OBD2 LT1 XDF $EE EEX creation

[Tom H]

i dont know if the DTC is separate from the misfire detection code flashing the check engine light...it does both

If your car is like the 96/7 Camaro/Firebird, I can give you a suggestion in a few days that *should* stop the lights. Can you tell me what code it is throwing??

[steveo]

i don't have a car
from memory it sets that obd-ii code called random misfire

[kur4o]

More comments added.

[sherlock9c1]

Well, I've got the disassembler open and am looking at the OBD1 code, with a whole lot of help from kur4o. And great work him on the commenting! I need to start an Ibuprofen fund; whew this is new territory for me.

[In-Tech]

More comments added.

Hi kur4o,
My version of ida is so old I cannot view your work. Could I talk you into saving/produce as html so I could view it? My old version of ida used to be able to do that with a keystoke.

[kur4o]

Hi kur4o,
My version of ida is so old I cannot view your work. Could I talk you into saving/produce as html so I could view it? My old version of ida used to be able to do that with a keystoke.

You can check here for a way to open the files or

if you are still having troubles here are some htmls. There is options to export to other formats but don`t what they are.


I managed to find that there are 2 revisions for the 96-97 files[1 for 96 and 1 for 97]. This is valid only for the latest updates by gm so any older p/n for the vin might have different layout.

I am looking for stock bins to confirm there isn`t any older revisions.


For now at least 2 xdfs will be needed.


We can transfer the thread`s topic to xdf and flash creations and we will be spot on with the conversation without spamming the thread.

I hope sherlock9c1 doesn`t mind.

[sherlock9c1]

No worries. Moderators, organize away.

Kur4o, I was just realizing that the BIN I was pattern-matching on was from Tunercat OBD2 (now JET DST). But is the organization of the file arbitary, dependent on what order the EEPROM memories are read? So the blocks might be re-arranged in a different order than what Tunercat OBD2 did?

[kur4o]

I am not sure about the tunercat layout, but the best one might be

tside 2000 ram + bank 0 + bank 1 + bank 2 +eside 2000 ram + eside rom.

For better offset experience eside might be first than tside full binary like

eside full bin with ram + tside full bin with ram.

[Tom H]

We can transfer the thread`s topic to xdf and flash creations and we will be spot on with the conversation without spamming the thread.

OK, here we stay. I have gone through a bunch of the code. Seems like a straight forward implementation of Intel's quick pulse programming / quick erase. Makes figuring it out a breeze.

I am still working through the '95 but I imagine the '97 must be very similar. The routine that is named ERASE2_sub_31D in your file represents the first two blocks of the flow chart. The intent is to program the whole array to zero. Here is the commented code I come up with:

*************************************************
* ERASE
* USE QUICK PULSE PROGRAMMING TO ZERO THE ENTIRE
* FLASH ARRAY. AS PER FIG. 4 & 5 OF THE DATA SHEET
*************************************************
031D  9D 29          	JSR	@$29		; INITIALIZE OC1: 20MS

031F  4F             	CLRA			; 
0320  B7 03 68       	STAA	$0368		; 

0323  DE 12          	LDX	@$12		; FLASH END ADDRESS
0325  08             	INX			; 

0326  09             	DEX			; PROGRAM NEXT LOCATION

0327  4F             	CLRA			; INITIALIZE PULSE COUNT
0328  36             	PSHA			; 

0329  9D 26          	JSR	@$26		; CHECK AND CLEAR OC1

032B  32             	PULA			; 

032C  27 0F          	BEQ	$033D		; OC1 MATCH NOT SET
032E  7C 03 68       	INC	$0368		; 
0331  F6 03 68       	LDAB	$0368		; 
0334  C1 05          	CMPB	#$05		; 
0336  25 05          	BCS	$033D		; 

0338  8D D0          	BSR	$030A		; SEND IN PROGRESS MESSAGE

033A  7F 03 68       	CLR	$0368		; 

033D  9D 1D          	JSR	@$1D		; MAKE FLASH OE INACTIVE

033F  C6 40          	LDAB	#$40		; FLASH COMMAND SEQUENCE
0341  E7 00          	STAB	$00,X		; COMMAND: SET UP PROGRAM
0343  C6 00          	LDAB	#$00		; 
0345  E7 00          	STAB	$00,X		; PROGRAM LOCATION TO $00

0347  9D 17          	JSR	@$17		; RESET WATCHDOG TIMERS

0349  C6 C0          	LDAB	#$C0		; FLASH COMMAND: PROGRAM VERIFY
034B  E7 00          	STAB	$00,X		; 

034D  9D 1A          	JSR	@$1A		; MAKE FLASH OE ACTIVE

034F  E6 00          	LDAB	$00,X		; READ BACK LOCATION
0351  27 07          	BEQ	$035A		; SUCCESS, LOCATION IS $00

0353  4C             	INCA			; INCREMENT PULSE COUNT
0354  81 19          	CMPA	#$19		; 25 PULSES
0356  23 E5          	BLS	$033D		; TRY AGAIN
0358  20 09          	BRA	$0363		; PROGRAMMING ERROR

035A  9C 10          	CPX	@$10		; FLASH BASE ADDRESS
035C  26 C8          	BNE	$0326		; LOOP THROUGH REST OF ARRAY

035E  CC 00 00       	LDD	#$0000		; NO MESSAGE, SUCCESS ARRAY IS NOW
0361  20 03          	BRA	$0366		; ZEROED OUT, READY FOR QUICK PULSE ERASE

0363  CC 06 06       	LDD	#$0606		; MODE 6 MESSAGE: PROGRAMMING ERROR

0366  39             	RTS			; DONE

0367  00             				; 
0368  00             				;

I assume the routines that are given between $0400 and $1810 are for the GM test gear. Planning to ignore...

-Tom

[Tom H]

Hi,
I have completed my look through the FLASH programming code & commented the operation. The comments are best efforts only, I hope they are of use to you.

-Tom