Picked up a CueCat barcode scanner at RatShack ("You've got questions.  We've got blank stares.") yesterday along with a few other odds 'n' ends.  If the store actually carried the stuff in their commercial sales catalog, I'd be a happy camper - I don't need an animated Elvis Presley phone, I need a local source of microcontrollers and specialized ICs.  But I digress...

One of the things that has a few people worried is that the clerk at Radio Shack takes down your name and address in their system before giving you your CueCat.  However, there doesn't appear to be a way of tying a particular CueCat to a person at the time of purchase - although each CueCat has a unique serial identifier, each CueCat package has the exact same barcode on the front (which is what the clerk scans in).  My goal was to find where that serial identifier lurks inside the CueCat....
 

Opened up the package (threw away the software, natch) and immediately began to open up the scanner.

Scan of bottom side of PCB

Scan of top side of PCB

semiconductor devices:
U1: ATC 93LC46 (serial EEPROM)
U2: Hyundai 90C54-GB189
U3: Phillips? 74HC3730
U4:
U5: Motorola HC4066
U6:
U7: TI LM358

The component that caught my eye was this small 8-pin device (U1) on the top side of the board:

The scan doesn't really show the markings at all, but it's an ATC 93LC46, which is a 1kbit serial EEPROM.  Unfortunately, ATC doesn't have datasheets for the device available on their page.  Not to worry, as other manufacturers have 93LC46s available, such as Microchip and Holtek.

The first thing I tried was removing the 93LC46 from the board.  However, I'm really not equipped to desolder SMT devices, so this was rather futile.  So I simply soldered some wirewrap wire onto the pins to see what's going on.  I hooked my trusty scope up to them and found that the data is read out of the 93LC46 only on powerup of the CueCat.

After this, I tried hooking up the 93LC46 to a PIC microcontroller (with a little bit of code that I whipped up) to see what lurks inside the serial EEPROM.  Unfortunately, I managed to wipe the contents of the EEPROM (looks like it reads back all locations as 0xFF now).  Oh well, at least I don't have that pesky serial number in there anymore.

To be continued when I can get my hands on another CueCat...