Results 1 to 15 of 27

Thread: Gm Seed key algorithms

Threaded View

Previous Post Previous Post   Next Post Next Post
  1. #13
    Fuel Injected!
    Join Date
    Mar 2013
    Posts
    1,478
    Code:
    FSR:1000 ; ===========================================================================
    FSR:1000
    FSR:1000 ; Segment type: Pure dataFSR:1000 ; segment FSR
    FSR:1000 org $1000
    FSR:1000 PORTA: fcb $44 ; DATA XREF: __RESET-AC0Dw
    FSR:1000 ; __RESET-A8B4r ...
    FSR:1000 ; Port A data
    FSR:1000 ; cleared at reset
    FSR:1001 DDRA: fcb $F8 ; DATA XREF: __RESET-AC1Bw
    FSR:1001 ; STATBYTESETsub_62B2+Aw
    FSR:1001 ; Data Direction Port A
    FSR:1001 ; loaded with $F8
    FSR:1002 PORTG: fcb $F0 ; DATA XREF: __RESET-AC0Aw
    FSR:1002 ; ADR_PLUSsub_ECEE+F9r ...
    FSR:1002 ; Port G Data
    FSR:1002 ; cleared with reset
    FSR:1002 ; 0 ; 1 ; 2 ; 3 ; 4
    FSR:1003 DDRG: fcb $F ; DATA XREF: __RESET-AC16w
    FSR:1003 ; STATBYTESETsub_62B2+Fw
    FSR:1003 ; Data Direction PortG
    FSR:1003 ; loaded with $07
    FSR:1004 PORTB: fcb $FF ; Port B Data
    FSR:1005 PORTF: fcb $FF ; Data Port F
    FSR:1006 PORTC: fcb $FF ; Data Port C
    FSR:1007 DDRC: fcb $FF ; Data Direction for Port C
    FSR:1008 PORTD: fcb $2D ; DATA XREF: __RESET-AC07w
    FSR:1008 ; OC4I+5E2r ...
    FSR:1008 ; Port D Data
    FSR:1008 ; cleared at reset
    FSR:1009 DDRD: fcb $3F ; DATA XREF: __RESET-AC11w
    FSR:1009 ; STATBYTESETsub_62B2+14w
    FSR:1009 ; Data Direction for Port D
    FSR:1009 ; loaded with $3E
    FSR:100A PORTE: fcb $49 ; I ; Port E Data
    FSR:100B CFORC: fcb 0 ; DATA XREF: STATBYTESETsub_62B2+42w
    FSR:100B ; Compare Force Register
    FSR:100C OC1M: fcb 8 ; DATA XREF: __RESET-ABF8w
    FSR:100C ; STATBYTESETsub_62B2+28w ...
    FSR:100C ; OC1 Action Mask Register
    FSR:100C ; loaded with $08
    FSR:100D OC1D: fcb 0 ; DATA XREF: __RESET-ABF4w
    FSR:100D ; STATBYTESETsub_62B2+2Cw
    FSR:100D ; OC1 Action Data Register
    FSR:100D ; cleared at reset
    FSR:100E TCNTH: fcb $11 ; DATA XREF: __RESET-A5DCr
    FSR:100E ; __RESET-A5D3r ...
    FSR:100E ; Timer Counter Register (High)
    FSR:100F TCNTL: fcb $A2 ; â ; Timer Counter Register (Low)
    FSR:1010 TIC1H: fcb $FF ; Input Capture 1 Register (High)
    FSR:1011 TIC1L: fcb $FF ; Input Capture 1 Register (Low)
    FSR:1012 TIC2H: fcb $FF ; Input Capture 2 Register (High)
    FSR:1013 TIC2L: fcb $FF ; Input Capture 2 Register (Low)
    FSR:1014 TIC3H: fcb $FF ; DATA XREF: IC3I:loc_5055r
    FSR:1014 ; IC3I:loc_5070r
    FSR:1014 ; Input Capture 3 Register (High)
    FSR:1015 TIC3L: fcb $FF ; Input Capture 3 Register (Low)
    FSR:1016 TOC1H: fcb $CF ; ¦ ; DATA XREF: __RESET-A5D6w
    FSR:1016 ; OC1I:loc_50E9r ...
    FSR:1016 ; Output Compare 1 Register (High)
    FSR:1017 TOC1L: fcb $2F ; / ; Output Compare 1 Register (Low)
    FSR:1018 TOC2H: fcb $FF ; Output Compare 2 Register (High)
    FSR:1019 TOC2L: fcb $FF ; Output Compare 2 Register (Low)
    FSR:101A TOC3H: fcb $FF ; Output Compare 3 Register (High)
    FSR:101B TOC3L: fcb $FF ; Output Compare 3 Register (Low)
    FSR:101C TOC4H: fcb $AC ; ì ; DATA XREF: __RESET-A5CDw
    FSR:101C ; OC4Ir ...
    FSR:101C ; Output Compare 4 Register (High)
    FSR:101D TOC4L: fcb $43 ; C ; Output Compare 4 Register (Low)
    FSR:101E TCO5H: fcb $CF ; ¦ ; DATA XREF: OC1I:loc_50FEw
    FSR:101E ; Output Compare 5 Register (High)
