I used their software to write a program to say "hello", when I downloaded it to the sign (via COM1) it sends a file. Through observation, I was able to determine the "command protocol" it was using and program it.

This is how to make it say "Hello":

1. 00FFFF000B // START, look for address bytes [0B]
2. 01 FF // Address [01], End of Field [FF]
3. 01 3031 // Create File [01], number 01 [3031]
4. 02 EFB0 EFA2 // Immediate, Red, 7x5 Font
5. 48 65 6C 6C 6F // "Hello" (ASCII)
6. FF // End of Field
7. FF00 // STOP

*Immediate (line 4) means that the word "Hello" appears with no transition

In line 3 the byte [01] tells it to create a file. I've programmed the time using the [08] byte, and set an alarm with the [02] byte. There HAS to be a byte for opening a file, but the sign is from China and I can't find any decent documentation.

Can anyone tell me how to dump the EPROM from one of these chips? I figure that there has to be a 1 byte input that tells it to "jump to subroutine - read from file".
----------------------------
Michael,
I have put the RXD pin on an oscilloscope and verified that it's receiving data from the 232 port. Nothing happens on this pin when I use the remote. The IR goes strait into a CPLD and becomes untraceable.