If I turn on the voltage for both pin 3 and 62 at the same while the boot pin is grounded, the ECU will boot in normal mode.

If voltage is turned on for pin 3 (while pin 62 already powered) and the boot pin is grounded, the ECU boots up but is not able to connect in normal or boot mode (with any software).

I will try using P.0L4 pin directly thru 8k resistor next time.
If that does not work I will try without the resistor.

Hi,

Did you try normal mode, in MPPS ? Thus no bootmode, but straight reading ?

That must work... 

On the bench and in the car. Hope you can try this out, and report back please.

PvL

Always read the updates on this topic.
You ll desolder the eeprom and flash? Or read them on board?

Keep trying i wish you to solve the problem.

Did some reading on the full version of Siemens C167 datasheet.

There are other conditions that must be met in order to launch the BSL mode (properly).

The CPU has a "Special Operations Mode" (SMOD) which is controlled via P0L.2, P0L.3, P0L.4, P0L.5.
During hardware reset the CPU monitors signal levels on these pins (HI/LO).

For normal start mode all of the signals should be set HI during hardware reset:


For SBL mode the signals should be set as follows (exactly what has been done during all these years):


The CPU sees signal being low if P0L.x -> Vss = 8k ohms (lower seems to work too).

However these two modes (normal & SBL) are the only modes that the CPU supports.
Any other P0L.2 - P0L.5 combinations can cause "undefined behaviour and should not be used" (according to the datasheet).

I made some measurements directly from the pins of the CPU and everything looks fine.
In power down mode the CPU is strapped to start in normal mode (P0L.2-5 are set to high; 4.6M - Vss).
Since this is obviously the case during power up I checked if altering the resistance between P0L.4 and Vss also alters the resistance on any other P0L.x pins, i.e pulls the low: -> Nope.

After this one was a dead-end I started tracking the pcb traces to see if there is any component which could pull any of P0L.2, P0L.3, P0L.5 signals low in case P0L.4 is being pulled low. The only chip on the PCB which has connection to all of the P0L.x signals (besides the C167 and AM29F800 flash) is the Bosch 30380 IC. This chip also has some kind of reset controlling feature for the CPU so it might well be behind all of the hassle.

Can anyone check the codes written on Bosch 30380 IC from a ECU with boot mode working properly?

Hi Nottingham,

About that ecu you have...  06A906032RP ...  I might have an interesting piece of info about it.

Did you already desoldered the flashrom, and read it out via the GQ ?  Ifnot, it might not be needed
to check one thing. I have a UK-mate that wanted to help a friend with his S3 to tune it. I helped
him out via teamviewer-session and via mpps we where able to read the thing, like normal. Well
the thing really wanted 13.5 volts to get a stable read, and the dashfuse pulled. Then we tried to
write the tune to it. That was a no-go. Then i looked to the read-out code. And i saw : REVO (C).

It was a 'reverted to stock' demotune. What the buggers of Revo do (and perhaps also APR) is blocking
ALL write-options, via OBD AND bootmode. Even when the ecu is pulled you can't communicate via
K-line to get some diags going via vagcom !!! The ecu is not findable !  (on the bench, via benchflashlead).

We tried bootmode, with nefmoto and mpps : no go.  So therefore i suspect you have a reverted trial
in yours. And user 'professor' might be having the same issue !!.

My friend's brother that works @ a revo-dealer, told him that they block the bootmode and only their
tool is able to revert it back to real original stock back. So that might be your case.

You can try it out, reconnecting the ecu to the car, undoing the dashfuse (clocks go numb), and be sure you
have 13.5 volts reading in the lower left corner of mpps screen.

Then all should be fine to read-out. 

Would be nice if you could tell us forumpeeps if you succeeded. 
Ifnot, try it with dashfuse in place. But one thing is really needed : proper battery+tricklecharger power !! 

Not only the flashrom is modified b.t.w.  Also the e2p 95040 immo-chip. Therefore it's such a nightmare
without solderingtools or Reveo themselves cleaning up their mess, to program a reverted or revo tuned
ecu.

Cheers,

PvL

Hopefully, like the stated S3 in previous message from me, the car is readable when the ecu is in the car.
By afterwards comparing the read-out to the original file (if available on the net) it becomes clear that
it has modified software inside.

@ KLS:  it is theorethically very nice to post info, but in reality things may differ a bit. Let's hope Nottingham
is able to read it out in his car like we did with the audi S3, and show the same we encountered.

If you have a alternative method to bypass this REVO protection against bootmode (and perhaps APR uses the
same way), you are welcome to say so.

Oh and another thing : NO communication whatsoever was possible when the ecu was taken out of the
car and putted on the workbench, and hooked-up via a benchflash lead. It was playing 'dead' like o.p. Nottingham
and forummember 'professor' have encountered.

But once placed-back in the car, all was normally working ?!?!?

B.T.W. if other forummembers have a non-soldering solution for this, do chime-in please. All help is welcome.

PvL

correct, thats all there is too it.. there is no "MAGIC super-protection" preventing this, it is just not possible tp prevent.
find/write an own bootloader that dumps the contents of the EEPROM and flash into 2 files on the computer, NO other code is run but your own.. surely the cpu is set in bootmode, but the tools you are using are specifically blocked.(galetto etc).

the only way to disable bootmode is to desolder the cpu, trash it, order a new cpu, program it with different instructions and solder it in place, and no need to tell you this has NOT been done to these ECUs.

what IS possible is a hardware scrambler solderd between the flash/eeprom and the chip, but you should be able to identify this one pretty easy just by looking at it.. im not aware of any chips with built in scrambler.. yet.. but you would easily see if the chips have been desolderd/swapped or not.

the flash and eeprom chips, are them the same sizes as the oem chips? i remember a protection beeing written for earlier bosch ecus, which filled the normal prom with crap, like "REVO REVO REVO..." and then after the normal code-space the new code was placed.. with a simple remap for the ecu to start reading at the second place.. the ecu does support larger flash/proms with the same pinout.. just a thought.

keep trying, im sure you will figure it out eventually =)
would love to get my hands on one of these ecus myself for some testing =)