how to find pid location to add to adx?

so this might be the wrong location, but is there a way to find a location of a pid you want to log from another scan tool? like I have pids from other places on the net, add them to torque app and they display. I'm guessing it's the same thing with tuner pro.. if I have the pid I can add it under edit ads. but how are these guys finding these pid locations? I've got access to paid scanners with that will show the data, I just don't know how to get that info and put it into a more handy program.

is there some thing I can use to log what the scanner doing?

You don`t need pid location, You need pid number, pid size and pid scaling. Than use the information to add the needed data in other software.

For logging you can try this program. It have a list of pids and you can add more if you want.Go to utilities->logger
https://github.com/joukoy/UniversalP...tcher-Full.Zip

2 Attachment(s)

I'm sorry, I said location, that is the wrong term since it's not changing a value in a bin file. I'm still not sure what that number is called. address?

anyways, I'll take a look at that patch file when I'm on my computer and can open it. on my phone now. but I thought patches were things to add into the bin file. like you add patch to add a function?

I'm probably not understanding what you mean. I've always been able to tune with what's provided but I'm missing some understanding of how it all works as far is making xdf and adx. in this particular case I'm not looking to adjust anything in a tune. just view interesting data easily and TP is handy and I've used it before. so like this is what I have inputted onto torque app for reference. this data I found online someone else figured out. this is is the hybrid battery charge and discharge current from a yukon hybrid. normally you need a tech 2
to find this level of data, but someone found the pids for it. I would like to learn how it's done. and make a nice adx file with all the stuff I wanna see quicky without the clunky tech 2. off the top of my head, say rear ride level air pressure. it's super handy when towing a trailer as about 160psi they start failing. my tech 2 shows this and I use it for loading tongue weight but it would be nice to have up on tp over a blue tooth connection on trips.

thanks for any help understanding this data steam stuff.

There are a few excellent threads on this process over on GMTnation actually, in fact I joined over there before I joined over here because they were the best data I could find. But they don't do much in the way of custom tuning and ROM reverse engineering so here I am. The basic process is, if you have a tool that already supports the PID you want, you use an OBD2 Y-cable with your existing tool and a ELM327 class device that allows rs232 port emulation mode on your device (that's a topic for another day, there's a lot of variance in quality and device support between both devices and OSes) and set up your filters on the elm327, record a big data collection and troll through it till you get past the setup handshaking and find the repeated requests to a small set of PIDs you don't recognize, then investigate them more closely till you figure out what they do.

The second is to cast a wide net by creating a script or program that just requests one PID after another while recording responses till it's got the whole set, then filter out the ones rejected as invalid, then begin probing each new unknown PID while exercising hardware inputs till you find the one you are looking for. It is very time consuming.

Another method I'm hoping to use is to simply reverse engineer the firmware on the ECU and find which input it is reading and where it's putting it in memory, combine that with factory service manual wiring diagrams and knowledge of OBD2 standards and you can find PIDs working backwards from the way most people do.

Quote:

Originally Posted by kastein

Another method I'm hoping to use is to simply reverse engineer the firmware on the ECU and find which input it is reading and where it's putting it in memory, combine that with factory service manual wiring diagrams and knowledge of OBD2 standards and you can find PIDs working backwards from the way most people do.

Hiya, no offense, this is no small task :)

I completely agree. It's one that I hope to get to, but it's definitely not the simplest way, just the most complete way.

I have worked through the code on the first OBDII PCMs for LT1. In my case, there is a table within the code that points one of: Where the value is stored OR Where the code is that is run to determine the value.

The key documents are J1979 and J2190. Once you find how the standardized PIDs from J1979 are stored finding the bounds of the table is not too hard. This will give you the list of all the PIDs your PCM will respond to. In my case it was quite difficult to determine what each of the PIDs were for. I had a great deal of help from this list hunting them down.

