my ECU bricked

[justatroll]

Originally Posted by aagun

Yes, I already know that the Microcontroller has JTAG, I was wondering if it was brought out to a header where we can just plug a ribbon cable into it.

Originally Posted by steve99

This would certiany be worth investigating. However the problem appears to be that when people flash bad code to the user rom area the sh72531 processor becomes unresponsive and no longet "talks" to any interfaces other than the low level serial interface ( sh boot mode). It seems to be poor coding of the watchdog or something and you dont seems to be able to get it to go to the boot rom which should save you by removing and restoring power. Somtimes this will work and somtimes it doesnot, it appears dependant on the corruption or coding error in the user rom.

If the user rom is completly corrupt non existant and checksum is wrong you can usually recover with a power off on reset and reflash.

If the rom flashed correctly and checksum is correct but code is bad and send processor into loop or some strange state then you dont appear to be able to recover with power off on and for some reason the watchdog does not seem to recover the processor. Or maybe it does and its resetting the thing so often you dont get a chance to talk to it via obd port.

Untill somone bench tests one and looks at all the signals its all speculation

The ability through JTAG varies with products (I dont know this processor at all), but with the processors at work, we have the ability to completely halt the CPU and muck around with the memory and the processor registers, then either restart or continue.

If you had that ability, you could probably even just overwrite the bad CRC with a good one and reboot to fix it.

I skimmed the JTAG section for the SH72531 and it looks pretty rudimentary though. There is probably a 'white paper' or users manual for how to start up the JTAG on this and what the capability is.

[steve99]

Originally Posted by justatroll

Yes, I already know that the Microcontroller has JTAG, I was wondering if it was brought out to a header where we can just plug a ribbon cable into it.



The ability through JTAG varies with products (I dont know this processor at all), but with the processors at work, we have the ability to completely halt the CPU and muck around with the memory and the processor registers, then either restart or continue.

If you had that ability, you could probably even just overwrite the bad CRC with a good one and reboot to fix it.

I skimmed the JTAG section for the SH72531 and it looks pretty rudimentary though. There is probably a 'white paper' or users manual for how to start up the JTAG on this and what the capability is.

Thanks :-)

The Jtag is definitly not brought out to a header theirs no connection points on ecu other that the connections to car wiring unfortunately and its all very compact surface mount components so not easy to access.




https://www.dropbox.com/s/pa9vigy3ot...14_NT.jpg?dl=0

https://www.dropbox.com/s/oh05oy902w...56_NT.jpg?dl=0

[steve99]

Originally Posted by aagun

@steve99
thx for helping


i am not give up form old ecu . i know alot of ppl wanna unbrick sh72531 ecm
and there are many rom devrs can't hijack anything coz of bricks .


thx alot

Talk to @ztan if you can I think he got his bricked ecu working to point where he could use it for software testing but not in car.


so he used the damaged ecu for testing/flash of new software to test before using software in his car ecu.

[vgi]

Originally Posted by steve99

Yes sh boot mode allows you to re-write both areas but the problem is no one has sucessfully read the boot area it has more protection than the standard user area. this is the 0000-7ffff which is just padding in the roms we use as we dont write back this area we start at 8000-13ffff.
when you use sh boot mode you need the actual data from 0000-7ffff which no one has, the tactrix guys were working on reading the boot area.

steve, not sure why you quoted my post as you're writing again the same info you had written before (minus the part i quoted, the one that made me cringe)?

i merely suggested to get information from people that wrote the tool (which would be used - EcuFlash) and can provide 100% correct and current answer versus getting rumors, assumptions, have herd somewhere from someone that also herd it somewhere from someone.., or simply stale info. it's common sense which for some reason escapes people.

eg, let's take your post, here's a quote from it: "but the problem is no one has sucessfully read the boot area" - you lay it out as a fact, 100% correct, no doubts whatsoever that no one in the whole world is able to read the boot area of that ECU. may i ask how you know that, where did you get that information from? Denso and its engineers aside, do you know all developers that are working on hacking ECU from all the companies that provide tuning solutions like EcuTek, EceFlash, FlashEdit, etc and got all that information from them at the time of your posting (latest info)? even assuming all the above, that's already "yesterday's news" as today someone might have hacked it.

[steve99]

Originally Posted by vgi

steve, not sure why you quoted my post as you're writing again the same info you had written before (minus the part i quoted, the one that made me cringe)?

i merely suggested to get information from people that wrote the tool (which would be used - EcuFlash) and can provide 100% correct and current answer versus getting rumors, assumptions, have herd somewhere from someone that also herd it somewhere from someone.., or simply stale info. it's common sense which for some reason escapes people.

eg, let's take your post, here's a quote from it: "but the problem is no one has sucessfully read the boot area" - you lay it out as a fact, 100% correct, no doubts whatsoever that no one in the whole world is able to read the boot area of that ECU. may i ask how you know that, where did you get that information from? Denso and its engineers aside, do you know all developers that are working on hacking ECU from all the companies that provide tuning solutions like EcuTek, EceFlash, FlashEdit, etc and got all that information from them at the time of your posting (latest info)? even assuming all the above, that's already "yesterday's news" as today someone might have hacked it.

ok misunderstood what you were asking sorry.

I did talk to the ecuflash/tactrix guys before xmas and they are still working on reading that area. Ecutek do have a ecu recovery service but you send ecu to them and i suspect it would be ecutek customers only, i doubt they would give away the info though.

hopefully someone will read it soon.

[vgi]

Originally Posted by steve99

ok misunderstood what you were asking sorry.

I did talk to the ecuflash/tactrix guys before xmas and they are still working on reading that area. Ecutek do have a ecu recovery service but you send ecu to them and i suspect it would be ecutek customers only, i doubt they would give away the info though.

hopefully someone will read it soon.

lol that's for sure they wouldn't

[aagun]

may help