MicroHacker Forum

Ursadon wrote: ↑

25 Jan 2020, 18:46

Unfortunately, it is impossible to dump through the CAN bus.
SBL does not support required features. Only via BDM.

Did you analyze it? What do you use to decompile?

Stevebe wrote: ↑

21 Jan 2020, 22:13

FOUND the MOD A B C
A and B are both tied to gnd via 10k
and mod C shares a pin with the BKGD and is tied to VDD with a 10k

With this it should be in "Normal single chip mode, BDM allowed".

P.S. i use SnagIt Pro for described images.

DGAlexandru wrote: ↑

20 Jan 2020, 18:04

Motorola BDM is with BKGD, GND, RESET, VDD

So it's really one single wire for communication?!

Yeah, i knew that this header has the leads for the Debug interface, good job Stevebe!
I'm excited if you manage to restore it this way. Keep us update please. Unfortunately i have less time at the moment, as i loved to assist... damned.

NOTE: I've separated the topic as it now is too different from the original one.keep on going, this is intersting stuff

Yes, you're right guys, it's BDM. steveb did you measure out the MOD-pins to know what operating mode we have? For our sake the designers of the PCB supported two sizes of the chip and soldered the smaller one, so we have excellent measurepoints there to hijack signals :-) But i would also suspect t...

That could absolutely be true. I did not investigate this further, even if i got all kinds of satnav systems here at hand, but too less time, you know
These are only my findings with an MCA.

It would be good if we could share CAN IDs and meanings on behalf of functionality...

If the module is not programmable, it does not react on CAN messages, no matter what you play around with software or interfaces. You already find out that it does not work, so you need to find another way to recover the Flash. There is of course a JTAG but a procedure is needed to rewrite it. Also ...

What i found in my research is that MP3 played from USB (FL Mondeo with S&C) gives titles on ID 4C7 (MM-CAN),
Phone via Bluetooth uses 4C3, 4C6
Radiotext and Navigationtargets comes via 4C1 (MSB is multiplex-index)
Also 4B0 (Bluetooth Musik, multiplex)
4B2+4B3 Station names

Welcome aboard scorpionul22