Corvette CCM Reverse Engineering Anyone?

[spfautsch]

Sorry been busy with other projects - first was replacing laptop keyboard so I have a ctrl key again. :-)

Finally had a chance over the weekend to wire up my aldl logger to the test bench setup and capture some data. This will also give me a decent platform to continue development of the microcontroller code, since I had to do it all in the car last fall. I think I'm going to take a page out of steveo's playbook and screw it all down to a piece of plywood so I don't have to disconnect everything to use my workbench.

Anyway, here are the initial interactions between the (94) CCM and the 1333 PCM.

With VATS enabled in PCM flash, correct PASSKey:

10 59 00 00 00 00 97
40 57 00 00 69
41 67 02 00 00 87 00 00 00 00 00 00 BE 00 04 4A 74 00 A0 A0 0F
10 59 00 00 00 00 97
40 57 3F 8C 9E
41 67 02 00 00 87 00 40 00 00 00 00 BE 00 04 FF FF 00 A0 A0 8F
10 59 08 87 02 00 06
40 57 BA B9 F6
41 67 02 00 00 87 00 41 00 00 00 00 BE 00 04 FF FF 00 A0 A0 8E
10 59 08 87 02 00 06
40 57 FF FF 6B
41 67 02 00 00 87 00 49 00 00 00 00 BE 00 04 FF FF 00 A0 A0 86
10 59 08 87 02 00 06
40 57 FF FF 6B
41 67 02 00 00 87 00 49 00 00 00 00 BE 00 04 FF FF 00 A0 A0 86
10 59 08 87 02 00 06
40 57 FF FF 6B
41 67 02 00 00 87 00 49 00 00 00 00 BE 00 04 FF FF 00 A0 A0 86
10 59 08 87 02 00 06
40 57 FF FF 6B
41 67 02 00 00 87 00 49 00 00 00 00 BE 00 04 FF FF 00 A0 A0 86
10 59 08 87 02 00 06
40 57 FF FF 6B
41 67 02 00 00 87 00 49 00 00 00 00 BE 00 04 FF FF 00 A0 A0 86
F0 56 F1 C9
>F1 56 08 B1

With VATS enabled in PCM flash, incorrect / no PASSKey:

10 59 00 00 00 00 97
40 57 00 00 69
41 67 02 00 00 87 00 00 00 00 00 00 BE 00 04 47 E9 00 A0 A0 9D
10 59 00 00 00 00 97
40 57 47 E9 39
41 67 02 00 00 87 00 40 00 00 00 00 BE 00 04 E1 93 00 A0 A0 19
10 59 08 87 02 00 06
40 57 E1 93 F5
41 67 02 00 00 87 00 40 00 00 00 00 BE 00 04 7B 26 00 A0 A0 EC
10 59 08 87 02 00 06
40 57 7B 26 C8
41 67 02 00 00 87 00 48 00 00 00 00 BE 00 04 14 B8 00 A0 A0 B9
10 59 08 87 02 00 06
40 57 14 B8 9D
41 67 02 00 00 87 00 48 00 00 00 00 BE 00 04 AE 63 00 A0 A0 74
10 59 08 87 02 00 06
40 57 AE 63 58
41 67 02 00 00 87 00 48 00 00 00 00 BE 00 04 47 F4 00 A0 A0 4A
10 59 08 87 02 00 06
40 57 47 F4 2E
41 67 02 00 00 87 00 48 00 00 00 00 BE 00 04 E1 9F 00 A0 A0 05
10 59 08 87 02 00 06
40 57 E1 9F E9
41 67 02 00 00 87 00 48 00 00 00 00 BE 00 04 7B 31 00 A0 A0 D9
10 59 08 87 02 00 06
40 57 7B 31 BD

As steveo found last year, this repeats on forever because neither module ever clears the VATS check.

VATS disabled in PCM flash, incorrect / no passkey:

10 59 00 00 00 00 97
40 57 00 00 69
41 67 02 00 00 87 00 00 00 00 00 00 BE 00 04 FF FF 00 EF EF 31
10 59 00 00 00 00 97
40 57 FF FF 6B
41 67 02 00 00 87 00 41 00 00 00 00 BE 00 04 FF FF 00 EF EF F0
10 59 08 87 02 00 06
40 57 FF FF 6B
41 67 02 00 00 87 00 41 00 00 00 00 BE 00 04 FF FF 00 EF EF F0
10 59 08 87 02 00 06
40 57 FF FF 6B
41 67 02 00 00 87 00 49 00 00 00 00 BE 00 04 FF FF 00 EF EF E8
10 59 08 87 02 00 06
40 57 FF FF 6B
41 67 02 00 00 87 00 49 00 00 00 00 BE 00 04 FF FF 00 EF EF E8
10 59 08 87 02 00 06
40 57 FF FF 6B
41 67 02 00 00 87 00 49 00 00 00 00 BE 00 04 FF FF 00 EF EF E8
10 59 08 87 02 00 06
40 57 FF FF 6B
41 67 02 00 00 87 00 49 00 00 00 00 BE 00 04 FF FF 00 EF EF E8
F0 56 F1 C9
>F1 56 08 B1

VATS disabled in PCM flash, correct PASSKey:

10 59 00 00 00 00 97
40 57 00 00 69
41 67 02 00 00 87 00 00 00 00 00 00 BE 00 04 FF FF 00 EF EF 31
10 59 00 00 00 00 97
40 57 BA B9 F6
41 67 02 00 00 87 00 41 00 00 00 00 BE 00 04 FF FF 00 EF EF F0
10 59 08 87 02 00 06
40 57 FF FF 6B
41 67 02 00 00 87 00 41 00 00 00 00 BE 00 04 FF FF 00 EF EF F0
10 59 08 87 02 00 06
40 57 FF FF 6B
41 67 02 00 00 87 00 49 00 00 00 00 BE 00 04 FF FF 00 EF EF E8
10 59 08 87 02 00 06
40 57 FF FF 6B
41 67 02 00 00 87 00 49 00 00 00 00 BE 00 04 FF FF 00 EF EF E8
10 59 08 87 02 00 06
40 57 FF FF 6B
41 67 02 00 00 87 00 49 00 00 00 00 BE 00 04 FF FF 00 EF EF E8
10 59 08 87 02 00 06
40 57 FF FF 6B
41 67 02 00 00 87 00 49 00 00 00 00 BE 00 04 FF FF 00 EF EF E8
F0 56 F1 C9
>F1 56 08 B1

One thing that I noticed that can't be gleaned from the logging is that with VATS enabled in the PCM, the CCM went to sleep a lot sooner than without it.

I'll probably write up a page on my wordpress site for the logger and post back with updates as I have time to progress. To make something that works across all the 90-95 Y bodies it will need to read the VIN from the CCM at startup so the logger knows what messages are supported, etc.