Corvette CCM Reverse Engineering Anyone?

[spfautsch]

steveo it's over in the flashhack thread [link].

I'm at the office today so won't be able to test anything until this evening.

I didn't mean to make it sound like I was checking out on the project. I do intend to build an .xdf for these. From what I've been able to gather, the 94-96 models are interchangeable. I might try buying a used one for a 90-91 and 92-93 just to verify the location of the reman pin.

I also intend to figure out the vats authentication so the key code can be read on the test bench. I suspect the unit wants to see the key in pin go off at the same time the two ign inputs go high before it checks the adc count. I just haven't taken the time to locate some dpdt switches and make some additional test leads.

I think I need to give some thought to whether to disclose the location or not. Frankly, it's pretty obvious and I'd hate to be the guy that started an avalanche of stupid. On the other hand I think as long as we omit the odometer from the .xdf that should raise the difficulty level enough to keep things sane. People should have to do some work if they want to enjoy the free stuff. What do you guys think?

I will make a suggestion on the write / erase routines steveo. There's so little that needs to be written and the eeprom block is so small, I'd suggest reading the whole thing to memory and diffing with the .bin, then only erasing / writing the necessary bytes. I know it complicates things, but I don't think we want to overwrite the erase counter on a used unit. Just my $0.02.

Edit: after thinking a bit more, it may make sense to only write $b600-$b66c (odometer), $b67f-$b6ca (oil life, vats, option bytes, lockout bit) and the VIN at $b7ef until we know more about what the 33 bytes at $b6cb are.

[spfautsch]

NomakeWan maybe you have some idea on this. I started working on an .xdf and noticed that based on the location in the datastream definition, the C68 option is not set in any of these bins. That's when it occurred to me that these units have a dedicated input for rear defog request. Is it possible this option became irrelevant after 91 or 93?

[NomakeWan]

NomakeWan maybe you have some idea on this. I started working on an .xdf and noticed that based on the location in the datastream definition, the C68 option is not set in any of these bins. That's when it occurred to me that these units have a dedicated input for rear defog request. Is it possible this option became irrelevant after 91 or 93?

The rear defog request hasn't changed between any of the years; it works the same way from 1990 all the way to 1996, and it works the same way regardless of C60 or C68.

My suggestion to you is to change the bit you think is C68, then check the idle datastream for $10 broadcast messages. That should be the only functional difference between a car with C60 and a car with C68 as far as the CCM is concerned. Now, if GM were really cheeky, then it wouldn't actually matter at all since there's no response to the $10 broadcast, but we'll see. I'm going to assume that all four BINs we have (my 94, my 95, your 95, your reman) all had C68. It was the most common RPO. So if we assume that, then it's safe to assume that whatever the HVAC bit is set to is the correct setting for C68, and so the opposite bit must be C60.

[spfautsch]

Any idea if the C68 programmer responds to anything? I seem to recall you telling me it wasn't attached to the aldl, but my 95 fsm show pins 9 & 10 connecting to the bus.

I'll try to do some experimenting later today or tomorrow. My plan today is pulling both of the climate control pieces out to replace the caps and bulbs. I'd like to go out and put some miles on the CCM just for fun, but it's raining so I might as well get this done.

Here's a "clean" dump of the reman ccm. Well, sort of clean - I forgot to erase the doodles I wrote to the unused FF bytes.

[BlackW1dow]

Alright a question probably only this thread could answer…. So I am wanting to do the 24x torque head coil conversion kit for my 92 corvette. Based on what the company told me it only works on 94-96 corvettes because of CCM comparability issues. From what I have been told after doing a idle CCM data pull it’s almost identical to the 94 CCM. Why would that kit not work for a 92 if the CCM’s are so similar.

Would what y’all are doing reverse engineering the CCM’s solve this issue in the future?

[steveo]

i found another corvette enthusiast that i've been helping out too, so we have another dump coming.
would it be helpful if we had RPO sheets for any of these to do some feature association? might help figure out a few config flags? or are we already way past that

[kur4o]

i found another corvette enthusiast that i've been helping out too, so we have another dump coming.
would it be helpful if we had RPO sheets for any of these to do some feature association? might help figure out a few config flags? or are we already way past that

I can get rpo codes from vin stored in the file, so it won`t be an issue if there is a need to see the options.

[NomakeWan]

Any idea if the C68 programmer responds to anything? I seem to recall you telling me it wasn't attached to the aldl, but my 95 fsm show pins 9 & 10 connecting to the bus.

