It's not a message string sent by the scantool. The OBDI ecm sends repeating strings of bytes depending on the mode selected. When the ALDL is active the code sends values from addresses that are hardware or code locations. I would alter one of the addresses to point to a memory location that I wanted to see.
This is code from AYBN $58:
Code:
;--------------------------------------------------
; SERIAL DATA ADDRESSES
; ALDL
; F95
;--------------------------------------------------
LC770 FCB $C000 ; 1, EPROM ID WD, MSB
LC772 FCB $C001 ; 2, EPROM ID WD, LSB
;--------------------------------------
LC774 FCB $0003 ; 3 error WORD 1
The code will read the values at address $C000 and $C001 (the first two addresses of the .bin file) and send them to the ALDL. We can look at this section of code:
Code:
D40D: ADDD L3FDC ; SPK PW, (DWELL)
Then alter the ALDL section as such:
Code:
LC770 FCB $3FDC ;
LC772 FCB $3FDD ;
Causing the scan tool to report the hex value for the current dwell period used by the ignition control hardware.
You would likely have to locate the portion of the code that handles messaging and see if the same strategy will work. Maybe the portion that reads back the VIN would work?
Bookmarks