411 disassembly help

Hi All,

Now that I've got your attention regarding the 411, I'll say that I don't actually have a 411, rather a similar (MC68336 based) PCM from a saturn. I've read a few different bins from different PCMs, and now I'm looking to disassemble them. The goal isn't to learn everything about them, rather to modify an auto bin to be a manual, or find the unique identifier in the PCM that handles the passkey info, put that into a manual bin, and force it to work.

A few questions:
1) I have IDA, is there a collection of '411 bins somewhere that I can get and disassemble them to get my feet wet in trying to understand the code?
2) Are there any folks here willing to help me out and find some key routines in my bin if I post it?

I'd appreciate any help I can get, I'm struggling trying to pass an e-test on a car converted from an auto to a manual. I can't seem to get a manual PCM to marry to the BCM, even with GM's software and an MDI.

My background is that I'm an EE with some MCU experience, but mainly 8 bit ones, the 68k is a little more advanced!

Thanks, Ivan

Can you post the bin and explain what is not working, and what exactly you are trying to do.

You need to find if there is a manual option on this model year,
and find a VIN from manual car.
Than flash the PCM with tech 2 with the manual VIN.
Than you can tune out the bcm problem.
Just turn off the theft protection in the PCM if you manage to find it.
The bcm have all the options code from the VIN stored. You may have to buy new bcm and programm it with the manual RPO added and auto RPO removed.

For now you can upload bin and VIN of the vehicle your are working on.

So I have tried a few things already, and in no particular order:

-I have bins from both a manual and an auto PCM
-i'm not sure of the manual VIN...but I do know my auto VIN.
-I'm not sure where the theft protection is in the PCM. I have looked, and if I diff the two bins, manual and pcm, I can quickly narrow down which blocks might contain the VIN/theft protection info
-From what I have read of saturn PCM's, the information about the drivetrain options are all stored in the PCM.
-I don't have a tech2, but I do have an MDI, and an old version of globalTIS or whatever it's called. I wish I had Tech2win.

Auto and Manual use different PCM, bcm is the same.
You need to do Passlock relearn procedure available only through tech2. It may be required to change the vin on the new PCM to match the vin stored in the bcm.
I am not sure mdi will work, tech2win also won`t work.

I tried the 30min relearn process many, many times, and it didn't work.

When I got the MDI, I tried the 10min process, and it went through all the motions as it should work, but didn't work. What i'm not sure about is this: I don't have good visibility on the options of my donor vehicle. In other words, I know it was a manual, but I don't know if it had cruise control, traction control, etc. Does this make the relearn process not work, _or_ does it mean it will relearn, but only with the options of the donor vehicle?

Interesting about the different PCM...for fun I put the auto bin in a manual PCM and it fired up and worked just fine. On the board level a large number of components are depopulated, I assume to support the auto transmission, which I don't have, haha!

I guess the vin in pcm and the bcm don`t match, and that`s the main problem.
Is the bcm from the donor available.
Is there an option in the mdi to change only vin at bcm or pcm.
Both modules need to be configured with the vin and rpo codes when first programmed.

Another thing to do is to find used bcm from manual car. Find the vin it was programmed with and flash your pcm with that vin calibration.

Hmm, I don't recall an option to change only the vin, I'll have to look into it more. I do know I can change the vin as part of reprogramming, but then my pcm becomes an auto, defeating the purpose. Getting the BCM from a manual car means that my VIN changes, which is an automatic fail on an e-test I think...it's as if I'm hooked up to another car.

Assume for the moment that interactions through the MDI/Tech2 are useless, I'm pretty sure that I can figure out the VIN portions of the code if I can read and write at will. This means disassembling the code a little more into chunks, finding the chunk that is different, and swapping it. Do you have any experience with this? Also, do you know how I'd go about calculating or figuring out the checksum?

Your only option will be to to find how to change the vin and where the VATS switch is located in the bin. It will be like this 00 , 01 or 02.
The vin is stored in the bin at 1c050, but I think it is also stored on the chip eeprom, so changing it in the bin might not have any effect.
On tech 2 there is option to see what vin is saved in the pcm and bcm and it might be possible to change it there. I think it`s also possible to reprogram bcm with new vin.
What is this e-test doing?

Wow, thanks for the tip on where the vin is located...I swear I had searched again and again looking for the VIN, and I couldn't find it...sure enough, it's there, in both bins! Now I just need to figure out the checksum and start fiddling with some burns!

I'm lucky in that I only have this one flash chip on this design, there is no other eeprom to worry about. So, if I can get the VIN changed on the manual pcm I can get it working.

Ivan

How do you plan to flash the chip. Do you know a software that can do saturn pcm. I think most popular tuning programs don`t support Saturn.

I have socketed the flash...I can remove it and program it, and then put it back in. I have verified this works, I just haven't hacked any bins yet.

Ivan

Hey Kur4o, I tried to reply to your private message but it's blocked as you're over your quota! :)