana: | |
|
Posted: Thu Sep 24th, 2009 10:57 pm |
|
Hi all,
Just to keep you guys posted on how I'm progressing with this, I have arranged to loan a very high-end EPROM emulator which I shall collect this weekend.
I don't think I will be able to do much for a couple of weekends because I need to order a 32-pin adapter for the emulator I'm borrowing, and next weekend is a housewarming party.
In the meantime if anyone requires pictures of any parts of the DGA-1800 then let me know, because the two machines we have seem to be very complete. Well, one of them certainly is. There's even a remote control handset that sits in a charger cradle for one of them.
I have a strong motivation to achieve this because my friend and I have between us not one, but two DGA-1800s, both of which are currently calibration 'locked'. Last weekend we borrowed a horsebox to transport one over from storage and wheel it into my place, ready for the project to begin!
The ideal end goal will be to produce a set of replacement EPROMs with modified software that replace the originals.
Alfarusty: That's right - there are two EPROMs, one of which appears to be the main application code and the other which appears to contain system diagnostics software; and there is also a RAM IC that sits upon a 'stack' of sockets just as you describe, most probably with a backup battery within the stack. Yes, I too wondered what the effect would be if the battery died completely. I am keeping my fingers crossed that the one in my shed should still have a healthy battery because I'm pretty sure the last calibration sticker on the machine was as recent as 2007. I may try to extract the data from that device just to back it up. The board also has a surprising amount of RAM, about 512K I think (would need to look and check). I'm guessing it's needed for the floppy disk access, and maybe some of it is used for video RAM?
Those of you with dead 1800s, bear with me for the next few weeks and don't chuck your machine in the skip yet.
Trev
Last edited on Thu Sep 24th, 2009 11:05 pm by Trev16v
|
Hut Dog
Member
| Joined: | Sun Jan 18th, 2009 |
| Location: | |
| Posts: | 3 |
| Status: |
Offline
|
| Mana: | |
|
Posted: Thu Sep 24th, 2009 08:51 pm |
|
Hi Guys, I bought one of these machines a while back with the intension of using it as a hobist. Just tried the code unfortuatly it didn't work.
|
Wesley
Trade Member
|
Posted: Tue Sep 15th, 2009 11:08 pm |
|
Trev16v wrote: Hi gents,
I've just joined this forum because I was searching for information about passwords for the DGA-1800.
A friend of mine has a couple of these machines, both of which need the calibration reset. It would be extremely useful to be able to reset them so that we can both have one for home test purposes.
Is the calibration reset password still a major stumbling block, or is there now someone on here who is prepared to supply it for a few pints?
The other avenue I am exploring is this. I have read the software out of the EPROMs from within one of the machines and I've started looking at reverse engineering the software, with the hope of defeating the password and / or calibration protection. However, what is interesting is that after seeing the warmup defeat code (313159) mentioned in this thread, I actually easily found that code within the ROM file. So I wondered if it's worth me looking for any other six-digit codes and then trying them out. So far, I found one other, which is 515324. I need to keep looking through to see if I find any more.
If anyone fancies trying out 515324 then please go for it. I can't get at the complete machines yet myself anyway so I'd be glad if anyone else could try any numbers I chuck up.
Edit: Oh heck, I just read Alfarusty's comment about the passcode changing daily. So perhaps not a fixed code that I can easily find in the ROM then. Ah, fiddlesticks. I'll carry on and see what I can figure out though. I'm loaning a ROM emulator which will be helpful.
Cheers
Trev
Hi Trev,
Some time back now, My Local friendly Engineer said that the "unlock" procedure could be carried out over the phone, so I passed his mobile mumber to my previous employer hoping for a result.
Sadly my previous employer is "retired" and has not done anything to unlock it yet.
Alfarusty, pointed out to me that 314159 is actually in mathematical terms pi 3.14159 these machines were never connected to the internet so i cannot see how the unlock code can be changed on multiple machines daily, unless you know any different keep up the good work and good luck to all present owners.
