I just tested the eside vpp apply and it works flawless. It reads both voltages vpp and ign. Now I have to fix a vpp_remove eside one that will allow separate side flashing.

Here is modded vpp for eside. Someone willing to upload to eside and report results.

If there is no space just use what is possible, In the end it will be much easier to add different reading format on the app side than mod the pcm side to cover the existing one.

That is great. I feel confident it will work at the end.

The channel 0 matches the ign lookup on eside and channel 1 is stored once but never used, so it is likely the vpp circuit there.

I will...

Can you post the code, I will try to adapt it for 94-95 eside.

I need mostly the port G config and the AD lookup for ign voltage and vpp voltage.

It looks like it will work in case the hardware links are there.

On both 94-95 and 96-97 pcms the vpp enable bit is at tside $1800 bit $80,
I checked the eside diss and 1800 $80 is not used...

It is f4=tside and e4=eside.

The read format being used



request
f4 5c 06 [02 00] [20 0b] [20 00] [xx]

[02 00]=load address
[20 0b]=code bra to
[20 00]=start address of data to be read

I have a version that will work on xp sp3. Just need to compile the latest source and will post it.

I have traced the vpp pin and it is common for the 2 sides. When it is turned on both sides get the voltage and the trigger pin is commanded by tside. Also the tside reads the voltage.

An easy...

Why don`t just make a bootstrap flash mode in flashhack and collaborate the effort with Tom H for easy recovery.

It is still serial comm and the same ftdi adapters can be used. The bootstrap...

That brings a good point. The vpp is applied by tside only, I guess the relay transistor is wired there and the voltage goes to both sides. Now can we apply vpp from tside, while flashing eside. I...

I guess you have some crap 3.3v serial cable. I got one batch that hardly worked at all.
The best ones that work flawless are ftdi based and look like this.

Try some other standard baud rate or...

All 94-95 files and pcms are interchangeable. On the average bin you want to parse, first part is tside and second part is eside. there is also ram 0-2000 area in the files. You can cut these and...

I vote for the slowest most reliable option for recovery. $400 bytes of ram is plenty enough. Anyway the original code is set to use 0-1ff as comm loop 300-on as buffer for write message and 200-2ff...

Use with care on code that reduce stack for the return address. It might crash as well.

I figured why it crashes.

You need at least $58 message length to save the jump buffer. Otherwise the code enters loops expecting more bytes that are never send.

It is also unavoidable to write...

Mode 6 is always download and execute.

In that case

$F4 $57 $06 $00 $00 $AE is

download at $0000 address zero bytes and execute at $0000 address.

I suspect that aldl chip verifies...

Nice work on the comments, much better to understand and complete.

Mode 35 is a built in mode for reading bin over odb2 port. Some of the earlier obd2 pcms have that built in the code, but later...

We will separate the response in 2 parts. 1st ones are comming from the main comm loop, The second ones coming from the write,erase code.

from write,erase code we have

8085, there is error...

The time you came up is way off. It will be like 1-2 min max in x4 mode.

Here is a list of simulated write with the commands send over the bus.

Chipid id used to identify the chip. It is always...

I am not sure about the tunercat layout, but the best one might be

tside 2000 ram + bank 0 + bank 1 + bank 2 +eside 2000 ram + eside rom.

For better offset experience eside might be first than...

You can check here for a way to open the files or

if you are still having troubles here are some htmls. There is options to export to other formats but don`t what they are.


I managed to find...

More comments added.

06 aa is the positive response when upload is good, it can be followed with some data like 2 byte checksum or chipid.

It is some standard frame response.



This is the header that is uploaded...