MSS60 Research

[MpowerE36]

Which address needs to be patched to 0 or 100h?


Sent from my iPad using Tapatalk

For the 240E program :

Fullbinary from MSS6x flasher : 0xF555A (injection) & 0x362B4A (ignition)
External memory binary : 0x7555A (injection) & 0x62B4A (ignition)

Apparently there are also lock instructions for the ignition processor (seems not existing for program older than 240E).

[terra]

After flashing the shadow region of the injector processor my ECU is unbricked You just have to write the long 0x20410000 at 0x0 address (UC3FCFIG register).

As I showed in the #100 post, you can replace 0x300 by 0x0 or 0x100 if you don’t want the injector processor to lock anymore (apparently during SK writing).

It's cool to know that I can brick my dme as many times as I want and I could always get it back

Since your DME is unlocked now, in theory if you set ACCESS to 1, that should prevent it from being locked even if the censor bits are triggered. Haven't tested that personally.

[pshoey]

Which address needs to be patched to 0 or 100h?


Sent from my iPad using Tapatalk

[MpowerE36]

After flashing the shadow region of the injector processor my ECU is unbricked You just have to write the long 0x20410000 at 0x0 address (UC3FCFIG register).

As I showed in the #100 post, you can replace 0x300 by 0x0 or 0x100 if you don’t want the injector processor to lock anymore (apparently during SK writing).

It's cool to know that I can brick my dme as many times as I want and I could always get it back

[terra]

I later on used the shadow region from the ignition side and things still seemed to work properly.

[MpowerE36]

terra I remember terra saying something about using the mss65 shadow region hoping they were the same?

If I understand correctly he used the injector shadow region of a MSS65 and flash it in the injector shadow region of his MSS60. Unfortunately I don't have a MSS65, so I will read the shadow region of the ignition processor of my MSS60 in order to flash it in the injector one. I hope it will work

[hobbit382]

terra I remember terra saying something about using the mss65 shadow region hoping they were the same?

[MpowerE36]

I've finally succeeded to write 41 FF 00 FF in the 0x2FC800 register. So my injector processor is bdm unlocked. I've succeeded to flash my backup in the 2 processors and 2 external eeproms but my ecu doesn't respond by obd. I will verify the flash with a bdm read but it is strange that both mpc don't respond by obd. Indeed before debugging my injector mpc, my ignition mpc responds by obd (with ram_lesen function for example)

I think it could come from the shadow region of my injector mpc. I think I have to flash it back after the clearing and setting censor manipulations. I hope it is the same as the ignition shadow region...

[MpowerE36]

what tool did you use?

I am using PEmicro's device but I don't think it is a tool problem.

terra Do you remember if you modified some registers before doing the setting censor process ? Maybe we have to disable external interruption with the spr 81 register before ?

It is like the current value store in the censor NVM CAM cell (0x00) is constantly reloaded in censor bits. So my 0x01 value is immediately overwritten before I succeed to finalize the program sequence.

[hobbit382]

I've succeeded to clear the censor bits of my injection processor. I have now 40 FF 00 FF instead of 43 FF 00 FF in the 2FC800 register but I don't succeed to set the first byte to 41. However I set before the 2FC808 register to 58 00 00 42 but then, when I try to change the first byte of the 2FC800 register from 40 to 41, the value stay at 40. It is like I am not allowed to set the censor bits and I don't understand why.

what tool did you use?

[MpowerE36]

I've succeeded to clear the censor bits of my injection processor. I have now 40 FF 00 FF instead of 43 FF 00 FF in the 2FC800 register but I don't succeed to set the first byte to 41. However I set before the 2FC808 register to 58 00 00 42 but then, when I try to change the first byte of the 2FC800 register from 40 to 41, the value stay at 40. It is like I am not allowed to set the censor bits and I don't understand why.

[MpowerE36]

You can send debug commands with ICDPPCZ

But yeah, I'm overall pretty annoyed with Freescale and PEMicro. There's a reason all the manufacturers switched to tricore CPUs. All the debugging features functionality can be accessed with simple TTL and JTAG interfaces.

Did you already use ICDPPCZ ? Do you know if it works fine ?

[terra]

You can send debug commands with ICDPPCZ

But yeah, I'm overall pretty annoyed with Freescale and PEMicro. There's a reason all the manufacturers switched to tricore CPUs. All the debugging features functionality can be accessed with simple TTL and JTAG interfaces.

[MpowerE36]

I have an old Cyclone Max which does support the MPC5xx/8xx, but of the devices they sell currently, it needs to be either the Multilink FX or the Cyclone FX. They're dropping support for the old devices too (even now when you buy the debugger, you have to email them for a version that supports the "legacy" licensing, so I don't recommend looking for a used older device)

I tried with my old USB PowerPC BDM Multilink which is for mpc5xx and mpc8xx and the PROGPPCZ software but I have the same problem you had in the past : the CC UC3F censor function seems to work to clear censor bits but not to set them to 01.

I am very disappointed about this software because it seems it is not possible to send read and write commands directly to the shadow registers, as it is possible in the OCD commander software.

[terra]

Will you use your PEMicro's debugging software with the Multilink Universal FX ? Do you think the Multilink Universal would be good enough ?

Edit : hum MPC5xx/MPC8xx seem to be FX only

I have an old Cyclone Max which does support the MPC5xx/8xx, but of the devices they sell currently, it needs to be either the Multilink FX or the Cyclone FX. They're dropping support for the old devices too (even now when you buy the debugger, you have to email them for a version that supports the "legacy" licensing, so I don't recommend looking for a used older device)