|
H2Deetoo
|
 |
« on: December 12, 2015, 02:37:21 AM »
|
|
|
Hi guys,
Did any of you ever work on the Tricore bootmode canbus protocol?
Is there any public info available?
I made a first log attempt (500kb/s 11bit CANID) which shows some data but can't make much sense of it yet.
For example the CANID always is 555h so doesn't look correct ..
555 [8] 31 00 04 00 00 00 00 D0
555 [4] 41 80 82 04
555 [8] 31 00 04 00 04 00 00 D0
555 [4] 46 A0 B3 E4
555 [8] 31 00 04 00 08 00 00 D0
555 [4] 82 06 00 10
555 [8] 31 00 04 00 0C 00 00 D0
555 [4] 24 1C 00 00
555 [8] 33 00 40 01 00 00 00 D4
555 [8] 40 BC 5D 00 0F 00 11 00
555 [8] 00 00 00 00 00 00 00 00
555 [8] 00 00 00 00 10 20 00 F8
555 [8] 08 20 00 F8 54 55 00 A0
555 [8] 49 BE 3A FA DF 10 3D 80
...
I am curious for example how the PASSWORD transaction is done.
Regards,
H2Deetoo
|
|
|
|
|
Logged
|
|
|
|
ozzy_rp
Jr. Member
Karma: +16/-1
 Offline
Posts: 49
|
|
« Reply #1 on: December 13, 2015, 07:27:52 AM »
|
|
|
Official information from Infineon
|
|
|
|
|
Logged
|
|
|
|
|
H2Deetoo
|
|
« Reply #2 on: December 13, 2015, 09:51:04 AM »
|
|
|
Thanks, I found and read this document already but it doesn't match up to the log I made :-/
Rgs Bonny
|
|
|
|
|
Logged
|
|
|
|
ozzy_rp
Jr. Member
Karma: +16/-1
Offline
Posts: 49
|
|
« Reply #3 on: December 13, 2015, 01:15:21 PM »
|
|
|
With which TriCore processor you work?
|
|
|
|
|
Logged
|
|
|
|
|
H2Deetoo
|
|
« Reply #4 on: December 14, 2015, 02:01:32 AM »
|
|
|
EDC17CP14 TC1796
|
|
|
|
|
Logged
|
|
|
|
|
dream3R
|
|
« Reply #5 on: December 14, 2015, 07:48:47 AM »
|
|
|
does the canid matter?
|
|
|
|
|
Logged
|
|
|
|
|
H2Deetoo
|
|
« Reply #6 on: December 14, 2015, 07:51:28 AM »
|
|
|
According to documentation the CANID should not matter.
|
|
|
|
|
Logged
|
|
|
|
|
dream3R
|
|
« Reply #7 on: December 14, 2015, 07:52:33 AM »
|
|
|
|
|
|
|
|
Logged
|
|
|
|
|
dream3R
|
|
« Reply #8 on: December 14, 2015, 07:56:47 AM »
|
|
|
Some sort of init/handshake protocol?
|
|
|
|
|
Logged
|
|
|
|
|
dream3R
|
|
« Reply #9 on: December 14, 2015, 07:58:36 AM »
|
|
|
|
|
|
|
|
Logged
|
|
|
|
|
H2Deetoo
|
|
« Reply #10 on: December 14, 2015, 10:58:20 AM »
|
|
|
Thanks for the file!
The CANID 0x555 is mentioned in this document, but it still isn't a match to the log I made.
Perhaps there's something wrong/missing in my log, or we miss some vital piece of info ...
Rgs H2Deetoo
|
|
|
|
|
Logged
|
|
|
|
|
dream3R
|
|
« Reply #11 on: December 14, 2015, 11:22:46 AM »
|
|
|
Welcome. Perhaps not exact doc.
|
|
|
|
|
Logged
|
|
|
|
|
H2Deetoo
|
|
« Reply #12 on: December 17, 2015, 04:28:50 AM »
|
|
|
I think my logger is messing up.
I read in the datasheet something about DOMINANT bit being set by mcu, so this might be the reason why some frames aren't showing up in my log.
Anyway I will try different hardware to log now ...
Regards,
H2Deetoo
|
|
|
|
|
Logged
|
|
|
|
|
dream3R
|
|
« Reply #13 on: December 17, 2015, 11:48:50 AM »
|
|
|
I think my logger is messing up.
I read in the datasheet something about DOMINANT bit being set by mcu, so this might be the reason why some frames aren't showing up in my log.
Anyway I will try different hardware to log now ...
Regards,
H2Deetoo
More reading mate, can is well, can and made by Bosch lol. http://www.totalphase.com/support/articles/200472276-CAN-Background |
|
|
|
|
Logged
|
|
|
|
pollux
Newbie
Karma: +1/-0
Offline
Posts: 5
|
|
« Reply #14 on: December 23, 2015, 07:51:53 AM »
|
|
|
You seem to miss the bootloader upload itself and only logged the exchange between the software and the bootloader (apparently reading the MCU ID before preparing for other stuff). The fact that it uses the same CAN ID for requests and response is a simple way to obfuscate a bit the exchanges but it does not matter.
For the password transaction itself, it is well detailed in the Infineon documentation and should not be hard to spot in a bootmode trace.
|
|
|
|
|
Logged
|
|
|
|
|
