Why I hate VZ V6 ECUs...

[The1]

i guess it depends if we can get a full read including security stuff via BDM. If so then reversing the code might be more possible, i havn't attempted a dissasembly on vz yet, need to look at that and see if pids 7D & FE subroutine can be id'd and see what it's doing. Im not sure yet what VZ is based on? i know barina one is Siemens 167CR.

[delcowizzid]

Mpc563/564

[Tazzi]

Mpc563/564

Wow I didnt know that!

Right.. I have a BDM100 laying about here also.. time to investigate.

[Tazzi]

My PEMicro tool should be able to communicate to it.

The MPC563/4 dont have internal eeproms.. so either this data is being saved into internal flash, or theres an external eeprom somewhere there.

Being that is PPC, I should be able to follow its coding fairly well now after the E38/E67s. Be nice to just patch the fucking VATs on it!!!

[The1]

yeh that's right! VATS would solve it all.
I checked last night and Barina is Kline for front end from the OBD port, it has no reset ecu in the ecu, it's done via the theft module. Going to try logging a reset attempt later on kline.

Anyway back to VZ.

That's VZ on the Left and Barina on the right.


VZ Clearer image.

Found this on another website


Top right maybe eeprom then?

[The1]

https://www.nxp.com/products/processors ... ers:MPC563
https://www.nxp.com/products/processors ... ers:MPC564

3 and 4 look basicly the same.

Looks like there should be Jtag also, have to do some image digging.

MPC563.JPG (52.59 KiB) Viewed 3206 times

[Tazzi]

hmmmmm ok. The VZ looks to capacitor dense to have an eeprom on the bottom part of that image...

Might be to the right of that the main flash along the top???

I think the BDM connection will be possible, but not so sure about the eeproms .. thats really really tiny pads

[Tazzi]

Well.. the soldering has begun....

Ill hook it up to my PEmicro tool.. see if I cant read its flash. Least we will know if its in there or not.

Not sure what the flash is, but its 2Mb. So hopefully they used a common one like a intel/micron 28F...

*edit
Well thinking about it, theres certain address's that the ECU does not send data back... so I would assume that might sensitive info like immo, ect. So.. maybe it will be in the flash?

[Tazzi]

We are soldered on.

The bottom pins arent so bad.. But that Hreset pin.. I question if Iv possibly disturbed any pins there from removing the resin.

[Tazzi]

soldered.. connected... and.... no connection.