Script only for IprogPro!!!
ATTENTION!!! Script only for professional use!!! This means that you must understand what you are doing and what result you want to get.
If you do not have a sufficient level, then please do not buy this script, so as not to ask me questions later on how to use it.
If you are used to "press the button - the mileage changes" then this script is not for you. It will not have colorful pictures of boards with connections and calculators, you must test the necessary points yourself and connect to them based on the help file with pinouts of processors.
In some cases, you will have to use an oscilloscope or logic analyzer to check the process and adjust the script.
If you are still not scared, and in anticipation of making new cars like MB, Toyota and others with closed processors, then please check the text below:
Now let's move from warnings to a description of the script itself.
1. The script allows you to read/write the DataFlash of the processor in 4-byte mode. As you already know, in many cases, when reading the RH850 and writing back the read
dump, the instrument cluster or other units stopped working normally. Now, with this mode, you can easily write what was previously impossible.
Of course, there are some RH850 families that do not support this mode, so for such processors, reading occurs at 16 bytes. ATTENTION!!! If the DataFlash is read in 16Bytes mode, then write it back at your own risk!!!
2. The script allows you to read both open and closed (Locked) processors. With open ones, I think everything is clear and there is no need to tell much. Read/erased/written.
With the locked ones, everything is much more complicated.
RH850 has several types of protection: No Security (no protection), ID Code protection (protection by 16-byte password), Command Protection Read/Write/Erase (protection from Reading/Writing/Erasing).
In addition, you can also set the Serial Programmer Disable protection.
The script allows you to bypass single protections Serial Programmer Disable and ID Code protection. That is, if you have both Serial Programmer Disable and ID Code protection enabled, then
you definitely need to know the ID Code.
In the case of single protection by ID Code (which you naturally do not know) the script allows reading, but writing and erasing will be unavailable without a known ID Code.
The script also determines the state of ICU-S (enable/disable). Some information about ICU-S can be read here
The script does not encrypt the read dumps, it saves them in normal form.
The adapter used to work with the script is almost identical to the adapter used with VAG scripts from @marchcat, raspberry is also used to form a glitch, but has a small modification for ease of use. The adapter diagram will be given to all participants.
Video of the script in action:
Reading/Writing in 4-byte mode
Reading/writing a processor with Serial Programmer Disable protection installed
