GM 16216588 Flash

Hi,


For those interested I have made a memory dump of an original ECU before it has been "paired" to a vehicle. The bin looks somewhat scrambled but this is due to a non 1-to-1 matching of the address lines from the CPU to the flash. I have checked the mapping between the Flash (Intel N28F010) and the CPU (Motorola MC68HC11F1). The 17th address line has no direct connection to the CPU, I suspect this is the selection between the normal and the backup firmware.


Flash CPU
Pin Mnemo Pin Mnemonic
1 Vpp ?
2 A16 ?
3 A15 43 ADDR15
4 A12 56 ADDR2
5 A7 51 ADDR7
6 A6 52 ADDR6
7 A5 53 ADDR5
8 A4 54 ADDR4
9 A3 47 ADDR11
10 A2 46 ADDR12
11 A1 45 ADDR13
12 A0 58 ADDR0
13 DQ0 9 DATA0
14 DQ1 10 DATA1
15 DQ2 11 DATA2
16 Vss 67,1 VSS
17 DQ3 12 DATA3
18 DQ4 13 DATA4
19 DQ5 14 DATA5
20 DQ6 15 DATA6
21 DQ7 16 DATA7
22 CE# ?
23 A10 44 ADDR14
24 OE# 36 OC1/OC2
25 A11 55 ADDR3
26 A9 49 ADDR9
27 A8 50 ADDR8
28 A13 57 ADDR1
29 A14 48 ADDR10
30 NC 67, 1 VSS
31 WE# 5 R/W#
32 Vcc 68,34 VDD

I also want to make a dump of the flash after it is paired to a vehicle to get an indication where the VIN is located. If people are interested, i also have a chip-tuned firmware dump of this ecu.

This is some good first progress! I'm sad I didn't find this post sooner.

Can you share any details on how you got started and grabbed the initial flash or how the non-matching addresses affect the .BIN file. I can't find any useful 2d or 3d patterns in this .BIN that make it look valid to start mapping pieces.

Thanks!

Quote:

---

Originally Posted by Erikje

Hi,


For those interested I have made a memory dump of an original ECU before it has been "paired" to a vehicle. The bin looks somewhat scrambled but this is due to a non 1-to-1 matching of the address lines from the CPU to the flash. I have checked the mapping between the Flash (Intel N28F010) and the CPU (Motorola MC68HC11F1). The 17th address line has no direct connection to the CPU, I suspect this is the selection between the normal and the backup firmware.


Flash CPU
Pin Mnemo Pin Mnemonic
1 Vpp ?
2 A16 ?
3 A15 43 ADDR15
4 A12 56 ADDR2
5 A7 51 ADDR7
6 A6 52 ADDR6
7 A5 53 ADDR5
8 A4 54 ADDR4
9 A3 47 ADDR11
10 A2 46 ADDR12
11 A1 45 ADDR13
12 A0 58 ADDR0
13 DQ0 9 DATA0
14 DQ1 10 DATA1
15 DQ2 11 DATA2
16 Vss 67,1 VSS
17 DQ3 12 DATA3
18 DQ4 13 DATA4
19 DQ5 14 DATA5
20 DQ6 15 DATA6
21 DQ7 16 DATA7
22 CE# ?
23 A10 44 ADDR14
24 OE# 36 OC1/OC2
25 A11 55 ADDR3
26 A9 49 ADDR9
27 A8 50 ADDR8
28 A13 57 ADDR1
29 A14 48 ADDR10
30 NC 67, 1 VSS
31 WE# 5 R/W#
32 Vcc 68,34 VDD

I also want to make a dump of the flash after it is paired to a vehicle to get an indication where the VIN is located. If people are interested, i also have a chip-tuned firmware dump of this ecu.

---

After hacking on this pcm for a bit with Quadstar87 I found that the scrambing was the same as in the '99 saturn which was figured out by sabercatpuk here http://pcmhacking.net/forums/viewtop...26&t=377#p4046

So I wrote some code descrambled the original bin. Its attached here, and the code I wrote to do it is in the thread here https://pcmhacking.net/forums/viewto...p=65617#p65617

This appears to be a 1996-1999 Suburban ECU? What engine family did it originally control?

Quote:

---

Originally Posted by Xnke

This appears to be a 1996-1999 Suburban ECU? What engine family did it originally control?

---

96-00 GM 6.5 Turbo Diesel
4L80e Trans or nv4500 manual trans

Can also be setup as a stand alone 4l80e Controller probably. Since the obd1 had that ability.