BECM Motorola MCU Type/Maskset

My research is purely an offshoot of my business which is keyfob repair and replacement so my end goal is still an easier way to provide P38 owners with reliable and reasonably priced replacement keys.

That's not to say I don't try to have fun investigating but even I don't think I'm crazy (or masochistic) enough to even begin to attempt a BECM replacement

In your opinion Irishrover, did you tend to find most BECM problems were power board related or were there as many corrupt CPU boards too ?

John, the ECU in my Toyota is 29 years old and trouble free, some of the micro controllers I designed in the mid eighties are still going strong, I think there is plenty of life in the BECM yet.

I'm watching & waiting to see when you advance your research.

Everything that has been mentioned here has been done many times before by others, & not fully got there. Even Irish rovers method had been done, but that also comes with problems & as not as straight forward.
I cracked the MCU years ago, & it took years to get there. I've just cracked the discovery 2 BCU's, which took 4 years to get right, & these are far more complex than the Becm MCU's, with full security.
Keep up the good work!

Thanks for the encouragement Rick.

Out of curiosity, Which MCU did you crack years ago .. the 68HC11 or the one next to it with the external ROM ?

And the Disco2 BCM .. cracked as in accessible via OBD or cracked as in accessible via direct chip access. I just had a quick look around and it appears that people have been successfully reading and writing the 2 different Motorola masksets in those Disco2 BCM's for quite a few years now. A standard off the shelf UPA programmer should do the job nicely.

Did a little more digging and it looks like they use 2 different mask sets on the Disco2 BCM.

An MC68HC11P2 (Mask 0G10V) and a MC68HC11PH8 (Mask 0H30R). Both are easily readable and writeable using a variety of different available programmers.

Most people are accessing these BCM's to change the mileage which is apparently stored at location 0x17C onwards (in KM not Miles btw). The MCU's also seem to be accessible using the very same method that I am utilizing with my arduino bootloader setup.

Care to share any of your last 4 years research Rick ?

Waiting on some other bits and bobs to come together hence the lack of updates. Did manage to spin a batch of *REALLY* dirty PCBs which should be processed in the next week or two :



If anyone wants one to play with one just let me know. Ill post when they arrive.

Still waiting on the P38 BECM boards winging their way from China .. so in the mean time, I found something else to play with ...



A Discovery 2 BCU. The MCU looks pretty easy to access. I would imagine a non solder option should be doable in less than 4 years...

Yay .. another day, another set of PCB's !



I can highly recommend "Dirty PCB's" if anyone ever needs any making.

Just need to source a few bits and then they are ready if anyone still wants to help test.

Wondered where you had gone......thought your brain had exploded with all this going on!

MrSporty said:

Yay .. another day, another set of PCB's !



I can highly recommend "Dirty PCB's" if anyone ever needs any making.

Just need to source a few bits and then they are ready if anyone still wants to help test.

Click to expand...

Sorry, this thread has wandered a bit and I've kind of lost it, although I wholeheartedly agree with IrishRover's comments.

What exactly are you after with regards to testing? Do you need volunteers to see if you can read / clone their keys or do you need volunteers to pull their BECMs apart so you can try to read the PCBs?

As above.I have a couple of spare BECM,s which can be used for testing .

Right now this can be used by anyone who would like to test the ability to clone their BECM to a spare. It could be someone who is putting up with a water damaged unit or just likes to tinker.

Being able to map the EEPROM values in the dumps to the different functions is difficult (at the moment) as most people with the ability to do this work are ones that have shelled out 600 odd quid for the BBS kit. For some unknown reason they seem quite shy when it comes to information

I'd be very happy if someone who already knew their FOB code was able to provide a dump too.

When you say FOB code,I presume you mean the code that can be read on a unlocked BECM?

Exactly that yes, the code that comprises of a 3 sets of 3 digits.

They are a decimal representation of the 3 hex bytes of each locksets unique code.

I have a couple of BECM,s ,unlocked so can do.

Super stuff, have dropped you a PM John.