Cas4 5M48H programer

[kisslorand]

Here are my findings so far:
With modded H3 adapter I can now ID the MCU (XEP100), it can bypass security but Codiprog reads 00s or FFs.
I connected the XProg adapter to my Codiprog MK2 interface. It can ID the MCU, it can bypass security. Now comes the fun part, it never reads 00s. I was able to write a backup dump into my CAS4, I was able to read it, to change mileage to 0. After a few tests (maybe 2-3 readings more), it reads only FFs. It started after I had Link error. Maybe my MCU is really erased so it might be only FFs in my MCU. I will do more tests to see if MCU gets erased or it just reads the dump occasionally. One big difference with XProg adapter is that with that adapter Codiprog never reads 00s from CAS4.

Markony can you be more specific about what to change in the Codiprog interface?

Later edit: Twisted pair or coax cable, it doesn't make any difference.

[markony79]

i was have the same problem like you ....read its good, write is good... but after must wait 5-10 minutes to read again, and allways restart the codiprog
if you start reading again directly, not wait 5-10 min, then will get all FF ...the flash is errased and also emulated eprom ,which is part of flash in this MCU,
now i was start learning from ex: freescale

http://cache.freescale.com/files/mic...geType=product

[markony79]

i was talk last days from people there, they give info like this in couple words:
the every 9s12 xgate family have nr ex: 1023,, or 1142...or...what ever..but that its means first 2 nr is year 10 (2010), last 2nr 41 (week in year)

the mcu is made it to 1152 2011 52 weeks, is posible to read and write , but after this nr products, is made it if you try to read its ok...but if you try to write...then can errased all D-flash memory, even if you try to write original dump which you was read before

the solution for this is exist , but they made it only processor out , put in programator and do with can H and L ...liek they do now in an?tomotive industry

i think for our job the solution for this is will be like this:

read original D-flash, save it,
modificated the KM
change the MCU (new one ) , and write it in new MCU

i was order 2 this MCU, and will see (Anyway is cheaper of can blocker ,and if it works can get NEW KM in KEYS, which is with Can blocker is ALLWAYS STAY OLD KM in KEYS)

[markony79]

the calculator for CAS4 5M48H is allready exist, but unfortuanly some one of us still have problem for reading the XEP100

BMW-Explorer

[rukartinatv]

I spoke with usprog owner
he told me the same think.
the solution is to have extra 5m48h
processors.

Kod with codiprog its passable
to read dflash modify the wright dflash only
without to press clear cas4 button?

[markony79]

i never use CLEAR CAS4 button in codiprog.....what this words mean...think

[rukartinatv]

You just choice 9s12xep
then press read modify and wright?

[markony79]

choise to read the flash....if it not open, then modified the software codiprog, from which adress to start and which end adress....see in datasheet for xep100
then use the codiprog....good luck my friend

dont tocuh it if you was dont modified the H3 cable

[markony79]

the strange is for this post is
658 views and only 22 replies

come on people...help with this MCU

[markony79]

if we here get solution for this, then how much money we can save it with can blockers....
i use min 1 -2 every week, and can not give coustomer the garanty.....meny of them will not do job, if the OLD KM stay in KEYS
( i am honest with my coustomers...and charge double )

[Master01]

đđĐđß$đĐßđßđßđđääđłldkf>>;*;ßßߤߤ;>>;>ßߤ]$ß$÷÷×ßß]¤¤¤]ß$$[ß[¤ĐĐß[ß...

[kisslorand]

I tested today Codiprog all day long. I could not write it, not even once!
Markony, can you please specify what mods have you done? On my H3 adapter I inserted a 30 ohm resistor to XCLKS, changed capacitor to 106 and inserted a diode before the 33 ohm resistor of Extal and GND (like on the XProg BDM adapter). On my Codiprog interface the logical ICs are ON Semiconductors, I guess they are quality ones (74AC125N, 74HC244 and 74HC06). What components did you change in your Codiprog interface?

i never use CLEAR CAS4 button in codiprog.....what this words mean...think

CAS4 Clear means it will put the mileage to 0, I tested it. It reads the D Flash, saves a backup and writes the D Flash back with 0Km.

Later edit: Codiprog is not good to clone/replace 5M48H, it can read/write only D Flash, P Flash cannot be done with it.

[raf0468]

sorry cant elaborate due to lack of knowledge im one of the 658......but sounds all intresting keep up the good work!!!

[yugo45]

Markony where do you find this date of production.
Is it on MCU ?

[kisslorand]

Production date is written on the MCU (last 4 digits under the "5M48H" mask).