E78 Shadow password

[Ironduke]

Can you derive the shadow password from the ecu serial number? or is that just the E39?

[usbbdm]

So far only for e39a and e39a.

[Ironduke]

Thanks,
I have 2 E78's I've scrounged up for playing around with. Both dead. Verified wiring is correct for bench use. 3rd one works ok.

Looks like Jtag method isn't possible either without the shadow password either. oh well.. Not any real need, just wanted to bring them back to life but do not know why they're dead either. bad flash or some other hardware issue. No response or signal from canbus.

[usbbdm]

If you use can bus to play with it. Always read the shadow and save it. Then you can use bam to recover. If you need to use jtag method, you need to modify the shadow first.

[Ironduke]

These have never been alive, lol.. I got em used with no history. I now know to grab the shadow before doing anything but it doesn't help me here.

Can I modify the shadow if CAN is dead? I did solder it up for boot but even doing that the can is dead. Your device gets absolutely no response from the first one I soldered up, will try the second later.

[usbbdm]

You need to have a can logger beside it to say it is dead. The boot method should give you something. But if password is not available you will not be able to talk to the ECU.

[Ironduke]

I am using a DBDT with a GM mdi and looking at the canbus lines..
They're dead at zero volts. When I use your tool I can see one of the lines jump up a little but not much.
When I use another mdi and request info I can see the canbus lines going high and low trying to talk but there is never a response from the ecu's.

Guessing they're both bricked hardware wise at this point. I may solder up the 2nd one just to see if that one gives a different respone.

Thanks for your knowledge, tips, and suggestions.

[usbbdm]

I found to use mcp2515 board reliably, you need to use 5v power instead of 3.3v from black wire from u-link NT. I modify the hardware and get 5v from inside of u-link NT. Try that .