Corvette CCM Reverse Engineering Anyone?

**spfautsch** · 10-10-2022

You're good:

Code:

Got reply to command: [DEV:f1] 05 AA

Means the CCM unlocked for mode 06. If you do nothing it will reboot if you don't upload code to RAM within a certain time window.

Edit: Actually, after thinking about it, when I reprogrammed mine in-car with the hotwire it blanked out the LCD as soon as unlock / mode 5 was entered. Either way, you're good to program eeprom at that point.

**-=Jeff=-** · 10-10-2022

Currently I am using Key inserted to wake CCM. Walking through VATs..

Here is my messy bench set up. Currently I have a 1991 CCM and my 1990 LT5 Cluster. I have a 94 LT1 cluster for testing as well

**spfautsch** · 10-10-2022

You haven't seen "messy". You simply haven't lived until you've lost $1k worth of hardware because you were working on a phase 3 project that was sitting on top of a pile of phase 1 and 2 and wires got crossed. :-)

Edit: I just broke out my wife's winblows laptop to see if I could get a Qt toolchain to install. I think I just vomited in my mouth a little bit while typing that...

**-=Jeff=-** · 10-10-2022

Originally Posted by spfautsch

You haven't seen "messy". You simply haven't lived until you've lost $1k worth of hardware because you were working on a phase 3 project that was sitting on top of a pile of phase 1 and 2 and wires got crossed. :-)

Edit: I just broke out my wife's winblows laptop to see if I could get a Qt toolchain to install. I think I just vomited in my mouth a little bit while typing that...

LOL, what do you usually use?

**spfautsch** · 10-10-2022

I sold my soul to Linus Torvalds back in 2008. He told me it was worthless and never cashed the check either. I suppose I should be offended, but it's the one thing I'll never find a reason to complain about.

**steveo** · 10-10-2022

You haven't seen "messy"

i wrote eehack in a 600 sq ft apartment with a bunch of crap duct taped and tiestrapped into a desk drawer. an elaborate test bench would take away development time

now as far as the unlock thing.. best to just make it a flag.

in processor_ccm.cpp, add this to get_parameter_list() function:

Code:

  out.append(parameter_def("CCM_VERIFY_UNLOCK","Verify CCM Unlock",
                           "This tries to determine if the CCM has been properly unlocked before programming.  "
                           "Try disabling this if your revision of CCM has been properly unlocked but still will not program.",
                           parameter_def::SWITCH,true));

and in flash_write, find this:

Code:

  if(verify_unlock() == false) {

change it to this:

Code:

  if(get_switch("CCM_VERIFY_UNLOCK") == true && verify_unlock() == false) {

**-=Jeff=-** · 10-10-2022

Current version with the checks should work with the 1994 CCM right? Helping my friend out today and will find out if swapping the flag (LT1 vs LT5 ) fixes the CCM issue in his car

**spfautsch** · 10-10-2022

Very cool steveo - I never noticed that list was populated from code.

jeff I didn't test write the 94 yesterday before modding the code so no idea. I would guess yes.

Working on steveo's suggestion now, might have a working windows build shortly.

**-=Jeff=-** · 10-10-2022

sounds good

**NomakeWan** · 10-11-2022

Originally Posted by spfautsch

I was addressing this to NomakeWan to explain his observations - if you're getting a F0 heartbeat with the arduino simulating the ECM and can connect with flashhack you should be good to go.

Thanks! Did you get a chance to check those resistance values? I know you've been pretty busy with this stuff over the past few days, so figure I'll just give a gentle reminder.

With the flash-based thing, it could be. I never actually tried disabling VATS in the tune and then checking the idle messages. It might do the exact same thing my Arduino sketch does--just send FFFF automatically.

As for the issue with '92 cars, I wrote the 92-93 code blind. I had one guy with a 92 send me an idle message and compared it to what I already knew from 1990 and 1994-1995. So it should work, but has never actually been tested to work. Jeff is the first person to try to make a 92-93 happy with my code. It may require tweaking.

I also found a minor issue with Flashhack while diagnosing a problem on my car today, but I'll toss that into its own thread. It's not related to the CCM.

**-=Jeff=-** · 10-11-2022

Failure!!

So I went and downloaded the BIN form a 1994 LT1 CCM. it had been sent out for updating, the VIN was corrected as was the mileage. I read it. saved it.. changed it for a LT5 saved the BIN, added the Reman wire, wrote an $F1 05 to confirm it was ready and then I wrote Programmed it ( so I thought) well the LT5 flag did not take. I tried it twice. I have the CCM with me, but cannot experiment on that one, I can on the others I have. I went to the CCM EEPROM, loaded BIN ,write BIN and it was fast, then I tried again and wrote the whole BIN.. nothing changed on the flag.

