Page 1 of 5 12345 LastLast
Results 1 to 15 of 65

Thread: Hacking the DataStream

  1. #1
    Fuel Injected! gregs78cam's Avatar
    Join Date
    May 2011
    Location
    N. Idaho
    Posts
    767

    Hacking the DataStream

    So you want to be able to datalog, or view some seemingly insignificant piece of data coming from the ECM, or you need to see something that GM should have put in the datastream, and left out. Here ya go. I learned how to do this by looking through 93V8S10's AWESOME P4 PCM files and making small tweaks.

    First you have to figure out if the ECM actually stores that data you want in the RAM. And you have to find this out by searching through the hac. In this case we are going to try to add 'Injector PulseWidth" to the '7747 datastream. A suitable address in the .bin could not really found, so we are going to get it directly from the register.

    Code:
           LBC00     EQU     $BC00        ; DRP COUNT
    
          LBC0E     EQU     $BC0E        ; SYNC  BPW    PWM
           LBC14     EQU     $BC14        ; ASYNC BPW PWM
    
           LBC3C     EQU     $BC3C        ; PWM
    So the next step is to decide which piece of data in the data stream we want to replace with the INJ PW. In this case PROM ID makes the most sense because it too is a 2byte value, and is hardly used.

    Code:
            ;  ALDL XMIT TABLE OR ADDRESSE'S
            ; 127747 ECM
            ;
            ;  5.7L TBI    L05 C/K    87,91 TRUCKS
            ;
            ; DATA PIN: Read data on PIN "E" of ALDL Connector
            ;
            ; BAUD RATE:  160 Baud
            ;             Open         - 20 Bytes
            ;             10k          - 20 Bytes
            ;             Shorted     - 20 Bytes
            ;
            ;---------------------------------------------
            ORG $04E7    ;
    LD4E7  FDB $D002   ; 1.  EPROM ID LSB
    LD4E9   FDB $D003   ; 2.  EPROM ID MSB
                        ;---------------------------------
    LD4EB   FDB $00FD   ; 3.  CURRENT IAC POSIT, (0-255)
                        ;      N = COUNTS
    What we are going to do is change the .bin at L04E7 from $D002 to $BC0E and L04E9 from $D003 to $BC0F from above. Only we are going to do it with a constant so we can change it easily, without having to use the hexeditor.

    So we make a XDF parameter as follows........


    At this point we have just told the computer to look at a different address for the data to send out in the datastream.


    Next step is to make a ADX parameter to view the data.


    We make the packet offset 0x02, because I guess that is the spot in the datastream that should have what used to be PROM ID, should now be INJ PW.


    Almost forgot, make the conversion as shown........



    Now someone make a log and tell me it worked.......Please.
    Attached Images Attached Images
    Last edited by gregs78cam; 04-16-2012 at 03:02 AM.
    1978 Camaro Type LT, 383, Dual TBI, '7427, 4L80E
    1981 Camaro Z-28 Clone, T-Tops, 350/TH350
    1981 Camaro Berlinetta, V-6, 3spd
    1974 Chevy/GMC Truck, '90 TBI 350, '7427, TH350, NP203, 6" lift, 35s

  2. #2
    RIP EagleMark's Avatar
    Join Date
    Feb 2011
    Location
    North Idaho
    Age
    63
    Posts
    10,477
    Sweet! Soon as I get a chance to do this I'll be logging!

    1990 Chevy Suburban 5.7L Auto ECM 1227747 $42!
    1998 Chevy Silverado 5.7L Vortec 0411 Swap to RoadRunner!
    -= =-

  3. #3
    Vintage Methane Ejector
    Join Date
    Apr 2011
    Posts
    194
    Nice! GearHead EFI needs a "like" button!

  4. #4
    RIP EagleMark's Avatar
    Join Date
    Feb 2011
    Location
    North Idaho
    Age
    63
    Posts
    10,477
    Working but not reading right? Does it have to do with 2 bytes and we are only using one? LSB and MSB?

