Heh.. beg to differ on the motorola thingy..

Look at this: http://www.nxp.com/files/microcontrollers/doc/ref_manual/RCPURM.pdf?fasp=1&WT_TYPE=Reference%20Manuals&WT_VENDOR=FREESCALE&WT_FILE_FORMAT=pdf&WT_ASSET=Documentation&fileExt=.pdf


The actual spec sheet of the CPU (for a BA falcon Visteon PCM).. and the copyright is... (drumroll please) "Copyright 2001 MOTOROLA; All Rights Reserved" It also has a big "digital DNA from Motorola" logo thingy. rights got sold to freescale who eventually sold to nxp.
From memory the size of the flash on a BA is 1476.


The MCP565 is the spanish oak BF PCM a member of the same family. It has only 2/3 the size, but it's much faster. I found a ton of data on memory locations and sizes of the PPC MPCxxx CPU's.. like this little snippet:
;device Motorola, MPC565, 1x32x128k, UC3F B 512k Memory Block
;begin_cs device=$00080000, length=$00080000, ram=$003F9800
NO_BASE_ADDRESS=00080000/
WRITE_SPR=00000800/027E/ ;enable internal UC3F Flash
WRITE_LONG=FFFFFFF0/002FC004/ ;Turn off watchdog timer
WRITE_LONG=44000000/002FC840/ ;Enable second 512K UC3F Flash
WRITE_LONG=00000000/002FC100/ ;Turn off CS0
WRITE_LONG=00000000/002FC140/ ;Turn off Dual Mapping


I found all this stuff about 6 months ago.. about 500 mb of documentation about BA and BF CPU's.. I even found the original Visteon PCM brochure to OEM's showing the BA PCM as the top option.. I also have a lot of the original software tooling for the factory firmware creation, but the versions are so old I can't get them working on Win7.. was planning to try XP and see if that ran them.

I was in the info collection stage of things planning to evaluate the best method of getting system level access to the PCM's.. you can see in that photo I posted that I have both BA and BF PCM's on the bench with the metal bottoms cut off.. I was going to solder some BDM or JTAG pins to the board and see if I could get access that way.. the benefit of doing that is that it gives you CPU level access to the workings (BDM) which would come in very handy for testing and analysis.. but I may have been overthinking the complexity.. trying to be methodical.

If you think any of that info would be handy. (I spent a lot of time trolling the various internet archives getting files from sites that no longer exist.) I can dig it up and send it though.. some of it will be on that same nxp site I linked to above.

regards

Frank

Last edited by frankieh on Tue Sep 13, 2016 8:03 pm, edited 1 time in total.

stick it up on dropbox or similar.

those developing code, I've recently (last year) come to start using github for sharing code, great way to share an open source project, for those that want their stuff open.

Well most of the docs and software are not open source, so I don't want to get in copyright trouble. I found some of the software on an archived version of Motorola website as it was in the mid to late 90's and stuff like that, but the rights to that stuff are now with NXP regardless of whether it's available on their site or not.. and they still sell the MCP5XX CPU's so they will protect it.

This is what I was aiming for with the BDM side of things:
https://www.youtube.com/watch?v=AmM2H6cEOUc

The are actually dumping a PCM with a BA MCP555 processor.
I need to get me a copy of IDA pro.. it ain't cheap though.

(on the subject of github, I am a Linux admin so of course I know github. (GIT was written by Linux Torvalds, the original father of the Linux Kernel) so I have a github account and my own Git server running in docker container on my Rockstor NAS at home. )

There you go, I had no idea motorola had anything to do with PowerPC. End of the day they use the PowerPC instruction set which is what I was getting at and hence IDAPro can view the assembler quite easily. Heres some screens of my binary which appear the same in the black oak (BA) and spanish oak








I'm putting most of my stuff on my dropbox atm, won't put the tuning software up until it is complete though.
https://github.com/rolandh/J2534DotNet

Anything you can post up or send privately would be greatly appreciated.

BTW, you might want to put some thought into the table and variable names you'll use.. possibly look at Openecu. If you use Fords internal naming schema you will run afoul with them.. which is why all of the others, (sniper, HPT, SCT, BE etc) don't use fords naming schema. Once you work out what they all are, it would be relatively trivial to map them to a naming schema without intellectual property rights asserted.

Yes variable names is one im still deciding how to handle for those exact reasons.

Openecu is a good pointer thanks.

https://pcmhacking.net/forums/viewtopic.php?f=4&t=4940

To try and keep the topics relevant I'm going to try and keep all of my posts in this thread from now on. Many of you guys members on pcmhacking?

I've been a lurker on that site. I've drooled over what they made for the holden stuff.. one of the things that started me thinking about writing a openECU plugin to add Ford stuff to the list.

duplicate

Anyone able to tell me if this drawing is ECU side or wiring loom connector side? Trying to make a bench setup (with no loom so I can't check wire colours) and I assume I may have wired it up mirrored.

Also anyone know where I can get an EEC-VI plug and pins from? I've currently just stuck pins on the pins then used aligator clips and their sheaths to shield the pins, pretty ugly but I guess it will work.

Also any comments on my guide of how to wire it up on the bench, are there any other cables that are needed?

Last edited by rolls on Sun Sep 25, 2016 5:33 pm, edited 1 time in total.

Ok all good I just had the drawing mirrored, luckily I didn't let the smoke out and it works.

For people not following the other forum I've got a program that will read and write the flash to a spanish oak PCM now.

Let me know if you are interested in beta testing the program with a J2534 cable if you have a spare PCM for testing.

what j2534 cable do u recommend and how much $$$ is needed to buy?

Have a read of the PCM hacking forum thread.
https://pcmhacking.net/forums/viewtopic ... 392#p71392

OpenPort 2.0 is $169 USD which I have successfully been using and is the cheapest non china clone J2534 cable on the market. My goal is for the software to also work with VCM2 and mongoose cables.

Currently I have some extremely basic proof of concept software that will read and write the flash to a BF/FG PCM. Someone has donated a BA PCM so I should support this also soon.

The proof of concept software reads flash to binary and writes it back with and nothing else other than basic VIN reading etc. Nothing stopping you from editing the binary yourself though.

I have working editor software also but I'm not releasing this until I polish it and get it to beta stage and incorporate the read/write j2534 library into it, I will post up when I'm ready for beta testers.

I'm aiming for a Christmas beta release to a limited number of people.