Corvette CCM Reverse Engineering Anyone?

[spfautsch]

Exactly. Same reason why I (and others) have reported difficulties logging ALDL data with an 8051 PCM in a Y body. Impedance mismatch.

I've been working on logging some broadcast traffic after reflashing my testbench 1333 with vats enabled. But as luck would have it my laptop decided to do something weird and now after having to pull the (non-removable) battery to revive it, the ctrl keys quit working. Pretty difficult to use as ctrl is the one key I use more than any other save maybe the space bar. :-(

[kur4o]

I will have some time soon, and might do some dissasembly for previous years. What needs to be done. Porting some switches from later bins to earlier should be pretty straightforward, when we have one of them defined.

[spfautsch]

I think if you could help us locate the location of the reman pin register that would be awesome. For the 94-96 units you determined it was at $644b bit 2. There are a few rom dumps staring around post 411 of this thread.

Then maybe we can build a list of PROMIDs to determine where to look to see if the reman pin is in the correct state for unlock.

I'm still working through testing with and without the VATS options on and off in my PCM tune (@ $2028 and $12017). There's definitely something to this because with it enabled there's no way to get the CCM to shutup without the correct passkey resistor.

[-=Jeff=-]

I'm still working through testing with and without the VATS options on and off in my PCM tune (@ $2028 and $12017). There's definitely something to this because with it enabled there's no way to get the CCM to shutup without the correct passkey resistor.

Are you getting messages other than the $40/$41 and $10?

I have found the Bit to switch between L98/LT5 on the ECM stream. I will grab data from a 1995 ZR-1 to try and find the bit location.

I have a couple friends with the 92 which I will do the same

Although this is more for the Arduino Simulator NomakeWan made

[spfautsch]

I'll try to sit down later tonight and get better logging / documentation. It's been a struggle to function without any ctrl keys - feels like I've had my pinky fingers cut off. Copying or pasting is a 10-15 millisecond event with a ctrl key. Having to use a mouse for this same operation is exquisite torture.

[spfautsch]

I didn't get to a point I was satisfied with on this tonight, sorry. Gotta go pay my wife some attention or I'll be sleeping on the dog's bed tomorrow night.

Anyway, I'll have to recompile flashhack to extend the idle scan time quite a bit because I wasn't always seeing 41 responses from the PCM presumably due to it being in a non-engine-running state, or maybe it's just how flashhack tries to re-sync to the datastream. I'll revisit again tomorrow night or the next day.

Whatever the outcome on that front, there's a very clear difference in the initial handshake data with VATS disabled in the PCM. I think it would be good to know the specific details of how this security loop works.

[steveo]

feel free to beat on datastream_8192::resync_datastream. it's a bit confusing and terrifying and like anything you touch will break it, and you corvette nerds are the only reason that it is like that. you could throw some log entries in there to see what's happening along the way.