Corvette CCM Reverse Engineering Anyone?

[spfautsch]

where did you ground the Reman pin to on the CCM? one of my CCMs when I tried to program said the HW pin was not ready (grounded) I will try another, but that particular one i don't have the PASSKey figured out.. been through all the Keys and it has not gotten detected. I am trying again and letting it wait longer between codes to try

Ground, 0 volts. The heatsinks were usually where I'd attach the alligator clip. It's not clear from your question, but if you aren't seeing the security pin turn off (c47) I don't think it's possible to unlock for programming.

Please bear with me as I refresh my memory on this - it's been almost a year since I've looked at one and I have the worst memory.

NomakeWan I also have an 8051 PCM I can look at for the resistor you mentioned. I vaguely recall documenting something about that a while ago, possibly in this thread. There's definitely an impedance difference on the ALDL between the two.

Also jeff, here's how the odometer is stored, using your ZR-1 dump as example.

The odometer triplet is showing $00 12 46 FF FF ...

00 denotes how many FF bytes (aka erased flash cells) to skip during the read from left to right (until a tailing FF is encountered).

That makes $1246 the gross odometer reading minus the lower 4 bits, so $12460 = 74592 (decimal)

On the units I had access to, the remainder of the odometer reading was stored at $b657, in units of 0.25 miles. I referred to this as the vss counter since 1000 pulses = 1/4 mile. Yours reads $1b there, so 27 * 0.25 = 6.75. So my guess would be the ccm you dumped first is showing 74598 or 749599 miles. But its possible this second storage location is different on earlier bins. Let me know if that's close or not.

Edit: Since I just moved it, I know where my test bench cables are at, and I just happen to have a ccm thanks to AngryCorvair that I don't know the passkey value to (maybe I do, but I'll pretend I don't). Probably won't have a chance to do that until late tomorrow evening.

[-=Jeff=-]

Yes odometer is within 6 miles of that. So yeah I found that as well.

If I understand correctly, you need to have the PASSKey correct to program. I am going to try to do that with the one I know the code for. I am tempted to make an automated tester to search for the codes.

At this point if I can program one with the known PASSKey then I will live on to the 1991 one I have

[steveo]

i do remember that if the 'security light' is on, you can't reprogram it.
that is definitely annoying
there has to be a decent hack we can come up with for people with wrecker ccms they need to repurpose
how many passkey values are there anyway
what memory address is it stored at again

[NomakeWan]

i do remember that if the 'security light' is on, you can't reprogram it.
that is definitely annoying
there has to be a decent hack we can come up with for people with wrecker ccms they need to repurpose
how many passkey values are there anyway
what memory address is it stored at again

Okay so then yeah, it won't allow programming if it's in lockout, which would suggest that it won't allow read in lockout either. I do still wonder how reman facilities are doing what they do.

There are 15 possible resistance values, and on a 90-91 they are stored at B69F while on 92-96 they are stored at B6A2.

[spfautsch]

I believe they stopped using #1 (402ohms) early on due to a large number of problems, so functionally only 14.

Whatever the case, the theft deterrent was the only part of this thing they took seriously. If memory serves, in 1984 the Corvette went from the most stolen vehicle in the US to the least due to this "technological marvel".

I'm still re-reading this whole thread to refresh my memory. It's making me pine for something else to hack, and the BCM in my 2001 has been acting a little flaky the last week or two. Hmm...

[-=Jeff=-]

i do remember that if the 'security light' is on, you can't reprogram it.
that is definitely annoying
there has to be a decent hack we can come up with for people with wrecker ccms they need to repurpose
how many passkey values are there anyway
what memory address is it stored at again

Cool, I have a 92 CCM I know the PASSKey that I will try to program this weekend. I also want to set up a simple bench with the 15 resistors to roll through (using a Potentiometer right now is a bit painful). I am also an automation guy by trade so debating on setting up a quick bench at home with some code to run it for me.. Plug in the CCM, then let it run through the codes and stop on the on that works, this way I could give it like 10-15min of wait time if I wanted

[spfautsch]

Actually, I just got to page 18 of this thread (posts #260-263) and it seems like it is possible to unlock / write without the vats resistor.

Maybe there's something else going on.

Sadly it's been less than a year since most of this transpired, but it feels like 5.

[-=Jeff=-]

Actually, I just got to page 18 of this thread (posts #260-263) and it seems like it is possible to unlock / write without the vats resistor.

Maybe there's something else going on.

Sadly it's been less than a year since most of this transpired, but it feels like 5.

hmm, I will try again. I have the reman pin tied to a ground on the connector. I will have to see if I get continuity to the heat sink

EDIT Also looks like once I am able to program I can change the VATS. the unit I can connected has the reman pin to ground, but I still have the security light and those posts state the light goes out if grounded. I am wondering now if the ground I have is good

[spfautsch]

I'm not sure if the security light does in fact go out, per steve's edit (from 10-30-2021)

very interesting, grounding the reman pin actually kills the security light...
edit: despite the security light being on, you're correct, it programs fine. that's helpful.

I'll try to get my testbench up tonight and verify.

Edit: one thing you might test is that the pin you're thinking is for reman has 5v on it. It's entirely possible (though I would think unlikely) that the location is different on older CCMs. It's also possible that flashhack is looking for a register to change that is at a different address. If so we may have to enlist kur4o to work his disassembly magic.

[steveo]

it kinda bugs me how the ECM code just goes ahead and barfs the seed/key for programming on ram dump. actually barfs the whole bin with no authentication, so one could track down the code that performs the seed/key pair. but then they scramble the address lines to the flash chip so anyone that tried to desolder it and read it would be in for some severe confusion, the thing looks damn near encrypted if you tried to read it by regular means.

somehow the CCM, though, they really went to town, and protected the passkey value in ram, so even if you dumped the whole thing and figured out where it was, no passkey ??

obviously two different development teams at work there..

[spfautsch]

Yes odometer is within 6 miles of that.

That tells me the vss counter must be in a different location for the 90-91s. Now I'd like to know the exact reading so I can look for another byte that matches. Or maybe you guys have already located that.

[-=Jeff=-]

That tells me the vss counter must be in a different location for the 90-91s. Now I'd like to know the exact reading so I can look for another byte that matches. Or maybe you guys have already located that.

Let me pull another dump of the BIN to be sure..

[AngryCorvair]

Edit: Since I just moved it, I know where my test bench cables are at, and I just happen to have a ccm thanks to AngryCorvair that I don't know the passkey value to (maybe I do, but I'll pretend I don't). Probably won't have a chance to do that until late tomorrow evening.

My apologies for the very late reply to this. I still have the steering column and keys for the CCM donor car, so I can get you the resistance value on Thursday 12/8. I'm away from home ATM.

C4 Options.jpg

EDIT: I wrote that reply when i was back on page 27. now that i'm fully caught up I see you already figured out the passkey on my (now your) CCM. I'll add a pic of the option code sticker in case any of that info would help.

[-=Jeff=-]

NomakeWan,

that particular corvette is not named Christine or is red by chance is it?

[NomakeWan]

Hahaha, nah, she doesn't have a name yet and is arctic white. But every so often, yeah, she does do some weird shit.

Just fired it up yesterday to move it out of the driveway so I could work on our race car, zero issues. Looks like my previous issue was indeed just a defective battery. Which is sad since the production date on it was May 2022. Guess they don't even make lead-acid batteries the way they used to anymore.