OBD2 LT1 XDF $EE EEX creation

[Tom H]

Hi,

Still at looking through the '97 Flash code. Are the response codes known? Look at this code segment

*************************************************
* SEND MESSAGE: 
*************************************************
1B80  CC 80 86           LDD    #$8086        ; SUB-PARAMEATER 80 = D/L & EXECUTE
1B83  DD 15              STD    @$15        ; 

1B85  CC 18 76           LDD    #$1876        ; TSIDE MODE 36 REPLY
1B88  DD 13              STD    @$13        ; 

1B8A  C6 06              LDAB    #$06        ; MESSAGE LENGTH
1B8C  BD 02 3E           JSR    $023E        ; SEND MESSAGE TO DLC

1B8F  CE 03 FF           LDX    #$03FF        ; ZERO THE INTERNAL RAM
1B92  6F 00              CLR    $00,X        ; 
1B94  09                 DEX            ; 
1B95  26 FB              BNE    $1B92        ; 
1B97  6F 00              CLR    $00,X        ; 

1B99  CE 40 00           LDX    #$4000        ; SEND BREAK SYMBOL
1B9C  FF 10 60           STX    $1060        ; FROM DLC

1B9F  20 FE              BRA    $1B9F        ; LOOP UNTIL WATCHDOG HITS


This results in a reply of 6C F0 18 76 80 86
                            |  |  |  |  |  |
Priority -------------------   |  |  |  |  |
Destination tester ------------   |  |  |  |
Source TSide ---------------------   |  |  |
Reply to mode 36 -------------------    |  |
Submode D/L & execute ------------------   |
Code unknown to me ------------------------

Do we have any info regarding the reply code? The one shown sends the message just before returning to normal operation with a watchdog reset. My guess it is a "done and happy" message.

-Tom

[kur4o]

We will separate the response in 2 parts. 1st ones are comming from the main comm loop, The second ones coming from the write,erase code.

from write,erase code we have

8085, there is error writing erasing the requested data.
8086, success send next block on write
8086, erase completed with success

7678, erase progress message.

From the main loop there is bunch more

7441 submode out of range
7443 upload size out of range
7442 upload address out of range
7444 mode34 success, upload enabled

7677 block checksum not good, resend
7678 upload good, will execute code now[for upload and execute]
7673 upload good, send next block[for upload only]

AAE0 on mode a0 request

Some more hint on using IDA.

You can open hex view and synchronize with ida view-a. You can edit the hex data in hex view. You can edit the input file and reload it in ida. It will take into account the mods. You can write code in hex in hex view and disassemble it and check for errors.
You can copy hex data from hex view.

Press space and it will switch the graph view. Extremely handy to trace code flow.

The file that have no extension in the archive I have uploaded is the hex file being disassembled. That is the load file, You can modify it and reload in ida from file/load file/reload the input file/