    1990 Chevy Suburban 5.7L Auto ECM 1227747 $42!
    1998 Chevy Silverado 5.7L Vortec 0411 Swap to RoadRunner!
    -= =-

  5. #5
    Fuel Injected! gregs78cam's Avatar
    Join Date
    May 2011
    Location
    N. Idaho
    Posts
    767
    It shouldn't be because of that.... We set the source data size to 16bit. Might try the LSB first check mark, but shouldn't need it. I think. Did you set the size in XDF parameter to 2byte, 16bit? Maybe Output type to 'Integer'? If you have data coming out that is half the battle.
    Last edited by gregs78cam; 03-01-2012 at 03:35 AM.
    1978 Camaro Type LT, 383, Dual TBI, '7427, 4L80E
    1981 Camaro Z-28 Clone, T-Tops, 350/TH350
    1981 Camaro Berlinetta, V-6, 3spd
    1974 Chevy/GMC Truck, '90 TBI 350, '7427, TH350, NP203, 6" lift, 35s

  6. #6
    Fuel Injected! gregs78cam's Avatar
    Join Date
    May 2011
    Location
    N. Idaho
    Posts
    767
    Quote Originally Posted by 93V8S10 View Post
    Nice! GearHead EFI needs a "like" button!
    Thanks, but I am just following in your foot steps.
    1978 Camaro Type LT, 383, Dual TBI, '7427, 4L80E
    1981 Camaro Z-28 Clone, T-Tops, 350/TH350
    1981 Camaro Berlinetta, V-6, 3spd
    1974 Chevy/GMC Truck, '90 TBI 350, '7427, TH350, NP203, 6" lift, 35s

  7. #7
    RIP EagleMark's Avatar
    Join Date
    Feb 2011
    Location
    North Idaho
    Age
    63
    Posts
    10,477
    Quote Originally Posted by gregs78cam View Post
    It shouldn't be because of that.... We set the source data size to 16bit. Might try the LSB first check mark, but shouldn't need it. I think. Did you set the size in XDF parameter to 2byte, 16bit? Maybe Output type to 'Integer'? If you have data coming out that is half the battle.
    Yup 2byte 16bit. but theres some conversion stuff on tab on bottom of XDF maybe?

    0x4E7 and D002 to 0052

    I'll try the integrater and stuff, I'm emulating in driveway so can get wireless internet...

    1990 Chevy Suburban 5.7L Auto ECM 1227747 $42!
    1998 Chevy Silverado 5.7L Vortec 0411 Swap to RoadRunner!
    -= =-

  8. #8
    Fuel Injected! gregs78cam's Avatar
    Join Date
    May 2011
    Location
    N. Idaho
    Posts
    767
    Quote Originally Posted by EagleMark View Post
    but theres some conversion stuff on tab on bottom of XDF maybe?
    .
    nope that is just for the XDF parameter display.

    zip me a log and files and I will take a look at it.

    EDIT: Found it! Change packet offset to 0x00
    Last edited by gregs78cam; 03-01-2012 at 04:07 AM.
    1978 Camaro Type LT, 383, Dual TBI, '7427, 4L80E
    1981 Camaro Z-28 Clone, T-Tops, 350/TH350
    1981 Camaro Berlinetta, V-6, 3spd
    1974 Chevy/GMC Truck, '90 TBI 350, '7427, TH350, NP203, 6" lift, 35s

  9. #9
    RIP EagleMark's Avatar
    Join Date
    Feb 2011
    Location
    North Idaho
    Age
    63
    Posts
    10,477
    Changed packet offset to 0x00 and seems steady but numbers are wrong? Data log attatched.

