Print Page - Siemens SIM4LE bootmode. Read failure

Title: Siemens SIM4LE bootmode. Read failure
Post by: PVTech on May 20, 2015, 03:28:31 PM

Hi there,

I am trying to read a SIM4LE ecu in bootmode. The processor is SAK-C167CS-LM and the flash is AM29F400BB.

I am using this photo as a guide:
(https://wiki.obdtuning.de/images/8/83/MB_SIM_4LE_Platine1.jpg)
The resistor that i am using is 8.2k soldered to ground and the ECU is on the bench.
The cable that i am using is a blue kkl.
The minimon version that i am using is the latest one, 2233.
While the processor is a C167CS-LM i cant find it in the available processors in the minimon so i choose the C167CR one.

The reply that i get from minimon when i try to connect is this:

Code:

*Loader file Prepare
*Minimon file Prepare
*send Byte  0+ Loader + MinimonCore
*RECEIVE - MC-Identifier: D5
*RECEIVE - LoaderACK 01 received
*ERROR: No Minimon Byte received (Minimon not successful)

Can you please help me on that? I am only interested in reading the external flash chip only because the address and data lines are scrambled so reading it using a willem doesnt provide usable data and code.

Regards

Title: Re: Siemens SIM4LE bootmode. Read failure
Post by: PVTech on May 20, 2015, 05:13:12 PM

Ok i have a small update.

Finally i managed to connect with the ECU in boot mode. The reply that i get in minimon is this :

Code:

*Loader file Prepare
*Minimon file Prepare
*send Byte  0+ Loader + MinimonCore
*RECEIVE - MC-Identifier: D5
*RECEIVE - LoaderACK 01 received
*RECEIVE - Minimon ACK 03 received
*Minimon successfully launched
*Reset: BUSCON0=0680
*Reset: SYSCON=0400
*Reset Configuration: External Bus enabled
*Reset Configuration: 16 Bit demultiplexed Bus
*Reset Configuration: WR# and BHE# retain their normal function (P0H.0=0)
*Reset Configuration: On chip watchdog timer is disabled (RD#=0)
*Reset Configuration: Lengthened ALE signal

Then i try to add a selection and then press upload. This is where it takes a while to get a reply like this :

Code:

*ERROR: no data received

It doesnt matter what address selections i try, it always gets the same reply. Anyway that i can sort this out?

Title: Re: Siemens SIM4LE bootmode. Read failure
Post by: f1torrents on May 23, 2015, 02:31:27 AM

You can always remove the chip and read it externally.

Title: Re: Siemens SIM4LE bootmode. Read failure
Post by: PVTech on May 23, 2015, 08:48:19 AM

Quote from: f1torrents on May 23, 2015, 02:31:27 AM

You can always remove the chip and read it externally.

Yes but that would give me a line swapped binary file. This ECU has line swapping in the data and address lines.
I want a correct binary file to disassemble in IDApro, find maps and/or add code features to it.

Title: Re: Siemens SIM4LE bootmode. Read failure
Post by: prj on May 23, 2015, 12:56:59 PM

You know how to disassemble, but you don't know how to lineswap it back to normal ???

Title: Re: Siemens SIM4LE bootmode. Read failure
Post by: daniel2345 on May 23, 2015, 02:11:30 PM

Yeah, and he knows how to add features to bin, too.

What a pitty, that this ecu got such a hard "protection" :D

Title: Re: Siemens SIM4LE bootmode. Read failure
Post by: PVTech on May 25, 2015, 10:01:18 AM

Quote from: daniel2345 on May 23, 2015, 02:11:30 PM

Yeah, and he knows how to add features to bin, too.

What a pitty, that this ecu got such a hard "protection" :D

Ha!!!

I never said anything like hard "protection"!
The fact that i haven't used minimon before, does that mean that the protection is hard?
And yes of course i know how to add new features in a code, i am doing it the last couple years in motorcycle and other offroad ECUs.

Quote

You know how to disassemble, but you don't know how to lineswap it back to normal Huh

I never said that i dont know how to lineswap it back to normal.
I just wanted to use minimon on this one and read the contents of the ECU that i have in my hands and not a binary that i found somewhere on the internet.
You can also use WinOLS to turn a lineswapped binary back to normal.

And yes i have proper legal versions of both IDApro and WinOLS, since i am a professional and i like using genuine legal tools to help me put food on the family table.

So instead of trying to judge, try to give some help to someone that asks for it.

