E38 Negative Response to read-write ECU

[VX L67 Getrag]

Ok so I know I was able to hot swap 1 of these ecu’s but to save the risk if there is a communicative e38 on the same comm bus of a non-responsive e38 will it write the same file on other PCM if branched together?

[Gareth]

Great question, keen to know the answer

[antus]

I'm not an E38 guy so there might be context I am not aware of here, but in general the whole flash process is bi-directional. It'd be incredibly unlikely that you have a software only fault that allows the pcm to run, but it just cant transmit, yet it'll passively sit on the bus, have the same security codes, and follow the entire re-flash process blind with no errors, packet by packet. If you need to reflash a bricked PCM or one that runs but wont talk then use BDM on the CPU and if you need slave, the other port and config for that.

[VX L67 Getrag]

Yeah it’s a bit strange, I have 3 of them that had been tunerlocked & then were brute forced to find correct key which on all three were the same as seed, then they had the correct key written & then try to read or write in anyway it responds 7F negative response code… so hence looking for safest option to repair them.

[Gatecrasher]

Having two ECUs on the bus will only cause chaos. Everything is bi-directional, like Antus said. The tool will send a block of data, and the ECU has to send an acknowledgement that it received the data correctly and it's ready for more.

And that only happens after you have a successful seed/key session along with a few other variables.

If it's responding with 7F, then it's communicating. It just doesn't like the conversation.

Do you have a log of the failed flash session?

[antus]

It sounds like writing the key didn't work. Try FFFF as the key (blank segment in the chip is all FFFF). Failing that, brute force to see what's going on, and failing that, or if it is blank and VIN and other data is missing use BDM to re-write the whole flash.

[VX L67 Getrag]

So it's a bit weird as 1 of the 3 ecu's literally only has a speed limit change & others are similar so I don't think they were intentionally locked, where the supposed seed/key is in all of them is around where VIN is supposed to be but all 3 are hyroglyphics & I think they may have just had the wrong O.S. for the ECU used & just scrabled it, now they have the correct seed/key combo it parses the unlock phase but can't get bootloader & that request....

Negative Response Code.png (9.23 KiB) Viewed 611 times

Initialize Controller.png (8.93 KiB) Viewed 611 times

The other strange thing is I know Trifecta Tunes give the same response & won't allow it to be written/read etc... but their own software parses that & can be read/written with that response... I might have to see what other software options I have for it are & then if no luck go down the BDM avenue but I didn't think there was a BDM option for the E38.

[antus]

it sounds like someone is flashing something custom in there to intentionally lock people out. BDM will work, that's a hardware way to get the right OS and Param block back on there, you don't need to come through what is likely an intentionally hacked up front door. There is a second BDM port on the board for the slave, if you find you need it. But just doing the main OS might be enough. It'll certainly replace the boot sector and param block including the seed/key assuming the bin you have is complete.

[VX L67 Getrag]

O.k. so I tried CATS & it unlocks fine & identifies calibration & doesn't identify VIN but ignore that & go to program & get a similar programming error & retries 3 times & then gives up, I then tried Fermec software for eeprom area & immo & just show's 00 for all of it, 1 of the versions has timeout error for downloading kernel, but other version will retireve it.

Where is the info to BDM these eceu's?

[Tazzi]

O.k. so I tried CATS & it unlocks fine & identifies calibration & doesn't identify VIN but ignore that & go to program & get a similar programming error & retries 3 times & then gives up, I then tried Fermec software for eeprom area & immo & just show's 00 for all of it, 1 of the versions has timeout error for downloading kernel, but other version will retireve it.

Where is the info to BDM these eceu's?

USBJTAG.com, he does all the BDMs of for these. Has youtube video which shows the exact connections needed!

As for your issue, some of these places like trifecta, they changes the code in the operating system so that the 'upload' mode is now a different number.
ie.. instead of using mode 34 and 36, it might be 33 and 38.

Monitoring what their software does would show it immediately.