    Also checked in hex editor at line 04E and it is changing 8th and 9th set of hex? But XDF was 0x4E7
    Attached Files Attached Files

    1990 Chevy Suburban 5.7L Auto ECM 1227747 $42!
    1998 Chevy Silverado 5.7L Vortec 0411 Swap to RoadRunner!
    -= =-

  10. #10
    RIP EagleMark's Avatar
    Join Date
    Feb 2011
    Location
    North Idaho
    Age
    63
    Posts
    10,477
    Also changed back to D002 and still get same reading in adx? I think the hex address is off. It is changing 8th and 9th hex in that line?

    1990 Chevy Suburban 5.7L Auto ECM 1227747 $42!
    1998 Chevy Silverado 5.7L Vortec 0411 Swap to RoadRunner!
    -= =-

  11. #11
    Fuel Injected! gregs78cam's Avatar
    Join Date
    May 2011
    Location
    N. Idaho
    Posts
    767
    OK, as a test go into hex editor and change the data at 0x4E9 to 0053 also. I will update the thread pics if this works.
    1978 Camaro Type LT, 383, Dual TBI, '7427, 4L80E
    1981 Camaro Z-28 Clone, T-Tops, 350/TH350
    1981 Camaro Berlinetta, V-6, 3spd
    1974 Chevy/GMC Truck, '90 TBI 350, '7427, TH350, NP203, 6" lift, 35s

  12. #12
    RIP EagleMark's Avatar
    Join Date
    Feb 2011
    Location
    North Idaho
    Age
    63
    Posts
    10,477
    here's the XDF, adx and bin set to D002
    Attached Files Attached Files

    1990 Chevy Suburban 5.7L Auto ECM 1227747 $42!
    1998 Chevy Silverado 5.7L Vortec 0411 Swap to RoadRunner!
    -= =-

  13. #13
    Fuel Injected! gregs78cam's Avatar
    Join Date
    May 2011
    Location
    N. Idaho
    Posts
    767
    I forgot we are actually dealing with two bytes in the datastream code. Check the first pic. OR try these.......
    Attached Files Attached Files
    Last edited by gregs78cam; 03-01-2012 at 04:50 AM.
    1978 Camaro Type LT, 383, Dual TBI, '7427, 4L80E
    1981 Camaro Z-28 Clone, T-Tops, 350/TH350
    1981 Camaro Berlinetta, V-6, 3spd
    1974 Chevy/GMC Truck, '90 TBI 350, '7427, TH350, NP203, 6" lift, 35s

  14. #14
    RIP EagleMark's Avatar
    Join Date
    Feb 2011
    Location
    North Idaho
    Age
    63
    Posts
    10,477
    OK did 0x4E7 and it changed 8th 9th 10th 11th hex from D0 02 D0 03 to 00 52 0053 so that looks right?

    BUT SOMETHING IS WRONG ON ADX SIDE NOW WE HAVE msb lsb 32 bit change in bi.

    I looked at ALDL file and for Prom ID it says:
    2 PROMID (MSB)
    3 PROMID (LSB) PROMID = (MSB)*256 + (LSB)
    The 2 in adx file would be 0x01 and the 3 would be 0x02 because they are 1 off, 1 is 0x00.

    Getting a reading in adx but it's 500.00ish and when I rev up goes down to 15.00ish

    1990 Chevy Suburban 5.7L Auto ECM 1227747 $42!
    1998 Chevy Silverado 5.7L Vortec 0411 Swap to RoadRunner!
    -= =-

  15. #15
    Fuel Injected! gregs78cam's Avatar
    Join Date
    May 2011
    Location
    N. Idaho
    Posts
    767
    HHMMMM. Ok, The hac I was looking at had Prom ID as 1 & 2, now you're saying 2 & 3. Try changing the packet offset back to 0x01. The data should come out of the ALDL as a 16bit value, then we just need to convert it properly.
    1978 Camaro Type LT, 383, Dual TBI, '7427, 4L80E
    1981 Camaro Z-28 Clone, T-Tops, 350/TH350
    1981 Camaro Berlinetta, V-6, 3spd
    1974 Chevy/GMC Truck, '90 TBI 350, '7427, TH350, NP203, 6" lift, 35s

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •