Results 1 to 15 of 511

Thread: Corvette CCM Reverse Engineering Anyone?

Hybrid View

Previous Post Previous Post   Next Post Next Post
  1. #1
    Fuel Injected! spfautsch's Avatar
    Join Date
    Apr 2015
    Location
    Montgomery City, MO
    Age
    53
    Posts
    883
    Quote Originally Posted by steveo View Post
    im busy cleaning up my shop right now so i'm stalled too but i will:
    - try to get the arduino i have to work with ALDL
    Unless you're unable to do anything further with the CCM, I have an arduino mega sitting on my workbench and I just dug out my last remaining aldl connector shell. I think I might know what NomakeWan is overlooking. This is something I've wanted to mess with anyway because I'd love to have passive logging to an SD card. And, it's something I might actually have a clue with (the arduino part anyway)!

    One more question if you would - I've never looked, but does the eehack logging exchange involve an ask / answer transaction for the entire logging session, or is it something more specialized? I ask because I'm curious if I periodically requested whatever the ccm asks for during run, would the ccm act on the data if silenced? I realize this would slow down eehack's data acquisition, but at this point I'm pretty happy with my tune and would be ok with fewer datapoints for time logged. I can regularly drive 200 interstate miles with the cruise control set, fill up when I get off the freeway, and see 26-29 mpg. As pig rich as it smells when idling, I can't imagine there's anything wrong with the closed loop fuel control considering the cruising mpg.

  2. #2
    Fuel Injected!
    Join Date
    Jul 2019
    Location
    Orange, CA
    Posts
    757
    Quote Originally Posted by spfautsch View Post
    One more question if you would - I've never looked, but does the eehack logging exchange involve an ask / answer transaction for the entire logging session, or is it something more specialized? I ask because I'm curious if I periodically requested whatever the ccm asks for during run, would the ccm act on the data if silenced? I realize this would slow down eehack's data acquisition, but at this point I'm pretty happy with my tune and would be ok with fewer datapoints for time logged. I can regularly drive 200 interstate miles with the cruise control set, fill up when I get off the freeway, and see 26-29 mpg. As pig rich as it smells when idling, I can't imagine there's anything wrong with the closed loop fuel control considering the cruising mpg.
    The whole session is ask/answer. The CCM sends an F0 poll, EEHack responds to it with an F1 Mode 8 request, followed by F4 Mode 1 requests (or in the case of speedlog, F4 Mode 5). Then the next time the CCM wakes up from the Mode 8 and does an F0, EEHack has to do another F1 Mode 8 to shut it up and retain bus master status, and continue.
    1990 Corvette (Manual)
    1994 Corvette (Automatic)
    1995 Corvette (Manual)

  3. #3
    LT1 specialist steveo's Avatar
    Join Date
    Aug 2013
    Posts
    4,055
    after the ccm has been silenced with a mode 8 request it shouldn't wake up again until you stop asking for data from the ecm for a few (usually 3) seconds

  4. #4
    Fuel Injected! spfautsch's Avatar
    Join Date
    Apr 2015
    Location
    Montgomery City, MO
    Age
    53
    Posts
    883
    Quote Originally Posted by steveo View Post
    ... it shouldn't wake up again
    Wake up, or start broadcasting?

    No biggie, I'll try to figure it out on my own. I'm interested in if it will process response data it hasn't asked for. If I can make the fuel consumption and aldl derived "gauges" work while logging I'll be one extremely happy camper.

    NomakeWan, try this out:



    Sketch:

    Code:
    byte M1Cmd[5] = {0xF1,0x57,0x01,0x00,0xB7};
    
    void setup() {
    
      Serial.begin(9600);
      Serial1.begin(8192);
      
    }
    
    void loop() {
    
      if (Serial1.available()) {
    
        while (Serial1.available()) {
          byte read = Serial1.read();
          Serial.println(read, HEX);
        }
        
      }
    
      if (Serial.available()) {
        for (uint8_t i = 0; i < 5; i++) {
          Serial1.write(M1Cmd[i]);
        }
        Serial.read();
      }  
      