"One Day"
Laters,
Wes.
|
Alfarusty
Member
| Joined: | Mon Jul 6th, 2009 |
| Location: | Leicester |
| Posts: | 11 |
| Status: |
Offline
|
| Mana: | |
|
Posted: Tue Sep 15th, 2009 10:30 pm |
|
Hi Trev, i can't give the new number a go myself at the moment because i'm not where the machine is till the weekends but i'll try it out when i can. It is possible that a softy wrote a back door code during development and it is still active. iIhad a look at the engineers mobile phone when he was doing my machine and they send him a table of numbers every month and at a quick glance they were all different, all 6 digit and seemed to be split into 3,2,1 numbers i think but he guarded them and i didn't want to push...bread and butter etc.
I did try doing a spread sheet mangling the date in different formats and considering them as ascii characters but at the time i wasn't sure the password was a number so gave up, i doubt if the password is very complex and i think it must be calculatedby the software from the date as there wasn't enough memory for a look up table, maybe this other number is the offset or first code for when the battery dies?
From what he was saying there were 2 proms with the MOT program in them identified by version numbers and there is a 3rd prom on a stack of sockets ( one is a keep alive battery for the data i think ) what happens if the battery dies i don't know but it could crash out of the MOT program and default to normal? or could turn to cabbage.
good luck ! fun isn't it reverse engineering.
Lloyd
|
Trev16v
Member
| Joined: | Mon Sep 14th, 2009 |
| Location: | |
| Posts: | 5 |
| Status: |
Offline
|
| Mana: | |
|
Posted: Mon Sep 14th, 2009 09:54 am |
|
Hi gents,
I've just joined this forum because I was searching for information about passwords for the DGA-1800.
A friend of mine has a couple of these machines, both of which need the calibration reset. It would be extremely useful to be able to reset them so that we can both have one for home test purposes.
Is the calibration reset password still a major stumbling block, or is there now someone on here who is prepared to supply it for a few pints?
The other avenue I am exploring is this. I have read the software out of the EPROMs from within one of the machines and I've started looking at reverse engineering the software, with the hope of defeating the password and / or calibration protection. However, what is interesting is that after seeing the warmup defeat code (313159) mentioned in this thread, I actually easily found that code within the ROM file. So I wondered if it's worth me looking for any other six-digit codes and then trying them out. So far, I found one other, which is 515324. I need to keep looking through to see if I find any more.
If anyone fancies trying out 515324 then please go for it. I can't get at the complete machines yet myself anyway so I'd be glad if anyone else could try any numbers I chuck up.
Edit: Oh heck, I just read Alfarusty's comment about the passcode changing daily. So perhaps not a fixed code that I can easily find in the ROM then. Ah, fiddlesticks. I'll carry on and see what I can figure out though. I'm loaning a ROM emulator which will be helpful.
Cheers
Trev
Last edited on Mon Sep 14th, 2009 10:05 am by Trev16v
|
Alfarusty
Member
| Joined: | Mon Jul 6th, 2009 |
| Location: | Leicester |
| Posts: | 11 |
| Status: |
Offline
|
| Mana: | |
|
Posted: Sun Sep 13th, 2009 10:33 pm |
|
Hi, i have sent you some photos of the back but haven't done the inside as i didn't want to disturb the calibration. i had a look in when the man was setting mine up and got him to explain a bit so if you send me photos of what you have i might be able to help a bit more.
Lloyd
|
Alfarusty
Member
| Joined: | Mon Jul 6th, 2009 |
| Location: | Leicester |
| Posts: | 11 |
| Status: |
Offline
|
| Mana: | |
|
Posted: Fri Sep 11th, 2009 10:19 pm |
|
Hi, its going to have to be after the weekend as my machine isn't local at the moment. i'll see what i can get.
lloyd
|
golden-net
Member
| Joined: | Wed Sep 9th, 2009 |
| Location: | |
| Posts: | 3 |
| Status: |
Offline
|
| Mana: | |
|
Posted: Fri Sep 11th, 2009 11:18 am |
|
Hi Mate,
Any chance of those pictures?
