some food for testing
Send in mode 6 download and execute.
ldaa #YY 86 YY
staa byte_fc 97 fc
ldy xxxx 18 ce XX XX
ldx off_ffb0 fe ff b0 update fix
jsr 0,x ad 00 fix
rtn 39
YY=length of reply message
XXXX= start address to dump data.
We can also set it: when you upload a data, the pcm will write and than read the written data and reply back with the data stored. Something like an echo message.
Last edited by kur4o; 09-30-2021 at 11:41 PM.
Check my work, but no luck. I didn't post all comms but I tried requesting as much as 0x40 and as few as 0x01 bytes returned.
What if we try to get it a reply with some fixed response first, would that help?Code:TX+F15605B4 RX+F15705AA09 TX+F166066000864097FC18CEB683FEFFB0AD003938 RX+NO REPLY TX+F15605B4 RX+F1570500B3 TX+F15605B4 RX+F15705AA09 TX+F166066000864097FC18CE7083FEFFB0AD00397E RX+NO REPLY TX+F15605B4 RX+F1570500B3
My original unit has all new tantalum caps. I'm probably going to put a "cheater wire" in before I put it back in the car so I can test mode 5 / 6.
Just wanted to drop back in with a non-technical post now that I've accomplished what I set out to do - have a replacement ccm that's actually programmable. Open source tools are just the icing on the cake. As I've indirectly stated previously, I'm not interested in the odometer tangent any farther than it pertains to being able to erase the mode 5 lockout.
First off, huge thanks to NomakeWan, steveo and kur4o for your insatiable curiosity and immense knowledge and patience. Without your contribution I'd surely still be banging my head against the wall. Blue Streak Electronics can also be begrudgingly thanked for making the ridiculous mistake of selling me a part through RockAuto that was supposedly "plug-and-play, no programming required". Shame on you.
Even if I find later that I haven't fixed my battery drain issue, I'm extremely happy with the outcome. I may or may not try advertising ccm reprogramming services over on cf at a very cheap rate, mainly to generate a source for donor eeprom / uveprom dumps. If anyone objects voice your opinion here. I just want to learn more, and if I can do that while providing a service at a reasonable price, no-one loses.
NomakeWan if you want to take it further and perhaps engineer a patched ROM for the 411 swap guys you have my blessing and support. I'm not planning on desoldering the uveprom, but I'd be happy to loan the module to you if you so desired. No strings attached except that steveo has first dibs.
Last edited by spfautsch; 10-01-2021 at 02:09 AM.
i think i should take your work and develop the tool that can read/write the eeprom as a bin
then someone could read an existing ccm and clone it or develop an xdf
if you want to maintain radio silence regarding the "reman pin" we could just make people ask us to prove they aren't just trying to screw over a potential car buyer by fudging the mileage?
just some thoughts what do you think
Thanks for the offer, but you overestimate my abilities. I think kur4o is the only one among us who would be capable of working on a patched ROM. My ability to decipher assembly is almost nonexistent (I know how to run diffs and look for similar routines to already-known routines but that's about it), and my ability to write assembly is nil. So as much as I would love to help, I am unfortunately without the requisite skill. Not to mention I'd need to know how the bus works on the C5 (which I don't, except that the E&C bus on them apparently still uses 8192 ALDL, albeit at a different voltage level), and I'd need first-hand experience with the '411 (which I don't have either).
I will however be continuing to work with the Arduino angle. If I can at least get that working, it opens up the possibility of letting people run a piggyback to make their CCM happy regardless of what ECM/PCM they're running. Speeduino, Holley, Haltech, '411, you name it. All you need are certain specific outputs and a piggyback can translate those into the answer the CCM is looking for. I think that's the winning angle...but it could also be because that's the limit of my understanding. ;)
Excellent work to all, and I look forward to further progress!
1990 Corvette (Manual)
1994 Corvette (Automatic)
1995 Corvette (Manual)
could you assist with differences between the 1994 and 1995 CCMs and maybe trying to find some 'vette people to get us a few extra example eeprom dumps? i'd like my tools to work with both, and i think i read that they're different. a clean dump from your 1994 and 1995 vette with some feature documentation might be pretty helpful to start
Sure. What's a "clean dump," though? How is a clean dump different from the dumps of my 94 and 95 I already made? I want to make sure I get you guys what you need.Originally Posted by steveo
1990 Corvette (Manual)
1994 Corvette (Automatic)
1995 Corvette (Manual)
Test 2
ldy 18 ce XXXX
ldab c6 YY
ldx off_ffb0 fe ff b0 update fix
jsr 0,x ad 00 fix
rtn 39
XXXX start address of read
YY length
I am sure this one will work. Than we can work out how to make an echo message of the upload.
