Corvette CCM Reverse Engineering Anyone?

[kur4o]

I will have some time soon, and might do some dissasembly for previous years. What needs to be done. Porting some switches from later bins to earlier should be pretty straightforward, when we have one of them defined.

[spfautsch]

I think if you could help us locate the location of the reman pin register that would be awesome. For the 94-96 units you determined it was at $644b bit 2. There are a few rom dumps staring around post 411 of this thread.

Then maybe we can build a list of PROMIDs to determine where to look to see if the reman pin is in the correct state for unlock.

I'm still working through testing with and without the VATS options on and off in my PCM tune (@ $2028 and $12017). There's definitely something to this because with it enabled there's no way to get the CCM to shutup without the correct passkey resistor.

[-=Jeff=-]

I'm still working through testing with and without the VATS options on and off in my PCM tune (@ $2028 and $12017). There's definitely something to this because with it enabled there's no way to get the CCM to shutup without the correct passkey resistor.

Are you getting messages other than the $40/$41 and $10?

I have found the Bit to switch between L98/LT5 on the ECM stream. I will grab data from a 1995 ZR-1 to try and find the bit location.

I have a couple friends with the 92 which I will do the same

Although this is more for the Arduino Simulator NomakeWan made

[spfautsch]

I'll try to sit down later tonight and get better logging / documentation. It's been a struggle to function without any ctrl keys - feels like I've had my pinky fingers cut off. Copying or pasting is a 10-15 millisecond event with a ctrl key. Having to use a mouse for this same operation is exquisite torture.

[spfautsch]

I didn't get to a point I was satisfied with on this tonight, sorry. Gotta go pay my wife some attention or I'll be sleeping on the dog's bed tomorrow night.

Anyway, I'll have to recompile flashhack to extend the idle scan time quite a bit because I wasn't always seeing 41 responses from the PCM presumably due to it being in a non-engine-running state, or maybe it's just how flashhack tries to re-sync to the datastream. I'll revisit again tomorrow night or the next day.

Whatever the outcome on that front, there's a very clear difference in the initial handshake data with VATS disabled in the PCM. I think it would be good to know the specific details of how this security loop works.

[steveo]

feel free to beat on datastream_8192::resync_datastream. it's a bit confusing and terrifying and like anything you touch will break it, and you corvette nerds are the only reason that it is like that. you could throw some log entries in there to see what's happening along the way.

[-=Jeff=-]

I was testing out a UART interface.. I must have had a connection backwards, I connected it and let some magic smoke out of one of my CCMs.. It was a 1992 unit, so not the end of the world, it still will work for Bench testing but the VATS Circuit looks to be the one that took the hit, I can still connect to it and download it, but the VATs doesn't work

[spfautsch]

LOL @ being classified a "corvette nerd". I still haven't had a chance to tinker with it, but I suspect some PCM responses are being dropped b/c I was seeing a lot of "resync datastream by fast forwarding XX bytes" or something to that effect. I do know my black box logger also isn't 100% accurate with datastream sync either, but I suspect it's because I didn't realize I needed to let the PCM tell the CCM it was unlocked, or whatever is happening that causes the CCM to start sending a heartbeat. I'm probably going to go swap out my nerdmobiles today so I can test that theory out.

... testing out a UART interface.. I must have had a connection backwards, I connected it and let some magic smoke out of one of my CCMs..

Wow, you really have to try to hurt one of these. Trust me, I've done a lot of really stupid things to the one steveo now owns (no returns allowed btw) while fairly well intoxicated, and I couldn't manage to get any smoke to come out.

If you can identify what's "bbq'd" it's possible it can be repaired. My guess would be you probably killed one of the passkey voltage divider resistors by shorting it to something with ground or power.

[-=Jeff=-]

For the amount of smoke that poured out of the unit and the fact the VATS is the only thing that seems to be broken, I would agree with you. I also found the 94-95 ZR-1 message to CCM is the same as 92-93

[spfautsch]

If you would care to share the message differences, it's sort of the entire spirit of this and most of the other things I post here.

I've only touched one and may never again, but if I ever get vanity plates for mine they will be "ZR-N0NE" because in it's current configuration it would easily best any stock LT5 and most of the modded ones. I would love to own one for nostalgic aspirations, but knowing that Lingenfelter has bought up and is effectively bogarting every last piece of remaining engine parts GM owned makes it something I couldn't afford to drive the way I would like to.

[-=Jeff=-]

Yes, planning to. Been away from my computer and a PITA to post from phone. I will get everything I know so far and post it. I will also post the 94 ZR-1 BIN

[-=Jeff=-]

I've only touched one and may never again, but if I ever get vanity plates for mine they will be "ZR-N0NE" because in it's current configuration it would easily best any stock LT5 and most of the modded ones. I would love to own one for nostalgic aspirations, but knowing that Lingenfelter has bought up and is effectively bogarting every last piece of remaining engine parts GM owned makes it something I couldn't afford to drive the way I would like to.

Not sure Lingenfelter bought them all. Jerry's Gaskets has tons of parts. Only had to find parts, CCM, ECM and Ignition Module, but the IM is pretty stout.. As for Power, yeah I only have headers on mine and 4.10 gears.. I did other mods as my last vette (89 L98) had a built Miniram motor. I do know one ZR-1 ( another friend of mine) that coule give you a good run.. it runs 10.5's in the 1/4 (on stock gears I think)..

