pcmhacking.net

Gampy, are you a "Glutton for Punishment" HAHAHAHA

Get well man.

Mike

Some update, I managed to emulate upto the point, where first frame of bin is send.
Now can set any seed and get a key for it. Hope it can be debugged ddep enough so the actual algo can be deciphered.
Also want to make process full so a bin can be dumped, from encrypted files.
Now this opens another work for Tazzi, since a good complete log can be taken, and hopefully he adds some j-support for CAN chrysler stuff.

Next on the list is to get the emulator working with IDS in virtual machine, and get a complete dump of it.

Any good source for IDS with bin files ready for flashing will be highly appreciated.

kur4o wrote: Next on the list is to get the emulator working with IDS in virtual machine, and get a complete dump of it.

Hi - What do you mean "complete dump of it" ? What would you like ?

Anyone have experience with de-compile Motorola MPC 5xx ?

kur4o,
Are you willing to share a UP script or? so I can test on my NGC4 vehicle ??

acln99,
It has been done around here, it is PowerPC I believe, if I had a bin I might get somewhere, where I do not know, but somewhere, I am not the disassembly guru that some others around here are ...

-Enjoy

NGC4 2009 challenger 6.1L Manual trans flash file ..

NGC3 Flash file - should also be MPC5xx family .

acln99,
I have a dissasembly of ngc3, They use some protection and most of the calibration data is not references in code directly but by some table lookups. Real piece of s.. to trace things down. Also still have`t figured checksum method that is used in bins.

you can use IDA pro or ghidra, both will disassemble it fine. Need to find some r2 and r13-17 registers to setup in code.

I want to dump a log with IDS flashing eecv pcm, not sure how it can be done.

It will be great if you can get some ngc3 writing and reading session. It may help really good , when I set it up for scI communication. I think ngc3 and ngc4 uses the same algo for unlocking a flash session.

Gampy, we need to dial seed/key algo and than for sure some reading script will be done. Currently I am using old chrysler flash program to log writing session to a virtual pcm. It won`t really help you. The can communication is very similar to Gm ones. You can use this config and start testing modes and custom data commands in iso15675 protocol. Added some test script for Gm CAN, most commands should work with NGC4, you can remove and add stuff as you like.

Thank you

What connection settings does the NGC4 use (Protocol/Baud/etc...) ??

The nurse that is here right now is a bit geeky and made a deal with me, I follow instructions, she'll hook me up, so she is hooking up the OBDII UART (st elm) and the Mastertech II to my NGC4 vehicle as I type ...

-Enjoy

You can connect raw CAN @500000 pins 6&14 and Iso15765 @ 500000 using the supplied configuration, so it sets filters properly.
You can also set other flow control filters to log other modules on bus.
NOt sure if chrysler have low speed bus for other modules, must check schematics.