If you want mode 6 response with aa
18 ce f4 9d c6 01 fe ff b0 ad 00 39
yeah, those
i don't have them, can you remind me where you posted them ?
steveo it's over in the flashhack thread [link].
I'm at the office today so won't be able to test anything until this evening.
I didn't mean to make it sound like I was checking out on the project. I do intend to build an .xdf for these. From what I've been able to gather, the 94-96 models are interchangeable. I might try buying a used one for a 90-91 and 92-93 just to verify the location of the reman pin.
I also intend to figure out the vats authentication so the key code can be read on the test bench. I suspect the unit wants to see the key in pin go off at the same time the two ign inputs go high before it checks the adc count. I just haven't taken the time to locate some dpdt switches and make some additional test leads.
I think I need to give some thought to whether to disclose the location or not. Frankly, it's pretty obvious and I'd hate to be the guy that started an avalanche of stupid. On the other hand I think as long as we omit the odometer from the .xdf that should raise the difficulty level enough to keep things sane. People should have to do some work if they want to enjoy the free stuff. What do you guys think?
I will make a suggestion on the write / erase routines steveo. There's so little that needs to be written and the eeprom block is so small, I'd suggest reading the whole thing to memory and diffing with the .bin, then only erasing / writing the necessary bytes. I know it complicates things, but I don't think we want to overwrite the erase counter on a used unit. Just my $0.02.
Edit: after thinking a bit more, it may make sense to only write $b600-$b66c (odometer), $b67f-$b6ca (oil life, vats, option bytes, lockout bit) and the VIN at $b7ef until we know more about what the 33 bytes at $b6cb are.
Last edited by spfautsch; 10-01-2021 at 11:40 PM.
NomakeWan maybe you have some idea on this. I started working on an .xdf and noticed that based on the location in the datastream definition, the C68 option is not set in any of these bins. That's when it occurred to me that these units have a dedicated input for rear defog request. Is it possible this option became irrelevant after 91 or 93?
Sorry. Again, please verify what I sent is what was intended.
Also, it has occurred to me I probably haven't uploaded a "clean" read either, but I'm getting an imagemagik runtime error when I try uploading. Will try to upload to my wp site later.Code:TX+F15605B4 RX+F15705AA09 TX+F16406600018CEF49DC601FEFFB0AD003974 RX+NO REPLY
Nevermind, I guess the upload worked regardless.
Last edited by spfautsch; 10-02-2021 at 02:23 AM.
The rear defog request hasn't changed between any of the years; it works the same way from 1990 all the way to 1996, and it works the same way regardless of C60 or C68.
My suggestion to you is to change the bit you think is C68, then check the idle datastream for $10 broadcast messages. That should be the only functional difference between a car with C60 and a car with C68 as far as the CCM is concerned. Now, if GM were really cheeky, then it wouldn't actually matter at all since there's no response to the $10 broadcast, but we'll see. I'm going to assume that all four BINs we have (my 94, my 95, your 95, your reman) all had C68. It was the most common RPO. So if we assume that, then it's safe to assume that whatever the HVAC bit is set to is the correct setting for C68, and so the opposite bit must be C60.
1990 Corvette (Manual)
1994 Corvette (Automatic)
1995 Corvette (Manual)
Any idea if the C68 programmer responds to anything? I seem to recall you telling me it wasn't attached to the aldl, but my 95 fsm show pins 9 & 10 connecting to the bus.
I'll try to do some experimenting later today or tomorrow. My plan today is pulling both of the climate control pieces out to replace the caps and bulbs. I'd like to go out and put some miles on the CCM just for fun, but it's raining so I might as well get this done.
Here's a "clean" dump of the reman ccm. Well, sort of clean - I forgot to erase the doodles I wrote to the unused FF bytes.
Alright a question probably only this thread could answer…. So I am wanting to do the 24x torque head coil conversion kit for my 92 corvette. Based on what the company told me it only works on 94-96 corvettes because of CCM comparability issues. From what I have been told after doing a idle CCM data pull it’s almost identical to the 94 CCM. Why would that kit not work for a 92 if the CCM’s are so similar.
Would what y’all are doing reverse engineering the CCM’s solve this issue in the future?
Posting Permissions
Reply With Quote
Bookmarks