    }
    Serial output is one byte per line without being padded with a leading 0 i.e. 00 in a bin = 0, 01 in a bin = 1 here. You'll have to group the ask / answers appropriately, but I've commented my 01 00 request and response from the CCM

    Code:
    41
    40 
    57
    FF
    FF
    6B
    41
    67
    2
    EC
    0
    4C
    4C
    1
    0
    E
    90
    F6
    E3
    0
    3F
    FF
    FF
    0
    FF
    FF
    1F
    F0
    56
    F1
    C9
    F1 < start looking here
    57
    1
    0
    B7
    F1  < response here ??? 
    7A
    1
    8
    8
    20
    3
    14
    0
    10
    DF
    B3
    0
    D3
    F1
    0
    77
    71
    0
    3B
    59
    42
    2C
    A9
    BF
    0
    0
    80
    0
    0
    0
    0
    0
    0
    0
    0
    0
    0
    0
    15
    10
    59
    8
    4C
    2
    0
    41
    40
    57
    FF
    FF
    6B
    Have you gotten this far, am I just pounding sand?

  5. #5
    LT1 specialist steveo's Avatar
    Join Date
    Aug 2013
    Posts
    4,055
    i have a 5v uno here that i could work with, although it's single serial port so more tedious to test with

    do you want me to write you a function or two for handling aldl comms? i could port you over the super important elements like 'fast forward to first valid message', 'find bus master ID' and 'wait for hole to send mode 8 request', also the checksum/length calcs

    your diode/resistor arrangement seems to make sense - is this about right? |< being a diode of course.

    [code]
    TX ----- |< ----------|---------- (car)
    RX ----- (resistor)--/
    [code]

  6. #6
    Fuel Injected! spfautsch's Avatar
    Join Date
    Apr 2015
    Location
    Montgomery City, MO
    Age
    53
    Posts
    883
    Quote Originally Posted by steveo View Post
    do you want me to write you a function or two for handling aldl comms? i could port you over the super important elements like 'fast forward to first valid message', 'find bus master ID' and 'wait for hole to send mode 8 request', also the checksum/length calcs
    I might enlist your help on that if I can't figure out something simple and fast. But for now I'll play with it because it's the best way for me to learn.

    What's the gist of finding bus master id? Is it just listening for a device that's sending the F0 5x Fn cc message?

    Am I correct to assume I should be prepared to buffer messages 0xAA + 2 bytes long?

    Quote Originally Posted by steveo View Post
    your diode/resistor arrangement seems to make sense - is this about right? |< being a diode of course.
    Yes, the TX pin on the arduino is an output and I believe is set to active high when not transmitting. The diode keeps that 5v from killing the bus' floating state and only conducts when TX is driven low.

    Nice work on flashhack btw. I always do my best coding after drinking "a lot". The problem is afterwards I rarely remember it. :-)

    I'm debating whether to include the odometer triplet in the .xdf (non-decoded of course). I'll get that to you over the weekend or I'm sure you could handle it if you wanted to.

  7. #7
    LT1 specialist steveo's Avatar
    Join Date
    Aug 2013
    Posts
    4,055
    considering any moron can go to the wrecker and swap the ccm to change his mileage i would just say get it all mapped out.
    honestly most owners would be happy to know if their ccm died they could correct the mileage
    i doubt we will find many people that are capable of such things that would use it to scam unsuspecting buyers but if they do thats their responsibility

    anyway the new version is in the usual place, i made a pdf explaining the reman pin and bundled it, also the current xdf because im too lazy to make a separate thing for that

  8. #8
    Fuel Injected!
    Join Date
    Jul 2019
    Location
    Orange, CA
    Posts
    757
    Quote Originally Posted by spfautsch View Post
    Wake up, or start broadcasting?

    No biggie, I'll try to figure it out on my own. I'm interested in if it will process response data it hasn't asked for. If I can make the fuel consumption and aldl derived "gauges" work while logging I'll be one extremely happy camper.

