Am I on a hiding to nothing? trying to crack a device with unavailable
remote control, and no button functions to speak of. Is there a technique of
sniffing a microcontroller to at least find the basic pulse repition rate?
perhaps inductive loop over the package or monitoring to nA level in supply
current would register a blip, or is it all or nothing?
Anyway
First tried this with Mitsubishi BD 512 "universal" rc
Removed the 4MHz resonator and fed in a sig gen of about 1.5V pk-pk
(previously scoped), floating from the rc battery levels. With a known
receiver and transmitter code selected, then functions would work over range
3.3 to 5.8M then fail outside that. The rc would work with 1.5V sine between
300K and 10.5M. Didn't continue with that one as you had to manually step
through each in-built code.

Got a few no-name URCs from UK Poundland "pound shop" , badged as Signalex ,
81415, 10 in 1 . 1 GBP for all the functionality of a URC. This type you can
set it to flicker away to itself until it reaches the end of a batch of
codes.
Removed the 3.58MHz resonator (why so apparently accurate?) . With 1.5V
pk-pk locked in with receiver over range 2.7 to 5.1M, and again about 300K
to 11M would operate using 1.5V. So far have only used with original 3.58M ,
6M and 7.5M sine inputs. Am I serendipitously likely to get a hit
somewhere, at least the unit on/off model recognition code if not function
code plus the model code

So 2 out of 2 of these URC have been amenable to this mod but no match to
the unit in question found so far. Is there any general guidelines for
makers to choose certain types/ranges of coding for different types of
equipment or is it totally open for them to choose? Assorted bits of kit
show at least partial responses to some of these off-spec codes, but not my
target one so far.