Corvette CCM Reverse Engineering Anyone?

[steveo]

i got the ccm today
can you refer me to what pins i have to connect for it to run on the bench?
i read that in a book written on the 68hc11 called the technicians guide to the 68hc11
i will probably do more tests as i cant break it either
its a 10 ms time saving to avoid an erase so if we can do it once in a while it could make a fair difference

[NomakeWan]

i got the ccm today
can you refer me to what pins i have to connect for it to run on the bench?
i read that in a book written on the 68hc11 called the technicians guide to the 68hc11
i will probably do more tests as i cant break it either
its a 10 ms time saving to avoid an erase so if we can do it once in a while it could make a fair difference

According to the '95 Corvette FSM, the pins you'll need are:

Grounds: C1, E15, E16
+12V Battery: F1, F2
+12V Ignition RUN: E4
+12V Ignition RUN+START: E5

Serial data is on pins E13 and F12.

c1.jpgc2.jpg

[spfautsch]

i read that in a book written on the 68hc11 called the technicians guide to the 68hc11

I would consider that bad info then. I've never heard of anything called a fuse map - the fuses he's speaking of are the actual floating gate transistors that make up the bits.

Thanks for posting the connector legend NomakeWan. To further elaborate, the gray connector is C and D, and the green is E and F - it doesn't really stand out on the legend.

steveo you only need one wire on any of the pins for battery, ground and serial - they're connected together internally. I think you can get by with only applying switched 12v on E4 also. The passkey resistor that was taped to the case goes between E12 and F5.

[In-Tech]

I would consider that bad info then. I've never heard of anything called a fuse map - the fuses he's speaking of are the actual floating gate transistors that make up the bits.

Thanks for posting the connector legend NomakeWan. To further elaborate, the gray connector is C and D, and the green is E and F - it doesn't really stand out on the legend.

steveo you only need one wire on any of the pins for battery, ground and serial - they're connected together internally. I think you can get by with only applying switched 12v on E4 also. The passkey resistor that was taped to the case goes between E12 and F5.

Agreed, I don't know everything, bit's are always fused in my experience with substrate unless open(0), hence why erase takes more current. Having to read/disect, It's very painful to "read" micro with an electron microspope, years years ago taught me alot. It's very painful so we even invented optical recognition to aid. The ability to "blow" a fuse bit does take more energy than reading.

[steveo]

thanks for all the info. i'll have this thing up and running tonight i'm sure, and i'll try to ammend my program to see if an erase is necessary and skip that step. i could definitely do it on the flashhack side of things too, but that's much less fun.

[steveo]

i definitely seem to be getting some garbage but no heartbeat.

if i disconnect the CCM, the ecm responds, so i know it's alive.

i've tried both calibrations 16200891 and 16209281 from my site.

here's what the CCM is spitting out, the ECM does not seem to respond from what I can see, but the ECM is certainly there, as if i disconnect the CCM, the ECM responds.

any idea why they aren't handshaking or whatever they're s'posed to do ?

13430ms to 13540ms (110ms) :: 1059088702000640574E9F7C416702000087004800000000880004E84900A0A08A
::: GAP78ms
13618ms to 13743ms (125ms) :: 105908870200064057E8493841670200008700480000000088000481DA00A0A060
::: GAP78ms
13821ms to 13946ms (125ms) :: 10590887020006405781DA0E4167020000870048000000008800041B8400A0A01C
::: GAP78ms
14024ms to 14149ms (125ms) :: 1059088702000640571B84CA416702000087004800000000880004B51500A0A0F1
::: GAP78ms
14227ms to 14352ms (125ms) :: 105908870200064057B5159F4167020000870048000000008800044EC000A0A0AD
::: GAP78ms
14430ms to 14524ms (94ms) :: 1059088702000640574EC05B416702000087004800000000880004E85B00A0A078

[steveo]

my connections on the bench (although it's sending a message so it must be right): i have power to F1 F2 and E4, resistor between F5 and E12, ground E15, aldl data F12

[spfautsch]

Here's my bin, maybe give it a try, cal id 16210071

[NomakeWan]

i definitely seem to be getting some garbage but no heartbeat.

if i disconnect the CCM, the ecm responds, so i know it's alive.

i've tried both calibrations 16200891 and 16209281 from my site.

here's what the CCM is spitting out, the ECM does not seem to respond from what I can see, but the ECM is certainly there, as if i disconnect the CCM, the ECM responds.

any idea why they aren't handshaking or whatever they're s'posed to do ?

13430ms to 13540ms (110ms) :: 10590887020006 40574E9F7C 416702000087004800000000880004E84900A0A08A
::: GAP78ms
13618ms to 13743ms (125ms) :: 10590887020006 4057E84938 41670200008700480000000088000481DA00A0A060
::: GAP78ms
13821ms to 13946ms (125ms) :: 10590887020006 405781DA0E 4167020000870048000000008800041B8400A0A01C
::: GAP78ms
14024ms to 14149ms (125ms) :: 10590887020006 40571B84CA 416702000087004800000000880004B51500A0A0F1
::: GAP78ms
14227ms to 14352ms (125ms) :: 10590887020006 4057B5159F 4167020000870048000000008800044EC000A0A0AD
::: GAP78ms
14430ms to 14524ms (94ms) :: 10590887020006 40574EC05B 416702000087004800000000880004E85B00A0A078

That looks totally normal, and in fact the ECM response is right there. I'm not sure why EEHack's idle scan has such weird spacing, but it always has. I've altered your above logs to have the correct spacing to make it more clear.

To elaborate, the 10 message is the HVAC broadcast (no response expected), the 40 message is the CCM polling the ECM, and the 41 message is the ECM responding to the CCM.

What's interesting to note here are the timer bytes in the 41 response. This makes me really really really want to know what "word_1983" is in $EE, because whatever that timer is, it's apparently being used by the CCM. The values of those two bytes in the ECM's response then reappear in the mystery bytes of the CCM's next poll. This explains why the CCM's initial poll before the ECM comes online is 4057000069, and why eventually it just becomes 4057FFFF6B. But knowing what these intermediate values mean (and perhaps finding out why GM thought it important for the CCM to echo these values in the 40 poll, something they only started doing in 1992) would mean figuring out word_1983.

kur4o, any insight into that particular area of the $EE program?

[kur4o]

1983 seems related with vats communication between pcm and ccm.
0000 means theft not completed, and some initial timer expired.
FFFF means theft completed pcm unlocked
random data means there is info exchanged between pcm and ccm

It is also related with the data ccm polls to pcm the 2 bytes of the 40 message.


In Steveo log there is something wrong with that, it doesn`t follow the earlier discovered patterns. Maybe the pcm-ccm communication is stuck at that theft loop and untill finished there will be no broadcasting.

Edit: also found another 40/40 request response in the code. the massage is 10 bytes long and is again y-body related, some of the data is similar to 40/41 message.

Could it be for older ccms or newer ones.