    NomakeWan, try this out:



    Sketch:

    Code:
    byte M1Cmd[5] = {0xF1,0x57,0x01,0x00,0xB7};
    
    void setup() {
    
      Serial.begin(9600);
      Serial1.begin(8192);
      
    }
    
    void loop() {
    
      if (Serial1.available()) {
    
        while (Serial1.available()) {
          byte read = Serial1.read();
          Serial.println(read, HEX);
        }
        
      }
    
      if (Serial.available()) {
        for (uint8_t i = 0; i < 5; i++) {
          Serial1.write(M1Cmd[i]);
        }
        Serial.read();
      }  
      
    }
    Have you gotten this far, am I just pounding sand?
    Start broadcasting. As steveo points out, the CCM will not remain silent forever after a Mode 8 request. It will eventually "time out" the Mode 8 request (after 5 seconds according to GM's documentation) and return to normal operation. At this point it will send another F0 poll, and that must then be replied to with another Mode 8 request before you can talk to the PCM again.

    I have tried the "just use a pulldown and a zener" connection and it did not work for transmit. I'm also using a sliding window to detect the appropriate incoming message. However, that's what I don't understand about your code. You don't appear to have any code whatsoever to detect anything on the line. If I'm reading it correctly, it just shouts F1 57 01 00 B7 every single program loop. Yet the serial monitor log you posted is entirely correct; there is an F0 poll, followed by your F1 Mode 1 Message 00 request, followed by the correct F1 Mode 1 Message 00 response.

    How? If the code you posted is your entire code, how did it know to transmit only after the F0 poll?
    1990 Corvette (Manual)
    1994 Corvette (Automatic)
    1995 Corvette (Manual)

  9. #9
    LT1 specialist steveo's Avatar
    Join Date
    Aug 2013
    Posts
    4,055
    Code:
      if (Serial.available()) {
        for (uint8_t i = 0; i < 5; i++) {
          Serial1.write(M1Cmd[i]);
        }
        Serial.read();
      }
    this means if there is data to read on the 9600 baud port (your PC), then you write to the aldl port. you then read a single byte from the 9600 baud port (your PC) to nowhere.

    this would technically work, if he is monitoring the serial data, then manually smacking a key in his serial terminal at the correct time to send the message (assisted by the fact that the write would only happen during a time when the bus was not fully saturated and the while() loop has exited)

  10. #10
    LT1 specialist steveo's Avatar
    Join Date
    Aug 2013
    Posts
    4,055
    well, i drank a bunch, and the flash tool works perfectly now.

    it's not fast, and i'm sure it has bugs, but i'm pretty happy that the assembly code end of things worked, and that flashhack would flash something so odd is just great...it would be good enough to read an old CCM and flash its eeprom contents to a new one.

    i spent a good few hours being abused by my own handmade assembly code faults incl. stupid typo in the address of the eeprom control register

    i guess we can work on the xdf and i will put a page on fbodytech that describes what to do, what to jumper, all that stuff, and post a new version of flashhack once i clean up the mess

  11. #11
    Fuel Injected!
    Join Date
    Jul 2019
    Location
    Orange, CA
    Posts
    757
    Quote Originally Posted by steveo View Post
    Code:
      if (Serial.available()) {
        for (uint8_t i = 0; i < 5; i++) {
          Serial1.write(M1Cmd[i]);
        }
        Serial.read();
      }
    this means if there is data to read on the 9600 baud port (your PC), then you write to the aldl port. you then read a single byte from the 9600 baud port (your PC) to nowhere.

    this would technically work, if he is monitoring the serial data, then manually smacking a key in his serial terminal at the correct time to send the message (assisted by the fact that the write would only happen during a time when the bus was not fully saturated and the while() loop has exited)
    Ah, that's what I missed, that the second was Serial.available() and not Serial1.available(). You're correct, it only fires if something comes in via the terminal.

