Fordmods Logo

BA-BF-SX-SY - Scantool Fun 

 

Page 43 of 44 [ 650 posts ] Go to page Previous  1 ... 40, 41, 42, 43, 44  Next

 
 Post subject: Re: BA-BF-SX-SY - Scantool Fun
Posted: Tue Sep 13, 2016 7:39 pm 
Getting Side Ways
Offline
User avatar

Age: 44

Posts: 3436

Joined: 23rd Dec 2007

Gallery: 32 images

Ride: BA XR6T (mix of BA, BF and FG)

Location: Perth
WA, Australia

rolls wrote:
Yes Ida pro will load the binary. It is powerpc big endian, processor is mpc5xx spanish/black oak is ppc not motorola

Can find all the maps in Ida pretty easy. Personally I've written my own binary library that dereferences all the pointers, finds the table structs and then displays the data.

I work full time but no kids, I have to keep my gf entertained so the only time I get is maybe 1 day on the weekend, spare time at work and some week nights.

I still reckon I get a solid 20 hours a week to ply with this though.



Heh.. beg to differ on the motorola thingy..

Look at this: http://www.nxp.com/files/microcontrollers/doc/ref_manual/RCPURM.pdf?fasp=1&WT_TYPE=Reference%20Manuals&WT_VENDOR=FREESCALE&WT_FILE_FORMAT=pdf&WT_ASSET=Documentation&fileExt=.pdf


The actual spec sheet of the CPU (for a BA falcon Visteon PCM).. and the copyright is... (drumroll please) "Copyright 2001 MOTOROLA; All Rights Reserved" It also has a big "digital DNA from Motorola" logo thingy. rights got sold to freescale who eventually sold to nxp.
From memory the size of the flash on a BA is 1476.


The MCP565 is the spanish oak BF PCM a member of the same family. It has only 2/3 the size, but it's much faster. I found a ton of data on memory locations and sizes of the PPC MPCxxx CPU's.. like this little snippet:
;device Motorola, MPC565, 1x32x128k, UC3F B 512k Memory Block
;begin_cs device=$00080000, length=$00080000, ram=$003F9800
NO_BASE_ADDRESS=00080000/
WRITE_SPR=00000800/027E/ ;enable internal UC3F Flash
WRITE_LONG=FFFFFFF0/002FC004/ ;Turn off watchdog timer
WRITE_LONG=44000000/002FC840/ ;Enable second 512K UC3F Flash
WRITE_LONG=00000000/002FC100/ ;Turn off CS0
WRITE_LONG=00000000/002FC140/ ;Turn off Dual Mapping


I found all this stuff about 6 months ago.. about 500 mb of documentation about BA and BF CPU's.. I even found the original Visteon PCM brochure to OEM's showing the BA PCM as the top option.. I also have a lot of the original software tooling for the factory firmware creation, but the versions are so old I can't get them working on Win7.. was planning to try XP and see if that ran them.

I was in the info collection stage of things planning to evaluate the best method of getting system level access to the PCM's.. you can see in that photo I posted that I have both BA and BF PCM's on the bench with the metal bottoms cut off.. I was going to solder some BDM or JTAG pins to the board and see if I could get access that way.. the benefit of doing that is that it gives you CPU level access to the workings (BDM) which would come in very handy for testing and analysis.. but I may have been overthinking the complexity.. trying to be methodical.

If you think any of that info would be handy. (I spent a lot of time trolling the various internet archives getting files from sites that no longer exist.) I can dig it up and send it though.. some of it will be on that same nxp site I linked to above.

regards

Frank

Last edited by frankieh on Tue Sep 13, 2016 8:03 pm, edited 1 time in total.

Top
 Profile  
 
 
 Post subject: Re: BA-BF-SX-SY - Scantool Fun
Posted: Tue Sep 13, 2016 7:45 pm 
ACT Cruise Moderator
Offline
User avatar

Age: 35

Posts: 6275

Joined: 24th Nov 2004

Ride: '06 BF GT-P

Power: 293 rwkw

Location: Canberra
ACT, Australia

frankieh wrote:
stuff
regards

Frank


stick it up on dropbox or similar.

those developing code, I've recently (last year) come to start using github for sharing code, great way to share an open source project, for those that want their stuff open.

