Colorado / H3 BCM hacking

[04colyZQ8]

I can upload the 36 00 payload anywhere from 800000 to 8001b60 verified by bdm dump!

But as soon as I attach 36 80 doesn’t write to ram?

If I try to send empty 36 80 u get 12 reject

[kur4o]

It is very likely function is disabled, or needs some mode AE to enable it, or pin grounded. Only disassembly of boot block will reveal the hidden treasures of the bcm.

[ironduke]

I can upload the 36 00 payload anywhere from 800000 to 8001b60 verified by bdm dump!

But as soon as I attach 36 80 doesn’t write to ram?

If I try to send empty 36 80 u get 12 reject

Just chiming in here because I'm curious what command your sending.. You mentioned in another post about sending the 36 80 with blank address. Not 100% sure with bcm's but with ecm's I have to send the 36 80 with the address I want it to start executing..
If your sending to 00 80 00 00 then the execute command your sending should be 36 80 00 80 00 00 00
You might already be doing that but your previous statement made me wonder if you are or not?

[04colyZQ8]

I am sending the address
6c 40 f0 36 80 00 00 00 0b 82 checksum
Gives code 12 reject

[04colyZQ8]

I do have the boot block disssembled but it’s a cluster f!!

[antus]

put the 36 80 in the last (or only) block of data you are uploading. And you may find the ram you are using is used by something else and not ok to use. for example if the stack is there your kernel might get corrupted as something is pushed or popped on the stack before or as the os hands off to your code, causing a crash and reboot. in the case of the p04 and p08 you have to move the stack to clear more contiguous ram before you make a call which will push the return address on to the stack. looking at the sps address and kernel size should give a starting point and disassemble it to see if it moves the stack and you need that logic in yours.

[04colyZQ8]

Well if I send the ae ….. command then it excepts much larger packets of uploads, it when I dump the ram via bdm its all messed up everything’s moved and the eeprom portion that’s usually there disappears! So it’s moving something alright!

If I don’t send the AE thing it only allows max 8 or so bytes of data to be sent but when I dump the ram it’s exactly as it should be and the eeprom is in place!

[04colyZQ8]

Are there any other commands that could be used other then 80? Any documentation for nrc responses and mode 36 with 80?

[antus]

Only 36 00 or 36 80

[04colyZQ8]

That’s lovely thanks what’s code 76 mean? I get that with 3680