E39A CAN, BAM,JTAG explained.

[00:00:03]This is an ECU E39A.

[00:00:07]And when it's working, we should be able to program this device through the canvas on these two connectors here. So when the unit uh paired with this board, I just need to connect the CAN high and CAN low to here.

[00:00:28]And then we need to connect the 12 pins.

[00:00:32]12 volt.

[00:00:35]This is 12 volt.

[00:00:38]And then the ground.

[00:00:43]Then I am powering on the uh USB. Power on the ECU.

[00:00:50]Go to software. We can check the ECU info.

[00:00:55]We one more time. And the spin number are there. The very first thing to for any ECU programming is always back up the original one just in case we have something bad, we need to uh recover it.

[00:01:07]So the first thing to do is we read the entire flash. So click here. This will put the ECU into the debugger on mode and start backing up the ECU.

[00:01:22]So finish the reading.

[00:01:29]Let's save this file.

[00:01:33]It is also important to read the shadow as well. Um because this is used when the issue get bricked then you can recover it.

[00:01:43]So here we read the shadow. So this is its password when we need to do the boot assistant mode and this is also its censorship word. Uh these censorship word tells the this ECU can only do the boot assist mode. The JTAG is disabled.

[00:02:00]I'm going to later on show you how to enable the JTAG. Uh currently we just save the the shadow as well as the flash. We can also verify the uh regular we verify the entire flash. And currently we we have good read. Now I'm going to do a programming but in instead of do a full programming I'm going to uh break it. The way I break it is I'm going to erase the flash. So I'm going to click the star here and going to erase the flash.

[00:02:36]So now it is uh it is erased and let's just trying to see if it's erased properly. We can do uh verify.

[00:02:47]Yeah. So everything is erased. Now if I do power cycle again, power off. You can see the debugger is off now. And I'm going to power on again.

[00:02:59]And let's see if we can read the EC info.

[00:03:02]No, nothing happens. We can power on the USB and see if we can enter debug on.

[00:03:09]Can't. This ECU is break into a lot of eyes and the only way you can recover it now is through the boot assist mode.

[00:03:18]Even J-Tech will not work. Okay. So now I'm going to take off and look at the inside of the board and we are going to select the target here called um E39A.

[00:03:38]Bam.

[00:03:40]And let's point to the the folder this folder here. And the pin out connection is in here.

[00:03:57]So give me some time. I'm going to do the solderings here. Wire these wires and I can show you how I connected this one to do the Buddha system mode programming.

[00:04:06]This is the back of the ECU E39A.

[00:04:10]And for the con canvas connection, I use the the back side of these connectors.

[00:04:16]And I'm connecting these two pins can high and camo to the uh uniand and MCP board. Also, I connect two power 12 volt here and then the ground from here.

[00:04:30]These pins are important for the band programming. So when I power on the ECU.

[00:04:36]So first I power on the ECU I need to take about 10 seconds. 1 2 3 4 5 6 7 8 9 10. Then I power on the unit end.

[00:04:49]And for the password we need to get the it from the shadow here.

[00:04:56]And then we check the from shadow then hit detect.

[00:05:01]Now once we enter the debug on uh we can see if we have the shadow properly uh connect we can verify shadows. Okay. Now since we already erased the entire flash I'm going to program the everything back to the original state so that we can restore this device. So here is the original flash. I just need to click this right and programming.

[00:05:56]program finished and everything seem to work.

[00:06:02]This is the E39A with the J-Tech pin connected. I have not modified the shadow. So I'm going to show you the JTE in this state is not going to be work.

[00:06:13]So I connect the Unink NT uh through this connector here. I also saw this resistor here which is trying to disable the watch. So let's power on the ECU and then power on the unique MT here.

[00:06:29]So let's go here and try to see if we can get detect on. We can't. Uh even we set the proper password we cannot detect on it. Now I am able to get this on if I'm going to the boot another boot mode but none of them will have the uh flash enabled. So you cannot read the write the flash. So I'm going to modify the uh shadow uh through the canvas and we can see how we can enable the JTAG. So now I connect the canvas here and uh the other things are everything is the same as regular canvas setup except this one.

[00:07:08]I'm not going to waste time to remove it and it will still allow me to modify the shadows. So, I power on the ECU and connect the unit end. Let's select the regular canvas. So, this is a regular canvas.

[00:07:25]Power it on and let's read the ECU info and get detect.

[00:07:36]So now we are here and let's see we have the shadow here. Now I want to modify the shadow and the current configuration does not allow me to modify shadow. I need to modify the uh the configuration. So go here go to the configure folder.

[00:07:56]So I'm going to modify the E39A E39A can. I'm going to edit this file here. The flash uh the shadow is set to one zero. I'm going to modify this to one and make it uh so restart the in NT software.

[00:08:21]Restart it. So now if I go to shadow default is FF when this value is zero.

[00:08:27]Default is zero. So now let me do this again and detect.

[00:08:35]So now I read the shadow.

[00:08:39]Now in order to enable the flash I'm going to make the 8811 to 55A.

[00:08:49]So after modify those two values then I'm going to write the flash uh write the shadow. There's no right shadow. So I'm going to here right shadow.

[00:09:00]Yes.

[00:09:02]So we verify shadow. Shadow is verified.

[00:09:06]So now read again.

[00:09:08]And you can see the value is 55A now.

[00:09:12]Okay. I'm going to power off power off this and remove the canvas. So there's no canvas. Now I'm going to use the Ulink NT and connect the So now the canvas is removed and I have the connected the J-Tech properly and make sure this resistor is on and I last uh I was having this loose and the J-Tech is not very stable. So now I power on the uh the ECU and then connect the uh uninkt. So let's try to see if we can get debug on. We can. And we don't even need the password here because I modified the shadow from 55A uh from 8811 to 55 AAA. So now we are in the uh debug on mode and we can get the flash. So let's do a verification verify. And you can see we can achieve about 566 uh 570k bytes of read speed. And let's do a programming. You can see it will be so much faster to do the program. So erase The programming uh only takes 32 seconds. The read only take one 5 seconds. So if you really want the JTAG method, it is possible by modifying the shadow.