Hi, I've been amazed at the progress James made working on dissecting and modifying the TCU, I thought I would crack it open and have a look.
My knowledge of mapping and how manufacturers lay out data onto PROMs to be interpreted by the software (If it is proprietary or following industry standards) is very lacking, and I barely know what I am looking at.
Fortunately, I know my way around the hot air station and a programmer, so here is a copy of mine for anyone wanting to see the TCU PROM.
I did try a few basic things to try and understand what was going on, but ended up running out of time to pursue it further. I last worked on this back in May after reading James' initial post.
What I tried:
- Opened file in a hex editor, and found strings relating to part numbers, but could not decipher any of the other data as I am not familiar with how it is encoded and laid out.
- Tried to see if there was any executable content using Ghidra, but that didn't go anywhere, assuming the generic 8051 instruction set shipped with the program was appropriate, and user error was not a factor.
Pretty sure the CPU is a Siemens 80C517. This is important as the 517 variant contains a mask ROM, which probably contains the actual program, and reads data on the factory-installed PROM. This makes sense as nothing "executable" stands out to me in the read PROM file, so I am sure the actual program is in mask ROM.
My next steps were to read the mask ROM from the CPU per the datasheet (Page attached). As long as the ROM is in unprotected mode, it should output data corresponding to the memory location I request. This test involves modifying the circuit significantly to facilitate reading and writing the data correctly, and I didn't get around to it. Maybe there was a better way?
Once I had copied over the mask ROM, I would have tried Ghidra again to see how the program read the PROM based on logic inputs from sensors and outputs to drivers, and make some uneducated guesses.
My ZIP file (Change extension!) contains:
- MODEL.TXT with all the writing located on the Bosch TCU front label.
- M27C1001-BACKUP.zip with three independent reads of the PROM. (All identical.)
- And
M27C1001@PLCC32.BIN, another read of the PROM. (Identical again.)
Hope someone finds this helpful! Or at least James gets a laugh.
David.