How hard can it be?

While digging around the radio, why not highjack the display too?

It probably got some smelly LCD driver chip and no magic.
How hard can it be?

Ok let's look at that thing:

ET8861S

Well google has failed me. No datasheet to be found. But the schematics tell us:

CS, WR, DATA? Looks like Serial whatever to me! It probably just takes bits and clock to turn on the segments.
Once again, more bodgewires!

(mo wires, mo problems)

Looking at the traffic, the SPI mode of the buspirate works well enough (with inverted chipselect)

Imma charge my laserz and fire some data at it! Maybe it even takes ASCII characters or someting.

It doesn't.

Systematic approach

OK, on the SPI bus the radio always sends 0x50 first. Also the display only changes when the first byte is 0x50.

So let's set bit after bit and look what happens.
Every bit seems to control one segment of one 13 segment segment. Some extra bits control the special segments. Every byte seems to define one character, and some extra segments (The DBB symbol, FM, etc shown above). I tried to map this oldschool with pen and paper.

And here it get's wonky. Every character seems to by controlled by two bytes. Guess what: The top left segment never comes on. After 16 bits, the next character gets controlled. After writing 16 bytes of 1, everything is lit up like a christmas tree, except for every top left segment. WHY GOD WHY.

Now comes the fucky part. Writing more than 16 bytes, some of the top left segments come on. but some of the previously lit segments go of. Shit's random. I have no clue what's going on ¯\_(ãƒ„)_/¯. I ragequit.

Best i can do is amuse myself by setting the frequency to things.

Heh. Wonder what naughty business is going on on this station. (hint: nothing)