|
- UID
- 805450
|
本帖最后由 HotCat 于 2010-1-18 16:56 编辑
本人是菜鸟，为了玩汽车外挂电脑调喷油，上了飞思卡尔的贼船。用的TBDML + codewarrior 5.0，上星期下载程序，无意间把地址0xff0f地址当成了向量地址，程序一烧上去，BDM就提示连不上了。在论坛上找了好多资料，说是被锁上了，在win7下按照步骤解锁一次都没有成功，气得吐血。拿到卖板子的地方去搞，他们也是搞了好久才搞好，折腾半天，还怀疑过板子有问题。我拿回来换XP，把芯片锁了后再unsecure，居然不是每次都能成功，有时候成功，有时候失败。这个问题不解决以后还怎么玩呢，毕竟是用在汽车发动机上的东西，不能乱来啊。还好我是搞软件的，拿出bus hound分析PC和TBDML的通讯协议，然后在tbdml.dll源代码基础上改一改，居然很好用。在win7下程序执行不到2秒钟unsecure就完成了。现在把部分代码贴上来-
- int main()
- {
- int devs;
- tbdml_usb_init();
- devs = tbdml_init();
- printf("tbdml_init, found %d devices\n", devs);
- if(!devs)
- return 0;
- tbdml_open(0);
- // set target 0x1e
- tbdml_set_target_type(0);
- // get target speed
- tbdml_target_sync();
- // set bdm interface bit rate
- tbdml_set_speed(16.00);
- // reset to special mode
- tbdml_target_reset(0);
- // get target speed
- tbdml_get_speed();
- // disable cop
- tbdml_write_byte(0x3c, 0);
- tbdml_write_byte(0x100, 0x11); // clock divider
- tbdml_write_byte(0x106, 0x30); // clear any error flags
- tbdml_write_byte(0x102, 0x00); // CCOBIX = 0
- tbdml_write_byte(0x10a, 0x08); // 0x08 Erase All Blocks
- tbdml_write_byte(0x106, 0x80); // launch command
- Sleep(1000);
- tbdml_write_byte(0x100, 0x11); // clock divider
- tbdml_write_byte(0x106, 0x30); // clear any error flags
- tbdml_write_byte(0x102, 0x00); // CCOBIX = 0
- tbdml_write_byte(0x10a, 0x06); // 0x06 Program P-Flash
- tbdml_write_byte(0x10b, 0x7f); // identify P-Flash
- tbdml_write_byte(0x102, 0x01); // CCOBIX = 1
- tbdml_write_byte(0x10a, 0xff); // P-Flash address hi
- tbdml_write_byte(0x10b, 0x08); // P-Flash address lo
- tbdml_write_byte(0x102, 0x02); // CCOBIX = 2
- tbdml_write_byte(0x10a, 0xff); // Word 0 program value hi
- tbdml_write_byte(0x10b, 0xff); // Word 0 program value lo
- tbdml_write_byte(0x102, 0x03); // CCOBIX = 3
- tbdml_write_byte(0x10a, 0xff); // Word 1 program value hi
- tbdml_write_byte(0x10b, 0xff); // Word 1 program value lo
- tbdml_write_byte(0x102, 0x04); // CCOBIX = 4
- tbdml_write_byte(0x10a, 0xff); // Word 2 program value hi
- tbdml_write_byte(0x10b, 0xff); // Word 2 program value lo
- tbdml_write_byte(0x102, 0x05); // CCOBIX = 5
- tbdml_write_byte(0x10a, 0xff); // Word 3 program value hi
- tbdml_write_byte(0x10b, 0xfe); // Flash Options/Security Byte
- tbdml_write_byte(0x106, 0x80); // launch command
- return 0;
- }
tbdml_set_target_type(0)
tbdml_target_sync()
tbdml_set_speed(16.00);
都会返回失败，不用理它，继续执行
当然这段代码是假设没有对Flash进行保护，如果Flash高地址被保护了，就需要先去掉保护，然后再mass erase。具体操作请参见AN2400，里面对Flash操作讲得很详细
另外编译的时候要用MingW+mSYS来编译，我是偷懒直接在libusb源代码的Makefile文件上改了改把要编译的代码加进去。我试过用VC2005调用libusb老是symbol有问题，一调用usb函数内存就崩了。
附件是libusb + tbdml源码，我是在tbdml源码上改的，在tests\tbdml目录下，然后修改了主Makefile，有MingW+mSYS环境的话就直接make，完了后在Makefile目录下生成tbdml.exe
 libusb-win32-src-0.1.12.2.rar (155.77 KB)
|
-
1
评分次数
-
|
