Welcome Guest Search | Active Topics |

PCM Unlock or WipeOptions ·View
JezzaB
#1 Posted : Sunday, July 27, 2008 12:58:11 AM
Rank: Newbie

Groups: ProTuner, Registered Users, Subscribers

Joined: 7/13/2008
Posts: 2

Hey guys,

              Is there a way or will OmniTuner offer a software way to erase LS1 PCMs? Currently I pull the chips and do it the hardware way and its time consuming and risky. Reading the locked tune would be good but 95% of the time i dont care. Not up for fixing other peoples tunes, would rather do it from scratch. But sometimes a customer/friend doesnt want to head back to their old tuner to wipe it.

Cheers guys. 

Jez

 

AussieLS1evil
#2 Posted : Tuesday, July 29, 2008 4:01:51 AM
Rank: Administration


Groups: ForumAdmin, ProTuner, Registered Users, Subscribers

Joined: 5/20/2008
Posts: 6

Jez,

That's the plan, using J2534 compliant  device like mongoose or GM MDI.

A utility that could cycle a pcm to find the correct seed and key would be nice.....Smile

 

Cheers

Mick

 

 

 

 

 

Rev it up, Drop the clutch, See what happens.....Smile
Roger
#3 Posted : Tuesday, July 29, 2008 5:55:06 AM
Rank: Administration


Groups: ForumAdmin, ProTuner, Registered Users, Subscribers

Joined: 5/17/2008
Posts: 27

Jez,

That is something we are going to do before long but it will take a while. After you guess wrong a few times the PCM puts in a delay between each try so it could take a week or more. You could also use a BDM (Background Debugging Module) to unlock a PCM. This lets you read the entire ROM without removing it but you do have to do a bit of soldering. You can hook the BDM up to the header block on the top corner of the board. Once it is hooked up no one can block it from reading or writing to the ROM.

http://www.pemicro.com/products/product_viewDetails.cfm?product_id=164&menu_id=details&CFID=1796272&CFTOKEN=36392617

Looking at the back of the PCM circuit board with the main connector facing you the test pads will be in the upper right hand corner of the board:
 
____________________________________________________
  1                                                                              30  |
  o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o    | 
  o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o    |
  o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o    |
 61                                                                             90 
 
Using the above pin numbering (which is arbitrary) and the following BDM cable connector:
 
          2          10
          o o o o o
          o o o o o
          1          9
 
with the BDM signals defined as:
 
  PIN       SIGNAL
    1        DS
    2        BERR
    3        GND
    4        BKPT/DSCLK
    5        GND
    6        FREEZE
    7        RESET
    8        IFETCH/DSI
    9        Vdd
    10      IPIPE/DSO 
   
you'll need to make the following connections
 
  BDM        PCM
    1            7
    2            42
    3            4
    4            89
    5            4
    6            90
    7            73
    8            11
    9            25
    10          13

 

 

JezzaB
#4 Posted : Monday, August 04, 2008 5:31:49 AM
Rank: Newbie

Groups: ProTuner, Registered Users, Subscribers

Joined: 7/13/2008
Posts: 2

I know of some software that isnt released that can read out the entire EEPROM tune via software and an old LS1Edit cable. It can be done. Good work guys, im watching this site with interest. If there is anything i can help with, give me a yell. Im a bit rusty on the old C++ though

Jez

PS Just purchased a Mongoose to do some experimenting....think its time to roll the sleeves up

 

Roger
#5 Posted : Tuesday, August 05, 2008 5:24:16 AM
Rank: Administration


Groups: ForumAdmin, ProTuner, Registered Users, Subscribers

Joined: 5/17/2008
Posts: 27

Sounds great! I sent you an email with more information. If anyone else want to help you are more than welcome . I would like to start sharing profiles and tunes before long. We can start a file share for this.

Flasher
#6 Posted : Saturday, September 06, 2008 12:21:29 AM
Rank: Newbie

Groups:

Joined: 9/5/2008
Posts: 1

The E40 & E38 ECM's i think is where a program that can scroll through a work out the key to allow the file to be over written is where i think your program will come in to it's own . There are people out there doing it now so it can be done . the time it takes to find the key does not worry me i have been told the e38 will only test once every 5 seconds so there could be a time frame of over a week 

 if any help is needed let me know

Geoff

 

 

tre-cool
#7 Posted : Friday, January 15, 2010 8:11:10 AM
Rank: Newbie

Groups: Registered Users, Subscribers

Joined: 1/15/2010
Posts: 6

Has anyone made any progress on this stuff or once you find out, do you go hush hush?