    FSR:101F TCO5L: fcb $2F ; / ; Output Compare 5 Register (Low)
    FSR:1020 TCTL1: fcb 3 ; DATA XREF: __RESET-ABEFw
    FSR:1020 ; STATBYTESETsub_62B2+31w ...
    FSR:1020 ; Timer Control Register 1
    FSR:1020 ; loaded with $03
    FSR:1021 TCTL2: fcb 1 ; DATA XREF: __RESET-ABEAw
    FSR:1021 ; Timer Control Register 2
    FSR:1021 ; loaded with $01
    FSR:1022 TMSK1: fcb 0 ; DATA XREF: __RESET-A5C8w
    FSR:1022 ; MAINsub_4F8D+973w ...
    FSR:1022 ; Timer Interrupt Mask Register 1
    FSR:1023 TFLG1: fcb $F8 ; DATA XREF: __RESET-A5DFw
    FSR:1023 ; OC4I+Bw ...
    FSR:1023 ; Timer Interrupt Flag Register 1
    FSR:1024 TMSK2: fcb 3 ; DATA XREF: __RESET-AC3Dw
    FSR:1024 ; ALDL_sub_B822+1F5w ...
    FSR:1024 ; Timer Interrupt Mask Register 2
    FSR:1024 ; loaded with $03
    FSR:1025 TFLG2: fcb $C0 ; DATA XREF: ALDL_sub_B822+3EEw
    FSR:1025 ; DOWNLOAD_BIN_00_01sub_BCB0:loc_BCD9r ...
    FSR:1025 ; Timer Interrupt Flag Register 2
    FSR:1026 PACTL: fcb 0 ; Pulse Accumulator Control Register
    FSR:1027 PACNT: fcb 0 ; Pulse Accumulator Count Register
    FSR:1028 SPCR: fcb $54 ; DATA XREF: __RESET-ABD6w
    FSR:1028 ; OC4I+C4w ...
    FSR:1028 ; Serial Peripheral Control Register
    FSR:1028 ; loaded with $44
    FSR:1029 SPSR: fcb $80 ; DATA XREF: OC4I+D2r
    FSR:1029 ; OC4I+E8r ...
    FSR:1029 ; Serial Peripheral Status Register
    FSR:102A SPDR: fcb 0 ; DATA XREF: OC4I+D5w
    FSR:102A ; OC4I+E1r ...
    FSR:102A ; SPI Data Register
    FSR:102B BAUD: fcb $13 ; DATA XREF: __RESET-AC02w
    FSR:102B ; STATBYTESETsub_62B2+19w
    FSR:102B ; Baud Rate
    FSR:102B ; loaded with $13
    FSR:102C SCCR1: fcb 0 ; DATA XREF: STATBYTESETsub_62B2+3Fw
    FSR:102C ; SCI Control Register
    FSR:102D SCCR2: fcb 8 ; DATA XREF: __RESET-A5E4w
    FSR:102D ; OC4I+5D8w ...
    FSR:102D ; SCCR2 - SCI Control Register 2 $102D
    FSR:102D ; RESET: 0 0 0 0 0 0 0 0
    FSR:102D ;
    FSR:102D ; $80 TIE - Transmit Interrupt Enable
    FSR:102D ; 0 = TDRE interrupts disabled
    FSR:102D ; 1 = SCI interrupt requested when TDRE status flag is set
    FSR:102D ; $40 TCIE - Transmit Complete Interrupt Enable
    FSR:102D ; 0 = TC interrupts disabled
    FSR:102D ; 1 = SCI interrupt requested when TC status flag is set
    FSR:102D ; $20 RIE - Receiver Interrupt Enable
    FSR:102D ; 0 = RDRF and OR interrupts disabled
    FSR:102D ; 1 = SCI interrupt requested when RDRF flag or the OR status flag is set
    FSR:102D ; $10 ILIE - Idle-Line Interrupt Enable
    FSR:102D ; 0 = IDLE interrupts disabled
    FSR:102D ; 1 = SCI interrupt requested when IDLE status flag is set
    FSR:102D ; $08 TE - Transmitter
    FSR:102D ; 0 = Transmitter disabled
    FSR:102D ; 1 = Transmitter enabled
    FSR:102D ; $04 RE - Receiver Enable
    FSR:102D ; 0 = Receiver disabled
    FSR:102D ; 1 = Receiver enabled
    FSR:102D ; $02 RWU - Receiver Wakeup Control
    FSR:102D ; 0 = Normal SCI receiver
    FSR:102D ; 1 = Wakeup enabled and receiver interrupts inhibited
    FSR:102D ; $01 SBK - Send Break At least one c
    FSR:102E SCSR: fcb 0 ; DATA XREF: __RESET-A5ECr
    FSR:102E ; MAINsub_4F8D+FF9r ...
    FSR:102E ; SCSR - SCI Status Register $102E
    FSR:102E ; TDRE TC RDRF IDLE OR NF FE -
    FSR:102E ; RESET: 1 1 0 0 0 0 0 0
    FSR:102E ;
    FSR:102E ; $80 TDRE - Transmit Data Register Empty Flag
    FSR:102E ; This flag is set when SCDR is empty. Clear the TDRE flag by reading SCSR and then
