Corvette CCM Reverse Engineering Anyone?

[spfautsch]

I'll try to sit down later tonight and get better logging / documentation. It's been a struggle to function without any ctrl keys - feels like I've had my pinky fingers cut off. Copying or pasting is a 10-15 millisecond event with a ctrl key. Having to use a mouse for this same operation is exquisite torture.

[spfautsch]

I didn't get to a point I was satisfied with on this tonight, sorry. Gotta go pay my wife some attention or I'll be sleeping on the dog's bed tomorrow night.

Anyway, I'll have to recompile flashhack to extend the idle scan time quite a bit because I wasn't always seeing 41 responses from the PCM presumably due to it being in a non-engine-running state, or maybe it's just how flashhack tries to re-sync to the datastream. I'll revisit again tomorrow night or the next day.

Whatever the outcome on that front, there's a very clear difference in the initial handshake data with VATS disabled in the PCM. I think it would be good to know the specific details of how this security loop works.

[steveo]

feel free to beat on datastream_8192::resync_datastream. it's a bit confusing and terrifying and like anything you touch will break it, and you corvette nerds are the only reason that it is like that. you could throw some log entries in there to see what's happening along the way.

[-=Jeff=-]

I was testing out a UART interface.. I must have had a connection backwards, I connected it and let some magic smoke out of one of my CCMs.. It was a 1992 unit, so not the end of the world, it still will work for Bench testing but the VATS Circuit looks to be the one that took the hit, I can still connect to it and download it, but the VATs doesn't work

[spfautsch]

LOL @ being classified a "corvette nerd". I still haven't had a chance to tinker with it, but I suspect some PCM responses are being dropped b/c I was seeing a lot of "resync datastream by fast forwarding XX bytes" or something to that effect. I do know my black box logger also isn't 100% accurate with datastream sync either, but I suspect it's because I didn't realize I needed to let the PCM tell the CCM it was unlocked, or whatever is happening that causes the CCM to start sending a heartbeat. I'm probably going to go swap out my nerdmobiles today so I can test that theory out.

... testing out a UART interface.. I must have had a connection backwards, I connected it and let some magic smoke out of one of my CCMs..

Wow, you really have to try to hurt one of these. Trust me, I've done a lot of really stupid things to the one steveo now owns (no returns allowed btw) while fairly well intoxicated, and I couldn't manage to get any smoke to come out.

If you can identify what's "bbq'd" it's possible it can be repaired. My guess would be you probably killed one of the passkey voltage divider resistors by shorting it to something with ground or power.

[-=Jeff=-]

For the amount of smoke that poured out of the unit and the fact the VATS is the only thing that seems to be broken, I would agree with you. I also found the 94-95 ZR-1 message to CCM is the same as 92-93

[spfautsch]

If you would care to share the message differences, it's sort of the entire spirit of this and most of the other things I post here.

I've only touched one and may never again, but if I ever get vanity plates for mine they will be "ZR-N0NE" because in it's current configuration it would easily best any stock LT5 and most of the modded ones. I would love to own one for nostalgic aspirations, but knowing that Lingenfelter has bought up and is effectively bogarting every last piece of remaining engine parts GM owned makes it something I couldn't afford to drive the way I would like to.