Corvette CCM Reverse Engineering Anyone?

[spfautsch]

Well that didn't take long.

I've already documented the ADC inputs to the cpu.

The memory data lines consume all 8 expansion bus pins, 9-16. Only 7 of the 8 address bus pins are used, leaving PB7 / pin 35 open for other purposes.

Reset and the two interrupts, as well as the rx and tx pins are accounted for. 22-24 are used by SPI, as well as PA3 / 31 which is apparently used as chip select for SPI.

The LCD is driven directly by PA7 / 27 through PA4 / 30.

This only leaves PD5 / 25 and pins 32-35 unaccounted. 32, 33 and 35 appear to be related to some sort of serial / i2c bus that ties to the two most centered SOIC16 chips. 34 heads over towards the other SOIC16 chip between the crystal and the big red capacitor. The part # on this seems to cross to a TI CD4555B which is described as a dual binary to 1-of-4 decoder. This would essentially take 3 inputs and turn them into 8 outputs. Pin 25 is the only one that looks interesting here, and it's connected with an under-chip via so I'll have to break out the soldering iron again to determine whether this is connected.

I'm going to take a break for a few hours, possibly days and you know, shave, shower, etc.

This appears to be a 3 layer pcb, and there are some traces that are particularly hard to locate with "mortal" tools. It may warrant some potentially destructive forensics such as removing the PLCC52 packaged ICs, xray photography, etc.

On the good news side, it appears my battery drain issue seems to be resolved. I just started it and let it warm up until closed loop for the first time in almost a month. Hopefully it can sit for a couple weeks without killing the battery (dammit, the weather is nice and it would be fun to drive). Unfortunately I'm reluctant to put the car back to a drive-able state because it may be useful having access to the CCM module / wiring. I'd simply re-locate it, but I've seen mention that the external / female connector bodies are no longer in production / available.

If there's any documentation anyone would care to share / point me towards I'm ready to read. It seems like it's time to discover what the module wants to talk about with brute force. I've controlled a bunch of outputs based on the discovery NomakeWan posted over in the flashhack discussion, but I'd like to start finding out about the ADC registers, software version, whatever the module wants to tell me without dumping the entire memory range.

[NomakeWan]

That's odd about the female connectors; normally it's the male connectors that are gone. For example, you can still to this day buy the female (car-side) connectors for the HVAC Programmer and the PKE Module. But the male connectors, for someone who might want to, say, make their own modern HVAC Programmer or replacement PKE Module? Nope!

Anyway, confirmed your findings partially. The green connector is out of production and not available from any of my usual sources for harness connectors. The grey connector, however, can still be acquired from a few sources. But of course that doesn't really matter if you can't get the green one. It's really crappy too because there are other 32-way connectors in the exact same connector family that are readily available, just not these specific two. Damn you, Delphi/Aptiv.

As for my end, my first experiment with talking to the car was a failure with a minor success. The minor success was I did get my AVR to properly recognize all of the CCM Poll requests, so I at least wrote that part of the code correctly. The fail was I was unable to then transmit the proper response signal. Considering all I did was short together the RX and TX lines and jam them into pin 9, I'm betting it's my wiring at fault, not the code. I was hoping that just disabling the TX/RX functions by flipping the appropriate bits before changing whether I was receiving or transmitting would be sufficient but clearly not. I don't have time today to go grab the PNP transistors I need to build the more robust interface circuit because I'm busy with GTR stuff, but hopefully tomorrow I'll have time to go get the parts and build the new circuit.

[spfautsch]

Sounds neat. I'd be interested to hear how the speedometer functions. My guess would have been that the ccm uses the vss line from the pcm for that instead of aldl data.

Mind me asking what arduino you're using? Hardware or software serial? Around 2009 or 2010 I messed around with the mpguino project and got it talking to my VW over iso 9141. I recall building an op-amp setup for that, but I can't find the code. I know I have the parts and schematic stashed in an esd bag in my lab somewhere.