    FSR:102E ; writing to SCDR.
    FSR:102E ; 0 = SCDR busy
    FSR:102E ; 1 = SCDR empty
    FSR:102E ; $40 TC - Transmit Complete Flag
    FSR:102E ; 0 = Transmitter busy
    FSR:102E ; 1 = Transmitter idle
    FSR:102E ; $20 RDRF - Receive Data Register Full Flag
    FSR:102E ; . 0 = SCDR empty
    FSR:102E ; 1 = SCDR full
    FSR:102E ; $10 IDLE - Idle Line Detected Flag
    FSR:102E ; 0 = RxD line is active
    FSR:102E ; 1 = RxD line is idle
    FSR:102E ; $08 OR - Overrun Error Flag
    FSR:102E ; 0 = No overrun
    FSR:102E ; 1 = Overrun detected
    FSR:102E ; $04 NF - Noise Error Flag
    FSR:102E ; 0 = Unanimous decision
    FSR:102E ; 1 = Noise detected
    FSR:102E ; $02 FE - Framing Error
    FSR:102E ; 0 = Stop bit detected
    FSR:102E ; 1 = Zero detected
    FSR:102E ; $01 empty
    FSR:102F SCDR: fcb $6D ; DATA XREF: __RESET-A5E9r
    FSR:102F ; MAINsub_4F8D+FFCw ...
    FSR:102F ; SCDR - SCI Data Register $102F
    FSR:102F ; Bit 7 6 5 4 3 2 1 Bit 0
    FSR:102F ; R7/T7 R6/T6 R5/T5 R4/T4 R3/T3 R2/T2 R1/T1 R0/T0
    FSR:102F ; RESET: I I I I I I I I
    FSR:1030 ADCTL: fcb $87 ; DATA XREF: __RESET-AB26w
    FSR:1030 ; __RESET-AB0Aw ...
    FSR:1030 ; A_D Control Register
    FSR:1031 ADR1: fcb $73 ; DATA XREF: __RESET-AB1Fr
    FSR:1031 ; __RESET-AB03r ...
    FSR:1031 ; ADR
    FSR:1031 ; #5-0 AD TPS
    FSR:1031 ; #5 01 AD MAP
    FSR:1031 ; #5-2 AD COOLANT=byte_109, filtr....
    FSR:1031 ; #5-3 AD =byte_10a,Byte_255 fitr Byte_256-258,word_25d-26b
    FSR:1031 ; #6 L02 ad
    FSR:1031 ; #7 R02 ad
    FSR:1031 ; #7-1 AD ??=byte_118,filt=1b15,1b16
    FSR:1031 ; #7-7?? ad TRANSMISSION INPUT VOLTS
    FSR:1031 ; #$10 ad ac press, egr ad pos
    FSR:1032 ADR2: fcb $73 ; DATA XREF: OC4I+69r
    FSR:1032 ; ADR_PLUS_IGN_OFF_CHECKsub_EA91+40r
    FSR:1032 ; A_D Result Register 2
    FSR:1033 ADR3: fcb $72 ; DATA XREF: OC4I+6Er
    FSR:1033 ; ADR_PLUS_IGN_OFF_CHECKsub_EA91+13r ...
    FSR:1033 ; A_D Result Register 3
    FSR:1034 ADR4: fcb $73 ; DATA XREF: OC4I+73r
    FSR:1034 ; ADR_PLUS_IGN_OFF_CHECKsub_EA91+52r
    FSR:1034 ; A_D Result Register 4
    FSR:1035 BPROT: fcb $11 ; DATA XREF: __RESET-AC3Aw
    FSR:1035 ; __RESET:loc_4290w
    FSR:1035 ; Block Protect Register
    FSR:1035 ; byte_200=$AA load with $10
    FSR:1035 ; byte_200=$55 load with word_201E first byte
    FSR:1035 ; byte_200=not $AA or $55 load with $11
    FSR:1036 RESERV36: fcb 0 ; RESERVED
    FSR:1037 RESERV37: fcb 0 ; RESERVED
    FSR:1038 OPT2: fcb 0 ; DATA XREF: __RESET-ABDBw
    FSR:1038 ; STATBYTESETsub_62B2+4Bw
    FSR:1038 ; System Configuration Options 2
    FSR:1038 ; cleared at reset
    FSR:1039 OPTION: fcb $99 ; DATA XREF: __RESET-AC42w
    FSR:1039 ; System Configuration Options
    FSR:1039 ; loaded with $99
    FSR:103A COPRST: fcb 0 ; DATA XREF: sub_3B04+25w
    FSR:103A ; sub_3B04+2Aw ...
    FSR:103A ; Arm_Reset COP Timer Circuitry
    FSR:103B PPROG: fcb 0 ; DATA XREF: MAINsub_4F8D+109Ew
    FSR:103B ; MAINsub_4F8D+10AAw ...
    FSR:103B ; EEPROM Program Control Register
    FSR:103C HPRIO: fcb $35 ; DATA XREF: __RESET-AC20w
    FSR:103C ; STATBYTESETsub_62B2+23w
    FSR:103C ; Highest Priority I-Bit Int and Misc
    FSR:103C ; loaded with $15
    FSR:103D INIT: fcb 1 ; DATA XREF: __RESET-AC47w
    FSR:103D ; RAM and I_O Mapping Register
    FSR:103D ; loaded with $01
    FSR:103E TEST1: fcb 0 ; Factory Test

