pcmhacking.net

Over the years I've had a few issues with these controllers & most important is having the correct Calibration/O.S. for the service/part number & same as all other controller programming a good power source for controller & laptop/programming device, but even if all that is correct there can be other issues that may cause program to fail in a write & controller will become unresponsive...

So after having a controller on the bench for a week & went through all the key's for seed from 0000 to FFFF & not finding key, I went & tried to listen to & send commands to controller & soon realized it wasn't doing anything! (hindsight I should have done this before key search)....

I then went back to what I looked into years ago & tried to find info for BDM/JTAG read & can't find anything but know there is people out there with a lot more info & images but are waiting for the right reason/circumstances, but this is what I know so far...

It seems to be a Delphi with IBM(PowerPC) MPC561 & this is the case taken off & rear of PCB... I was able to borrow a friends tool to get info on what to connect to to get the file done on the bench, but seeing the E38 has the main components on the side of the PCB not shown &/or easy to remove from case it's hard to know where to connect but this is the closest info that I believe may be to get info on/off over bench... Now after going through all that & wasting a week or so(but would still like to find out how to do it for future reference) I eventually thought I have no other options so had a good E38 controller here & made some modifications to the wiring connector to make a quick swap harness, I used the good controller to set write entire & as soon as the unlocking controller message came up I swapped the harness from good to bad PCM & had just gone to programming mode & after 5 minute or so write process it was back to life although it showed weird characters for VIN & Serial but then did a write VIN section by itself seperately & all back to normal.. WOOHOO!

Good to hear the 'hotswap' method got it up and running again. Has recovered a few that have been unidentifiable!

nice info there mate. gonna rig up a new bench harness to try the hot swap trick out.
i'm still working on(more like wasting time) a way to do it bdm style, if its even possible. if you've had any more progress i'd be keen to hear it

I have been told(all hear say till I see proof myself) from a "USER" on this site it is possible by BDM but with time they put in they will not share any info even if paid....WTF... anyway so yeah it is possible so I've been told!

Yeah its more than possible. Requires sacrificing a few boards, reading tech documents and mashing around with configuration files to suit the controller and flash combo.. but certainly can be done. Iv put in (sacrified?) a silly amount of time on it myself, can read via bdm, but writing appears to be alot more tedious, at least it only wants to sometimes work on some boards.

Appears related with clock speeds and write algos, which Im pretty certain on as I can reliably use one board for read/write, but then a bunch of others simply will not... so it must be right on the threshold of timing specifics.

Makes for getting seed/key combos fast. Full write recovery though is not something thats playing ball consistently. Recovery was my main goal for playing/testing with read/write routines via canbus.. as its a quite way to killing ecus

VX L67 Getrag wrote:even if paid....WTF...

I guess some 'users' can't be paid off for work they have done. I can personally vouch for the frustration I went through.

Cant we all? But the whole point of this site is sharing. Thanks to the community members that do!

Hi
I fond all wire to read
I need reset pin
Not fond
Can you help

All credit to In-tech, he posted this info, take a look at viewtopic.php?f=38&t=6416&start=200

should find his post with a helpful pdf file..

Thanks
I fond reset bin
I read it on xprog
It is ok