pcmhacking.net

J-tools don`t use baud rate for communication with pc. It is j-tool->pcm baud rate selection[For J1850PWM can select normal speed [41600] and high speed[83300].
Also you can use any j-tool and log any protocol it supports.
.
Tazzi, do you know which dll IDS use for seed/key algos. I found some copy of IDS in my pc but there are tens of dlls to look at. I am sure some full bin can help find it in disassembly.

At some site someone claims each pcm uses 2 algos being for unlocked one for bank1-4 and one for bank5

kur4o wrote:J-tools don`t use baud rate for communication with pc. It is j-tool->pcm baud rate selection[For J1850PWM can select normal speed [41600] and high speed[83300].
Also you can use any j-tool and log any protocol it supports.
.
Tazzi, do you know which dll IDS use for seed/key algos. I found some copy of IDS in my pc but there are tens of dlls to look at. I am sure some full bin can help find it in disassembly.

At some site someone claims each pcm uses 2 algos being for unlocked one for bank1-4 and one for bank5

Search for SecAlg.dll, this specifically labels the EECV algos internally and is where I ripped out some functios in the previous pages.
Biggest issue currently is working out what bytes are being fed into the function specifically. The EECV ECUs may use a different algorithm AND also have different salts passed in for the different unlock levels (bank 1-4, high speed and bank 5).

In-Tech wrote:Thank you for the explanation. So, it sounds like we really need to log an IDS transaction to see if we're missing the holy grail. Shoot, that's $149 for 2 days hmmmm I have a ford vcm

Don't stress about spending any money on this. We will come up with a solution.
I believe I just need a different Ford EECV ECU since mine is just not playing ball!

Can you provide any numbers/partnumbers/info on your EECV? Just so I can try look up one on Ebay and get one shipped over?

Tazzi wrote:

In-Tech wrote:Thank you for the explanation. So, it sounds like we really need to log an IDS transaction to see if we're missing the holy grail. Shoot, that's $149 for 2 days hmmmm I have a ford vcm

Don't stress about spending any money on this. We will come up with a solution.
I believe I just need a different Ford EECV ECU since mine is just not playing ball!

Can you provide any numbers/partnumbers/info on your EECV? Just so I can try look up one on Ebay and get one shipped over?

Hiya Tazzi, let me burn through what I have before you have to buy anything. I should be able to reply with a lot of information in the next 24hrs and be better equipped.

In-Tech wrote: Hiya Tazzi, let me burn through what I have before you have to buy anything. I should be able to reply with a lot of information in the next 24hrs and be better equipped.

Keep in mind its not my $$ being used, its OBDX since its for development. If I have to buy multiple units, then thats what will happen.
If I have to buy a whole damn car, I will, this is happening one way or another

Maybe we can attack this via the Operating System decompile also if Ford IDS does not play nicely.

Looks like it should be an intel based processor: http://www.auto-diagnostics.info/pdf/ford_eectch98.pdf
Apparently they moved to powerpc (PPC) in some of the later 2000+ EECV's.

I went to test out logging using Forscan with the OBDX Pro FT, and it worked flawlessly for HSCAN... but... nothing on MSCAN.

I tested MSCAN on my bench setup with Ford FG modules, which could communicate and work perfectly. But when loading Forscan, only HSCAN modules would display. Immediately I started going through several hundreds of lines of code thinking I must have missed something, but it turns out to be one tiny little error in Forscan which I will pass on to Alex shortly so he can update the software:
I checked with my MDI, VCM2 and the OBDX Pro FT to ensure I was not going mad. But the error has come down to an incorrect baud rate selection as seen above where it uses 500,000 instead of the required 125,000. The pins are then set next (0x030B = pins 3 and 11) which are the MSCAN pins.

I did come across a thread thats been around for a while, so this should be a nice long await fix: https://forscan.org/forum/viewtopic.php ... 3&start=10

I'm able to access ms-can on forscan using my gm vcx nano. Wonder why it works but a cardaq 3 won't?

Nice

Cincinnatus wrote:I'm able to access ms-can on forscan using my gm vcx nano. Wonder why it works but a cardaq 3 won't?

VX nano forces using 125000 baud rate for CANbus when setting pins to 3/11 (MSCAN pins).

So it only works due to vxdiag have basically rigged it too. I imagine this was done intentionally after discovering the issue I came across too.

I looked at the dll, and figured which code is used for each algo. EECV have legacy and normal mode, also normal mode have 2 subtypes. I will need some valid seed/key pairs to start testing the algo.

Tazzi I think your test pcm uses the legacy algo, if it gives zero as first byte.

In-tech do you have some full bins floating around we can use for disassembly.