I upgraded the stereo in my Volkswagen Tiguan to a newer system, which left the old RNS 510 for sale. Selling it turned out to be less straightforward than I expected.
The roadblock
The RNS 510 has an anti-theft protection code. When I installed it years ago, it came with a small card holding a four-digit PIN, meant to be kept somewhere safe. I put it somewhere so safe that I couldn't find it when I needed it.
On the day of the sale, the buyer, a Volkswagen enthusiast, installed the unit in his car and hit the security code prompt. I had no idea where the card was. Without the code the unit is a brick, and the sale was about to fall through.
Brute-forcing the PIN
Rather than lose the sale, I looked at brute-forcing the PIN. To be clear, this was recovering a code for a device I owned, not defeating someone else's security.
Entering thousands of combinations by hand isn't practical, so I wrote a tool to do it. That became the RNS510 Code Finder.
Building the RNS510 Code Finder
The script is Python and uses pyserial. It connects to the RNS 510 over a serial (COM) port, sends each PIN in a given range, reads the device's response to see whether the PIN was accepted, and logs every attempt. I've since cleaned it up and released it as open source.
How to use it
If you're in the same spot, trying to sell an RNS 510 without the PIN card, here's how to run the RNS510 Code Finder.
1. Clone the repository
First, clone the RNS510 Code Finder repository from GitHub:
git clone https://github.com/SlashGordon/rns510-code-finder.git
cd rns510-code-finder
2. Install pyserial
With Python installed, add the pyserial library:
pip install pyserial
3. Run the script
Connect the RNS 510 to your computer via a serial port and run the script. This example uses COM1; replace it with the correct COM port for your device. You can also adjust --baudrate, --timeout, --start, and --stop:
python rns510_code_finder.py --portname COM1 --baudrate 9600 --timeout 2 --start 0 --stop 1999
The script tests PINs across the range and prints the correct code to the terminal when it hits it.
4. Example output
Running it looks roughly like this:
$ python rns510_code_finder.py --portname COM1 --baudrate 115200 --timeout 1 --start 0 --stop 1999
2023-08-12 14:23:45,123 - INFO - Opened serial port COM1
2023-08-12 14:23:45,124 - INFO - Trying code: 0000
2023-08-12 14:23:45,225 - INFO - Code 0000 is invalid.
...
2023-08-12 14:24:15,567 - INFO - Trying code: 1234
2023-08-12 14:24:15,668 - INFO - Code found: 1234
2023-08-12 14:24:15,669 - INFO - Closed serial port COM1
The code it prints unlocks the RNS 510.
How it went
I connected my PC to the RNS 510, started the script, and watched it work through the PINs. A few minutes later it found the code, and the unit powered up.
I wrote the code down, gave it to the buyer, and the sale went through.
Takeaway
Keep your radio code somewhere you'll actually find it. And a bit of Python can get you out of a spot like this. The RNS510 Code Finder is on GitHub if you need it. Use it only for a device you own.
GitHub Repository: RNS510 Code Finder
License: MIT License - Open for everyone to use, improve, and share.
This post was originally published on www.slashgordon.link.
Top comments (0)