    I'm not doing that, though; I'm actually waiting until the appropriate command has come into the buffer programmatically, and then responding to it in that loop. I figure I'll just toss my code up here for the shit of it, even though at present it does not work. Maybe someone will spot something I missed. (EDIT: To be clear, it's only the transmit that hasn't worked. I've already confirmed everything else in the code works. It can read, correctly detect the $40 poll, correctly respond, and correctly responds only once per received $40 poll)

    Code:
    /* CCM Interaction Test Sketch for Arduino Mega 2560
    This sketch pretends to be the PCM for a 1994 to 1995 Chevrolet Corvette.
    It listens for the CCM poll request bytes (40 57 XX XX Checksum),
    then sends the appropriate diagnostic string upon receipt.
    The diagnostic string is idle values except for coolant temp,
    which is either static (154C) or variable (based on ADC0 input).
    
    This sketch only works on the 1994 to 1995 Corvette. It may work for 1996.
    1990 Corvettes use shorter polls (40 55 6B) and have shorter responses.
    To use for a 1990 Corvette, change the sliding window to 3 bytes
    and just use the following match code without checksum ifs:
    ((window[0] == 0x40) && (window[1] == 0x55) && (window[2] == 0x6B))
    Then comment out the top lines for output[21] and use output[15].
    
    This sketch only works on the Arduino Mega 2560 family.
    This is because we're using Serial1, UCSR1B, RXEN1, RXCIE1.
    If you want to try it on a different board, change these accordingly.
    
    */
    
    #include <avr/io.h>
    #include <wiring_private.h>
    
    byte window[5]; //define the 5-byte-wide sliding window
    byte output[21]= {0x41, 0x67, 0x02, 0xF5, 0x00, 0xCD, 0x87, 0x01, 0x00, 0x00, 0x00, 0x00, 0x88, 0x00, 0x48, 0xFF, 0xFF, 0x00, 0xFF, 0xFF, 0x40}; //define the static CTS message
    //byte output[21]= {0x41, 0x67, 0x02, 0xF5, 0x00, 0x87, 0x87, 0x01, 0x00, 0x00, 0x00, 0x00, 0x88, 0x00, 0x48, 0xFF, 0xFF, 0x00, 0xFF, 0xFF, 0x86}; //define the standard message
    //byte output[15]= (0x41, 0x61, 0x00, 0xEC, 0x00, 0xCD, 0x39, 0x01, 0x00, 0x00, 0x00, 0xB4, 0x00, 0x39, 0x45); //define 1990 Corvette CTS message
    //byte output[15]= (0x41, 0x61, 0x00, 0xEC, 0x00, 0x39, 0x39, 0x01, 0x00, 0x00, 0x00, 0xB4, 0x00, 0x39, 0x12); //define 1990 Corvette standard message
    
    void setup() {
      analogReference(DEFAULT); //Switch to default reference explicitly
      pinMode(A0, INPUT); //Make sure A0 is an input explicitly
      bitSet (DIDR0, ADC0D); //Disable digital buffer on A0
      bitSet (DIDR0, ADC1D); //Disable digital buffer on A1
      bitSet (DIDR0, ADC2D); //Disable digital buffer on A2
      bitSet (DIDR0, ADC3D); //Disable digital buffer on A3
      bitSet (DIDR0, ADC4D); //Disable digital buffer on A4
      bitSet (DIDR0, ADC5D); //Disable digital buffer on A5
      bitSet (DIDR0, ADC6D); //Disable digital buffer on A6
      bitSet (DIDR0, ADC7D); //Disable digital buffer on A7
      bitSet (DIDR1, AIN0D); //Disable digital buffer on AIN0
      bitSet (DIDR1, AIN1D); //Disable digital buffer on AIN1
      bitSet (DIDR2, ADC8D); //Disable digital buffer on A8
      bitSet (DIDR2, ADC9D); //Disable digital buffer on A9
      bitSet (DIDR2, ADC10D); //Disable digital buffer on A10
      bitSet (DIDR2, ADC11D); //Disable digital buffer on A11
      bitSet (DIDR2, ADC12D); //Disable digital buffer on A12
      bitSet (DIDR2, ADC13D); //Disable digital buffer on A13
      bitSet (DIDR2, ADC14D); //Disable digital buffer on A14
      bitSet (DIDR2, ADC15D); //Disable digital buffer on A15
      analogRead(0); //Burn an analog reading on pin0
        Serial1.begin(8192); //Open UART1 at 8192 baud
        UBRR1H = (uint8_t)(121>>8);
        UBRR1L = (uint8_t)121;
        cbi(UCSR1A, U2X0); //disable 2x mode
        cbi(UCSR1A, MPCM0); //disable multi-processor mode
    }
    
