vanquish Tiny PCB

[h9361]

Thank you.
Do you know which other models of ML is not protected?

[waltr]

It's called "one wire serial communications"

Maybe this is the 36c4p?

https://www.microchip.com/en-us/product/ATsha204a

https://ww1.microchip.com/downloads/...-40002025A.pdf

Yes, very likely this is the 3-pin chip used or another that is similar.

Notes from the data sheet:
Chip markings are only manufacturing codes and DO NOT identify the chip.
The DATA pin is Bi-directional, Wakeup & commands from Host, data to host.

It may be possible to capture the transfers on the DATA pin during detector power up. But this requires a working unit.

[Altra]

It may be possible to capture the transfers on the DATA pin during detector power up. But this requires a working unit.

I actually captured the data with my Rigol logic analyser. It would be a lot of work to decode and and duplicate the hand shake, specially when we don't know the exact device. Most of the new encryption schemes use random keys and are nearly impossible to crack.

[waltr]

I actually captured the data with my Rigol logic analyser. It would be a lot of work to decode and and duplicate the hand shake, specially when we don't know the exact device. Most of the new encryption schemes use random keys and are nearly impossible to crack.

Didn't think about it being an encryption with a key input and response out. This would be very hard to crack.

[sinclairuser]

i think you are missing a connection,https://www.geotech1.com/forums/atta...7&d=1664707625
clearly shows a 3rd connection on the centre pad(shield or buck), but this is missing from https://www.geotech1.com/forums/atta...1&d=1664707887
since no one noticed i thought i would.

[Skippy]

A few thoughts and observations:
1 ) Mr Foma's 'schematic' for the Eqx is VERY rough and approximate, and contains many errors. It serves as a guide, upon which can be built on, by doing a proper reverse-engineering job.
2 ) Notice the PCB has many unfilled transistor pads, SOT-23. Pairs of these are paralled up - this is clearly a low-noise discrete front-end, like a long-tail pair, surrounded by a low-noise opamp to complete the feedback loop. As they are missing, ML are clearly satisfied that just the opamp alone is adequate for noise.
3 ) The PCB silk-screen shows the RX output is a differential pair, like on the Eqx. So is safe to assume the second opamp in the IC package is used as an inverter to create the complementary signal.
4 ) Regarding 'redesigning it with through-hole part' . NO. It's not the 1980's, do it like Minelab have done it. Short tracks, small components all make for better performance, eg. less noise, less EMI pickup, more effective power-supply decoupling etc. The parts may not even be available in leaded packages. And obviously, a small magnetic footprint make the circuit less visible to the coil, so less disturbance of the induction-balance.
5 ) Notice the small inductor on the Eqx PCB is missing on this board. I thought it was in series with the RX coil input, possibly to improve high-frequency performance, possibly just filtering.
6 ) The tracks etc need some close attention. Clearly the ground-plane has that thin finger track pattern to give electrical shielding, without a huge magnetic footprint that will be seen by the coil. The X-ray does show a shadow of a continuous square shape, looking like a solid ground-plane. This seems unlikely, but it may be there.
7 ) The PCB can only be reverse-engineered when it's in the hands of someone skilled. Doing it from crap photos is just stupid. GOOD photos of the PCB will be needed if anyone on the Forum is going to help you.