BDM or JTAG pinout listings
-
- Posts: 2882
- Joined: Sun Aug 02, 2009 9:16 pm
- Location: Bayside, Melbourne, Victoria
- Contact:
BDM or JTAG pinout listings
Seeing a lot of the later type controllers can't be done over the OBD plug or if controllers get bricked over OBDII does anyone have advice on best tools to use (software & hardware) & have a pinout list to connect to all the common cotroller's (Ford, GM-Holden, Hyundai etc..)?
Re: BDM or JTAG pinout listings
I am very interested in this.
Basically you will need to identify the CPU, the model it is and find a pinout, then you have the arduous task of tracing pins through a multi layer PCB to find somewhere you can put a clamp on that hopefully already has a through hole solder joint.
How far have you gotten?
Basically you will need to identify the CPU, the model it is and find a pinout, then you have the arduous task of tracing pins through a multi layer PCB to find somewhere you can put a clamp on that hopefully already has a through hole solder joint.
How far have you gotten?
Re: BDM or JTAG pinout listings
I think most modern designs actually have these pins accessible from the main ecu connectors.rolls wrote:I am very interested in this.
Basically you will need to identify the CPU, the model it is and find a pinout, then you have the arduous task of tracing pins through a multi layer PCB to find somewhere you can put a clamp on that hopefully already has a through hole solder joint.
How far have you gotten?
Well.. on the Holdens at least, the LS1, e38's and e40's are.
More a matter of traching these back.. to the cpu!
It makes sense they do that though, It would be where they flash in a OS and test the ECUs via these connectors after assembly.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Re: BDM or JTAG pinout listings
Yeah that is a good point, they have to program the flash chip at some point in the factory so there must be a header somewhere.Tazzi wrote:I think most modern designs actually have these pins accessible from the main ecu connectors.rolls wrote:I am very interested in this.
Basically you will need to identify the CPU, the model it is and find a pinout, then you have the arduous task of tracing pins through a multi layer PCB to find somewhere you can put a clamp on that hopefully already has a through hole solder joint.
How far have you gotten?
Well.. on the Holdens at least, the LS1, e38's and e40's are.
More a matter of traching these back.. to the cpu!
It makes sense they do that though, It would be where they flash in a OS and test the ECUs via these connectors after assembly.
-
- Posts: 1215
- Joined: Sun Mar 15, 2009 10:20 am
- cars: 2004 VYII Acclaim Wagon V6 Auto LPG/Petrol
2004 VYII Berlina sedan V6 Auto
2005 VZ Monaro CV8 manual - Location: Geelong, VIC
Re: BDM or JTAG pinout listings
Only thing I've seen is like these:
http://www.flashtec.ch/index.php/produc ... dflash-bdm
http://www.dhgate.com/product/wholesale ... 98379.html
https://www.obd2buy.com/chip-programmer ... 00cmd.html
They don't mention E38. E67, ....., so not sure if something similar available for them
http://www.flashtec.ch/index.php/produc ... dflash-bdm
http://www.dhgate.com/product/wholesale ... 98379.html
https://www.obd2buy.com/chip-programmer ... 00cmd.html
They don't mention E38. E67, ....., so not sure if something similar available for them
-
- Posts: 2882
- Joined: Sun Aug 02, 2009 9:16 pm
- Location: Bayside, Melbourne, Victoria
- Contact:
Re: BDM or JTAG pinout listings
They look good at a quick glance (couldn't see pinout diagrams on phone) but look similar to ones on eBay & main one I want now is e69/e77!
There's a few e39's I have but think I damaged parts on them as I used e38 wiring harness by mistake!
There's a few e39's I have but think I damaged parts on them as I used e38 wiring harness by mistake!
Re: BDM or JTAG pinout listings
I think the BDM100 is the way to go for starting off on it all. Seems to support a good chunk of common ecus.
Ultimately the best option will be a BCM/jtag device recommended by the manufacturer for debugging/programming which can usually be found on the tech sheets for that specific chip.
Next part is actually pulling the damn things apart to begin backtracing.
Ultimately the best option will be a BCM/jtag device recommended by the manufacturer for debugging/programming which can usually be found on the tech sheets for that specific chip.
Next part is actually pulling the damn things apart to begin backtracing.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
- antus
- Site Admin
- Posts: 8250
- Joined: Sat Feb 28, 2009 8:34 pm
- cars: TX Gemini 2L Twincam
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B - Contact:
Re: BDM or JTAG pinout listings
The thing is bdm/jtag is a debug tool. You can run code on the cpu and read ram/flash data but write flash is not a function of the cpu as its on another chip from another manufacturer. You need software which knows how the flash is connected to the cpu and with support to run the flash. Eg in the 0411 the intel flash is not a motorola product like the cpu and you need to supply 12v to a flash pin to enable write. That 12v conbection is proprietry to the ecu. Essentially to write you need code almost identical to what you upload over an obd2 flash to control the flash chip need to drive the flash process from a pc. This can be done but its much simpler to get a product that supports you ecu to begin with. Even later ecus that dont need code uploaded will need pc software that can hook in to the code thats there. You might get lucky on newer pcms and it may be a less proprietry process and something off the shelf may exist.If you get something going let us know how.
Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396
Re: BDM or JTAG pinout listings
Reading/Writing to the flash chip that isn't supported by your BDM would be easier to use an arduino with SPI (I assume it would use SPI) and wire it to the chip directly. BDM I'm mainly interested in for debugging and stepping through code.
You can get SPI flash chip programmers off the next with the flash enable pin etc all on a nice header. Most chips use similar instruction sets and the page sizes can be adjusted in software.
You can get SPI flash chip programmers off the next with the flash enable pin etc all on a nice header. Most chips use similar instruction sets and the page sizes can be adjusted in software.
Re: BDM or JTAG pinout listings
Yeah, I assumed the BDM software would be able to debug/request information fro attached flash chips as they are usually connected via spi.antus wrote:The thing is bdm/jtag is a debug tool. You can run code on the cpu and read ram/flash data but write flash is not a function of the cpu as its on another chip from another manufacturer. You need software which knows how the flash is connected to the cpu and with support to run the flash. Eg in the 0411 the intel flash is not a motorola product like the cpu and you need to supply 12v to a flash pin to enable write. That 12v conbection is proprietry to the ecu. Essentially to write you need code almost identical to what you upload over an obd2 flash to control the flash chip need to drive the flash process from a pc. This can be done but its much simpler to get a product that supports you ecu to begin with. Even later ecus that dont need code uploaded will need pc software that can hook in to the code thats there. You might get lucky on newer pcms and it may be a less proprietry process and something off the shelf may exist.If you get something going let us know how.
Saw a thread on the web before from some mob that posted a pinout of the LS1 ecus for a BDM connection... gonna have to go through my billion bookmarks to find it! Think I just googled ls1 bdm.. maybe this link?
http://www.omnituner.com/default.aspx?t ... posts&t=58
Says can read/write to the rom.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726