In my case each entry to the PID table has six bytes. Byte 0:1 form the PID number such that the table can be searched. The next byte is a count of the number of bytes to be sent in the reply. This is followed by a flag byte (not used in my case, always 0). The last byte pair 4:5 is the data address OR the routine address.

I have still to find the meaning of several dozen of the PIDs. Probably undocumented PIDs that were not used in the field. Three that I found recently reports the state of the octal drivers (open or short circuit). These come from a routine that accesses them over the SPI bus.

As was stated earlier, this all isn't an easy thing to work through. Good luck!

-Tom

[Edit]

Here is the start of the table for interest...

Code:

BANK0:E484 ************************************************* BANK0:E484 * PARAMETER IDENTIFICATION TABLE BANK0:E484 * BANK0:E484 * J1979 MODE $01 : REQUEST CURRENT POWERTRAIN BANK0:E484 * DIAGNOSTIC DATA BANK0:E484 * J2190 MODE $22 BANK0:E484 ************************************************* BANK0:E484 * STRUCTURE BANK0:E484 * PID, REPLY BYTES, FLAGS, LOCATION OR ROUTINE BANK0:E484 * BANK0:E484 PID_STRUC_TABLE: fdb PID_$0000 ; PID ; RESET TYPE BANK0:E484 fcb $00 ; REPLY_COUNT BANK0:E484 fcb $00 ; FLAGS BANK0:E484 fdb $0000 ; PID_SUBR_LOC BANK0:E48A BANK0:E48A **************************************************** BANK0:E48A * PID 0000: PID SUPPORTED BANK0:E48A **************************************************** BANK0:E48A fdb PID_$0000 ; PID BANK0:E48A fcb $04 ; REPLY_COUNT BANK0:E48A fcb $00 ; FLAGS BANK0:E48A fdb $42E4 ; PID_SUBR_LOC BANK0:E490 BANK0:E490 **************************************************** BANK0:E490 * PID 0001: EMISSION RELATED DTC + MIL BANK0:E490 **************************************************** BANK0:E490 fdb PID_$0001 ; PID BANK0:E490 fcb $04 ; REPLY_COUNT BANK0:E490 fcb $00 ; FLAGS BANK0:E490 fdb $DFC8 ; PID_SUBR_LOC BANK0:E496 BANK0:E496 **************************************************** BANK0:E496 * PID 0003: FUEL SYSTEM STATUS BANK0:E496 **************************************************** BANK0:E496 fdb PID_$0003 ; PID BANK0:E496 fcb $02 ; REPLY_COUNT BANK0:E496 fcb $00 ; FLAGS BANK0:E496 fdb $DFE2 ; PID_SUBR_LOC BANK0:E49C BANK0:E49C **************************************************** BANK0:E49C * PID 0004: CALCULATED LOAD BANK0:E49C **************************************************** BANK0:E49C fdb PID_$0004 ; PID BANK0:E49C fcb $01 ; REPLY_COUNT BANK0:E49C fcb $00 ; FLAGS BANK0:E49C fdb $DFE8 ; PID_SUBR_LOC BANK0:E4A2 BANK0:E4A2 **************************************************** BANK0:E4A2 * PID 0005: ECT BANK0:E4A2 **************************************************** BANK0:E4A2 fdb PID_$0005 ; PID BANK0:E4A2 fcb $01 ; REPLY_COUNT BANK0:E4A2 fcb $00 ; FLAGS BANK0:E4A2 fdb $01D5 ; PID_SUBR_LOC BANK0:E4A8 BANK0:E4A8 **************************************************** BANK0:E4A8 * PID 0006: SHORT TERM FUEL TRIM BANK 1 BANK0:E4A8 **************************************************** BANK0:E4A8 fdb PID_$0006 ; PID BANK0:E4A8 fcb $01 ; REPLY_COUNT BANK0:E4A8 fcb $00 ; FLAGS BANK0:E4A8 fdb $016B ; PID_SUBR_LOC BANK0:E4AE