Corvette CCM Reverse Engineering Anyone?

[spfautsch]

Any idea if the C68 programmer responds to anything? I seem to recall you telling me it wasn't attached to the aldl, but my 95 fsm show pins 9 & 10 connecting to the bus.

I'll try to do some experimenting later today or tomorrow. My plan today is pulling both of the climate control pieces out to replace the caps and bulbs. I'd like to go out and put some miles on the CCM just for fun, but it's raining so I might as well get this done.

Here's a "clean" dump of the reman ccm. Well, sort of clean - I forgot to erase the doodles I wrote to the unused FF bytes.

[BlackW1dow]

Alright a question probably only this thread could answer…. So I am wanting to do the 24x torque head coil conversion kit for my 92 corvette. Based on what the company told me it only works on 94-96 corvettes because of CCM comparability issues. From what I have been told after doing a idle CCM data pull it’s almost identical to the 94 CCM. Why would that kit not work for a 92 if the CCM’s are so similar.

Would what y’all are doing reverse engineering the CCM’s solve this issue in the future?

[steveo]

i found another corvette enthusiast that i've been helping out too, so we have another dump coming.
would it be helpful if we had RPO sheets for any of these to do some feature association? might help figure out a few config flags? or are we already way past that

[kur4o]

i found another corvette enthusiast that i've been helping out too, so we have another dump coming.
would it be helpful if we had RPO sheets for any of these to do some feature association? might help figure out a few config flags? or are we already way past that

I can get rpo codes from vin stored in the file, so it won`t be an issue if there is a need to see the options.

[spfautsch]

I think it's a little soon to say, but here's what I'm basing the two option bytes on, from the A297.DS file:

..PAGE
..HEAD02L CCM ALDL DATA LIST 
..HEAD03L NUMBER OF DATA WORDS - 23
..HEAD04L CCM ALDL MODE 1 DATA LIST (MESSAGE 1)
 BYTE  BIT  DESCRIPTION
 ----  ---  -----------
 1          FIRST PROM ID WORD (MSB)
 2          SECOND PROM ID WORD (LSB)
 3-19       VEHICLE IDENTIFICATION NUMBER

 20    0    REAL TIME DAMPING          0 = NO        1 = YES
       1    ANTI-LOCK BRAKES           0 = NO        1 = YES
       2    ELECTRONIC THROTTLE CONTROL              1 = YES
       3    RESERVE FUEL INDICATION    0 = NO        1 = YES
       4    OVERSPEED WARNING          0 = YES       1 = NO
       5    SPEEDOMETER BIASING        0 = YES       1 = NO
       6    ROUGH ROAD DETECTION       0 = NO        1 = YES
       7    NOT USED

 21    0    ENGINE                     0 = LT1       1 = LT5
       1    TRANSMISSION               0 = AUTO      1 = MANUAL
       2    MAGNETIC SPEED-DEPENDANT VARIABLE ASSIT  1 = PRESENT
       3    HVAC                       0 = C60       1 = C68
       4    LOW TIRE PRESSURE WARINING SYSTEM        1 = PRESENT
       5    SELECTIVE RIDE SYSTEM                    1 = PRESENT
       6    POWER SEAT, DIRVER SIDE                  1 = PRESENT
       7    POWER SEAT, PASSENGER SIDE               1 = PRESENT

 22    0    NOT USED
       1    NOT USED
       2    NOT USED
       3    NOT USED
       4-7  NOT USED

 23    0-7  NOT USED

Bytes 20 and 21 match $b6c6-$b6c8 pretty much exactly. The only "mainstream" head scratcher is the C68 option which seems like was standard equipment after 90 or 92. Everything else that was optionally available before 97 was incredibly rare save the FX3 (selective ride system). NomakeWan's 94 has this and the bit's cleared on the dump he posted. I have a message out to someone with a 92 ZR-1 with the FX3, but he would need hand-holding and his wife is in the hospital with cancer / chemo + covid so I think I'm going to leave him to be with his wife for the moment.

Everything else was either not available, or doesn't make any difference to the unit.