 

_________________

1998 DL LTD in Sparkling Burgundy, daily, 302W, stereo, slow - 97.5rwkw
2006 BF GT-P in Ego, mods. 293rwkw - 12.427@109 - 0-1000m 24.838@221

Top
 Profile  
 
 
 Post subject: Re: BA-BF-SX-SY - Scantool Fun
Posted: Tue Sep 13, 2016 7:57 pm 
Getting Side Ways
Offline
User avatar

Age: 44

Posts: 3436

Joined: 23rd Dec 2007

Gallery: 32 images

Ride: BA XR6T (mix of BA, BF and FG)

Location: Perth
WA, Australia

data_mine wrote:
frankieh wrote:
stuff
regards

Frank


stick it up on dropbox or similar.

those developing code, I've recently (last year) come to start using github for sharing code, great way to share an open source project, for those that want their stuff open.



Well most of the docs and software are not open source, so I don't want to get in copyright trouble. I found some of the software on an archived version of Motorola website as it was in the mid to late 90's and stuff like that, but the rights to that stuff are now with NXP regardless of whether it's available on their site or not.. and they still sell the MCP5XX CPU's so they will protect it.

This is what I was aiming for with the BDM side of things:
https://www.youtube.com/watch?v=AmM2H6cEOUc

The are actually dumping a PCM with a BA MCP555 processor.
I need to get me a copy of IDA pro.. it ain't cheap though.

(on the subject of github, I am a Linux admin so of course I know github. (GIT was written by Linux Torvalds, the original father of the Linux Kernel) so I have a github account and my own Git server running in docker container on my Rockstor NAS at home. :-) )
Top
 Profile  
 
 
 Post subject: Re: BA-BF-SX-SY - Scantool Fun
Posted: Tue Sep 13, 2016 8:16 pm 
Oompa Loompa
Offline

Age: 100

Posts: 39

Joined: 6th Sep 2016

Ride: BF XR6T Falcon

Location: Australia
SA, Australia

frankieh wrote:
Heh.. beg to differ on the motorola thingy..

Look at this: http://www.nxp.com/files/microcontrollers/doc/ref_manual/RCPURM.pdf?fasp=1&WT_TYPE=Reference%20Manuals&WT_VENDOR=FREESCALE&WT_FILE_FORMAT=pdf&WT_ASSET=Documentation&fileExt=.pdf

The actual spec sheet of the CPU (for a BA falcon Visteon PCM).. and the copyright is... (drumroll please) "Copyright 2001 MOTOROLA; All Rights Reserved" It also has a big "digital DNA from Motorola" logo thingy. rights got sold to freescale who eventually sold to nxp.
From memory the size of the flash on a BA is 1476.


There you go, I had no idea motorola had anything to do with PowerPC. End of the day they use the PowerPC instruction set which is what I was getting at and hence IDAPro can view the assembler quite easily. Heres some screens of my binary which appear the same in the black oak (BA) and spanish oak

Image
Image
Image

data_mine wrote:
stick it up on dropbox or similar.

those developing code, I've recently (last year) come to start using github for sharing code, great way to share an open source project, for those that want their stuff open.



I'm putting most of my stuff on my dropbox atm, won't put the tuning software up until it is complete though.
https://github.com/rolandh/J2534DotNet
Top
 Profile  
 
 
 Post subject: Re: BA-BF-SX-SY - Scantool Fun
Posted: Tue Sep 13, 2016 8:19 pm 
Oompa Loompa
Offline

Age: 100

Posts: 39

Joined: 6th Sep 2016

Ride: BF XR6T Falcon

Location: Australia
SA, Australia

frankieh wrote:
The MCP565 is the spanish oak BF PCM a member of the same family. It has only 2/3 the size, but it's much faster. I found a ton of data on memory locations and sizes of the PPC MPCxxx CPU's.. like this little snippet:
;device Motorola, MPC565, 1x32x128k, UC3F B 512k Memory Block
;begin_cs device=$00080000, length=$00080000, ram=$003F9800
NO_BASE_ADDRESS=00080000/
WRITE_SPR=00000800/027E/ ;enable internal UC3F Flash
WRITE_LONG=FFFFFFF0/002FC004/ ;Turn off watchdog timer
WRITE_LONG=44000000/002FC840/ ;Enable second 512K UC3F Flash
WRITE_LONG=00000000/002FC100/ ;Turn off CS0
WRITE_LONG=00000000/002FC140/ ;Turn off Dual Mapping


I found all this stuff about 6 months ago.. about 500 mb of documentation about BA and BF CPU's.. I even found the original Visteon PCM brochure to OEM's showing the BA PCM as the top option.. I also have a lot of the original software tooling for the factory firmware creation, but the versions are so old I can't get them working on Win7.. was planning to try XP and see if that ran them.


