ZCP DME flash Semi-Successful on Non-ZCP F8X

[packetpilot]

I wonder if the latest packages have the FTDI chip on-board; the earlier rev seems to necessitate a miniwiggler in order to talk to the JTAG, but there is definitely a set of USB mini B contacts (with traces that drop into the matrix) that might lead to the ftdi chip on the other side of the board. In any case, a mini wiggler is en route and I'll have the D+/D- wires soldered to the USB vias relatively soon to find out...

[DD88]

Found this one earlier today, car is built 2014-02-19, plenty of mods.

Full Akrapovic system and custom tune, really nice sound, a lot of burbles and pops


https://instagram.com/p/BFhPi7qBfmf/

[packetpilot]

Originally Posted by DD88

Found this one earlier today, car is built 2014-02-19, plenty of mods.

Full Akrapovic system and custom tune, really nice sound, a lot of burbles and pops


https://instagram.com/p/BFhPi7qBfmf/

Okay, but how is this relevant?

[DD88]

Originally Posted by thisisdave

Okay, but how is this relevant?

Damn, wrong thread. Please ignore.

[packetpilot]

I've sunk into a bit of a hole with my sandbox DME while learning from friends and coworkers how to use multimeters/scopes/logic analyzers, and doing a bit of my own electronics work (like vacuuming the solder glue off the JTAG pads and dropping a j-leg 10-pin connector onto that beast--there's plenty of clearance to leave it on there with the lid back on FWIW).

It's been a lot of fun. Nothing ground-breaking to report as yet, but I'll hopefully be able to successfully do a password read soon and import those into the freely-available Infineon MemTool in conjunction with my DAP miniWiggler.

[packetpilot]

For what it's worth, my thesis at present is that it's wholly possible for folks to avoid spending €1,000 on needlessly bloated solutions with their extraneous boxen and nutty cabling, and can instead spend less than a tenth of that on DigiKey and get what you need to carry out most, if not all, of the same procedures ECU Explorer, K-TAG, and others offer.

[aboulfad]

@thisisdave , are you using your company resources now for a public project btw, what sw will you use to sniff the tprot, that if successful, and is that your used 10mi DME? oh just saw your response above!

[packetpilot]

Originally Posted by aboulfad

@thisisdave , are you using your company resources now for a public project btw, what sw will you use to sniff the tprot, that if successful, and is that your used 10mi DME? oh just saw your response above!

I am indeed using company resources for a personal project, which may well benefit the public. Thankfully I work at a really great company who lets us use resources for personal projects so long as it's not intended for financial gain.
(Edit: this is a great example http://f80.bimmerpost.com/forums/sho....php?t=1263773 )

I do plan to share what I learn and certainly don't plan to sell anything.

[terahertz]

Originally Posted by aboulfad

@thisisdave , are you using your company resources now for a public project btw, what sw will you use to sniff the tprot, that if successful, and is that your used 10mi DME? oh just saw your response above!

TPROT is the password to get into bootmode right? If he's programming over JTAG, he has r/w access to all memory. He should be able to get the TPROT when he dumps the DME, although he doesn't need it to program over the JTAG connection.

I think.

[aboulfad]

yeah not that simple, even if you have JTAG access, it doesn't necessarily mean you can do much, unless you have the right software with the right features to take advantage of the JTAG debugging port. Thats why I asked him what software he's using.

I have developed on embedded specialized chips (DSP) with JTAG debugging, and usually the chip vendor provides the JTAG adapter as well as the debugger. However don't know much about automotive DME processors ! and I just partially answered my question: "Infineon MemTool in conjunction with my DAP miniWiggler"

[packetpilot]

Logic (saelae) should help me get TPROT over CAN and I seemingly have to jump two pins on separate plugs in order to do so (at 120ohm). But that's info for general MEVD 17.2.G... I've found other info for Fxx cars that indicates pins 1 and 5 from JTAG with 1Kohm resistors need to lead... somewhere.

Info has been gleaned from the obdtuning wiki and some Italian PDF. I plan to dedicate more time this evening and next weekend to trying to get TPROT hex over CAN but if anyone has anything useful to share, I'm all ears. :-)

[aboulfad]

Why don't you join forces with su_root, you both seem to have bench'ed your DMEs, with different tools but for similar goals!

[banff]

I guarantee you BMW is watching this thread now haha

[packetpilot]

CAN bitrate for both the TPROT and the DATA buses is 5K, thus bridging the two in order to achieve ACK on the CAN bus is rather straightforward.

It's a bit messy looking, however:







Next step is to bridge 6 and 51 in the following image at 120Ω to see if that has any impact at all...



...or if something needs to be done with pins 1&5 on the OptiCAN/JTAG pins as per this image...

[packetpilot]

BMW's silicon valley tech office is a half mile from my office; I wonder how secure their network is...



There'd be no fun in that though... I'd rather stay on the right side of the law than put on my light grey hat...

[aboulfad]

Maybe they are walking right now to your office with an FBI warrant to search the premises

[packetpilot]

Originally Posted by aboulfad

Maybe they are walking right now to your office with an FBI warrant to search the premises

Ha; I wonder if anything I'm doing here even approaches the limits of legality... I bought a thing; I want to figure out how the thing works; I don't expect this particular thing to ever be a part of my car...

I was once the kid who'd smash chintzy LCD watches between rocks in my mom's flower bed to try and see what made them tick. PCB has always been a mystery to me, and I'm really excited to have gotten some basics down.

But if this--the equivalent of telling people how to disassemble a watch and look at the gears--is bordering on the illegal (there is no IP at stake here; I'm not dumping source code, and wouldn't ever be able to), then I suppose I should move the conversation to the private "flashers" channel in f8x.slack.com... which for now has just been me posting dick pics.

[aboulfad]

I was being silly You bought the thing, it's your property, you can do as you please with it... And speaking of PCBs, when you were breaking those watches I was building my double sided PCBs by hand using acetate traces, perchlorure de fer and a drill back in the eighties, back then SMT didn't exist yet for hobbyists and it was so easy to fix and hook things up!

Your project brings so much memories, I just wish I had your resources to do it too ...