    void loop() {
        if (Serial1.available()) {
            // Slide the 5-byte window
            for (uint8_t i = 0; i < 4; i++) {
                window[i] = window[i + 1];
            }
            // Add new bytes as they come in
            window[4] = Serial1.read();
    
            // Check the first two bytes for a match
            if ((window[0] == 0x40) && (window[1] == 0x57)) {
                // Calculate the checksum byte
                byte cs = 0;
                for (uint8_t i = 0; i < 4; i++) {
                    cs += window[i];
                }
                cs = 0xFF - cs;
                cs += 0x01;
                // If checksum byte matches, send diagnostic data
                if (cs == window[4]) {
                    window[0] = 0x00; //poison the sliding window
                    Serial1.write(output, sizeof(output));
                    Serial1.flush(); //wait until transmit completes
                }
            }
        }
        //Read A0 to check status of potentiometer, save to cts byte
        //output[5] = analogRead(0)>>2;
        //Calculate new checksum and save to checksum byte
        //byte checksum = 0;
        //for (uint8_t i = 0; i < 20; i++) {
          //checksum += output[i];
        //}
        //checksum = 0xFF - checksum;
        //checksum += 0x01;
        //output[20] = checksum;
    }
    Last edited by NomakeWan; 10-29-2021 at 09:22 AM.
    1990 Corvette (Manual)
    1994 Corvette (Automatic)
    1995 Corvette (Manual)

  12. #12
    Fuel Injected! -=Jeff=-'s Avatar
    Join Date
    Jun 2013
    Location
    Chicago Suburbs
    Age
    51
    Posts
    222
    So I attempted to program one of the CCMs.. I have the jumper connected to the located pad and a ground ( on the connector) and it shows it is still hardware locked. So I am assuming I need to have the PASSKey to be correct?

    Edit: I have yet to try the CCM I know the PASSKey for I might try it tonight or continue to work through the PASSKey values on the one that is unknown.
    Attached Images Attached Images
    Last edited by -=Jeff=-; 10-05-2022 at 02:18 PM.
    -=Jeff=-
    1990 Corvette ZR-1
    Black/Red Interior

  13. #13
    Fuel Injected! spfautsch's Avatar
    Join Date
    Apr 2015
    Location
    Montgomery City, MO
    Age
    53
    Posts
    883
    Quote Originally Posted by NomakeWan View Post
    How? If the code you posted is your entire code, how did it know to transmit only after the F0 poll?
    I sent it a linefeed on the other serial port. This is simply a hello world that proves it's possible to transmit with two components, non-inverted. And that's not a zener, just a plain small signal diode. A 1N4001 would work as well.

    I'll play with your sketch tonight if you haven't figured it out by then.

Similar Threads

  1. car bogs down when switching into reverse/D
    By CAMMED LT1 in forum GM EFI Systems
    Replies: 4
    Last Post: 09-27-2021, 12:34 AM
  2. 12212156 code reverse engineering project in Ghidra
    By dzidaV8 in forum OBDII Tuning
    Replies: 8
    Last Post: 01-13-2020, 11:04 AM
  3. Help!! 93 Lt1 6M Reverse lockout
    By noeysuarez in forum GM EFI Systems
    Replies: 3
    Last Post: 09-14-2017, 08:17 AM
  4. 4l60e reverse boost valve location and procedure
    By JTodd in forum Introductions
    Replies: 1
    Last Post: 04-19-2013, 01:20 AM
  5. T56 reverse lockout options with TBI PCM
    By CDeeZ in forum GM EFI Systems
    Replies: 1
    Last Post: 02-26-2013, 05:06 PM

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •