Fordmods Logo

BA-BF-SX-SY - Scantool Fun 

 

Page 42 of 44 [ 650 posts ] Go to page Previous  1 ... 39, 40, 41, 42, 43, 44  Next

 
 Post subject: Re: BA-BF-SX-SY - Scantool Fun
Posted: Sun Sep 11, 2016 1:55 pm 
Oompa Loompa
Offline

Age: 100

Posts: 39

Joined: 6th Sep 2016

Ride: BF XR6T Falcon

Location: Australia
SA, Australia

https://dl.dropboxusercontent.com/u/142 ... shim32.dll

Can confirm if you use my shim dll in place of the bosch VCM2 dll it will let you use as VCI mini or basically any J2534 device. IDS has issues with it though and will not let you do most of the functionality due to random timeouts etc. I suspect that is due to dodgy cheap $25 hardware.

I'm guessing if you use a mongoose or an OpenPort 2.0 it will work fine. I suspect you can also interchange the Ford and GM flashing tool via this method.
Top
 Profile  
 
 
 Post subject: Re: BA-BF-SX-SY - Scantool Fun
Posted: Mon Sep 12, 2016 12:38 am 
Technical Contributor
Offline
User avatar

Age: 52

Posts: 5502

Joined: 14th Jan 2005

Gallery: 10 images

Ride: 96 XH/97 EL

Location: South Coast
NSW, Australia

Nigel wrote:
Theres already a guy on FordForums who can flash the AU (and EL/EF I think) EEC's, and do custom tunes to them. He charges from $100-$150 to do that, and has most of the Ford Binaries. He uses Custom Hardware that he put together.So its doable.
So this is communicating directly with the ECU onboard ROM ? Not just to a plug in J3 chip ?
Ripping an onboard binary seems straightforward - a J3 programmer and the F2E connector, which is essentially a pass through connector, and the software executionable.
I guess it wouldn't be that straightforward to write another executionable to use this same setup to enable writing to the onboard ROM.

 

_________________

96 XH Longreach 'S': LPG, Alarm, 3.23:1 LSD, Cruise, Trip Comp, ABS, Power Windows, Mid Series Dome Lt, Climate Ctrl
97 EL Futura S/W: LPG, Alarm, LED int Lts, Trip Comp, F/Lane Dome Lt, Climate Ctrl, T5 Conversion

Top
 Profile  
 
 
 Post subject: Re: BA-BF-SX-SY - Scantool Fun
Posted: Mon Sep 12, 2016 12:54 am 
ACT Cruise Moderator
Offline
User avatar

Age: 35

Posts: 6275

Joined: 24th Nov 2004

Ride: '06 BF GT-P

Power: 293 rwkw

Location: Canberra
ACT, Australia

snap0964 wrote:
Nigel wrote:
Theres already a guy on FordForums who can flash the AU (and EL/EF I think) EEC's, and do custom tunes to them. He charges from $100-$150 to do that, and has most of the Ford Binaries. He uses Custom Hardware that he put together.So its doable.
So this is communicating directly with the ECU onboard ROM ? Not just to a plug in J3 chip ?
Ripping an onboard binary seems straightforward - a J3 programmer and the F2E connector, which is essentially a pass through connector, and the software executionable.
I guess it wouldn't be that straightforward to write another executionable to use this same setup to enable writing to the onboard ROM.



EF/EL don't have flashable ECU's. the chips on them are all read only things.

AU (maybe AU2+) do have flashable ECU's.

 

_________________

1998 DL LTD in Sparkling Burgundy, daily, 302W, stereo, slow - 97.5rwkw
2006 BF GT-P in Ego, mods. 293rwkw - 12.427@109 - 0-1000m 24.838@221

Top
 Profile  
 
 
 Post subject: Re: BA-BF-SX-SY - Scantool Fun
Posted: Mon Sep 12, 2016 3:47 pm 
Getting Side Ways
Offline
User avatar

Age: 44

Posts: 3436

Joined: 23rd Dec 2007

Gallery: 32 images

Ride: BA XR6T (mix of BA, BF and FG)

Location: Perth
WA, Australia

Nigel wrote:
Theres already a guy on FordForums who can flash the AU (and EL/EF I think) EEC's, and do custom tunes to them. He charges from $100-$150 to do that, and has most of the Ford Binaries. He uses Custom Hardware that he put together.