Real time damping wasn't an option until much later afaik.
ABS might have been a delete-able option but would have been a special order
ETC didn't come into the picture until the LS1 in 97
Bits 4-6 are all 1s in everything we have

In byte 21 the engine option was pretty obvious. I think this one is probably the most complained about fault code with a mis-configured ccm.
Transmission seems documented well enough
Electric power steering was also not available until 200?
C68 versus manual A/C controls is still a grey area, but I think not relevant to the function of the module since all our cars have it but none have this bit set
TPMS was a very rare option so may have some bearing on things - good luck finding someone with that option
FX3 seems to not have bearing on the ccm function
The power seat options are irrelevant because there are no inputs / outputs it could possibly effect

I'm still open to discussion on how to handle the reman pin location and whether to include (odometer) in the .xdf. An "experimental" version is attached.

[steveo]

this is really awesome. nobody hacks body control modules.

for the reman pin i would not think its dirtier information than anything else we do with these modules. im in a country where reverse engineering for repair purposes is legal. totally your find and your call. but if you are that worried maybe just start really detailed rumors and let someone else do it.

if the general cared that much they would have put some proper protection on it.

my main concern is scumbags rolling odos back

[steveo]

speaking of odometers, i see you managed to wipe it, but did you actually decipher it? if not, i'd like to help with that too, give me what you've found so far ? i enjoy code breaking this old stuff

[NomakeWan]

Any idea if the C68 programmer responds to anything? I seem to recall you telling me it wasn't attached to the aldl, but my 95 fsm show pins 9 & 10 connecting to the bus.

The C68 programmer never responds to anything and has no ability to talk on the bus. For diagnostic purposes, you can connect a jumper between pin 4 on the HVAC control head and pin 14 on the ALDL connector to allow a Tech 2 to talk to the HVAC Programmer via the E&C Bus. Check section 8A-52-0 of your FSM. The two connections between C9/C10 on the HVAC Programmer and the ALDL are only there to receive the $10 CCM broadcast message and nothing else.

Alright a question probably only this thread could answer…. So I am wanting to do the 24x torque head coil conversion kit for my 92 corvette. Based on what the company told me it only works on 94-96 corvettes because of CCM comparability issues. From what I have been told after doing a idle CCM data pull it’s almost identical to the 94 CCM. Why would that kit not work for a 92 if the CCM’s are so similar.

Would what y’all are doing reverse engineering the CCM’s solve this issue in the future?

Torqhead is correct. As we discussed via PM, your '92 has a different diagnostic message from the 94-96 Corvette. It is three bytes shorter. The CCM's poll request message, however, is identical. To be clear, this means that the message the CCM sends to the ECM is the same as the 94-96, but the reply from the ECM is different. Since the reply is what Torqhead has to account for, that's why their setup won't work for the earlier cars.

Additionally, Torqhead's modified '411 PCM only has connectors for the PCM found in the 94-96 Corvette, not the ECM found in the 92-93 Corvette. So they are absolutely correct that their system would not work for you.

However, should we be able to figure out how to fake that message ourselves with open-source hardware and software, that means we would be able to provide anyone with a 90-96 Corvette the ability to have a working dash with any aftermarket computer, whether that be Torqhead, Holley, Haltech, etc etc etc. So hopefully we can figure that out. Torqhead clearly knows some of the things we'd like to know already, but as they're in the business of making money, I don't think they'd be willing to share that information freely.

[BlackW1dow]

The C68 programmer never responds to anything and has no ability to talk on the bus. For diagnostic purposes, you can connect a jumper between pin 4 on the HVAC control head and pin 14 on the ALDL connector to allow a Tech 2 to talk to the HVAC Programmer via the E&C Bus. Check section 8A-52-0 of your FSM. The two connections between C9/C10 on the HVAC Programmer and the ALDL are only there to receive the $10 CCM broadcast message and nothing else.


Torqhead is correct. As we discussed via PM, your '92 has a different diagnostic message from the 94-96 Corvette. It is three bytes shorter. The CCM's poll request message, however, is identical. To be clear, this means that the message the CCM sends to the ECM is the same as the 94-96, but the reply from the ECM is different. Since the reply is what Torqhead has to account for, that's why their setup won't work for the earlier cars.

Additionally, Torqhead's modified '411 PCM only has connectors for the PCM found in the 94-96 Corvette, not the ECM found in the 92-93 Corvette. So they are absolutely correct that their system would not work for you.

