Chrysler NGC4 (MPC5554MZP80 CPU)

[AngelMarc]

Alright, finally took time to learn some more.
TIPM definitely translates (encrypts?) the start signal from WIN module, then sends that to ECU.
Connected WIN directly to ECU bus, without disconnecting TIPM; that cranks. So it accepts WIN traffic on the wrong bus. Disconnect TIPM or the run start pin next to CAN bus... no crank.
Triggered a relay directly off WIN run/start pin, ran everything run/start and ASD off that, including the run/start TO TIPM that originally tripped me up, and "ignition unlock run/start" TO ECU.
Making me want to just add an external trigger and use a GM V6 ECU.
If anybody comes up with a way to get ECU to accept unchanged WIN signal, that'd be cool.
I suppose without a bus analyzer, I don't know if it's changing the packet, or adding a packet.

[Tazzi]

This is where SKIM bytes come into play I believe, its a set of security bytes which get checked between modules and allow it to start.

I have not personally tested, but some people indicate that clearing/resetting the SKIM bytes will allow the ECU to start so long as the other security modules (TIPM/WIM) do not get connected again.
But without testing it myself, I have no idea if thats actually true!

[AngelMarc]

Well, there's no physical/analog start signal from WIN, so this setup would require... something different from what you're thinking.
Possible it could work for removing TIPM though, don't know enough about the coding.

[Ralmo94]

Is the goal to reverse engineer the software or get a car running that has security issues? I got a little lost reading the thread, if it was already stated plainly I apologize. These in chip sense seem to be real close to the Spanish oak Ford. Multiple AIs have told me in the ngc4 Chrysler had actually moved to an artificial nural network for the airflow in these. Anybody loaded a bin in Ghidra yet? Or managed to get a bin from the dlc?

[AngelMarc]

Here's one I had lying around

Somebody linked a .bin. I never tried it.
There's little info on these and nothing free.
I don't want to jump straight to flashing it, partially because money is tight, partially for the learning/observations.
I don't expect to do much before somebody more familiar with ECU reverse engineering gets to it.
Some of it is my observations and posting whatever info I can. Observations can give clues about code function, maybe.

It's a pile of parts by the way, see

Has MAP sensor code, but it runs.
https://www.youtube.com/shorts/1XKVfl2VhxY

Planning to put it on an NSG370 manual transmission, or make an adapter for something else. They never came with a manual trans.

[AngelMarc]

I think cutting a couple grounds broke the TIPM. Reconnected grounds, still won't crank. Might be the end of my tinkering until I buy something to flash it. Looking at AlfaOBD at the moment.

[Ralmo94]

Here's one I had lying around

Somebody linked a .bin. I never tried it.
There's little info on these and nothing free.
I don't want to jump straight to flashing it, partially because money is tight, partially for the learning/observations.
I don't expect to do much before somebody more familiar with ECU reverse engineering gets to it.
Some of it is my observations and posting whatever info I can. Observations can give clues about code function, maybe.

It's a pile of parts by the way, see

Has MAP sensor code, but it runs.
https://www.youtube.com/shorts/1XKVfl2VhxY

Planning to put it on an NSG370 manual transmission, or make an adapter for something else. They never came with a manual trans.

[AngelMarc]

I think cutting a couple grounds broke the TIPM. Reconnected grounds, still won't crank. Might be the end of my tinkering until I buy something to flash it. Looking at AlfaOBD at the moment.

Or there's some rolling key between WIN and TIPM, which maybe didn't roll correctly with WIN connected on wrong bus.
Red light was blinking on cluster. I'll see what happens after just a skim reset.

[AngelMarc]

Ordered a Vlinker MS and bought AlfaOBD.

Capture.PNG

Researching more as I impatiently wait for my order.
Looking like I'll be able to remove "skim". Will it go as far as needing the "analog" start wire added to ECU? Don't know, but hope so.
There were about 5 settings I seen that look relevant to security removal.
Then I could make a harness to connect another ECU to my TIPM to make future ECUs easy to swap mod. Change TIPM VIN if needed, proxi alignment, done, SKIM removed on another ECU. If not, run the "replaced ECU" option. I swear, from reading about proxi alignments before, it configures BCM (TIPM in this case) for all other modules in car, not the other way around.

[AngelMarc]

This is looking like a good read so far. Apparently it is BCM/TIPM configuring everything else. Makes sense to say it "proxy".
https://www.jeeprenegadeforum.com/threa ... um=organic
EDIT: Supposedly "proxi alignment" is just newer vehicles, I guess since Fiat merger/buy out.
AlfaOBD doesn't seem to do the best job of seperating old/new options; it never asks the year of the vehicle from what I've seen so far. Maybe connecting to a vehicle will sort some things better. It does some filtering. Got a week before tool shows up.