Anything you can post up or send privately would be greatly appreciated.
Top
 Profile  
 
 
 Post subject: Re: BA-BF-SX-SY - Scantool Fun
Posted: Tue Sep 13, 2016 9:02 pm 
Getting Side Ways
Offline
User avatar

Age: 44

Posts: 3436

Joined: 23rd Dec 2007

Gallery: 32 images

Ride: BA XR6T (mix of BA, BF and FG)

Location: Perth
WA, Australia

rolls wrote:
frankieh wrote:
The MCP565 is the spanish oak BF PCM a member of the same family. It has only 2/3 the size, but it's much faster. I found a ton of data on memory locations and sizes of the PPC MPCxxx CPU's.. like this little snippet:
;device Motorola, MPC565, 1x32x128k, UC3F B 512k Memory Block
;begin_cs device=$00080000, length=$00080000, ram=$003F9800
NO_BASE_ADDRESS=00080000/
WRITE_SPR=00000800/027E/ ;enable internal UC3F Flash
WRITE_LONG=FFFFFFF0/002FC004/ ;Turn off watchdog timer
WRITE_LONG=44000000/002FC840/ ;Enable second 512K UC3F Flash
WRITE_LONG=00000000/002FC100/ ;Turn off CS0
WRITE_LONG=00000000/002FC140/ ;Turn off Dual Mapping


I found all this stuff about 6 months ago.. about 500 mb of documentation about BA and BF CPU's.. I even found the original Visteon PCM brochure to OEM's showing the BA PCM as the top option.. I also have a lot of the original software tooling for the factory firmware creation, but the versions are so old I can't get them working on Win7.. was planning to try XP and see if that ran them.


Anything you can post up or send privately would be greatly appreciated.



BTW, you might want to put some thought into the table and variable names you'll use.. possibly look at Openecu. If you use Fords internal naming schema you will run afoul with them.. which is why all of the others, (sniper, HPT, SCT, BE etc) don't use fords naming schema. Once you work out what they all are, it would be relatively trivial to map them to a naming schema without intellectual property rights asserted.
Top
 Profile  
 
 
 Post subject: Re: BA-BF-SX-SY - Scantool Fun
Posted: Tue Sep 13, 2016 9:13 pm 
Oompa Loompa
Offline

Age: 100

Posts: 39

Joined: 6th Sep 2016

Ride: BF XR6T Falcon

Location: Australia
SA, Australia

Yes variable names is one im still deciding how to handle for those exact reasons.

Openecu is a good pointer thanks.
Top
 Profile  
 
 
 Post subject: Re: BA-BF-SX-SY - Scantool Fun
Posted: Tue Sep 13, 2016 9:59 pm 
Oompa Loompa
Offline

Age: 100

Posts: 39

Joined: 6th Sep 2016

Ride: BF XR6T Falcon

Location: Australia
SA, Australia

https://pcmhacking.net/forums/viewtopic.php?f=4&t=4940

To try and keep the topics relevant I'm going to try and keep all of my posts in this thread from now on. Many of you guys members on pcmhacking?
Top
 Profile  
 
 
 Post subject: Re: BA-BF-SX-SY - Scantool Fun
Posted: Fri Sep 16, 2016 8:53 pm 
Getting Side Ways
Offline
User avatar

Age: 44

Posts: 3436

Joined: 23rd Dec 2007

Gallery: 32 images

Ride: BA XR6T (mix of BA, BF and FG)

Location: Perth
WA, Australia

rolls wrote:
https://pcmhacking.net/forums/viewtopic.php?f=4&t=4940

To try and keep the topics relevant I'm going to try and keep all of my posts in this thread from now on. Many of you guys members on pcmhacking?


