Uplander/montana/relay locked bcm

[04colyZQ8]

looks like the 09 bcm is rejecting the 07 kernel? .... 6C F0 40 76 00 74, 74 is reject? 78 would be positive correct? Maybe try a different location? assuming this is the memory address in the ram? 02 84 00

Utility File: 15783631_01_utility.BIN
Utility File Step=01 Opcode=01
Utility File Step=02 Opcode=3C
21:56:24.2< 6C 40 F0 3C 08 [0005]
21:56:24.2> 6C F0 40 7C 08 00 F2 32 C9 00 00 [0011]
Utility File Step=03 Opcode=28
21:56:24.2< 6C FE F0 28 00 [0005]
21:56:24.2> 6C F0 40 68 00 [0005]
Utility File Step=04 Opcode=27
21:56:26.2< 6C FE F0 28 00 [0005]
21:56:26.2> 6C F0 40 68 00 [0005]
21:56:26.5< 8C FE F0 3F [0004]
21:56:28.3< 6C 40 F0 27 01 [0005]
21:56:28.3> 6C F0 40 67 01 36 AC [0007]
21:56:28.3< 6C 40 F0 27 02 35 6E [0007]
21:56:28.4> 6C F0 40 67 02 34 [0006]
Utility File Step=05 Opcode=AE
21:56:28.4< 6C 40 F0 AE FE 00 00 00 00 00 80 [0011]
21:56:28.4> 6C F0 40 EE FE E1 [0006]
21:56:28.4< 8C FE F0 3F [0004]
Utility File Step=06 Opcode=FC
Utility File Step=07 Opcode=34
21:56:29.5< 6C 40 F0 34 [0004]
21:56:29.5> 6C F0 40 74 44 [0005]
Utility File Step=08 Opcode=B0
21:56:29.6< 8C FE F0 3F [0004]
21:56:29.6< 6D 40 F0 36 00 02 84 00 00 30 00 00 80 00 02 00 02 00 00 00 00 00 00 00 .. [0656]
21:56:30.1> 6C F0 40 76 00 74 [0006]
Utility File Step=0B Opcode=EE

[antus]

6C F0 40 76 00 74 is Priority 6C, F0 (tool) to 40 (module). Mode 76 00 (response to 76-40=previous mode 36 00 packet. Mode 36 is upload). 74 is OK. Errors are 7F.

If it stopped responding here, it probably worked, but the code crashed trying to run on the module.

In most PCMs its 36 00 to upload, and 36 80 to upload and execute. But its not universally implemented like that on everything. So in this case 36 00 doesnt necessarily mean it didnt try to execute.

[Gatecrasher]

I looked up the part history for this BCM. There was a ton of different versions. The final reman part number (19119308) fits everything from 05 to 09, but that doesn't necessarily mean the later parts were programmable. I'd say it's still worth looking into the utility, but keep it in the back of your mind that it might not be meant to work with the hardware version you have.

[antus]

I had another look at your flash dump. I thought the last 3 bytes looked like they might be a reset vector as the 3 bytes before it were the same, possibly another vector. This reminded me of the older motorola HC11 cores, such as in the older Holden computers from 1989 until early 00s. So I loaded the whole flash image in to ida, and picked the motorola hc12 as hc11 were pretty obsolete by 2007, but I recall hearing that hc12 was a very similar chip and intended to take over the role for modules where HC11 was used in older generations and the selection criteria was low cost chip and low cost to continue using older designs in smaller modules like BCMs. I got lucky but because the last 3 bytes were not a vector. But just using the default settings on that architecture IDA picked vectors at the start of the file instead and disassembled enough code out of it that I can see the code is decoding fine. It didnt find all of it, but if I move the cursor to where the disassembled code ends and hit 'c' for code on the next byte it disassembles more functions and jumps around and does the right things. The disassembly looks sain. Ive had the wrong architecture loaded before, and its not this clean. So it probably is HC12 (aka HCS12 or 68HC12)

[04colyZQ8]

Ok I’ll try hcs12 24 bit in ghidra ok think it’s 16 bit though??

[04colyZQ8]

Big or little endian?

[antus]

IDA doesnt prompt me for endianess. So probably look at the CPU spec, or try one and if its a mess, try the other. It asked me for a list of cpus I just picked the default. MC9S12A128B for RAM=8192 ROM=0 EPROM=0 EEPROM=2048

Its probably not the right RAM/EEPROM, but it was enough to disassemble code.

[kur4o]

Code $74 - Illegal Address in Block Transfer

The upload address is not correct for later bcm, Try a disassembly to get a grasp how the reflash logic works.
The bcm contains the flash logic, so there might be more memory regions you can try to read.
What is the type of flash on board.

[kur4o]

You can also try mode 23 to make a memory map of bcm.

[Tazzi]

You can also try mode 23 to make a memory map of bcm.

^^ This is a great idea. Alot of older style modules will allow dumping the entire module this way.