Corvette CCM Reverse Engineering Anyone?

[NomakeWan]

Yes, I understand and I will post my GM documentation when I find it. The Mefi4 is very very similar to the obd1 LT1 computers electronically and when I need to convert a 4 into a 4a or 4b this is how we get it into boot mode for programming the entire 256k and not just the calibration data, and yes, still ground for diagnostic mode. Maybe this doesn't work on the LT1 computer but I bet it does. I only have obd2 LT1 puters here or I would already know :)

I look forward to seeing that documentation. What I have on the CCM (as posted earlier) says that the "secret" pin for resetting EEPROM values is internal to the CCM, not something that can be accessed externally via any means. This makes sense since the CCM controls the odometer, and you wouldn't want someone to just be able to plug a stolen GM tool into the ALDL port and change the odometer at will.

NomakeWan can you make an updated dump of the ccm you have. Hope thay gathered some mileage, so we can identify some stuff pretty quick, if the eeprom increase at some places.

Here's a fresh one from my '95, taken just now.

[spfautsch]

This is all really cool guys, thanks!

I was able to dump the memory on both modules in-car today. What a PITA those connectors are in the cramped space they left us to work in!

Honestly, I'm more concerned with why I was unable to talk to the serial port on the test bench. My intuition is leaning me towards the absence of the LCD module, but that's just a wild-assed-guess. I have an idea of someone who might be able to confirm / deny this but won't bog you down with those details.

I'm fried from a long day so will post more thoughts on the dumps tomorrow, but as I was fearing, the "remanufactured" module has a foreign VIN and the ultra-low mileage of 2675 when booted up. Yay, my car just increased in value by $300.00. :-\ How does one total a C4 before it's first oil change? Perhaps Vince Niel can elaborate. But for now I'll digress.

I suspect I see where the odometer counter is stored in triplicate at the "top" of the eeprom.

Truth be told, I'm not terribly optimistic that clearing / programming these pieces is a realistic goal. I'm not inclined to give up yet, but honestly this module is a mother-bear to get to. Presumably by design. I'm not even 100% sure it's the cause of my battery drain, though I have noticed that before dumping these today my battery had stabilized at 12.49v for the last 10 days with the CCM removed. Normally it's down to 12.0-11.8 after that long. And I've only left the keys in the ignition two or three times in the past couple years. It's a habit I never break unless the battery / engine / transmission is removed and the car is rendered immobilized.

Edit: NomakeWan I saw your comment about the PKE possibly waking the CCM and I've considered this more than once. My neighbors across the street still have a Bill Clinton era 900mhz cordless phone, and I've always been suspicious the half-octave harmonics from it have been annoying the PKE. Whatever the case, I have a sacrificial CCM board, and wish to exploit it to it's full potential.

[NomakeWan]

I'm not surprised at all that a "remanufacturer" didn't bother to actually, yanno, remanufacture the CCM. The only way they could do that correctly would be to request information from you prior to shipment, which they obviously did not do. This leads to a huge issue in that anyone who uses a reman from that company would be committing odometer fraud at worst and have a branded title at best. Big freakin' yikes. So for your second unit, attempting to locate the reman terminal as well as all the requisite memory locations for a Mode 5 request might actually be worth it.

But for CCMs that are still good and still in a car, I don't see the point. I agree that for those, it would be a waste of time and energy. The only reason to mess around with that would be to do something nefarious, so it's probably best left alone.

On my end, I've worked out a test program that should allow me to inject arbitrary data into the ALDL port and override the dash. I'm working on the Arduino code now, so hopefully in the next week or so I'll be able to test it by just unplugging my PCM, plugging the Arduino into the ALDL port, and then turning a knob on my potentiometer to set the speedometer on the dash to whatever I want. I've never done tight timing serial comms before, so it'll be a fun exercise. And if it works, then we know that we can make anything work with the CCM going forward. So if someone had, say, Holley EFI, and wanted their dash to work, no problem. Cheapie Arduino board, set your outputs on the Holley to those needed for the datastream, have Arduino interpret those outputs into the datastream the CCM expects, and go.