Announcement

Collapse
No announcement yet.

MSS60 Research

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

    Originally posted by terra View Post

    read the text below the table. Access can only be set while the professor is uncensored mode. It can only be cleared in censored mode.
    Yes I've just seen that
    Last edited by MpowerE36; 08-17-2021, 09:39 AM.
    https://www.youtube.com/channel/UCwN...zf45mXp6PDOCzA

    Comment


      Originally posted by terra View Post
      The censor can be set without erasing the contents of the flash memory, but it cannot be cleared without erasing the flash memory. In theory it might be possible to write a program that runs in RAM and then restores the flash, but that's beyond my skillset.

      In other news, I ended up just spending the money to buy PEMicro's debugging software. Syntax is a little different than macraigor's, but overall has the same capabilities (really more). Once I verify I have the right sequence of commands down pat, I'll post them here.
      Will you use your PEMicro's debugging software with the Multilink Universal FX ? Do you think the Multilink Universal would be good enough ?

      Edit : hum MPC5xx/MPC8xx seem to be FX only
      Last edited by MpowerE36; 08-19-2021, 03:10 PM.
      https://www.youtube.com/channel/UCwN...zf45mXp6PDOCzA

      Comment


        Originally posted by MpowerE36 View Post

        Will you use your PEMicro's debugging software with the Multilink Universal FX ? Do you think the Multilink Universal would be good enough ?

        Edit : hum MPC5xx/MPC8xx seem to be FX only
        I have an old Cyclone Max which does support the MPC5xx/8xx, but of the devices they sell currently, it needs to be either the Multilink FX or the Cyclone FX. They're dropping support for the old devices too (even now when you buy the debugger, you have to email them for a version that supports the "legacy" licensing, so I don't recommend looking for a used older device)

        Comment


          Originally posted by terra View Post

          I have an old Cyclone Max which does support the MPC5xx/8xx, but of the devices they sell currently, it needs to be either the Multilink FX or the Cyclone FX. They're dropping support for the old devices too (even now when you buy the debugger, you have to email them for a version that supports the "legacy" licensing, so I don't recommend looking for a used older device)
          I tried with my old USB PowerPC BDM Multilink which is for mpc5xx and mpc8xx and the PROGPPCZ software but I have the same problem you had in the past : the CC UC3F censor function seems to work to clear censor bits but not to set them to 01.

          I am very disappointed about this software because it seems it is not possible to send read and write commands directly to the shadow registers, as it is possible in the OCD commander software.
          https://www.youtube.com/channel/UCwN...zf45mXp6PDOCzA

          Comment


            You can send debug commands with ICDPPCZ

            But yeah, I'm overall pretty annoyed with Freescale and PEMicro. There's a reason all the manufacturers switched to tricore CPUs. All the debugging features functionality can be accessed with simple TTL and JTAG interfaces.

            Comment


              Originally posted by terra View Post
              You can send debug commands with ICDPPCZ

              But yeah, I'm overall pretty annoyed with Freescale and PEMicro. There's a reason all the manufacturers switched to tricore CPUs. All the debugging features functionality can be accessed with simple TTL and JTAG interfaces.
              Did you already use ICDPPCZ ? Do you know if it works fine ?
              https://www.youtube.com/channel/UCwN...zf45mXp6PDOCzA

              Comment


                I've succeeded to clear the censor bits of my injection processor. I have now 40 FF 00 FF instead of 43 FF 00 FF in the 2FC800 register but I don't succeed to set the first byte to 41. However I set before the 2FC808 register to 58 00 00 42 but then, when I try to change the first byte of the 2FC800 register from 40 to 41, the value stay at 40. It is like I am not allowed to set the censor bits and I don't understand why.
                https://www.youtube.com/channel/UCwN...zf45mXp6PDOCzA

                Comment


                  Originally posted by MpowerE36 View Post
                  I've succeeded to clear the censor bits of my injection processor. I have now 40 FF 00 FF instead of 43 FF 00 FF in the 2FC800 register but I don't succeed to set the first byte to 41. However I set before the 2FC808 register to 58 00 00 42 but then, when I try to change the first byte of the 2FC800 register from 40 to 41, the value stay at 40. It is like I am not allowed to set the censor bits and I don't understand why.
                  what tool did you use?

                  Comment


                    Originally posted by hobbit382 View Post

                    what tool did you use?
                    I am using PEmicro's device but I don't think it is a tool problem.

                    terra Do you remember if you modified some registers before doing the setting censor process ? Maybe we have to disable external interruption with the spr 81 register before ?

                    It is like the current value store in the censor NVM CAM cell (0x00) is constantly reloaded in censor bits. So my 0x01 value is immediately overwritten before I succeed to finalize the program sequence.
                    Last edited by MpowerE36; 08-29-2021, 05:14 AM.
                    https://www.youtube.com/channel/UCwN...zf45mXp6PDOCzA

                    Comment


                      I've finally succeeded to write 41 FF 00 FF in the 0x2FC800 register. So my injector processor is bdm unlocked. I've succeeded to flash my backup in the 2 processors and 2 external eeproms but my ecu doesn't respond by obd. I will verify the flash with a bdm read but it is strange that both mpc don't respond by obd. Indeed before debugging my injector mpc, my ignition mpc responds by obd (with ram_lesen function for example)

                      I think it could come from the shadow region of my injector mpc. I think I have to flash it back after the clearing and setting censor manipulations. I hope it is the same as the ignition shadow region...
                      Last edited by MpowerE36; 09-05-2021, 05:50 PM.
                      https://www.youtube.com/channel/UCwN...zf45mXp6PDOCzA

                      Comment


                        terra I remember terra saying something about using the mss65 shadow region hoping they were the same?

                        Comment


                          Originally posted by hobbit382 View Post
                          terra I remember terra saying something about using the mss65 shadow region hoping they were the same?
                          If I understand correctly he used the injector shadow region of a MSS65 and flash it in the injector shadow region of his MSS60. Unfortunately I don't have a MSS65, so I will read the shadow region of the ignition processor of my MSS60 in order to flash it in the injector one. I hope it will work
                          Last edited by MpowerE36; 09-06-2021, 05:30 AM.
                          https://www.youtube.com/channel/UCwN...zf45mXp6PDOCzA

                          Comment


                            I later on used the shadow region from the ignition side and things still seemed to work properly.

                            Comment


                              After flashing the shadow region of the injector processor my ECU is unbricked You just have to write the long 0x20410000 at 0x0 address (UC3FCFIG register).

                              As I showed in the #100 post, you can replace 0x300 by 0x0 or 0x100 if you don’t want the injector processor to lock anymore (apparently during SK writing).

                              It's cool to know that I can brick my dme as many times as I want and I could always get it back
                              Last edited by MpowerE36; 09-08-2021, 02:02 PM.
                              https://www.youtube.com/channel/UCwN...zf45mXp6PDOCzA

                              Comment


                                Which address needs to be patched to 0 or 100h?


                                Sent from my iPad using Tapatalk

                                Comment

                                Working...