Regards,
Chris
|
golden-net
Member
| Joined: | Wed Sep 9th, 2009 |
| Location: | |
| Posts: | 3 |
| Status: |
Offline
|
| Mana: | |
|
Posted: Thu Sep 10th, 2009 12:00 am |
|
Hi Mate,
Yep that was the one on ebay. He wanted the cabinets to put parts in, I did know that when I bid. Didn't realise half the casing would be missing though! Yep someone cut thru or pulled off the plastic piping..... the gits. Thanks for the info, I'll have a look tomorrow see whats what. I got all the bits, filters, printer, leads etc... so far as I can see.
If you could sent some pics that would be brilliant. Its chris@nvqs.net
Thanks
Chris
|
Alfarusty
Member
| Joined: | Mon Jul 6th, 2009 |
| Location: | Leicester |
| Posts: | 11 |
| Status: |
Offline
|
| Mana: | |
|
Posted: Wed Sep 9th, 2009 11:21 pm |
|
I can send you a picture or 2 if you send an email address, the chassis should slide out like a filing cabinet draw so there should be no need to have cut any pipe inside ( please say he hasn't ) . There should be a pair of filters out side the chassis did you get them? As a quick guide there should only be 2 pipes and 1 small filter sticking out the middle of the rear panel. when you start the machine and it is doing the count down with the pump running air is sucked in through the small filter not through the 2 filter bowls. nothing more to do to that one. Air should be puffing out of one pipe.. this one goes to the T peice at the bottom of the filter bowls and blows away vapour/ moisture. The final pipe goes to the filter bowl ( far right hand side with right angle union) the exhaust probe goes to the input to the filter bowls on the left. When you do a leak check air should be sucked in through the filter bowls/ exhaust probe not the small filter sticking out the back.
I think i was watching that ebay sale, did he state is was sold without trolley? collect from london?.... why?
You should try to ensure cooling air is directed over electronics, put newspaper over top worked for me.
enjoy.
Lloyd
|
golden-net
Member
| Joined: | Wed Sep 9th, 2009 |
| Location: | |
| Posts: | 3 |
| Status: |
Offline
|
| Mana: | |
|
Posted: Wed Sep 9th, 2009 10:11 pm |
|
Hi All,
So I got me a cheap DGA - 1800 - 96 Sun gas analyser of ebay. Budgeted for an engineer to switch off the MOT lock. Guess what?..... When I picked it up the guy had decided to 'take the cabinet' so I got all the leads (good) + two caseless bits and a screen.
The thing starts OK (at least the menus etc come up on the screen) but he has cut so many air pipes getting it out of the case that I can't see wot goes where, so of course it is reporting a 'leak'. Got a user manual OK, but it does not go in to detail regarding a parts diagram - that is copyright apparently!
So can anyone let me have a picture of the back of their machine, especially with the lid of so I can see wot goes where!
Thanks for any help.
Chris
p.s. I have a copy of the operators manual if any one wants a copy........
Last edited on Wed Sep 9th, 2009 10:15 pm by golden-net
|
Alfarusty
Member
| Joined: | Mon Jul 6th, 2009 |
| Location: | Leicester |
| Posts: | 11 |
| Status: |
Offline
|
| Mana: | |
|
Posted: Thu Sep 3rd, 2009 06:00 pm |
|
Ok i gave up and got a SUN man to come and turn it off the MOT program. Apparently the password changes daily so chances are if some one finds out what it is it would be out of date by the time you use it. He said he was told by someone that there was a site on the internet that could predict the password ( number ) but i couldn't find it.
He also said that because it had gone passed the cal due date and locked out it had to have cal gas passed through it before the password would unlock it so i needed him to come and unlock it. ***So if you are thinking of buying one off EBAY like i did and they say it is out off cal extpect to part with money ***.