So its doable.



You are probably talking about TI performance... Jason? We have him here too.. in fact he posted in this very thread last week. username galapogos01

:-)
Top
 Profile  
 
 
 Post subject: Re: BA-BF-SX-SY - Scantool Fun
Posted: Mon Sep 12, 2016 3:54 pm 
Getting Side Ways
Offline
User avatar

Posts: 1137

Joined: 27th Feb 2005

Ride: Supercharged EF Fairmont

Location: T.I. Performance HQ
VIC, Australia

Yep. Very keen to help get an open definition solution for BA-FGX too :)

 

_________________

T.I. Performance - Performance Tuning for your Ford. J3 Chips, DIY Tuning Kits, Wideband O2 Controllers and much more!

Top
 Profile  
 
 
 Post subject: Re: BA-BF-SX-SY - Scantool Fun
Posted: Mon Sep 12, 2016 4:44 pm 
Getting Side Ways
Offline
User avatar

Age: 44

Posts: 3436

Joined: 23rd Dec 2007

Gallery: 32 images

Ride: BA XR6T (mix of BA, BF and FG)

Location: Perth
WA, Australia

It's very serendipitous that this is happening now.

There are limitations to the binary editor setup I have with my mongoose cable most related to the encrypted schema I'm having to use. It was so frustrating getting it working that I resolved to start making a system myself to do it.


I setup a work bench and started getting kitted up for testing.

Image

Got a ton of PCM's, a CRO, a proper USB to CAN adaptor (not elm) Arduino and canshield, 2 Raspberry Pi's and 2 J2534 adaptors, couple of laptops and started wiring up pinouts on PCM's, BCM's and ICC's.. (got some work to do with those too.)

Started sniffing and coding on Linux to start with simply because that's my day job, but as it turns out, there is a ton more Windows stuff available for J2534 than Linux.. so started teaching myself Wxwidgets as that is what Forscan is written too and I like the look and function of Forscan. If Fordscan was OSS I'd knock up a PCM write extension to that. It already has PATS and some built as data stuff.. would be nice to have a single tool that does everything a lowly falcon/territory owner could want. Perhaps that is what this will end up being.

Last edited by frankieh on Mon Sep 12, 2016 4:53 pm, edited 1 time in total.

Top
 Profile  
 
 
 Post subject: Re: BA-BF-SX-SY - Scantool Fun
Posted: Mon Sep 12, 2016 4:48 pm 
Oompa Loompa
Offline

Age: 100

Posts: 39

Joined: 6th Sep 2016

Ride: BF XR6T Falcon

Location: Australia
SA, Australia

That is one oldschool cro you have there.

What j2534 adapters are you using?
Top
 Profile  
 
 
 Post subject: Re: BA-BF-SX-SY - Scantool Fun
Posted: Mon Sep 12, 2016 4:59 pm 
Getting Side Ways
Offline
User avatar

Age: 44

Posts: 3436

Joined: 23rd Dec 2007

Gallery: 32 images

Ride: BA XR6T (mix of BA, BF and FG)

Location: Perth
WA, Australia

rolls wrote:
That is one oldschool cro you have there.

What j2534 adapters are you using?


yeah, the CRO is ancient.. but it works perfectly.. kinda cool in a retro sort of way.. the lab power supply is of a similiar vintage and it works perfectly too.

The two J2534's I have are an old Mongoose Pro ford and a new VX diag one I bought on a whim a while pack. http://www.vxdiag.net interestingly I had issues getting the VXdiag to putput the 18v on pin 13 (going from memory) so I bought a OBD2 extension and a small 12 to 18v step up which just arrived so I'll be able to manually trigger the 18v if I have to.. (but I'd rather find out how to do it via the vxdiag DLL...) It apparently works fine with FMP so it must be there.. I can't get FMP anymore as they figured out I was in australia and stopped letting me buy it otherwise I'd do a write and trace it with the both the mongoose and vxdiag.

