PCMTec Development Blog

Ford information and tools can be found here
jay woo
Posts: 51
Joined: Mon Jul 11, 2011 8:42 pm

Re: Ford MPC565 Tuning

Post by jay woo »

Good luck, I am reasonable confident that reflashing will work with open port. I know some software uses open port to reflash Fords. It am not sure which ecus they support. I do not think they support any Australian Ford's, as it requires google translate to read the sites. Using Google translate made it hard to work out but it appeared as though they supported some eec ecu's.
User avatar
rolls
Posts: 407
Joined: Wed Sep 07, 2016 11:22 am
cars: bf xr6t falcon

Re: Ford MPC565 Tuning

Post by rolls »

I have zero doubt it will work, my only doubt was I might get the addressing wrong and hence brick the PCM. I'm going to do it on my bench so if I do mess up the programming I still have a car to drive!

From what I've seen with other packages even if it fails half way through it is not an issue. This is as 0x8000 to 0x10000 is ignored during flashing (can be seen in the PHF header) as I image this is where the boot loader/CAN bus RTOS lives.
User avatar
rolls
Posts: 407
Joined: Wed Sep 07, 2016 11:22 am
cars: bf xr6t falcon

Re: Ford MPC565 Tuning

Post by rolls »

Ok so I ran into what I thought was a packet corruption problem as my checksums were not validating. Turns out I had a n-1 problem and was not copying the first byte of every block.

what a knob

Goes to show how important validating checksumming is!
User avatar
rolls
Posts: 407
Joined: Wed Sep 07, 2016 11:22 am
cars: bf xr6t falcon

Re: Ford MPC565 Tuning

Post by rolls »

Ok so I've got a proof of concept GUI on github that has tight error handling and will read the flash to a binary file.

If you have a J2534 cable of any kind I'm love for people to beta test the software with their cable, PM me if you want a link to a binary if you aren't a programmer.

Ultimately I want it to support the following cables:

VCI 2 genuine and clone
Ford Mongoose with FEPS
OpenPort 2.0

If you manually supply the FEPS voltage any other J2534 cable should also work. I've noticed some implementation differences in the VCI mini (which doesn't work) vs the OP2.0.

If I send a ISO15765 message using the OP cable eg:

ReadMemoryByAddress
00 00 07 E0 23 0 xx xx xx xx xx xx

I get back 3 messages with the following RXSTATUS

msg1: RX_MSG_TYPE | TX_INDICATION (0x09)
msg2: START_OF_MESSAGE (0x02)
msg3: NONE (this contains the actual payload data)

If I send the same command with the VCI Mini china clone ($25 piece of shit that crashes lots) I get:
msg1: NONE
msg1: START_OF_MESSAGE (this contains the actual payload data)

Curious if anyone knows what the correct sequence of RXSTATUS words is?

I also just bought some pins to make up a test harness on my spare PCM, hopefully get stuck into testing out the erase and write procedure this weekend.
User avatar
rolls
Posts: 407
Joined: Wed Sep 07, 2016 11:22 am
cars: bf xr6t falcon

Re: Ford MPC565 Tuning

Post by rolls »

antus wrote:Ive used the USB BDM NT from http://www.usbjtag.com/ on the '0411. I have one you could borrow for a while, otherwise they are $65 USD + post.
FYI I don't think that will work with PowerPC CPUs, says on the page:
USB BDM is Windows based BDM tool for MC68331 CPU.
I did find one on ebay for $50 for the MPC chipset though.
User avatar
antus
Site Admin
Posts: 8239
Joined: Sat Feb 28, 2009 8:34 pm
cars: TX Gemini 2L Twincam
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B
Contact:

Re: Ford MPC565 Tuning

Post by antus »

Ive got a couple of j2534 cables but no ford. Since were located near each other it'd be good to try some stuff. Im particulary interested in what the gm mdi can do, and i also have a mongoose GM to test. Send a PM if interested.
Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396
User avatar
rolls
Posts: 407
Joined: Wed Sep 07, 2016 11:22 am
cars: bf xr6t falcon

Re: Ford MPC565 Tuning

Post by rolls »

antus wrote:Ive got a couple of j2534 cables but no ford. Since were located near each other it'd be good to try some stuff. Im particulary interested in what the gm mdi can do, and i also have a mongoose GM to test. Send a PM if interested.
Once I get flash writing working this weekend then I'll definitely be keen to try it out with some other cables. Maybe next week depending how I go.

