pcmhacking.net

yoda69 wrote:http://www.usbjtag.com/jtagnt/ecu411/index.php

Ah awesome!

Right so, almost matches up with what the other site has.

So it would be:

BDM SIGNAL ECU PIN
1 DS 7
2 BERR 42
3 GND 4
4 BKPT/DSCLK 89
6 FREEZE 90
7 RESET 72 (This says 73.. I counted from the pic yoda put up)
8 IFETCH/DSI 11
10 IPIPE/DSO 13

The omni link shows pin 9 and 5, but.. doesnt look like they are needed (Ground and VDD). I guess when you power up the ecu, vdd will inherently be supplied.

Theres also a wpp pin... not sure what that stands for.. write protect pin?. Looks like it needs 12v and 100ohm resistor applied before firing up the ecu to allow writing to the chip.

With a lot of the late model manufacturer controller's the manufacturer is getting tighter on security & thats why you have to use KTAG(type of unit) to read/write rather than being able to do it over the comm's with KESS(type of unit) that's why that particular manufacturer offer's the 2 varieties.

I thought they were going the other way with better access via the OBD port. I have a MPPS and it reads my Hyundai ECU fine. I haven't been game enough to make any changes (wife's car). The software is pretty basic with what can be changed but I am sure some of you chaps would have no problem fixing that. I also bought BDM100 but haven't tried it out yet. Future toys.

VX L67 Getrag wrote:With a lot of the late model manufacturer controller's the manufacturer is getting tighter on security & thats why you have to use KTAG(type of unit) to read/write rather than being able to do it over the comm's with KESS(type of unit) that's why that particular manufacturer offer's the 2 varieties.

Ahhh right.
Well, I guess thinking about it... the LS1 ECU's arent too bad to pull apart.. so access to those pins are pretty easy from factory..

But, on an E38 (And most other modern ECUs), they are sealed completely shut.. Must be why they are accessible from the ECU plug pins.

Charlescrown wrote:I thought they were going the other way with better access via the OBD port. I have a MPPS and it reads my Hyundai ECU fine. I haven't been game enough to make any changes (wife's car). The software is pretty basic with what can be changed but I am sure some of you chaps would have no problem fixing that. I also bought BDM100 but haven't tried it out yet. Future toys.

I recon that BDM100 is a contender. Pretty sure late last night I was watching some tutorial on an ECU which the same chipset as the E38 being read out, gonna have to find that now

I think they have legislated in the US that all car manufacturers have easy access via the OBD port for program changes but saying that they have divided the ECU data allowing access to only parts not all. Cunning bastards.

I just read on HPT 3.4 release there is a PCM modification needed to be able to read/write with their software/hardware for the 2015 to 2017 Jeep/Chrysler/Dodge etc... range so don't think it is all that easy over the port anymore & getting harder but I guess like everything overtime there will be ways around things!

If only there was a tool like Rolls has for Ford that can write to a controller ignoring communication state for the other manufacturers, GREAT recovery tool!

This must be the FGtech stuff here: http://www.gearhead-efi.com/Fuel-Inject ... -gt-(PICs)

Looks like that does over the comms for alot of vehicles.

But also has options for using bdm/jtag for alot of ecus as well. Iv got a couple E38's on the way.. so its abut tiem to get some pictures of these things opened up.

They are getting more secure, but it depends on brand. As mentioned the physical devices are harder to get in to, and the software/obd methods are getting more tightly locked up.

For example: http://www.efilive.com/latest/2013-15-c ... unlocking/

antus wrote:They are getting more secure, but it depends on brand. As mentioned the physical devices are harder to get in to, and the software/obd methods are getting more tightly locked up.

For example: http://www.efilive.com/latest/2013-15-c ... unlocking/

Wow....