Pages: 1 2 [3]
Author Topic: dump decrypted file through encryption board?  (Read 36354 times)
tonyM
Newbie
*

Karma: +2/-0
Offline Offline

Posts: 10


« Reply #30 on: September 01, 2012, 12:27:17 PM »

I found useful info rearding discussed problem here: http://www.keil.com/forum/20221/

To prove this, on a dissasembled ECU, I routed the data lines between C167-proc and AMD-flash. Here is the result:
C167CR-LMAMD29F200BB
AD0DQ4
AD1DQ12
AD2DQ5
AD3DQ13
AD4DQ6
AD5DQ14
AD6DQ7
AD7DQ15
AD8DQ11
AD9DQ3
AD10DQ10
AD11DQ2
AD12DQ9
AD13DQ1
AD14DQ8
AD15DQ0

So, the problem with write/erase fails is that the data lines are crossed (for routing simplification): when the C167 "wants" to write the "sequences" (see the AMD datasheet), the memory doesen't see the right values.

Actually, this problem is well known in Siemens automotive ECU units.

For example, in some cases you must write "44h" on the proc side, if you want the memory to see part of the unlock sequence "A0h".

So, I have to rewrite (and recompile) the minimon driver in order to correct the memory patterns.

Progs as WinOls and ECM2001 have integated option to code/decode dumps BIN<->SIE, due to swapped data lines.

For comparision, find two attached files: one is in-circuit read with Minimon, the other is read by eeprom programmer (flash chip desoldered).

Could someone help me to write a new driver for AMD29F200BB and AMD29F400BB, which will work in the case with swapped data lines?

Thanks.
Logged
redtop
Jr. Member
**

Karma: +5/-0
Offline Offline

Posts: 44


« Reply #31 on: August 28, 2014, 05:15:51 AM »

I have dumped chips in encryption sockets by reading them through the ecu using boot mode and KWP2000.

I tried putting the encryption socket into my eeprom reader and I got garbage.

Lifting old thread!

I take it that you can use a suitable ECU in boot mode to read any EPROM from any ecu if you use boot mode, since the ECU will not use the code in the EPROM at all when booting in boot mode?

Then, what ECU would be suitable to read a 27c256 chip? Could you even use a ECU that normally holds a 27c512 chip?
Logged
Pages: 1 2 [3]
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.017 seconds with 18 queries. (Pretty URLs adds 0s, 0q)