At the end i desoldered the flash and read it with my batronix.
But i would really like some help on minimom as i would like to make it work with this ECU. If you are willing to help, then please do help. I can give more details on this issue.

Oh and by the way daniel2345, can you please tell me why i dont get any notifications for the replies from this forum? Ah yes i have checked the "Notify me of replies" and the email address is valid. I just thought to ask you since you seem to know a lot...

Title: Re: Siemens SIM4LE bootmode. Read failure
Post by: daniel2345 on May 25, 2015, 10:45:17 AM

I know some on specific ecus, not about forum stuff ;)

Minimon is not working as it should, because the values for bus configuration, timings, memory layout,... are not set right.

One idea is always to look on similar original file and find the place where all this is set.

Note down all and edit minimon configuration like that. Should be easy, when you know ida.

Title: Re: Siemens SIM4LE bootmode. Read failure
Post by: PVTech on May 25, 2015, 11:17:54 AM

Quote from: daniel2345 on May 25, 2015, 10:45:17 AM

Now this is the reply that i was expecting in the first place.

Here is how i set the settings in minimon from the disassembly in IDA.

Code:

mov     CP, #0F200h
nop
mov     DPP0, #22h ; '"'
; assume dpp0: 22h (page 0x88000)
mov     DPP1, #2Ch ; ','
; assume dpp1: 2Ch (page 0xB0000)
mov     DPP2, #23h ; '#'
; assume dpp2: 23h (page 0x8C000)
extr    #1
mov     XPERCON, #0C03h
bfldh   SYSCON, #0FFh, #0E3h
bfldl   SYSCON, #0FFh, #0Eh
mov     ADDRSEL1, #1008h 
mov     ADDRSEL2, #880h 
mov     ADDRSEL3, #180h 
mov     ADDRSEL4, #0FFF0h
bfldh   BUSCON0, #0FFh, #44h
bfldl   BUSCON0, #0FFh, #0BFh
bfldh   BUSCON1, #0FFh, #84h
bfldl   BUSCON1, #0FFh, #8Eh
bfldh   BUSCON2, #0FFh, #4
bfldl   BUSCON2, #0FFh, #2Eh
bfldh   BUSCON3, #0FFh, #84h
bfldl   BUSCON3, #0FFh, #0AFh
bfldh   BUSCON4, #0FFh, #4
bfldl   BUSCON4, #0FFh, #2Eh
extr    #1
mov     PICON, #0CFh ; '_'
mov     STKOV, #0F220h
mov     STKUN, #0F2BCh
mov     SP, #0F2BCh
einit

I set the exact same values in the exact same order and here is where i am stuck now.
At first i have to say that i am working on a Win8.1 64 bit system, but results are the same on WinXP also.
Minimon is really slow. The only baud rate that it can communicate is 57600.
After it gets a proper reply from the ECU it starts writing to the system registers. This process is really slow.
When setting the SYSCON it says that it failed to get a reply from the mcu.
On the other registers i get no error but it takes like one minute to set all the registers. I would expect it to do it in a couple seconds but it takes almost a minute, maybe more.
I think that the problem is that i dont pull the P0L4 the correct way. I have tried using a 8k resistor and without a resistor. I pull it down first and then power on the ECU. Minimon can init after a couple tries. Should i pull the P0L4 without a resistor, power on, connect with minimon and let the P0L4 floating? I read the datasheet a few times but it is not really clear to me.

Title: Re: Siemens SIM4LE bootmode. Read failure
Post by: crackerx on December 16, 2020, 01:16:13 AM

hello

i try to read this ecu with MPPS generic boot . fgtech boot mode etc and no succes

i need the correct procedure for boot mode this ecu

Many Thanks

Title: Re: Siemens SIM4LE bootmode. Read failure
Post by: bogolepov on April 10, 2021, 12:37:26 AM

Hello. Now I have SIM4LKE (Have different with SIM4LE) on table. Read OK with Galletto v54 . But I noticed the oddity. If i puldown P0L4 , than power on the ECU , than try read - i have bad , not correct readed file.
If i puldown P0L4 , than power on the ECU, than remove pull down - I have normal readed file. For read I use VAG ME7 BOOT MODE 29f800.
But I can not write file. I always have write error on 1% and have no change in file (i read it after attempwritting) . If I write readed file - all ok

NefMoto

Technical => Reverse Engineering => Topic started by: PVTech on May 20, 2015, 03:28:31 PM