Roger
#8 Posted : Sunday, January 17, 2010 10:38:10 PM
Rank: Administration


Groups: ForumAdmin, ProTuner, Registered Users, Subscribers

Joined: 5/17/2008
Posts: 27

Tre-Cool wrote:

Has anyone made any progress on this stuff or once you find out, do you go hush hush?

Actually we have but it is easier with a LS1 PCM to just lift the flash chip and reprogram it in a flash burner. I have not had much time to do much work with this on the E38 but the header is on the board and you can get it apart. The only barrier is that the connection to the header is so small I have to get a special part made to connect a BDM to it. I have spent most of my time working on the DUAL-FLASH module and OmniTuner software.

If you are interested in working on it I am will to answer any questions you might have and point you in in the correct direction.

Roger

tre-cool
#9 Posted : Sunday, January 17, 2010 11:24:22 PM
Rank: Newbie

Groups: Registered Users, Subscribers

Joined: 1/15/2010
Posts: 6

Roger wrote:

Tre-Cool wrote:

Has anyone made any progress on this stuff or once you find out, do you go hush hush?

Actually we have but it is easier with a LS1 PCM to just lift the flash chip and reprogram it in a flash burner. I have not had much time to do much work with this on the E38 but the header is on the board and you can get it apart. The only barrier is that the connection to the header is so small I have to get a special part made to connect a BDM to it. I have spent most of my time working on the DUAL-FLASH module and OmniTuner software.

If you are interested in working on it I am will to answer any questions you might have and point you in in the correct direction.

Roger

Sorry Roger, I actually meant the LS1 controller. (though i do have a spare e38 doing nothing)

Wheres a good place to start to get a hold the software/hardware for the flashburner? i've had a look on the moates website but I couldnt find/tell if you can burn to the ls1 eproms with his burn1,burn2 devices.

I also like your idea of using the BDM to flash,burn the epprom, but again im not sure how you "download" the bin file from the flash, unless they give you some form of software to do this. Then i guess it's a matter of going through the  bin or uploading a clean bin file.

 

never mind found this site http://www.digitalgraphics.com.au/xeltek/sp501s.html

odd boy
#10 Posted : Monday, December 20, 2010 9:48:07 PM
Rank: Newbie

Groups: Registered Users, Subscribers

Joined: 12/20/2010
Posts: 1

 If i know the seed via efilive, then will remove the chip and read it, can I know the key?

VN05L
#11 Posted : Thursday, April 07, 2011 11:57:20 PM
Rank: Newbie

Groups: Registered Users, Subscribers

Joined: 4/7/2011
Posts: 1

Hey

Just wondering if the BDM has been connected and tested to the LS1 PCM yet to allow direct read and write ?

Very interested in it as taken the chip on and off is a pain.

John L
#12 Posted : Tuesday, August 16, 2011 5:25:07 PM
Rank: Newbie

Groups: Registered Users, Subscribers

Joined: 10/22/2008
Posts: 1

VN05L wrote:

Hey

Just wondering if the BDM has been connected and tested to the LS1 PCM yet to allow direct read and write ?

Very interested in it as taken the chip on and off is a pain.

I bought a BDM, made up a jig per Rogers wiring post it did not work, if others have got it working they are not saying. Back to lifting the chip!

Users browsing this topic
Guest (2)
Forum Jump  
You cannot post new topics in this forum.
You cannot reply to topics in this forum.
You cannot delete your posts in this forum.
You cannot edit your posts in this forum.
You cannot create polls in this forum.
You cannot vote in polls in this forum.

Information is provided as is and no assumption should be made of its accuracy. Use this information at your own risk. Digital Inflection Corporation provides not warranties or guaranties and is will not be liable for information contained on this site. If you do not agree with these terms than please do not use this site or information it contains.  Please see the terms of use statement for additional restrictions.