Siemens GS20 and the MS43 have very close similarities. The biggest is the processor and the EEPROM. Traditionally on the MS43 to read and write we use JMFlasher. Since both have the same processor and the same EEPROM, booting the GS20 into boot mode is just like the MS43, by shorting pin 104 as shown below.
5th pin from the left corner.
Unfortunately, the GS20 has different echo bytes which aren’t recognized by JMFlasher and thus writing to the EEPROM is not possible yet. I have sniffed the packets that were sent in and out on different scenarios with sharkwire in hopes that someday the authors of JMFlasher will find some use for them to support this unit.
CONNECT.pcapng — No issue
READ.pcapng — No issue
READ_2.pcapng — No issue
WRITE.pcapng — “Wrong echo bytes”
In order to access the EEPROM you will need to carefully drill out the rivets to release the board from the chassis.
WBADS43411GD84493_SIEMENS_GS20_5WK33502AG_AM29F400BB.BIN – A full 512kb read out of my unit.
In the near future I will attempt to sniff CAN BUS data and perhaps interpreting it as well.