Corvette CCM Reverse Engineering Anyone?

[kur4o]

Just looked at some diagrams. Freeking complex unit, operating almost anything in the car. Including driving directly the instrument panel.

The 31 32 pins your are reffering are like pins F1 and F2 -battery input. ALso tons of inputs that wake up the module. I guess it goes to sleep when all is quiet, and the car is locked.

Some interesting pin is d6 -diagnostic enable. Goes to DLC terminal 12. Likely when it is grounded or resistored like 4-10kohm it runs some tests.

[spfautsch]

Thanks kur4o - saved me a bunch of money there. I've done a little bit more searching over at cf and found where they used a tech 2 to dump a PCM and then a tech 1 on the CCM so was suspicious the functionality didn't exist in the newer tool. Looking at the 1, it seems like it needs a memory card for CCM / BCM programming. :-\

I'm looking for the aldl pin to try and dump them on the bench. Then will hook up the original one in car and see if it shows any DTCs. I wasn't seeing the SYS message, but maybe not all DTCs trigger that. I highly doubt that the remanned unit has the same fault as mine, but anything's possible. I'm pretty sure in some model years, leaving the key in the ignition would cause the CCM to never go to sleep.

I noticed a VIN (in two places) in the two dumps NomakeWan posted in the other thread so I'm hoping to find out if the eeprom in the remanned unit has been wiped. It would really suck if the eeprom is integrated with the processor though. I don't see anything that looks like a jtag type pad except for the 5 next to the 28 pin SOIC in the lower right corner. They're just vias to bring those traces to the other plane, but the spacing seems suspiciously uniform.

I wonder if diagnostic enable might be the "magic" pin.

[kur4o]

e13 and f12 are the aldl pins.

There is an older 10mb tech2 card that works with older vehicles but needs custom adapter which is 600$ and never managed to run it, So tech1 with the proper cartridge might be the only option.

ALso some dissasembly hacks can reveal all the hidden features.

[kur4o]

Why would you care about the vin that is programmed. It is never used between communication between ccm and pcm. It is the correct signal from key and the communication that is handled between pcm and ccm. If key is good. It shoul send the pcm correct signal.

What is more important are the options that are being programmed in the ccm. They might give you troubles.

[NomakeWan]

do you have any documentation of that at all ?

The 100 miles thing was actually confirmed several times over on Corvette Forums, including by, as I recall, people who had actually worked at GM during the C4's run. As for hard evidence of that as well as the ability to remanufacture CCMs, yes, there is this little tidbit to confirm it:

ccmreman.jpg

Is this info from the FSM? Mine haven't arrived yet. I'm not disputing this statement but it seems like if it can ask the PCM for message 41 it could also ask it for the VIN, and derive the engine code from that. Though I doubt that's the case.

Also wouldn't the VATS voltage / resistor code have to be set here?

Am I correct to assume the odometer is stored solely in the CCM?

This info can be assumed from several data points. First, the ALDL data request commands for both the PCM and CCM are public information, available right here on Gearhead-EFI's servers. If you sift through those, you will see that the parameters you are asking about are not part of any datastream. Additionally, they are not a part of the $41 datastream. As such, we can infer that the CCM is incapable of querying other modules (such as ECM/PCM) for the data that would be stored in secured locations.

Speaking of, yes, VATS resistor code is stored in the CCM. This value should be a part of the dump I posted, actually; that memory location is only prevented from access if no key (or the incorrect key) is inserted into the ignition. Since I only talk to the car with my car's proper key inserted, it should be there.

Also yes, the odometer is only stored in the CCM.

Here's a couple quick pics of the board (click for full res).



Though I also doubt the unit can self program the VIN and options, I have seen mention of a learn procedure for the VATS resistor value over on cf.

The three solder pads on the bottom-left appear curious to me. That said, as expected, they don't just point you at what pin you'd need to ground in order to override the EEPROM. That would be an insane security problem. Even I haven't seen any documentation pointing out where this pin would be. I'm sure GM knows, and I'm sure there must be some third-party remanufacturers who know, but I'm afraid I do not.

As for the VATS relearn procedure, you'll note if you go back and check that those threads were referring to people who had new or remanufactured CCMs installed, and were being told that this procedure had to be done within the first 100 miles.

Some interesting pin is d6 -diagnostic enable. Goes to DLC terminal 12. Likely when it is grounded or resistored like 4-10kohm it runs some tests.

It's not all that interesting. This is just the normal self-diagnostic pin on the ALDL connector (on a 94-96, this is pin 12, which you then jumper to pin 4, ground). When this pin is grounded, the CCM acts like a Tech 2, allowing the buttons on the dashboard to act as the Tech 2's buttons. Initially it queries ALDL devices for DTCs, then displays any available DTCs on the dashboard. Once DTC display is complete, you can either use the dash buttons to repeat the messages or can also switch modes to clear DTCs or run actuators. This functionality is detailed here: https://tech.corvettecentral.com/201...-trouble-codes

I wonder if diagnostic enable might be the "magic" pin.

Sadly not.

[spfautsch]

The three solder pads on the bottom-left appear curious to me.

Those are all tied together - there's another trace between the right pads on the back side. Holding a light behind the unpainted area around the pads it seems like there might be a trace leaving the right pad in a middle layer, but it dead ends on the visible layers. It reads 40mohm to ground.

