Sahara DP3601 video projector,2006

[N_Cook]

Bright orange, 2 of these , minus the security necessary top control panel
for each, not found a pic of them yet.
15 way connector for a panel , that when removed, disables the projector.
Any chance of hacking them, there is a IR receiver lens but that presumably
would be disabled with an absent top panel? presumably most of those 15 ways
will be a diode matrix for control buttons and anunciator LEDs.
Little info found on these projectors but Google images suggests Delta and
similar model numbers maybe a related badge name. Googling the lamp numbers
has not shown up any model Xref
One lamp is physically blown, the electrode , external to the axial quartz
glass stem but in the central bright quasi-focused beam area is broken, not
actually where it emerges from the stem. Surrounding the break , and also
the supposedly working one, in that area, is a neat looking aggregation of
spikey white crystals around the conductor. I've not found an image of a new
bulb yet , but could there have been a piece of silicone there that has
degraded to silica crystals (asbestos-like)? perhaps creating a hotspot for
the lamp current and then failure, actual and potential, at that point?
Any pointers to a procedure for hacking the control-defeat function of these
top panels?

 

[N_Cook]

a pic of the projector and top control panel
http://www.sahara-products.com/images/content/607279001132675284.jpg
and
"Each projector has a unique serial coded panel and it recognises only that
one; replace it with an unauthorised panel and the projector will not work.
Therefore, should a thief obtain even one panel, they will not be able to
re-boot any machine but its manufactured partner."
so presumably the only chance is to find some powerFET control switch or
something simple like that

 

[N_Cook]

Comes apart quite easily . Seems to have 2 separate smps , one for the
electronics proper and one for the lamp only.
Of the 15 lines 11 go to 3K3 pullup Rs , presumably for key matrix.
Of the remaining 4 , one is gnd, one is clock line of an I2C 24C08, one to
its data line and one to its Vcc
So what sort of thing goes in the missing control panel, like a car radio
removable control panel, linked to those 4 lines?

 

[N_Cook]

The E0 and E1 CS lines are tied low. Could it be as simple as the 2K on
the internal 24C08 is repeated on the control panel on another 24C08.
Then either copying the contents to another one or even switching the
internal E2 line so the internal 2K is read twice, woud be all that's
required?