The C68 programmer never responds to anything and has no ability to talk on the bus. For diagnostic purposes, you can connect a jumper between pin 4 on the HVAC control head and pin 14 on the ALDL connector to allow a Tech 2 to talk to the HVAC Programmer via the E&C Bus. Check section 8A-52-0 of your FSM. The two connections between C9/C10 on the HVAC Programmer and the ALDL are only there to receive the $10 CCM broadcast message and nothing else.

Alright a question probably only this thread could answer…. So I am wanting to do the 24x torque head coil conversion kit for my 92 corvette. Based on what the company told me it only works on 94-96 corvettes because of CCM comparability issues. From what I have been told after doing a idle CCM data pull it’s almost identical to the 94 CCM. Why would that kit not work for a 92 if the CCM’s are so similar.

Would what y’all are doing reverse engineering the CCM’s solve this issue in the future?

Torqhead is correct. As we discussed via PM, your '92 has a different diagnostic message from the 94-96 Corvette. It is three bytes shorter. The CCM's poll request message, however, is identical. To be clear, this means that the message the CCM sends to the ECM is the same as the 94-96, but the reply from the ECM is different. Since the reply is what Torqhead has to account for, that's why their setup won't work for the earlier cars.

Additionally, Torqhead's modified '411 PCM only has connectors for the PCM found in the 94-96 Corvette, not the ECM found in the 92-93 Corvette. So they are absolutely correct that their system would not work for you.

However, should we be able to figure out how to fake that message ourselves with open-source hardware and software, that means we would be able to provide anyone with a 90-96 Corvette the ability to have a working dash with any aftermarket computer, whether that be Torqhead, Holley, Haltech, etc etc etc. So hopefully we can figure that out. Torqhead clearly knows some of the things we'd like to know already, but as they're in the business of making money, I don't think they'd be willing to share that information freely.

[BlackW1dow]

The C68 programmer never responds to anything and has no ability to talk on the bus. For diagnostic purposes, you can connect a jumper between pin 4 on the HVAC control head and pin 14 on the ALDL connector to allow a Tech 2 to talk to the HVAC Programmer via the E&C Bus. Check section 8A-52-0 of your FSM. The two connections between C9/C10 on the HVAC Programmer and the ALDL are only there to receive the $10 CCM broadcast message and nothing else.


Torqhead is correct. As we discussed via PM, your '92 has a different diagnostic message from the 94-96 Corvette. It is three bytes shorter. The CCM's poll request message, however, is identical. To be clear, this means that the message the CCM sends to the ECM is the same as the 94-96, but the reply from the ECM is different. Since the reply is what Torqhead has to account for, that's why their setup won't work for the earlier cars.

Additionally, Torqhead's modified '411 PCM only has connectors for the PCM found in the 94-96 Corvette, not the ECM found in the 92-93 Corvette. So they are absolutely correct that their system would not work for you.

However, should we be able to figure out how to fake that message ourselves with open-source hardware and software, that means we would be able to provide anyone with a 90-96 Corvette the ability to have a working dash with any aftermarket computer, whether that be Torqhead, Holley, Haltech, etc etc etc. So hopefully we can figure that out. Torqhead clearly knows some of the things we'd like to know already, but as they're in the business of making money, I don't think they'd be willing to share that information freely.

Thanks for the response, and it makes some more sense now! Please let me know if I can contribute to the cause anymore. I should have a EPROM dump for another user tomorrow.

[-=Jeff=-]

Hi all,

NomakeWan pointed me here.. While I am still reading through this thread (currently on page 9) I have some questions and will offer some Help

Including my car (1990 ZR-1) I have 4 CCMs, 2 1990s (both ZR-1 programmed) one 1991 (I think) and one 1992. I know the 1992 is programmed for a LT1 and I want to change it to LT5 and adjust mileage to match my 1990 as i would like to move to the 1992 coding to allow for the additional gauges on the LCD.

I am curious if you have been successful in reprogramming the CCM.. if so I would like to try it..

I am willing to get dumps from the CCMs I have, but not sure how to do that.. but happy to if I can

[NomakeWan]

Getting a dump from your LT5 CCMs would be phenomenal, as would if any of your 4 CCMs were from cars that originally had C60 climate control (manual). I know you have a C60 unit installed in your car right now, but I'm guessing it didn't actually come that way from the factory.

To dump the CCM, you'll need to plug a laptop into your ALDL port and use steveo's flashhack software. It's available here: https://ecmhack.com/flashhack/#Downloads

When you run the program you'll be greeted with a selection window. Choose "ALDL Universal Read" and then click "Run." Then go to Parameters tab -> Device ID and change the value from f4 to f1. Then go back to the Operations tab and click Read Calibration. This will download the entire CCM. You can then save the BIN and toss it up as a forum attachment.