However, should we be able to figure out how to fake that message ourselves with open-source hardware and software, that means we would be able to provide anyone with a 90-96 Corvette the ability to have a working dash with any aftermarket computer, whether that be Torqhead, Holley, Haltech, etc etc etc. So hopefully we can figure that out. Torqhead clearly knows some of the things we'd like to know already, but as they're in the business of making money, I don't think they'd be willing to share that information freely.

Thanks for the response, and it makes some more sense now! Please let me know if I can contribute to the cause anymore. I should have a EPROM dump for another user tomorrow.

[NomakeWan]

If you've already got a dump on the way, then I think you're good. The rest is stuff the analyzing group needs to do. I'm still working on Arduino stuff, while others are working on analyzing the actual code. Hopefully one of them can figure out the $41 CCM poll response through reverse-engineering the dumps. That would be fantastic since there's still several unknowns (bytes 8, 9, 16, 17, 19 and 20 for the 94-96, bytes 8, 9, 16 and 17 for the 92-93).

[steveo]

i could probably help with your tool too nomakewan, i will have an ECM and CCM on the same test bench some time soon and can do some testing/analysis. i feel like the ECM's response to that poll might be better figured out by analysis of the ECM code since we have already done a ton of groundwork there, and i'm sure most of the unknown bytes you're looking for are well defined addresses in memory of EE

[NomakeWan]

i could probably help with your tool too nomakewan, i will have an ECM and CCM on the same test bench some time soon and can do some testing/analysis. i feel like the ECM's response to that poll might be better figured out by analysis of the ECM code since we have already done a ton of groundwork there, and i'm sure most of the unknown bytes you're looking for are well defined addresses in memory of EE

Oh, duh, good point; this is the reply from the ECM, so of course the ECM would have it defined. One would just have to find the routine that fires off data when it receives the $40 poll message. Good point!

I was out all day today but hopefully tomorrow I can run those experiements I was planning on. I'll keep you all posted.

[-=Jeff=-]

Hi all,

NomakeWan pointed me here.. While I am still reading through this thread (currently on page 9) I have some questions and will offer some Help

Including my car (1990 ZR-1) I have 4 CCMs, 2 1990s (both ZR-1 programmed) one 1991 (I think) and one 1992. I know the 1992 is programmed for a LT1 and I want to change it to LT5 and adjust mileage to match my 1990 as i would like to move to the 1992 coding to allow for the additional gauges on the LCD.

I am curious if you have been successful in reprogramming the CCM.. if so I would like to try it..

I am willing to get dumps from the CCMs I have, but not sure how to do that.. but happy to if I can

[NomakeWan]

Getting a dump from your LT5 CCMs would be phenomenal, as would if any of your 4 CCMs were from cars that originally had C60 climate control (manual). I know you have a C60 unit installed in your car right now, but I'm guessing it didn't actually come that way from the factory.

To dump the CCM, you'll need to plug a laptop into your ALDL port and use steveo's flashhack software. It's available here: https://ecmhack.com/flashhack/#Downloads

When you run the program you'll be greeted with a selection window. Choose "ALDL Universal Read" and then click "Run." Then go to Parameters tab -> Device ID and change the value from f4 to f1. Then go back to the Operations tab and click Read Calibration. This will download the entire CCM. You can then save the BIN and toss it up as a forum attachment.

[spfautsch]

NomakeWan I see you added an eeprom car to your collection - cool! Anyway, thanks for helping -=Jeff=- get started dumping memory.

Jeff - it's been a while and I've moved on to other projects so I might be slow to respond but will do everything I can to help. When you get the memory dumped post them up along with everything you know about them except the mileage as I'd like to verify my assumptions without bias of knowing ahead of time.

I've definitely been able to reprogram the '95 CCM. I currently have a '94 along with the harness side connectors thanks to AngryCorvair but have yet to take the time to re-assemble my test bench to dump it's memory. Having the memory dumps from yours will be very beneficial for owners of eeprom based cars (93 and older LT1s, all ZR-1s).

Disclaimer - you will have to open the unit up and short the reman pin to ground to be able to unlock the CCM, but I'm sure NomakeWan mentioned this. I'm sure you also know that getting them out of the car is no picnic.

I cleared up some space in my inbox so PM is now available again.