Another bloke has tried mongoose but the readprogrammingvoltage returns 0v after I call the setprogrammingvoltage routine. Either the read is not implemented or the set is not working as expected. It works on his OP2.0 cable though.
User avatar
rolls
Posts: 407
Joined: Wed Sep 07, 2016 11:22 am
cars: bf xr6t falcon

Re: Ford MPC565 Tuning

Post by rolls »

I've been thinking more about open source and ive decided to leave all my libraries open source but I will be keeping the gui closed source.

This way people can use the libraries and contribute via plugins if interested. The reason for leaving the gui closed source is in case I decide to monetise any of the product down the track. Also this is where all my original ideas lie, eg parsing the binary files and automatically generating definitions/maps.
User avatar
Tazzi
Posts: 3422
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: Ford MPC565 Tuning

Post by Tazzi »

Moving along steadily.

Will have to look into how that plugin system works and tinker around with that.

Saw your post with not letting out the smoke on the ECU :lol:

Would actually probably be a good thing to make a quick photoshop hack with the exact pins needed from the ECU end and also the harness end.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
rolls
Posts: 407
Joined: Wed Sep 07, 2016 11:22 am
cars: bf xr6t falcon

Re: Ford MPC565 Tuning

Post by rolls »

Ok here is a progress update:

I can now erase the flash and start the download process. I get about 4000 bytes into it and run into a problem with it returning a non standard UDS error code 0x79.

Process so flash:
unlock controller
erase flash by sending 0xB1 (diagnostic command), 00 B2 AA (magic bytes??)
get 0xF1 00 B2 (success)

request download
//ISO14229 RequestDownload
//byte1 ServiceID 0x34
//byte2 DataFormatIdentifier
// High nibble = memorySize)
// Low nibble = memoryAddress
//byte3 AddressAndLengthFormatIdentifier (0x01 for Ford Spanish Oak)
//byte4 memoryAddressByte1
//byte5 memoryAddressByte2
//byte6 memoryAddressByte3
//byte7 uncompressedMemorySizeByte1
//byte8 uncompressedMemorySizeByte1
//byte9 uncompressedMemorySizeByte1

send
0x34 00 01 00 00 0F 00 00 00
0xF000000 = max size of memory sent (I think)

get response 0x74 04 01 (success)
where 04 = lengthFormatIdentifier (see ISO14229 spec for details)
01 = MaxNumberOfBlockLength

The PCM expects all data starting at address 0x10000 as the RTOS etc lies before this hence if you stop halfway or upload crap you don't brick the PCM.

TransferData
n = 0x400
dataOffset = 0x10000
0x36, data[0+dataOffset],data[1+dataOffset]...data[n+dataOffset]

Expect back response
0x7F 78 (response pending)
0x76

Now I am running into a problem around block ~0x13000 where I get back some 0x7F 79 packets. 0x79 is not defined in the ISO14229 spec and is listed as OEM specific. My best guess is this means something like the PCM is processing the data and to wait, I assume eventually you get back 0x76

Looking at IDS you don't ever get a 0x79 only 0x78 back followed by a 0x76. I haven't had a chance to try simply waiting until you get a 0x76 packet back though I suspect this will work.

I'm booked out until Friday at this stage so hope to get the flash routine working by end of next weekend.

I've also implemented some auto detection routines for the J2534 cable as I found with the guys who were trailing the program it would not always disconnect cleanly and throw errors when a simple reconnect would fix the problem. Now I always perform a full disconnect and connect before doing anything.

Slow but steady progress...
Last edited by rolls on Wed Sep 28, 2016 1:48 pm, edited 3 times in total.
Post Reply