I'm anxious to see about how the 3->2 downshift works in the 96/97 code, maybe we can Port it over to the 94/95 for those that obd1 swap the 96/97.
BTW are you Tom Hussey from here
https://web.archive.org/web/20030527...y/msg00279.htm
If so wow I congrats on working on this platform for so long
97z28 A4 obd1 swap(16188051)
Tunerpro Newbie
I hope once complete any/all code could be ported or modified. Sticking with GM tested code is safe: exhaustivly tested and considering the entire design. So far I have detailed much of the OBDII and Tside code. Three is transmission code I have not touched... yet. There is 100K of code and that is a steep thing for disassembly. I hope that we could get there...
I am that same person from a lifetime ago. I can't say I have been working on the platform all this time however. I had the car new and took it solo racing. This love of road racing grew and I bought an open wheel car: Formula Vee. Ran that in regional racing (CASC up here in Canada is like SCCA down in US). The Camaro met it's demise on our busy highway 401 one afternoon when I stopped for road construction backup. When I woke, I was looking up at someone's oil pan through the shattered back glass. I was lucky the seat had broken and it went up, landing on top.
I am planning a project now, and started again a month ago to understand the ECMs. I had some code that I wrote from all those years ago but am starting almost fresh. I have discovered (and re-discovered) much of the work I did back then.
I hope that this work will be of use to someone other than myself. Currently I am working on download. I have now digested steps up to the point where the tester has entered Mode $34. Last step is mode 36 to actually send something. I was surprised that all this isn't more common knowledge. I am now working out details such as which bytes are contained in the 16bit checksum of the download mode 36 commands. I hope to post details and a program to get a PCM reply of "Hello world!" soon.
Cheers, -Tom
Originally Posted by Tom H
I went through obd2 code real quick and it is a real mess at least on the 96. Later OS might get it a bit cleared.
As far as mode 36 block checksum is calculated on later vpw pcms it is really simple.
Sum all words after 6D 10 F0 36 ......data...... xxxx[last 2 bytes of checksum=block checksum] yy[vpw message checksum of whole message].
I couldn`t find it in the code to confirm but should be something like that.
The pcm might response with 72 and 77 message stating wrong checksum and longer than expected message.
73 or 78 or something else if the upload is successful.
Did you managed to find what modes are supported. I have a detailed info on most of them.
Last edited by kur4o; 03-06-2019 at 02:45 AM.
Have been sorting through the code for mode $34 & $36 for some time now. There are a bunch of different buffers and queues, code that depends on flags I don't yet know the purpose of and so on. Typical disassembly ?s.
One thing I am questioning is if the standard "header:frame:checksum" format is followed in mode $36. The DLC is set up for this format as is the ELM327. I need to see if/how the ....data.... you suggest is handled.
I have detailed most of the supported modes and found all of them. Different modes supported depending on which target ECM, physical vs. functional addressing and other conditions ( such as access to the data transfer)
I will keep plugging away on this, hope to complete soon.
-Tom
{6D 10 F0 36 [[80 (00 70) (00 18 10) //86 86 36 CE 76 80 3C 30 9D 86 38 31 39 18 38 18 EC 02 FD 18 7C CD EE 00 18 08 18 08 18 08 18 08 4F 9D 8F C6 40 E7 00 18 E6 00 E7 00 FB 18 7F F7 18 7F 24 03 7C 18 7E 9D 89 C6 C0 E7 00 9D 8C 18 E6 00 E1 00 27 07 4C 81 19 23 D6 20 12 08 18 08 3C FE 18 7C 09 FF 18 7C 38 26 C5 86 86 20 02 86 85 36 CE 76 80 3C 30 9D 86 38 31 39 00 00 00 00//]] [29 0A]} [56]
Here is some sample mode 36 message.
MODE is 36 80 it could be 36 00 also. It depends on pcm. 80 means download and execute. 00 means download only. Some PCMs don`t support multi message download and they execute on both 00 or 80.
