MicroHacker Forum

4.3.3 Unsecuring the Microcontroller

In order to unsecure the microcontroller, the internal FLASH and EEPROM must be erased. This can be done through an external program in expanded mode or via a .sequence of BDM commands. Unsecuring is also possible via the Backdoor Key Access. Refer to Flash Block Guide for details.

Once the user has erased the FLASH and EEPROM, the part can be reset into special single chip mode. This invokes a program that verifies the erasure of the internal FLASH and EEPROM. Once this program completes, the user can erase and program the FLASH security bits to the unsecured state. This is generally done through the BDM, but the user could also change to expanded mode (by writing the mode bits through the BDM) and jumping to an external program (again through BDM commands). Note that if the part goes through a reset before the security bits are reprogrammed to the unsecure state, the part will be secured again.

Stevebe wrote: ↑21 Jan 2020, 22:13 FOUND the MOD A B C
A and B are both tied to gnd via 10k
and mod C shares a pin with the BKGD and is tied to VDD with a 10k

With this it should be in "Normal single chip mode, BDM allowed".

P.S. i use SnagIt Pro for described images.

Usually these Motorola MCUs are not locked in Ford modules. Also, you don't need to play with the configuration pins.
Just connect BDM programmer and read / flash the MCU.

DGAlexandru wrote: ↑22 Jan 2020, 07:10 Usually these Motorola MCUs are not locked in Ford modules. Also, you don't need to play with the configuration pins.
Just connect BDM programmer and read / flash the MCU.

Yes your right it seems to be open book, making progress but my BDM100 is a bad clone and software keeps crashing,
I have found a few more tips on getting these BDM units working will see if I can get any further

BDM100 usually is used for ECU / PCM that have MOTOROLA MPC5xx MCUs. I don't think you can use it for Motorola HC 912 / 9S12 MCUs

You need something like:
https://www.abkeys.com/abk-1097-etl-mot ... mmobilizer
http://www.obd2shop.co.uk/wholesale/cg- ... ammer.html
https://detail.en.china.cn/provide/p150816470.html

DGAlexandru wrote: ↑25 Jan 2020, 19:46 BDM100 usually is used for ECU / PCM that have MOTOROLA MPC5xx MCUs. I don't thin you can use it for Motorola HC 912 / 9S12 MCUs

You need something like:
https://www.abkeys.com/abk-1097-etl-mot ... mmobilizer
http://www.obd2shop.co.uk/wholesale/cg- ... ammer.html
https://detail.en.china.cn/provide/p150816470.html

I have got the cg pro on order CG Pro 9S12 Features: Support Freescale 705 series
Support Freescale 908 series
Support Freescale 711 series
Support Freescale 912 series
Support Freescale 9S12 series
Support NEC V850 series
Supports engine computer change and ISN read
Support automatic conversion BMW, Mercedes-Benz kilometers
Support BMW key programming

managed to read Pam
see video



https://youtu.be/O5j3fqqVfH8
Ok guys I need the eeprom an d flash files from pre face middd and facelife,, if you send me you pam I will read code and return
For all you trouble I fill blue LEDs to your converse

Share your dump here in order for us to try to understand what happened.

DGAlexandru wrote: ↑30 Jan 2020, 06:02 Share your dump here in order for us to try to understand what happened.

Will do later I just got to bed at 07;00 been working at it all night there files are well messed up the eeprom could be crypted
Or it’s well messed up.
I need to take the working pam of my motor and read flash and eeprom

DGAlexandru wrote: ↑30 Jan 2020, 06:02 Share your dump here in order for us to try to understand what happened.