Flashing the MK60 with ZCP software

[heinzboehmer]

The rumor mill says your zcp mk60 supports flashing, but the non-m does not. Have you tried to do ccp against your zcp module? Dunno if this is a hardware limitation or software…

I have, yes. The results are the same between both, unfortunately.

[heinzboehmer]

Well, I tested my tooling on my E82 and, unfortunately, it works great.

E5 auth/KWP scan probe:

Full capability scan: auth levels, then every service space at each level.
Entered session 0x87. Scanning SecurityAccess: requestSeed (27 <odd>) at 01,03,..FF - a 67 reply with a non-zero seed means that level exists.
27 03: SEED 0x2719 -> grants level 0x02.
27 07: SEED 0x2715 -> grants level 0x04.
27 FB: SEED 0x2601 -> grants level 0x7E.
27 FD: SEED 0x261F -> grants level 0x7F.​

...

1A (ReadECUIdentification) sweep 00..FF:
  1A 80: 7F 1A 78 - EXISTS.
  1A 81: 7F 1A 78 - EXISTS.
  1A 82: 7F 1A 78 - EXISTS.
  1A 83: 5A positive - WORKS.
  1A 87: 7F 1A 78 - EXISTS.
  1A 88: 7F 1A 78 - EXISTS.
  1A 89: 7F 1A 78 - EXISTS.
  1A 8A: 5A positive - WORKS.
  1A 90: 7F 1A 78 - EXISTS.
  1A 91: 7F 1A 78 - EXISTS.
  1A 92: 7F 1A 78 - EXISTS.
  1A 93: 7F 1A 78 - EXISTS.
  1A 94: 5A positive - WORKS.
  1A 95: 5A positive - WORKS.
  1A 98: 7F 1A 78 - EXISTS.
  1A 99: 5A positive - WORKS.
  1A 9A: 7F 1A 78 - EXISTS.
  1A 9B: 5A positive - WORKS.
  1A 9C: 7F 1A 78 - EXISTS.
  1A 9D: 5A positive - WORKS.
  1A 9E: 7F 1A 78 - EXISTS.
  1A 9F: 5A positive - WORKS.
  1A A0: 7F 1A 78 - EXISTS.
  1A A1: 7F 1A 78 - EXISTS.
  1A A2: 5A positive - WORKS.​

...

31 (RoutineControl, 00 control byte) sweep 00..FF:
  31 00: [7F, 30, 22] (unexpected).
  31 09: 71 positive - WORKS.
  31 21: 7F 31 22 - EXISTS.
  31 22: 7F 31 22 - EXISTS.
  31 23: 7F 31 22 - EXISTS.
  31 24: 7F 31 22 - EXISTS.
  31 25: 7F 31 22 - EXISTS.
  31 26: 7F 31 22 - EXISTS.
  31 27: 7F 31 22 - EXISTS.
  31 28: 7F 31 22 - EXISTS.
  31 29: 7F 31 22 - EXISTS.
  31 2A: 7F 31 22 - EXISTS.
  31 31: 7F 31 22 - EXISTS.
  31 32: 7F 31 22 - EXISTS.​

Note that `1A 89` and `31 31` are both there, while they were absent on the E46. I think `31 07` and `31 08` are missing because I only probed at auth level 0x00. The car really didn't like me running these tests with live modules everywhere 🙃

I say this is unfortunate cause that means all my E46 testing has been valid and not a tooling issue. Will keep poking around.

[terra]

Hmm, sounds like we might need to figure out an invasive way of extracting the contents of the flash to really poke around in these. Wonder how practical it'd be to interface a debugger to one of these things. CPU is probably similar to a variant of this? https://www.nxp.com/docs/en/data-sheet/MMC2107.pdf

Also I have a Z4M MK60e5 I could try poking at if you think that has relevance

[George Hill]

I don't know if it is helpful but I will likely have an E90 Non-M MK60 available in a few weeks if you need to do some testing that might be destructive.