(00 70) is the lenght of the message. The message lenght is contained between //...//
(00 18 10) is the ram address you want the message to get loaded. It is always 3 byte length.
[29 0A] this is the block checksum. It is used by the pcm to check data integrity. It is word+word+word 16 bit type checksum caculated from data contained in[[.....]]
[56] this the checksum of DLC. it is calculated from data contained in {....}
this is 8-bit CRC with the following attributes
8 Bit CRC
Polynom 0x1D
Inital value 0xFF direct
Final XOR value 0xFF
Reflection IN false
Reflection Out false
So you have 2 different checksums to calculate. The DLC checksum is usually handled by the tool.
If the upload is successful you are likely to get a message containing 73.
Thank you for all your help! The additional clarification is a great boost.
Looks to me as if the ELM327 is a non-starter for download. To send anything like the format you have given, a large buffer is needed internally OR the translator needs to start the transmit before all the characters have been placed in it;s fifo.
I guess a different setup will be needed. Setback but a thing that is not too difficult.
I will go through the code. I had already found the process for the 2nd byte (execute the code). Along with that are a great number of checks and standard replys (things like invalid address if not in ram )
Again, thanks for the help and I will get back over the next few days.
-Tom
you know if you want any help with the software end of things i'd be happy to do things like.. you know.. write a tool and UI for a flash tool or whatever? help write and clean up an XDF? i did it for $EE and i'd do it just for fun with this thing. just holler.
I am having a bit of trouble with this checksum. I think it to be byte+byte+byte with the count extended to 16bit. Here is the code I think it uses from the PCM... please correct if I missed the point here. Adding 16 bit words also results in a problem when/if frames have odd number bytes.
It seems also, I have made a number of errors in the "hello world" execution frame I posted. Not the least of which is that I forgot to reset the cop and watchdog timers... this will result in a reset (no harm done). I plan to update with a fix soonCode:************************************************ * CHECKSUM INCOMMING FRAME ************************************************ DDC3 BB 1C 06 ADDA $1C06 ; CHECKSUM OF MESSAGE DDC6 B7 1C 06 STAA $1C06 ; UPDATE DDC9 B6 1C 05 LDAA $1C05 ; EXTEND CHECKSUM TO DDCC 89 00 ADCA #$00 ; 16 BITS DDCE B7 1C 05 STAA $1C05 ; DDD1 39 RTS ; DONE
The makeshift tool I am using to send download frames works but is not great for debugging. Takes way too much time to set things up.
Current problem I am working through is that the PCM accepts the frame, but does not respond in any way. Then after it times out the d/l it just keeps on as if I had sent nothing. Here is the test frame I am sending after removing security and sending a mode 34 to get ready. Mode 34 responds with a $44-- ready to download.
Just plays possum after. Wondering now about how the content of address and length in the mode $34 command might affect the following mode $36 command.Code:Frame content: 6d 10 f0 36 80 00 16 00 00 00 86 55 b7 10 3a 86 aa b7 10 3a cc 50 a0 b7 18 06 f7 18 06 01 20 08 6a e2
-Tom
The checksum is byte+byte+byte checksum-16 type of. I noticed the error but forgot to make a note.Code:6d 10 f0 36 [80 00 16 00 00 00 86 55 b7 10 3a 86 aa b7 10 3a cc 50 a0 b7 18 06 f7 18 06 01 20 08] 08 72
In this frame the checksum will be 08 72, $16 byte long with 000000 load address.
On newer pcm when you download a frame with wrong checksum you will get 77 response. I suppose that is not added in the code so that`s why the pcm stay silent. Or it might just crash. Try loading with 36 00 with wrong checksum just to see how it will respond.
Mode 34 just check if the memory region is available for download and is not in outside range. Than the pcm enters upload loop.
The following mode 36 request can be changed and it should work.
Posting Permissions
Reply With Quote
Bookmarks