This is just the normal self-diagnostic pin on the ALDL connector (on a 94-96, this is pin 12, which you then jumper to pin 4, ground).

I figured that's what it was but haven't been able to look at all the schematics thus far.

Why would you care about the vin that is programmed.

I'm interested in knowing if the remanned unit has had the eeprom erased before I connect it to the car. Since I know my vin and how many miles are on mine I'm hoping to be able to extrapolate their location in the dump. Though I'm somewhat worried they used some sort of hash algo on the odometer reading. Edit: and it occurred to me it's probably not stored in units of miles but rather some proprietary GM unit.

Edit: Still no luck with serial data. May have to put it back in the car to troubleshoot.

[-=Jeff=-]

Setup my bench to read a couple CCMs. but I keep getting the Bus is too Noisy.. I have not changed anything on my setup. Suggestions on what to check?

EDIT:
1990-1991 works but 1992-1993 keeps giving the Bus to Noisy, then is says it cannot find the Heartbeat. I have another port setup and running YAT to read the data, the CCM seems to be sending the commands as expected, but for some odd reason, the Arduino setup to fake the messages is not working. As I thought having the reply messages will help. I also tried driect connection to CCM, (No ECM present)

[-=Jeff=-]

After reading through the post and fixing some Arduino code, I got it working. I need to improve my bench setup and clean the wiring up

[In-Tech]

Quote Originally Posted by spfautsch
I wonder if diagnostic enable might be the "magic" pin.

Sadly not.

Momentary 12v on key up to the diagnostic pin should put it in boot mode, not ground.

[NomakeWan]

Momentary 12v on key up to the diagnostic pin should put it in boot mode, not ground.

I'm not sure what you're trying to say. The diagnostic pin is already 12V (through an internal pull-up resistor). The only available option for this pin is to ground it, which puts the CCM into diagnostic mode. Here is the relevant section from the FSM. It also addresses spfautsch's earlier comment about some CCM-related DTCs not setting the SYS light.

ccmdiagnosticmode.jpg

[In-Tech]

I'm not sure what you're trying to say. The diagnostic pin is already 12V (through an internal pull-up resistor). The only available option for this pin is to ground it, which puts the CCM into diagnostic mode. Here is the relevant section from the FSM. It also addresses spfautsch's earlier comment about some CCM-related DTCs not setting the SYS light.

ccmdiagnosticmode.jpg

Yes, I understand and I will post my GM documentation when I find it. The Mefi4 is very very similar to the obd1 LT1 computers electronically and when I need to convert a 4 into a 4a or 4b this is how we get it into boot mode for programming the entire 256k and not just the calibration data, and yes, still ground for diagnostic mode. Maybe this doesn't work on the LT1 computer but I bet it does. I only have obd2 LT1 puters here or I would already know :)

[spfautsch]

e13 and f12 are the aldl pins.

Thanks, that helped me make sense of the pin numbering terminology. They're numbered 1-16 right to left, so what I was calling gray 31 & 32 are F1 and 2 and grounds are on E15 and 16. I assume the gray connector is c and d. Maybe the unpopulated 40 pin IDC header is a and b?

I'm not getting anything with only one serial pin connected, so am having to find connectors to add a second.

Oddly, I'm finding when I power up the board without applying power to the CCM1 and CCM3 circuits, the board sometimes comes up in sleep mode, and sometimes doesn't, but seems to go to sleep eventually. Both of the two additional power circuits are unswitched to battery afaik.

[NomakeWan]

Thanks, that helped me make sense of the pin numbering terminology. They're numbered 1-16 right to left, so what I was calling gray 31 & 32 are F1 and 2 and grounds are on E15 and 16. I assume the gray connector is c and d. Maybe the unpopulated 40 pin IDC header is a and b?

I'm not getting anything with only one serial pin connected, so am having to find connectors to add a second.

Oddly, I'm finding when I power up the board without applying power to the CCM1 and CCM3 circuits, the board sometimes comes up in sleep mode, and sometimes doesn't, but seems to go to sleep eventually. Both of the two additional power circuits are unswitched to battery afaik.

Please see below the relevant pages for pinouts related to power supply and ALDL comms.

ccmwiring1.jpgccmwiring2.jpg

[kur4o]

I found the disassembly I made while ago.

The ram is located at $6000-65ff the eeprom is located at $7000-$71ff main code is at 8000-ffff, first part containing some calibration details, than main code.

We have $200 bytes of eeprom.

NomakeWan can you make an updated dump of the ccm you have. Hope thay gathered some mileage, so we can identify some stuff pretty quick, if the eeprom increase at some places.

I think figuring some commands and sequences will not be hard at all when we label the eeprom.

As far as the secret pin. It is most likely connected to the a/d channels of processor and will have some 12v voltage, when grounded it will override something in the code.

Figuring other grounding inputs inputs and tracing the pcb patterns will likely find the secret pin.

[kur4o]

FOund the mode5 code in the bin, but there is not much that it can do. It seems the ccm enters some loop where you can upload custom code. It still doesn`t make sense since there is no execute visible in the loop.

Also I think I spot the bit that prevents the mode5 entering. It will be esily patched if we have access to writing a custom bin.

Now the main question. What should I expect from mode 5.


Edit;

I think some polling of the ccm will be great. Sending different modes and submodes commands over the aldl bus and recording the reponse.

The CCM ID is f1 or f0. There is also tons of other ids in the code, but it will take some time to figure the usage.