Oh wasn't aware you guys didn't have the BDM pins on the P04. I figured that's how you guys were able to dev on it. I've been saying JTAG just so people know what I'm talking about clearly. I have been using the U-Link device so that's exactly right =).antus wrote:Yep. Those terms are for the Motorola BDM (Background Debug Mode) interface. Its like a predecessor to JTAG. You can use u-link nt from http://www.usbjtag.com/ to read and write the flash. It was formerly called usb-bdm-nt as well. The owners youtube channel has lots of information. We have done it on P01 and P59, but did not have the P04 pinouts until now. Thanks!
Note that P04 support is in development in pcmhammer. We cant say when it'll be finished, but you can load and build the development branch from github now, make sure your OSID is listed with the right chip sizes, and it should read it over OBD2. Also note that you dont need BDM to get the key out, you can brute force it over a number of days, or it might be possible possible to attack the hardware and ground an address pin so that it doesnt see the calibration magic numbers and thinks its on the factory floor when it boots and opens up for initial calibration load. That does work for P01 and P59, but they have newer boot code the P04 may be missing.
Here's a couple pics of the P11 wired up to give an idea what I mean by it's picky about wire length. I'm using 30 gauge kynar wire, maybe that's less than ideal though. Maybe if I made a template/jig with pogo pins it would be a bit easier to hook it up and not be so picky lol. I have a pic of a P04 hooked up but it shows my U-Link serial so probably should censor that just encase there's any issues with that being out in the public.