admin
Moderator
1J35D is MC68HC08AZ60 (08 is OTP One Time Programing)
4J74Y is MC68HC908AZ60
Both Have EEPROM , FLASH and MONROM areas.
it is impossible to write in MONROM, well because it is ROM and this means READ ONLY MEMORY.
For example i take one MCU with mask 1J35D from EZS block of MercedessBenz and will use Orange5
Select MC68HC908AZ60[4J74Y] , not MC68HC08AZ60[1J35D] in Orange-5 software !
This mask if from MB EZS have security type MONROM (not SS) active, but in Orange-5 at the moment the function of skiping MONROM security is active only in the algorythm of MC68HC908AZ60[4J74Y] , and not for MC68HC08AZ60[1J35D]!
After that select EEPROM area then we use Skip security, after it is finished we use Read function of the software.
After the EEPROM area is read, using the mouse move to address 00200H of the EEPROM and if there the first two bits have value D3 (hexidecimal) it means that MONROM is active, to deactivate it replace D3 with value FF. To save the change press M ( Modify command), this command writes over only the content of the cell(s) which were changed ( in current exapmle replace D3 with FF)
After that use C (Compare command) to check if the change was made correct ( the function compares if what you see at the monitor is same with what is written inside the MCU.
Now if done proprely this MCU does not have active protection MONROM anymore .
After that Select FLASH1 , use Read , and on display you will see only sequence of AD AD AD AD.....
This is normal at current point, because FLASH still has active sequrity SS ( Sequrity Sequence).
Select from the software MC68HC08AZ60[1J35D], then Read (without skip sec) EEPROM and it goes without problem because we skipped the MONROM security in the steps above thus the EEPROM is unlocked.
Press Skip Sec and you will see a new window called HC08 Security , there press the button Scan and wait.
A new window appears which says SS Detected in in press OK.
Example : Orange-5 found SS : F9-F1-F9 ....press OK
After either select Add to list or press OK again this allows the programmer to recognize that the current chip has SS security of F9-F1-F9.
Next Select Flash1, read , it now shows the real contents and not AD AD AD sequence.
Select Flash2, read, etc read all FLASH areas.
Read MONROM too.
After that save all the data -> File > Save as.
Important note here : It is important to select the type of the data to save in this case - Save as Type : change Binary Files(*.bin) to S-Record (*.s19)( S-Record is file format specially designed by Motorola MCU). This will allow us to save all of the contents of the chip - FLASH1/2/etc areas, MONROM area and so on. If the type remains "Binary files (*.bin)" it will only save the curently selected window and not whole memory.
Example file name : Full1J35D.s19 - Correct !
Full1J35D.bin - Incorrect !
All this was an example of how to read the contents of 1J35D if the MCU is from MB EZS.
If another MCU with mask 1J35D and you want to replace it you first need to compare all areas.
If is same possible rewrite EEPROM only , because the MCU is OTP One Time Programing .
The mask 4J74Y (908) is possible delete flash areas and if MONROM is same write all another areas .
Put it simple to clone MCUs you need them to have same mask (either 1J35D, 4J74Y etc.) .
4J74Y is MC68HC908AZ60
Both Have EEPROM , FLASH and MONROM areas.
it is impossible to write in MONROM, well because it is ROM and this means READ ONLY MEMORY.
For example i take one MCU with mask 1J35D from EZS block of MercedessBenz and will use Orange5
Select MC68HC908AZ60[4J74Y] , not MC68HC08AZ60[1J35D] in Orange-5 software !
This mask if from MB EZS have security type MONROM (not SS) active, but in Orange-5 at the moment the function of skiping MONROM security is active only in the algorythm of MC68HC908AZ60[4J74Y] , and not for MC68HC08AZ60[1J35D]!
After that select EEPROM area then we use Skip security, after it is finished we use Read function of the software.
After the EEPROM area is read, using the mouse move to address 00200H of the EEPROM and if there the first two bits have value D3 (hexidecimal) it means that MONROM is active, to deactivate it replace D3 with value FF. To save the change press M ( Modify command), this command writes over only the content of the cell(s) which were changed ( in current exapmle replace D3 with FF)
After that use C (Compare command) to check if the change was made correct ( the function compares if what you see at the monitor is same with what is written inside the MCU.
Now if done proprely this MCU does not have active protection MONROM anymore .
After that Select FLASH1 , use Read , and on display you will see only sequence of AD AD AD AD.....
This is normal at current point, because FLASH still has active sequrity SS ( Sequrity Sequence).
Select from the software MC68HC08AZ60[1J35D], then Read (without skip sec) EEPROM and it goes without problem because we skipped the MONROM security in the steps above thus the EEPROM is unlocked.
Press Skip Sec and you will see a new window called HC08 Security , there press the button Scan and wait.
A new window appears which says SS Detected in in press OK.
Example : Orange-5 found SS : F9-F1-F9 ....press OK
After either select Add to list or press OK again this allows the programmer to recognize that the current chip has SS security of F9-F1-F9.
Next Select Flash1, read , it now shows the real contents and not AD AD AD sequence.
Select Flash2, read, etc read all FLASH areas.
Read MONROM too.
After that save all the data -> File > Save as.
Important note here : It is important to select the type of the data to save in this case - Save as Type : change Binary Files(*.bin) to S-Record (*.s19)( S-Record is file format specially designed by Motorola MCU). This will allow us to save all of the contents of the chip - FLASH1/2/etc areas, MONROM area and so on. If the type remains "Binary files (*.bin)" it will only save the curently selected window and not whole memory.
Example file name : Full1J35D.s19 - Correct !
Full1J35D.bin - Incorrect !
All this was an example of how to read the contents of 1J35D if the MCU is from MB EZS.
If another MCU with mask 1J35D and you want to replace it you first need to compare all areas.
If is same possible rewrite EEPROM only , because the MCU is OTP One Time Programing .
The mask 4J74Y (908) is possible delete flash areas and if MONROM is same write all another areas .
Put it simple to clone MCUs you need them to have same mask (either 1J35D, 4J74Y etc.) .