I also have a VCM but the vxdiag can be both VCM and J2534 which was why I bought it.. it also has wireless which I wouldn't use for writting (no backup power if you get fluctuations or voltage drops) but for PATS resets it works well enough. Forscan uses it well too.
Top
 Profile  
 
 
 Post subject: Re: BA-BF-SX-SY - Scantool Fun
Posted: Mon Sep 12, 2016 8:35 pm 
Oompa Loompa
Offline

Age: 100

Posts: 39

Joined: 6th Sep 2016

Ride: BF XR6T Falcon

Location: Australia
SA, Australia

edit: double post

Last edited by rolls on Mon Sep 12, 2016 8:37 pm, edited 1 time in total.

Top
 Profile  
 
 
 Post subject: Re: BA-BF-SX-SY - Scantool Fun
Posted: Mon Sep 12, 2016 8:35 pm 
Oompa Loompa
Offline

Age: 100

Posts: 39

Joined: 6th Sep 2016

Ride: BF XR6T Falcon

Location: Australia
SA, Australia

https://dl.dropboxusercontent.com/u/1428435/PHF2BIN.rar

Ford IDS PHF to Binary converter I wrote this afternoon. Wrote a plugin structure so it can be extended to open/save other formats if desired. All source code included.

It only works with BF/FG PHF files, I haven't tested it with others. Also the PHF file is missing the binary from 0x10000 to 0x20000 which I believe is some unimportant bit of ROM. I fill this section with 0xFF

Not sure if it is of use to anyone but I am using the plugin library in my PCM editing software so other people can extend it to open/save other formats.
Top
 Profile  
 
 
 Post subject: Re: BA-BF-SX-SY - Scantool Fun
Posted: Tue Sep 13, 2016 2:21 am 
Getting Side Ways
Offline
User avatar

Age: 44

Posts: 3436

Joined: 23rd Dec 2007

Gallery: 32 images

Ride: BA XR6T (mix of BA, BF and FG)

Location: Perth
WA, Australia

rolls wrote:
https://dl.dropboxusercontent.com/u/1428435/PHF2BIN.rar

Ford IDS PHF to Binary converter I wrote this afternoon. Wrote a plugin structure so it can be extended to open/save other formats if desired. All source code included.

It only works with BF/FG PHF files, I haven't tested it with others. Also the PHF file is missing the binary from 0x10000 to 0x20000 which I believe is some unimportant bit of ROM. I fill this section with 0xFF

Not sure if it is of use to anyone but I am using the plugin library in my PCM editing software so other people can extend it to open/save other formats.


That's pretty cool. Does IDApro help with pulling out the OS? I tried half a dozen OSS apps that do much the same thing as IDA but none did the job and the free IDA doesn't do the motorola CPU stuff.

you certainly move quickly.. I have 3 kids and 2 jobs so I do what I can when I can.. wish I had more as I enjoy this stuff.
Top
 Profile  
 
 
 Post subject: Re: BA-BF-SX-SY - Scantool Fun
Posted: Tue Sep 13, 2016 8:09 am 
Oompa Loompa
Offline

Age: 100

Posts: 39

Joined: 6th Sep 2016

Ride: BF XR6T Falcon

Location: Australia
SA, Australia

Yes Ida pro will load the binary. It is powerpc big endian, processor is mpc5xx spanish/black oak is ppc not motorola

Can find all the maps in Ida pretty easy. Personally I've written my own binary library that dereferences all the pointers, finds the table structs and then displays the data.

I work full time but no kids, I have to keep my gf entertained so the only time I get is maybe 1 day on the weekend, spare time at work and some week nights.

