Vida CEM swapping

[rkam]

Ref.: https://www.swedespeed.com/threads/obd- ... ues.61070/
C0 is said to start the Primary Boot Loader, but it is normally already running when you send commands to it, so I am not sure how useful it is.

A0 starts the uploaded program after setting the start address with 9C.
A8 is of no use I believe.
A8+number of bytes to write is the write command

B4 is checksum, and useful on many controllers, and can be used to read flash one byte at the time when running PBL. (Not CEM)

[dikidera]

Small typo yes, i did in fact mean and did in fact use 7AA0

Run Code
Segment at
Jump
Point
FFFFE 7A A0

[rkam]

My first flash readers used the checksum command which is very slow.
Later I modified SBL files to make the 9C response include 6-bytes of data from the given address.

For experimenting and debugging I have used plain serial. (K-line).

[dikidera]

K-line works on Volvo on the bench? Denso included or just Bosch?

[rkam]

In general.
If you write your own software and run it in any type of controller where there are hardware components routing the serial port of the CPU to a pin on the outside connector, it is often easier to use this for communication and feedback than CAN bus.
Many/Most car controllers have serial port accessible, typically connected for K-line physical protocol.

[dikidera]

I'm getting closer bit by bit(almost literally). When I attempted to execute my code, the chip gets reset perhaps externally from what I observed on the pins. I was told there may be an external watchdog and that must be the case. As soon as I disable that or find the condition on which it reset and satisfy it, it should be smooth sailing from there.

Probing the circuit is difficult because of the protective coating on the PCB to prevent moisture. I managed to remove some parts by using nail polish, but I am unsure if it will cause other problems.
And don't get me started on soldering on the QFP256 chip's pins, small buggers.

[oscilloscope]

I'm getting closer bit by bit(almost literally). When I attempted to execute my code, the chip gets reset perhaps externally from what I observed on the pins. I was told there may be an external watchdog and that must be the case. As soon as I disable that or find the condition on which it reset and satisfy it, it should be smooth sailing from there.

Probing the circuit is difficult because of the protective coating on the PCB to prevent moisture. I managed to remove some parts by using nail polish, but I am unsure if it will cause other problems.
And don't get me started on soldering on the QFP256 chip's pins, small buggers.

Out of curiosity what cem are you trying to read , decode , decrypt , program , make something for ??

[dikidera]

I'm getting closer bit by bit(almost literally). When I attempted to execute my code, the chip gets reset perhaps externally from what I observed on the pins. I was told there may be an external watchdog and that must be the case. As soon as I disable that or find the condition on which it reset and satisfy it, it should be smooth sailing from there.

Probing the circuit is difficult because of the protective coating on the PCB to prevent moisture. I managed to remove some parts by using nail polish, but I am unsure if it will cause other problems.
And don't get me started on soldering on the QFP256 chip's pins, small buggers.

Out of curiosity what cem are you trying to read , decode , decrypt , program , make something for ??

It's the ECM, I will tackle the CEM as soon as I can modify maps/code on the Denso ECM .

[oscilloscope]

I'm getting closer bit by bit(almost literally). When I attempted to execute my code, the chip gets reset perhaps externally from what I observed on the pins. I was told there may be an external watchdog and that must be the case. As soon as I disable that or find the condition on which it reset and satisfy it, it should be smooth sailing from there.

Probing the circuit is difficult because of the protective coating on the PCB to prevent moisture. I managed to remove some parts by using nail polish, but I am unsure if it will cause other problems.
And don't get me started on soldering on the QFP256 chip's pins, small buggers.

Out of curiosity what cem are you trying to read , decode , decrypt , program , make something for ??

It's the ECM, I will tackle the CEM as soon as I can modify maps/code on the Denso ECM .

Ahh I see are you trying to dump the eeprom & flash ?

[dikidera]

I actually did. Dumping them was easy(the internal on-chip rom and external flash of the ecm) from the Hilton commands. It's writing that is the core issue. You need your own code to run on the IC, but at the same time, satisfy the condition as to not reset the chip.