MSS60 Research

[MpowerE36]

read the text below the table. Access can only be set while the professor is uncensored mode. It can only be cleared in censored mode.

Yes I've just seen that

[MpowerE36]

The censor can be set without erasing the contents of the flash memory, but it cannot be cleared without erasing the flash memory. In theory it might be possible to write a program that runs in RAM and then restores the flash, but that's beyond my skillset.

In other news, I ended up just spending the money to buy PEMicro's debugging software. Syntax is a little different than macraigor's, but overall has the same capabilities (really more). Once I verify I have the right sequence of commands down pat, I'll post them here.

Will you use your PEMicro's debugging software with the Multilink Universal FX ? Do you think the Multilink Universal would be good enough ?

Edit : hum MPC5xx/MPC8xx seem to be FX only

[terra]

Will you use your PEMicro's debugging software with the Multilink Universal FX ? Do you think the Multilink Universal would be good enough ?

Edit : hum MPC5xx/MPC8xx seem to be FX only

I have an old Cyclone Max which does support the MPC5xx/8xx, but of the devices they sell currently, it needs to be either the Multilink FX or the Cyclone FX. They're dropping support for the old devices too (even now when you buy the debugger, you have to email them for a version that supports the "legacy" licensing, so I don't recommend looking for a used older device)

[MpowerE36]

I have an old Cyclone Max which does support the MPC5xx/8xx, but of the devices they sell currently, it needs to be either the Multilink FX or the Cyclone FX. They're dropping support for the old devices too (even now when you buy the debugger, you have to email them for a version that supports the "legacy" licensing, so I don't recommend looking for a used older device)

I tried with my old USB PowerPC BDM Multilink which is for mpc5xx and mpc8xx and the PROGPPCZ software but I have the same problem you had in the past : the CC UC3F censor function seems to work to clear censor bits but not to set them to 01.

I am very disappointed about this software because it seems it is not possible to send read and write commands directly to the shadow registers, as it is possible in the OCD commander software.

[terra]

You can send debug commands with ICDPPCZ

But yeah, I'm overall pretty annoyed with Freescale and PEMicro. There's a reason all the manufacturers switched to tricore CPUs. All the debugging features functionality can be accessed with simple TTL and JTAG interfaces.

[MpowerE36]

You can send debug commands with ICDPPCZ

But yeah, I'm overall pretty annoyed with Freescale and PEMicro. There's a reason all the manufacturers switched to tricore CPUs. All the debugging features functionality can be accessed with simple TTL and JTAG interfaces.

Did you already use ICDPPCZ ? Do you know if it works fine ?

[MpowerE36]

I've succeeded to clear the censor bits of my injection processor. I have now 40 FF 00 FF instead of 43 FF 00 FF in the 2FC800 register but I don't succeed to set the first byte to 41. However I set before the 2FC808 register to 58 00 00 42 but then, when I try to change the first byte of the 2FC800 register from 40 to 41, the value stay at 40. It is like I am not allowed to set the censor bits and I don't understand why.

[hobbit382]

I've succeeded to clear the censor bits of my injection processor. I have now 40 FF 00 FF instead of 43 FF 00 FF in the 2FC800 register but I don't succeed to set the first byte to 41. However I set before the 2FC808 register to 58 00 00 42 but then, when I try to change the first byte of the 2FC800 register from 40 to 41, the value stay at 40. It is like I am not allowed to set the censor bits and I don't understand why.

what tool did you use?

[MpowerE36]

what tool did you use?

I am using PEmicro's device but I don't think it is a tool problem.

terra Do you remember if you modified some registers before doing the setting censor process ? Maybe we have to disable external interruption with the spr 81 register before ?

It is like the current value store in the censor NVM CAM cell (0x00) is constantly reloaded in censor bits. So my 0x01 value is immediately overwritten before I succeed to finalize the program sequence.

[MpowerE36]

I've finally succeeded to write 41 FF 00 FF in the 0x2FC800 register. So my injector processor is bdm unlocked. I've succeeded to flash my backup in the 2 processors and 2 external eeproms but my ecu doesn't respond by obd. I will verify the flash with a bdm read but it is strange that both mpc don't respond by obd. Indeed before debugging my injector mpc, my ignition mpc responds by obd (with ram_lesen function for example)

I think it could come from the shadow region of my injector mpc. I think I have to flash it back after the clearing and setting censor manipulations. I hope it is the same as the ignition shadow region...

[hobbit382]

terra I remember terra saying something about using the mss65 shadow region hoping they were the same?

[MpowerE36]

terra I remember terra saying something about using the mss65 shadow region hoping they were the same?

If I understand correctly he used the injector shadow region of a MSS65 and flash it in the injector shadow region of his MSS60. Unfortunately I don't have a MSS65, so I will read the shadow region of the ignition processor of my MSS60 in order to flash it in the injector one. I hope it will work

[terra]

I later on used the shadow region from the ignition side and things still seemed to work properly.

[MpowerE36]

After flashing the shadow region of the injector processor my ECU is unbricked You just have to write the long 0x20410000 at 0x0 address (UC3FCFIG register).

As I showed in the #100 post, you can replace 0x300 by 0x0 or 0x100 if you don’t want the injector processor to lock anymore (apparently during SK writing).

It's cool to know that I can brick my dme as many times as I want and I could always get it back

[pshoey]

Which address needs to be patched to 0 or 100h?


Sent from my iPad using Tapatalk