DId I do something wrong or has that not been tried.. I am willing to test things on one of the 1992 CCMs.. it have be the sacrificial one if needed

Also NomakeWan, there is still something weird with the simulator, it worked, I could swap CCMs back and forth, cycle power ETC.. As soon as I put 1990 code then back to 1992 it is not working.

Now I might have some of the Serial lines swapped.. Where does the diode connect? TX or RX, same with 1K. maybe I have them swapped (need to check)

**NomakeWan** · 10-11-2022

Originally Posted by -=Jeff=-

Also NomakeWan, there is still something weird with the simulator, it worked, I could swap CCMs back and forth, cycle power ETC.. As soon as I put 1990 code then back to 1992 it is not working.

Now I might have some of the Serial lines swapped.. Where does the diode connect? TX or RX, same with 1K. maybe I have them swapped (need to check)

Again, it was never tested on a 92. You are the first person to attempt it. I think it's right but since I didn't have a 92 to test with there was no way to be sure.

It should work perfectly on a 90 since the 90 code was based on a GM specification. It should work perfectly on a 94-96 since that's what I originally wrote the code to handle. 92-93 however are a total mystery. I'd have to see more idle traffic from one to be sure.

As far as the code goes, it's super basic and simple. There shouldn'e be a way to 'break' it, there's just ways to forget to change a value here and there when switching between years. Make doubly sure that all the appropriate vaules match per the header documentation.

With the physical connection, the code does not require any diodes whatsoever. It is designed to allow you to plug the Arduino directly into the ALDL lines. It does this by controlling the registers for the RX/TX ports directly, so that the Arduino tri-states the TX pin and thus doesn't hold the line high and kill the bus as would normally happen. Since ALDL is 5V the signal levels are perfectly safe on the Mega 2560 with no shifting. So if you're using my code verbatim, you should just be able to wire RX and TX directly to your ALDL line(s) and it'll do the job.

**-=Jeff=-** · 10-11-2022

NomakeWan.. cool will try it directly

Another question, I know the LT5 and LT1 (LT5 and L98) complain. If there are not Correct. So I am wondering if there is a handshake we are missing? Dunno sort of new to this stuff but really would like to find out why the CCM (95) did not program, it was done in the car

**spfautsch** · 10-11-2022

Originally Posted by -=Jeff=-

... I read it. saved it.. changed it for a LT5 saved the BIN, added the Reman wire, wrote an $F1 05 to confirm it was ready and then I wrote Programmed it ( so I thought) well the LT5 flag did not take.

Can you send me the .bin you attempted to write pls (will PM you my email). I can try writing it to the donor CCM. Also, please turn on the 'Comms' debugging and copy / paste that logging info when you're asking for help with flashhack. Otherwise we have no way to sanity check your question.

You should never need to force a full write.

NomakeWan: I haven't forgotten about the 8051 PCM, will make every effort to open it up tomorrow and investigate as well as look into the security loop messaging. Sorry I've been awol but Saturday was picture perfect weather and a car show I made a commitment to attend so the entire day was spent on that. Yesterday was almost entirely spent re-assembling the CCM / PCM test bench. I just managed to get a test build for windows working for jeff to test.

**NomakeWan** · 10-11-2022

Originally Posted by -=Jeff=-

Another question, I know the LT5 and LT1 (LT5 and L98) complain. If there are not Correct. So I am wondering if there is a handshake we are missing? Dunno sort of new to this stuff but really would like to find out why the CCM (95) did not program, it was done in the car

This I am actually super curious about as well. The error about L98/LT5 exists in the 1990 CCM, but there is no bit in the ECM reply message specifying engine type. There is, however, mention that something in the reply message tips the CCM off as to which ECM it's talking to. Unfortunately my information does not actually specify explicitly what this data would be. However, you are correct that something in the datastream allows the CCM to know whether it's talking to the L98 or LT5 ECM.

Originally Posted by spfautsch

NomakeWan: I haven't forgotten about the 8051 PCM, will make every effort to open it up tomorrow and investigate as well as look into the security loop messaging. Sorry I've been awol but Saturday was picture perfect weather and a car show I made a commitment to attend so the entire day was spent on that. Yesterday was almost entirely spent re-assembling the CCM / PCM test bench. I just managed to get a test build for windows working for jeff to test.

No worries, I had a feeling it was that. I only just got back to the thread today and saw how much the two of you had gone back and forth, so totally understandable. Thanks again!