PCMTec Development Blog

[rolls]

Should be easy enough to figure out from the phf file. I havent looked into it yet though.

[rolls]

Ok at from what I can see it appears the BA flash read ranges are:

bank1: 0 -> 0x70 000
bank2: 0x500 000 -> 0x600 000

On a write only the following addresses are written:
0x10 000 (write 0xF0 000 bytes)
0x500 000 (write 0x10 000 bytes)

BF/FG flash range for refernce
Read: 0 -> 0xFF 800

on a write:
0x10 000 (write 0xF0 000 bytes)

stayed tuned for the VID locations (I suspect they are the same as spanish oak)
edit: yes the BA VIN is located at 0x100C0 just like the spanish oak

[Tazzi]

Split it into two.. odd but maybe not so surprising. Could just be how they designed the layout of the original ECU flash, or limitations of the chip?. Then with the BF, they simply combined it into one large section for simplicity?

My BA XR8 is prime for reading when you are rolls. Can start making a list of blank untuned bins which can be a 'goto' reference.

[rolls]

Split it into two.. odd but maybe not so surprising. Could just be how they designed the layout of the original ECU flash, or limitations of the chip?. Then with the BF, they simply combined it into one large section for simplicity?

My BA XR8 is prime for reading when you are rolls. Can start making a list of blank untuned bins which can be a 'goto' reference.

The MPC555 has more flash memory than the MPC565, the 565 is a faster processor though so most likely why they moved to that. Most of the flash is blank space anyway so I don't believe they needed the full 1meg.

I extracted the BA PHF into a 6mb file so that the offsets are correct internally and I can read it in IDAPro with the pointers being correct.

[rolls]

Ok just sent you guys a PM with a version that should hopefully read the BA PCM

[MeZmeriZe]

heh..

I have one of those 6MB bins too.
https://money2.biz.uwa.edu.au/franki/PP ... AANFG4.bin

Manual Turbo BA.

[rolls]

Someone just confirmed they can read a 6.0L powerstroke 512kb using a VCM2 so it appears the read flash commands are the same for most Ford PCMs, also good news that the VCM2 works. Apparently the read voltage doesn't seem to work on anything but an OpenPort 2.0.

If someone can do a read voltage with another application and log the J2534 API calls (use my shim dll or the bosch ones that have logging built in) and send it to me I can try and figure out what they are doing differently.

[Tazzi]

Just jumping out to the XR8. Will let ya know how it goes.

[rolls]

Found something in the PHF header that I missed last time

seg000:00000105 aVehicleCalibra db ' VEHICLE CALIBRATION > NA',0
seg000:00000122 aVehicleApplica db ' VEHICLE APPLICATION > FALCON (BARRA)',0
seg000:0000014B aEngineSize4_0l db ' ENGINE SIZE > 4.0L',0
seg000:0000016A aProductionModu db ' PRODUCTION MODULE',0
seg000:0000017E aPartNumber3r23 db ' PART NUMBER > 3R23-12A650-HK',0
seg000:000001A7 aOmitFromServic db ' OMIT FROM SERVICE TOOL FLASH>0x00000000 ^ 0x0000FFFE',0
seg000:000001DE aFlashIndicator db ' FLASH INDICATOR> 1',0
seg000:000001F3 aFlashEraseSect db ' FLASH ERASE SECTORS> 0xAA',0
seg000:000001F3 ; DATA XREF: seg000:00129D74o
seg000:000001F3 ; seg000:0012AD5Co ...
seg000:0000020F aFileChecksum0x db ' FILE CHECKSUM>0x9650',0
seg000:00000226 aCatchword32hk db ' CATCHWORD > 32HK',0
seg000:00000245 aWersNoticeA141 db ' WERS NOTICE > A141 E11721077-000',0
seg000:00000272 aDesignTransmit db ' DESIGN TRANSMITTAL > N/A',0
seg000:00000290 aCalId102225f23 db ' CAL ID > 10222;5F23',0
seg000:000002B5 aLastDataAddres db ' LAST DATA ADDRESS > 0059FF07',0
seg000:000002D8 aCommentsForPro db ' COMMENTS > FOR PRODUCTION USE ONLY.',0
seg000:000002FE aReleasedByPdeb db ' RELEASED BY > PDEBRULE DIV/DEPT > TEL >',0
seg000:000002FE ; DATA XREF: seg000:000788BC

"Flash Erase Sectors 0xAA" this explains the Erase command that I send, I'm assuming it is B1 (diagnostic command), B2 (erase flash) AA (sector), I'm guessing you can erase other sectors as well but not something I want to play with.

[rolls]

Ok I misread the PM, the VCM2 does not seem to work with the two people who have tried it, simply won't connect at all. Suspect there is something funky going on with the drivers, will report back if we get it working.