He did tweek it while he was here to get it back in spec. The extra leads i have are for triggering of the injectors and connecting to a BMW.
This model is still a MOT grade machine so it is still serviced by SUN and hence they still control the password.
Good luck sorting yours !
|
Wesley
Trade Member
|
Posted: Thu Jul 9th, 2009 10:03 pm |
|
Alfarusty wrote: Hi, thanks for the tip, the number works a treat, (even thought i'd see if it worked as the password but alas it did not). All i need now is a friendly man to sort the lock out for 'a pie and a pint' and i'm on a roll.
Thanks again
Hi, Have sent you a pm.
|
Alfarusty
Member
| Joined: | Mon Jul 6th, 2009 |
| Location: | Leicester |
| Posts: | 11 |
| Status: |
Offline
|
| Mana: | |
|
Posted: Thu Jul 9th, 2009 05:52 pm |
|
Hi, Thanks , i shall give that a go as well, its always worth a try.
Am i right in thinking that these are no longer approved for MOT use ? This would mean that the secrets no longer need guarding ! most of them will end up in the hands of enthusiast like my self who would use them to improve their cars and save the environment also the equipment wouldn't get scrapped saving further needless waste. Come on SUN save the planet and make the information available !
I notice when it starts up it does an auto cal... What is the value of this if they prevent you from using the machine until it has been serviced/calibrated ... it's like they are saying our self cal function is no good ?
Any good on what the spare clamp i have is for ?
Cheers
Lloyd.
|
Alfarusty
Member
| Joined: | Mon Jul 6th, 2009 |
| Location: | Leicester |
| Posts: | 11 |
| Status: |
Offline
|
| Mana: | |
|
Posted: Thu Jul 9th, 2009 08:07 am |
|
Hi, thanks for the tip, the number works a treat, (even thought i'd see if it worked as the password but alas it did not). All i need now is a friendly man to sort the lock out for 'a pie and a pint' and i'm on a roll.
Thanks again
|
castrolrob
Trade Member
|
Posted: Wed Jul 8th, 2009 09:39 pm |
|
blimey,aint had to pump that number in since last year-shame it dont work on our new ones...
|
Wesley
Trade Member
|
Posted: Mon Jul 6th, 2009 11:35 pm |
|
for warm up bypass try, "314159"
|
Alfarusty
Member
| Joined: | Mon Jul 6th, 2009 |
| Location: | Leicester |
| Posts: | 11 |
| Status: |
Offline
|
| Mana: | |
|
Posted: Mon Jul 6th, 2009 10:58 pm |
|
Hi, I'm running a 1980 1.5 Ti and was having porblems with the carb due to shaft wear on the primary jet messing the idle adjustments up for the MOT. The Gunson gadjet said it was in spec at 2% but when i went to the MOT his machine measured 0.5% so i decided to get a better gadget. I got a DGA 1800 but it is out of cal and doesn't measure ( at the moment ) . With it came several clips and probes that don't have sockets to plug in at the back ? I was hoping to learn more about these and the proper use of the machine/ maintenance. Currently there is a grey clamp device connected and the oil temp sensor but i have a yellow metal clamp device and some dodgy looking meter leads.
If you know how to get it going again and turn off the MOT test that would be great.
I read that the SUN man needs to come round and turn it off, i am guessing here but there must be a common code to use as there are hundreds of machines out there and they can't all have individual codes ? is a boot disk needed?
Bypassing the warm up period sounds like a real bonus.
All help gratefully recieved.
Thanks
Lloyd
|
Alfarusty
Member
| Joined: | Mon Jul 6th, 2009 |
| Location: | Leicester |
| Posts: | 11 |
| Status: |
Offline
|
| Mana: | |
|
Posted: Mon Jul 6th, 2009 07:11 pm |
|
Hi, i am in the same situation and looking for a manual for the DGA 1800. Could you do me a copy ? will pay you for your trouble.
Thanks
Lloyd 
|
Current time is 08:07 pm | Page:   1 2 3   |
|
