Corvette CCM Reverse Engineering Anyone?

[spfautsch]

Nevermind my rantings earlier about eeprom write protect.

At some point I'd thought it was ok to omit the RTS at the end of the uploaded routines so it was crashing after writing the first byte of the odometer.

Odometer zeroed and lockout bit erased.

TX+F166066000C616F7103BF7B6CAC617F7103B3956
RX+NO REPLY
TX+F15C0660007F103B394A
RX+NO REPLY
TX+F15802B6CA35
RX+NO REPLY
TX+F15802B6CA35
RX+F19602FF400010000000800020000801804020100804028000080002000000000020000800FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFED
TX+F15605B4
RX+F15705AA09

Mode 5 above without the reman pin shorted.

The tantalum capacitors to permanently repair my original unit should be here today so I'll put the remanned unit in the car to see if the LCD displays what I hope it will.

[kur4o]

I will make some test headers lately for experimentation. The way I see it custom mode 6 with jump to vector subroutine will read the bin in large chucks. It might be read fully without some data being omitted by mode2 and mode3.

[spfautsch]

Sounds good. If all else fails I offered to loan the board to steveo so you guys can avoid teaching a remedial course in machine code to an idiot (referring to myself).

Blindly erasing / writing the vats bytes worked. I haven't driven it like this yet, but I doubt I'll be able to resist the temptation.

IMG_20210930_141239896.jpg

It occurred to me kur4o (and you might have suggested it and I misunderstood) that the reason for copying the entire eeprom to $7000 is for comparison during the write procedure. The eeprom value cannot be read unless the control register is cleared, so I guess it was to save a few instructions when determining what changed and whether an erase will be required.

[kur4o]

some food for testing
Send in mode 6 download and execute.

ldaa #YY 86 YY
staa byte_fc 97 fc
ldy xxxx 18 ce XX XX
ldx off_ffb0 fe ff b0 update fix

jsr 0,x ad 00 fix
rtn 39

YY=length of reply message
XXXX= start address to dump data.

We can also set it: when you upload a data, the pcm will write and than read the written data and reply back with the data stored. Something like an echo message.

[spfautsch]

Check my work, but no luck. I didn't post all comms but I tried requesting as much as 0x40 and as few as 0x01 bytes returned.

TX+F15605B4
RX+F15705AA09
TX+F166066000864097FC18CEB683FEFFB0AD003938
RX+NO REPLY
TX+F15605B4
RX+F1570500B3


TX+F15605B4
RX+F15705AA09
TX+F166066000864097FC18CE7083FEFFB0AD00397E
RX+NO REPLY
TX+F15605B4
RX+F1570500B3

What if we try to get it a reply with some fixed response first, would that help?

My original unit has all new tantalum caps. I'm probably going to put a "cheater wire" in before I put it back in the car so I can test mode 5 / 6.

[spfautsch]

Just wanted to drop back in with a non-technical post now that I've accomplished what I set out to do - have a replacement ccm that's actually programmable. Open source tools are just the icing on the cake. As I've indirectly stated previously, I'm not interested in the odometer tangent any farther than it pertains to being able to erase the mode 5 lockout.

First off, huge thanks to NomakeWan, steveo and kur4o for your insatiable curiosity and immense knowledge and patience. Without your contribution I'd surely still be banging my head against the wall. Blue Streak Electronics can also be begrudgingly thanked for making the ridiculous mistake of selling me a part through RockAuto that was supposedly "plug-and-play, no programming required". Shame on you.

Even if I find later that I haven't fixed my battery drain issue, I'm extremely happy with the outcome. I may or may not try advertising ccm reprogramming services over on cf at a very cheap rate, mainly to generate a source for donor eeprom / uveprom dumps. If anyone objects voice your opinion here. I just want to learn more, and if I can do that while providing a service at a reasonable price, no-one loses.

NomakeWan if you want to take it further and perhaps engineer a patched ROM for the 411 swap guys you have my blessing and support. I'm not planning on desoldering the uveprom, but I'd be happy to loan the module to you if you so desired. No strings attached except that steveo has first dibs.

[steveo]

i think i should take your work and develop the tool that can read/write the eeprom as a bin
then someone could read an existing ccm and clone it or develop an xdf
if you want to maintain radio silence regarding the "reman pin" we could just make people ask us to prove they aren't just trying to screw over a potential car buyer by fudging the mileage?
just some thoughts what do you think