rolls wrote:
Now I am running into a problem around block ~0x13000 where I get back some 0x7F 79 packets. 0x79 is not defined in the ISO14229 spec and is listed as OEM specific. My best guess is this means something like the PCM is processing the data and to wait, I assume eventually you get back 0x76
Looking at my sniffed data exchange you can often get two 0x79 packets back followed by a 0x76. I haven't had a chance to try simply waiting until you get a 0x76 packet back though I suspect this will work.
I'm booked out until Friday at this stage so hope to get the flash routine working by end of next weekend.
I've also implemented some auto detection routines for the J2534 cable as I found with the guys who were trailing the program it would not always disconnect cleanly and throw errors when a simple reconnect would fix the problem. Now I always perform a full disconnect and connect before doing anything.
Slow but steady progress...
Do you get the 78 responses between each block? Or get them at all?
Never seen a 79 response either, think your on the ball though, its received a massive chuck of frames and needs to process/write them to the ECU.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
I get 7F 78 (response pending) and then 76 (76-36=40/success) after each 0x400 sized block, after block 12 it gives a 7F 79 and then a timeout if I wait for another packet.
roughneck427 wrote:I have a cardaq j2534 interface with a few ecms to test on the bench. I also have a VCM2 with and IDS subcription if you need beta testers
Awesome. I'll contact people when I get further along.
Ok figured it out. I had the wrong parameters in the "request download" txbytes. For some stupid reason I had 3000 instead of the flash size (had 0x3000 for testing) which meant the routine would bomb out as soon as I transmitted more data than that.
Can do a read back and the flash appears to be working correctly. Let me know if anyone has a bench test harness with a spanish oak PCM and would like to test the software out.
Now on to integrating my library into my editor app and developing definitions. Will keep progress updated!
Right, looks like Im gonna have to grab one of these openPorts to help give it a go!
Got a few ECU's here plus the BA 2002 XR8 to tinker with.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Someone on ford mods just reported it will read his ba with a mongoose cable. Obviously fails to save as I have only implemented bf memory size but it proves the read routine and unlock works with a mongoose and a ba.
Someone is already donating a ba pcm so the next big help is does anyone have a eecvi connector/loom or know where I can get one cheap for the Pcms?
Ive got my bench setup wired using pins stuck on the pins and alligator clips stuck on them with the sheaths to stop them shorting. Then I wired a switch between two alligator clips for ignition. It is ugly but it works.
rolls wrote:Someone on ford mods just reported it will read his ba with a mongoose cable. Obviously fails to save as I have only implemented bf memory size but it proves the read routine and unlock works with a mongoose and a ba.
Someone is already donating a ba pcm so the next big help is does anyone have a eecvi connector/loom or know where I can get one cheap for the Pcms?
Ive got my bench setup wired using pins stuck on the pins and alligator clips stuck on them with the sheaths to stop them shorting. Then I wired a switch between two alligator clips for ignition. It is ugly but it works.
I stripped a couple looms not long ago. So I should have a spare to donate
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
rolls wrote:Someone on ford mods just reported it will read his ba with a mongoose cable. Obviously fails to save as I have only implemented bf memory size but it proves the read routine and unlock works with a mongoose and a ba.
Someone is already donating a ba pcm so the next big help is does anyone have a eecvi connector/loom or know where I can get one cheap for the Pcms?
Ive got my bench setup wired using pins stuck on the pins and alligator clips stuck on them with the sheaths to stop them shorting. Then I wired a switch between two alligator clips for ignition. It is ugly but it works.
I stripped a couple looms not long ago. So I should have a spare to donate
If Tazi doesn't have any mate i can send one up with that ecu.