I still reckon I get a solid 20 hours a week to ply with this though.
Top
 Profile  
 
 
 Post subject: Re: BA-BF-SX-SY - Scantool Fun
Posted: Tue Sep 13, 2016 11:48 am 
Oompa Loompa
Offline

Age: 100

Posts: 39

Joined: 6th Sep 2016

Ride: BF XR6T Falcon

Location: Australia
SA, Australia

Ok so I'm playing with the security request commands with my J2534 library that is here: https://github.com/rolandh/J2534DotNet

I've gotten this far:
Request security access level 3
00 00 00 07 E0 27 03 00 00 00

I get back response
00 00 00 07 E8 67 03 xx xx xx

Where I suspect xx xx xx is the seed however once I calculate the seed response I don't know how to send it back. I tried 27 04 xx xx xx where x is the seed response but I always get 7F 27 error back suggesting I am sending the wrong seed reponse back.

The sniffed security access exchange I found was sending the following:

00 00 00 07 E0 27 01 00 00 00

However if I try and access mode 01 I get back
00 00 00 07 E8 7F 10 11

Where 7F is error 11. I'm unsure where to find a list of error codes but it doesn't accept mode 01.

Perhaps this is where I need to apply the 18v to pin 13 for it to accept it. Thoughts? I will try with my laptop power supply connected to this pin later on tonight/this week and see what happens.

I'm thinking if I'm requesting mode 03 I need to use a different security key to the one I'm using for mode 01, assume I send the seed response back using 04. I will try the other keys I've got and see if it accepts any of them.

Eg request mode 01, send seed response back using mode 02
request mode 03, send seed response back using mode 04

Sound like I'm on the right track?
Top
 Profile  
 
 
 Post subject: Re: BA-BF-SX-SY - Scantool Fun
Posted: Tue Sep 13, 2016 12:43 pm 
Oompa Loompa
Offline

Age: 100

Posts: 39

Joined: 6th Sep 2016

Ride: BF XR6T Falcon

Location: Australia
SA, Australia

Ok figured it out, there are two different seed keys used depending on the level of security access you are requesting.

I did the seed request for level 2 (27 03), generated the response with the correct key and it replied with 67 03 indicating success.

I'm going to bet the level 1 (27 01) access requires the 18v on pin 13. Should be easy to test. If it is the case I should have a read binary app developed by the end of the week!
Top
 Profile  
 
 
 Post subject: Re: BA-BF-SX-SY - Scantool Fun
Posted: Tue Sep 13, 2016 7:32 pm 
Oompa Loompa
Offline

Age: 100

Posts: 39

Joined: 6th Sep 2016

Ride: BF XR6T Falcon

Location: Australia
SA, Australia

Ok so I managed to get the level 1 security access (required for flashing) working.

Pull Pin 13 high (used 20v laptop power supply)
Power cycle ignition off
Wait a few seconds
Power cycle ignition on

...set CAN baud rate etc

Enter security level 1
00 00 07 E0 27 01

Possible responses:
If you have not applied power to pin 18 you will get: 7F 27 11
If you have applied power to pin 18 but not power cycled you will get 7F 27 12

If everything was ok you will get 67 which means successfully requested level 1
00 00 07 E8 67 01 XX XX XX

Generate seed response with level 1 security key
0xYY YY YY = GenerateSeed(level1_security_key, XX XX XX)

Send response
00 00 07 E0 27 02 YY YY YY

If you generated the response correctly you will get:
00 00 07 E8 67 02

You have now successfully unlocked the controller.

Send the following to initiate a read from memory request
00 00 07 E0 23 00 00 00 00 01 00

This is where it fails with my VCI mini crashing and causing an access violation or timeout regardless of the baud rate, timeout or how long I wait before polling the device. The cables requires a full power reset at this point.

I'm ordering an OpenPort 2.0 and will see how I go with that, the bonus is it has full 0-20V support for all vendor pins.
Top
 Profile  
 
Display posts from previous:
Sort by  
 Page 42 of 44  [ 650 posts ]  Go to page Previous  1 ... 39, 40, 41, 42, 43, 44  Next

Who is online

Users browsing this forum: No registered users and 9 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

 

 

It is currently Fri Dec 09, 2016 2:45 pm All times are UTC + 11 hours

 

 

(c)2014 Total Web Solutions Australia - Australian Web Hosting and Domain Names