I've been a lurker on that site. I've drooled over what they made for the holden stuff.. one of the things that started me thinking about writing a openECU plugin to add Ford stuff to the list.
Top
 Profile  
 
 
 Post subject: Re: BA-BF-SX-SY - Scantool Fun
Posted: Fri Sep 16, 2016 8:54 pm 
Getting Side Ways
Offline
User avatar

Age: 44

Posts: 3436

Joined: 23rd Dec 2007

Gallery: 32 images

Ride: BA XR6T (mix of BA, BF and FG)

Location: Perth
WA, Australia

duplicate
Top
 Profile  
 
 
 Post subject: Re: BA-BF-SX-SY - Scantool Fun
Posted: Sat Sep 24, 2016 2:08 pm 
Oompa Loompa
Offline

Age: 100

Posts: 39

Joined: 6th Sep 2016

Ride: BF XR6T Falcon

Location: Australia
SA, Australia

Anyone able to tell me if this drawing is ECU side or wiring loom connector side? Trying to make a bench setup (with no loom so I can't check wire colours) and I assume I may have wired it up mirrored.

Also anyone know where I can get an EEC-VI plug and pins from? I've currently just stuck pins on the pins then used aligator clips and their sheaths to shield the pins, pretty ugly but I guess it will work.

Also any comments on my guide of how to wire it up on the bench, are there any other cables that are needed?

Image

Last edited by rolls on Sun Sep 25, 2016 5:33 pm, edited 1 time in total.

Top
 Profile  
 
 
 Post subject: Re: BA-BF-SX-SY - Scantool Fun
Posted: Sat Sep 24, 2016 2:41 pm 
Oompa Loompa
Offline

Age: 100

Posts: 39

Joined: 6th Sep 2016

Ride: BF XR6T Falcon

Location: Australia
SA, Australia

Ok all good I just had the drawing mirrored, luckily I didn't let the smoke out and it works.
Top
 Profile  
 
 
 Post subject: Re: BA-BF-SX-SY - Scantool Fun
Posted: Tue Sep 27, 2016 8:06 pm 
Oompa Loompa
Offline

Age: 100

Posts: 39

Joined: 6th Sep 2016

Ride: BF XR6T Falcon

Location: Australia
SA, Australia

For people not following the other forum I've got a program that will read and write the flash to a spanish oak PCM now.

Let me know if you are interested in beta testing the program with a J2534 cable if you have a spare PCM for testing.
Top
 Profile  
 
 
 Post subject: Re: BA-BF-SX-SY - Scantool Fun
Posted: Tue Sep 27, 2016 8:18 pm 
Getting Side Ways
Offline
User avatar

Posts: 3363

Joined: 27th Dec 2004

Gallery: 4 images

Ride: MCMXCV Falcon

Location: G town
VIC, Australia

what j2534 cable do u recommend and how much $$$ is needed to buy?

 

_________________

Image

Top
 Profile  
 
 
 Post subject: Re: BA-BF-SX-SY - Scantool Fun
Posted: Tue Sep 27, 2016 11:52 pm 
Oompa Loompa
Offline

Age: 100

Posts: 39

Joined: 6th Sep 2016

Ride: BF XR6T Falcon

Location: Australia
SA, Australia

Have a read of the PCM hacking forum thread.
https://pcmhacking.net/forums/viewtopic ... 392#p71392

OpenPort 2.0 is $169 USD which I have successfully been using and is the cheapest non china clone J2534 cable on the market. My goal is for the software to also work with VCM2 and mongoose cables.

Currently I have some extremely basic proof of concept software that will read and write the flash to a BF/FG PCM. Someone has donated a BA PCM so I should support this also soon.

The proof of concept software reads flash to binary and writes it back with and nothing else other than basic VIN reading etc. Nothing stopping you from editing the binary yourself though.

I have working editor software also but I'm not releasing this until I polish it and get it to beta stage and incorporate the read/write j2534 library into it, I will post up when I'm ready for beta testers.

I'm aiming for a Christmas beta release to a limited number of people.
Top
 Profile  
 
Display posts from previous:
Sort by  
 Page 43 of 44  [ 650 posts ]  Go to page Previous  1 ... 40, 41, 42, 43, 44  Next

Who is online

Users browsing this forum: No registered users and 10 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

 

 

It is currently Thu Dec 08, 2016 8:45 pm All times are UTC + 11 hours

 

 

(c)2014 Total Web Solutions Australia - Australian Web Hosting and Domain Names