The code protected chip returns all three nybbles of data xor-ed
     together in the lower nybble.

     bit 0 is xored with bit 4 is xored with bit 8 and returned on bit 0.
     bit 1 is xored with bit 5 is xored with bit 9 and returned on bit 1.
     etc.

     I don't think that de-scrambling these bits would be worth the effort,
     and the accuracy of de-scrambling would be very low.  Many different
     instructions can generate the same CP code.

     I suppose that it might be possible to copy a CP part if the part were
     de-encapsulated, the code protect bit memory cell located, and JUST
     the code protect bit erased, allowing the program to be read out, but
     it would be rather expensive and time consuming.  Is 512 words of
     programming really worth that much effort?


______________________________ Reply Separator _________________________________
Subject: Re: 16c54
Author:  chalo@TIKAL.NET.GT at internet
Date:    11/6/96 10:33 PM


At 01:50 PM 11/6/96 +0000, Frank wrote:
>Does anyone know how to copy a cp 16c54
>
>                                       Thanks
>                                       Frank FTB
>

I suppose the whole idea behind code protection is NOT to be able to copy
the firmware.  However, I have heard of some methods of disabling code
protection in 16c84's.  Because they are EEPROM, I guess that would be
easier than disabling code protection on a 16c54, which I think cannot be
done.  However, a code protected PIC can be read, so it would be a hackers
job to "discramble" what was read.