Alright, CCM Messaging:

I want to thank everyone for the help I have received. I have looked at a couple messages with the CCMs I have. So of this info cam from NomakeWan as well
I am pulling this form the ECM Simulator that NomakeWan posted around page 18. I was woking on the Arduino to test the messages which is why they are formatted the way they are

Edit: Checksums may not be correct at the end, witht he simulator I had it always calculating the Check sum as I kept changing values and compiling, so that was the quicker way to get the correct messages

94-95 ECM->CCM message.. LT1 only
0x41, 0x67, 0x02, 0xF5, 0x00, 0xCD, 0x87, 0x01, 0x00, 0x00, 0x00, 0x00, 0x88, 0x00, 0x48, 0xFF, 0xFF, 0x00, 0xFF, 0xFF, 0x40 

1992-1993 ECM->CCM
 LT1 Message 0x41, 0x64, 0x01, 0xF3, 0x00, 0xCD, 0x60, 0x01, 0x00, 0x6F, 0x0F, 0xD6, 0x83, 0x00, 0x51, 0xFF, 0xFF, 0x13
I found this message was happy with CCMs set for LT5 or LT1. I tried to twiddle Byte 10 MSB, but no changes as I could see

1990-1991 ECM->CCM Messages 
L98 Message = 0x41, 0x61, 0x00, 0xEC, 0x00, 0x39, 0x39, 0x01, 0x00, 0x00, 0x00, 0xB4, 0x00, 0x39, 0x12
LT5 Message = 0x41, 0x61, 0x00, 0x00, 0x00, 0x4F, 0x54, 0x01, 0xAD, 0x80, 0x76, 0x7A, 0x00, 0x4B, 0x13
1990-1991 Byte 10 MSB must be  set to 1 to tell CCM it is a LT5 (Tested and Confirmed with above messages)

My final message was a pull from the 1995 ZR-1 I helped fix due to having a LT1 CCM. What I found interesting was the message:

1995 LT5 (I assume 94 as well)
0x41, 0x64, 0x00, 0xEF, 0x00, 0x51, 0x47, 0x01, 0x08, 0xCB, 0x14, 0x81, 0x7A, 0x00, 0x46, 0xFF, 0xFF, 0xAD
Same size and length as the LT1. I no longer have a 94-95 CCM for test purposes.

I am debating on buying a 1994 CCM for testing purposes, but have 4 others so not quite sure I need it. I need to finish my test bench which will add functions to the ECM Simulator for some of the cluster displays..

EDIT #2. ECM messaging will be the same for 92-95 LT5s. they new at the end of 1992 the ZR-1 would end in 1995, so all remaining motors were built in 1993. If the LT1 and LT5 shared messaging in 92-93 that would make sense that the flag int he 94-95 CCM changes the whole message detection. I still believe there might be a flag in 92-93 but thinking now maybe not

EDIT #3: you said you would do a vanity plate: ZR NONE.. My Expanded Antique Plate is ZR ONE.. LOL

[spfautsch]

Not sure Lingenfelter bought them all. Jerry's Gaskets has tons of parts. Only had to find parts, CCM, ECM and Ignition Module, but the IM is pretty stout..

I was referring to the hard parts like blocks, heads, intakes, cams and crankshafts. You know, the other type of "magic smoke" where the fire is ignited by metal-on-metal type catastrophic friction.

I am debating on buying a 1994 CCM for testing purposes, but have 4 others so not quite sure I need it. I need to finish my test bench which will add functions to the ECM Simulator for some of the cluster displays..

AngryCorvair's donor is out of a 94. I'd loan it to you if it would contribute to your quest.

Thanks for sharing what you have. Once we have this nut fully cracked we can move on to the C5 and OBD-II / J1850 VPW based stuff. Who's with me!?! [crickets]

[NomakeWan]

Once we have this nut fully cracked we can move on to the C5 and OBD-II / J1850 VPW based stuff. Who's with me!?! [crickets]

I would be down, if only because the fact that Rob Dahm has stuffed a stock PCM and entire throttle body into the fender of his rotary-swapped C5 drives me absolutely freaking bonkers. There is no reason to do that when all he actually wants to do is make the dash happy.

Just...yanno...need to actually get my hands on a C5 first.

As for the flag in 92-93 for LT1 vs LT5, technically the CCM does have the code for that error message. However, figuring out what those error codes are actually querying is the territory of the real nerds here. Someone like kur4o would need to take a crack at disassembling the CCM code and looking for the routine that the CCM runs to trip the error flag for DTC 81.

[-=Jeff=-]

Actually the error I would see for the 90-91 want C41. So it could be either, C81 was not on the 1990-91

Here is my better version of my bench. The green PCB is an old ECM setup made on Thirdgen or anothe site years ago, it has some POTs. I want to test my message reader that will be based on Nomake's code

The screen is a 4.3 version of the 5" version in my car. It replaced the basic DIC. I am working on adding the data from the ECM to CCM. This is an older screen and I want to see if I can make a second page that is touch accessible