BDM or JTAG pinout listings

VX L67 Getrag
Posts: 2877
Joined: Sun Aug 02, 2009 9:16 pm
Location: Bayside, Melbourne, Victoria
Contact:

BDM or JTAG pinout listings

Post by VX L67 Getrag »

Seeing a lot of the later type controllers can't be done over the OBD plug or if controllers get bricked over OBDII does anyone have advice on best tools to use (software & hardware) & have a pinout list to connect to all the common cotroller's (Ford, GM-Holden, Hyundai etc..)?
User avatar
rolls
Posts: 407
Joined: Wed Sep 07, 2016 11:22 am
cars: bf xr6t falcon

Re: BDM or JTAG pinout listings

Post by rolls »

I am very interested in this.

Basically you will need to identify the CPU, the model it is and find a pinout, then you have the arduous task of tracing pins through a multi layer PCB to find somewhere you can put a clamp on that hopefully already has a through hole solder joint.

How far have you gotten?
User avatar
Tazzi
Posts: 3422
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: BDM or JTAG pinout listings

Post by Tazzi »

rolls wrote:I am very interested in this.

Basically you will need to identify the CPU, the model it is and find a pinout, then you have the arduous task of tracing pins through a multi layer PCB to find somewhere you can put a clamp on that hopefully already has a through hole solder joint.

How far have you gotten?
I think most modern designs actually have these pins accessible from the main ecu connectors.

Well.. on the Holdens at least, the LS1, e38's and e40's are.
More a matter of traching these back.. to the cpu!

It makes sense they do that though, It would be where they flash in a OS and test the ECUs via these connectors after assembly.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
rolls
Posts: 407
Joined: Wed Sep 07, 2016 11:22 am
cars: bf xr6t falcon

Re: BDM or JTAG pinout listings

Post by rolls »

Tazzi wrote:
rolls wrote:I am very interested in this.

Basically you will need to identify the CPU, the model it is and find a pinout, then you have the arduous task of tracing pins through a multi layer PCB to find somewhere you can put a clamp on that hopefully already has a through hole solder joint.

How far have you gotten?
I think most modern designs actually have these pins accessible from the main ecu connectors.

Well.. on the Holdens at least, the LS1, e38's and e40's are.
More a matter of traching these back.. to the cpu!

It makes sense they do that though, It would be where they flash in a OS and test the ECUs via these connectors after assembly.
Yeah that is a good point, they have to program the flash chip at some point in the factory so there must be a header somewhere.
yoda69
Posts: 1215
Joined: Sun Mar 15, 2009 10:20 am
cars: 2004 VYII Acclaim Wagon V6 Auto LPG/Petrol
2004 VYII Berlina sedan V6 Auto
2005 VZ Monaro CV8 manual
Location: Geelong, VIC

Re: BDM or JTAG pinout listings

Post by yoda69 »

Only thing I've seen is like these:
http://www.flashtec.ch/index.php/produc ... dflash-bdm
http://www.dhgate.com/product/wholesale ... 98379.html
https://www.obd2buy.com/chip-programmer ... 00cmd.html

They don't mention E38. E67, ....., so not sure if something similar available for them
VX L67 Getrag
Posts: 2877
Joined: Sun Aug 02, 2009 9:16 pm
Location: Bayside, Melbourne, Victoria
Contact:

Re: BDM or JTAG pinout listings

Post by VX L67 Getrag »

They look good at a quick glance (couldn't see pinout diagrams on phone) but look similar to ones on eBay & main one I want now is e69/e77!

There's a few e39's I have but think I damaged parts on them as I used e38 wiring harness by mistake!
User avatar
Tazzi
Posts: 3422
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: BDM or JTAG pinout listings

Post by Tazzi »

I think the BDM100 is the way to go for starting off on it all. Seems to support a good chunk of common ecus.

Ultimately the best option will be a BCM/jtag device recommended by the manufacturer for debugging/programming which can usually be found on the tech sheets for that specific chip.

Next part is actually pulling the damn things apart to begin backtracing.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
antus
Site Admin
Posts: 8237
Joined: Sat Feb 28, 2009 8:34 pm
cars: TX Gemini 2L Twincam
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B
Contact:

Re: BDM or JTAG pinout listings

Post by antus »

The thing is bdm/jtag is a debug tool. You can run code on the cpu and read ram/flash data but write flash is not a function of the cpu as its on another chip from another manufacturer. You need software which knows how the flash is connected to the cpu and with support to run the flash. Eg in the 0411 the intel flash is not a motorola product like the cpu and you need to supply 12v to a flash pin to enable write. That 12v conbection is proprietry to the ecu. Essentially to write you need code almost identical to what you upload over an obd2 flash to control the flash chip need to drive the flash process from a pc. This can be done but its much simpler to get a product that supports you ecu to begin with. Even later ecus that dont need code uploaded will need pc software that can hook in to the code thats there. You might get lucky on newer pcms and it may be a less proprietry process and something off the shelf may exist.If you get something going let us know how.
Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396
User avatar
rolls
Posts: 407
Joined: Wed Sep 07, 2016 11:22 am
cars: bf xr6t falcon

Re: BDM or JTAG pinout listings

Post by rolls »

Reading/Writing to the flash chip that isn't supported by your BDM would be easier to use an arduino with SPI (I assume it would use SPI) and wire it to the chip directly. BDM I'm mainly interested in for debugging and stepping through code.

You can get SPI flash chip programmers off the next with the flash enable pin etc all on a nice header. Most chips use similar instruction sets and the page sizes can be adjusted in software.
User avatar
Tazzi
Posts: 3422
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: BDM or JTAG pinout listings

Post by Tazzi »

antus wrote:The thing is bdm/jtag is a debug tool. You can run code on the cpu and read ram/flash data but write flash is not a function of the cpu as its on another chip from another manufacturer. You need software which knows how the flash is connected to the cpu and with support to run the flash. Eg in the 0411 the intel flash is not a motorola product like the cpu and you need to supply 12v to a flash pin to enable write. That 12v conbection is proprietry to the ecu. Essentially to write you need code almost identical to what you upload over an obd2 flash to control the flash chip need to drive the flash process from a pc. This can be done but its much simpler to get a product that supports you ecu to begin with. Even later ecus that dont need code uploaded will need pc software that can hook in to the code thats there. You might get lucky on newer pcms and it may be a less proprietry process and something off the shelf may exist.If you get something going let us know how.
Yeah, I assumed the BDM software would be able to debug/request information fro attached flash chips as they are usually connected via spi.

Saw a thread on the web before from some mob that posted a pinout of the LS1 ecus for a BDM connection... gonna have to go through my billion bookmarks to find it! Think I just googled ls1 bdm.. maybe this link?
http://www.omnituner.com/default.aspx?t ... posts&t=58

Says can read/write to the rom.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
Post Reply