pcmhacking.net

Seeing a lot of the later type controllers can't be done over the OBD plug or if controllers get bricked over OBDII does anyone have advice on best tools to use (software & hardware) & have a pinout list to connect to all the common cotroller's (Ford, GM-Holden, Hyundai etc..)?

I am very interested in this.

Basically you will need to identify the CPU, the model it is and find a pinout, then you have the arduous task of tracing pins through a multi layer PCB to find somewhere you can put a clamp on that hopefully already has a through hole solder joint.

How far have you gotten?

rolls wrote:I am very interested in this.

Basically you will need to identify the CPU, the model it is and find a pinout, then you have the arduous task of tracing pins through a multi layer PCB to find somewhere you can put a clamp on that hopefully already has a through hole solder joint.

How far have you gotten?

I think most modern designs actually have these pins accessible from the main ecu connectors.

Well.. on the Holdens at least, the LS1, e38's and e40's are.
More a matter of traching these back.. to the cpu!

It makes sense they do that though, It would be where they flash in a OS and test the ECUs via these connectors after assembly.

Tazzi wrote:

rolls wrote:I am very interested in this.

Basically you will need to identify the CPU, the model it is and find a pinout, then you have the arduous task of tracing pins through a multi layer PCB to find somewhere you can put a clamp on that hopefully already has a through hole solder joint.

How far have you gotten?

I think most modern designs actually have these pins accessible from the main ecu connectors.

Well.. on the Holdens at least, the LS1, e38's and e40's are.
More a matter of traching these back.. to the cpu!

It makes sense they do that though, It would be where they flash in a OS and test the ECUs via these connectors after assembly.

Yeah that is a good point, they have to program the flash chip at some point in the factory so there must be a header somewhere.

Only thing I've seen is like these:
http://www.flashtec.ch/index.php/produc ... dflash-bdm
http://www.dhgate.com/product/wholesale ... 98379.html
https://www.obd2buy.com/chip-programmer ... 00cmd.html

They don't mention E38. E67, ....., so not sure if something similar available for them

They look good at a quick glance (couldn't see pinout diagrams on phone) but look similar to ones on eBay & main one I want now is e69/e77!

There's a few e39's I have but think I damaged parts on them as I used e38 wiring harness by mistake!

I think the BDM100 is the way to go for starting off on it all. Seems to support a good chunk of common ecus.

Ultimately the best option will be a BCM/jtag device recommended by the manufacturer for debugging/programming which can usually be found on the tech sheets for that specific chip.

Next part is actually pulling the damn things apart to begin backtracing.

The thing is bdm/jtag is a debug tool. You can run code on the cpu and read ram/flash data but write flash is not a function of the cpu as its on another chip from another manufacturer. You need software which knows how the flash is connected to the cpu and with support to run the flash. Eg in the 0411 the intel flash is not a motorola product like the cpu and you need to supply 12v to a flash pin to enable write. That 12v conbection is proprietry to the ecu. Essentially to write you need code almost identical to what you upload over an obd2 flash to control the flash chip need to drive the flash process from a pc. This can be done but its much simpler to get a product that supports you ecu to begin with. Even later ecus that dont need code uploaded will need pc software that can hook in to the code thats there. You might get lucky on newer pcms and it may be a less proprietry process and something off the shelf may exist.If you get something going let us know how.

Reading/Writing to the flash chip that isn't supported by your BDM would be easier to use an arduino with SPI (I assume it would use SPI) and wire it to the chip directly. BDM I'm mainly interested in for debugging and stepping through code.

You can get SPI flash chip programmers off the next with the flash enable pin etc all on a nice header. Most chips use similar instruction sets and the page sizes can be adjusted in software.

antus wrote:The thing is bdm/jtag is a debug tool. You can run code on the cpu and read ram/flash data but write flash is not a function of the cpu as its on another chip from another manufacturer. You need software which knows how the flash is connected to the cpu and with support to run the flash. Eg in the 0411 the intel flash is not a motorola product like the cpu and you need to supply 12v to a flash pin to enable write. That 12v conbection is proprietry to the ecu. Essentially to write you need code almost identical to what you upload over an obd2 flash to control the flash chip need to drive the flash process from a pc. This can be done but its much simpler to get a product that supports you ecu to begin with. Even later ecus that dont need code uploaded will need pc software that can hook in to the code thats there. You might get lucky on newer pcms and it may be a less proprietry process and something off the shelf may exist.If you get something going let us know how.

Yeah, I assumed the BDM software would be able to debug/request information fro attached flash chips as they are usually connected via spi.

Saw a thread on the web before from some mob that posted a pinout of the LS1 ecus for a BDM connection... gonna have to go through my billion bookmarks to find it! Think I just googled ls1 bdm.. maybe this link?
http://www.omnituner.com/default.aspx?t ... posts&t=58

Says can read/write to the rom.