    These are the registers ID you might be missing.
    The multiplexer configuration varies by pcms so I can`t help much on that. Maybe a some high res pictures on the 97 pcm board can be used for comparison.
    Code:
    ldx #PORTG [$1002] ; L02 AD
    bclr 0,x 7
    ldaa #3
    oraa 0,x
    staa 0,x
    sei
    ldaa #6
    staa ADCTL [$1030] ; A_D Control Register
    mul
    mul
    mul
    nop
    ldaa ADR1 [$1031] ; A_D Result Register 1
    staa byte_124
    Does this make more sense. Anyway you should trace the channels on the board hardware. Robertisaar has done that on similar 94 v6 pcm, but he is not very active lately.


    Most of the code is data coversion, table lookup and interpolation. There is a lot of obd2 stuff that really does nothing. Much easier is to focus on result of the subroutine and the purpose of it.


    Easiest for 1's and 2's for me is ...

    calc_acc = ~calc_seed; // One's
    calc_acc = -calc_seed; // Two's
    Does this add 1 to the final result. You said it is off by one. Is it off by +1 or -1 on 2`s complement.
    Last edited by kur4o; 01-11-2019 at 11:29 PM.

Similar Threads

  1. Getting seed/key on locked pcm brute force style
    By mecanicman in forum OBDII Tuning
    Replies: 21
    Last Post: 06-29-2014, 08:24 AM

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •