Flashhack - New LT1 flash tool

[kur4o]

It looks like that it is a mode 0 msg with device id 00. The ccm interprets it is as a mode 00 msg and returns to normal comm.

[steveo]

yeah does look like that. i'm surprised the CCM responds to a message that isn't addressed to it. that thing is really annoying.

i'll try your msg F0 mode F0 i guess. i just need some valid message to keep all the devices quiet

nomakewan i know you're probably tired of all this bus testing but can you try device F0 mode F0 with flashhack, and just click the button every few seconds and take a comm log? no need to load the kernel just send the command. want to see if that keeps the CCM asleep without causing issues with the CCM/dash/whatever

[NomakeWan]

Nah, not tired of it at all, actually! I've been messing around with more commands anyway.

I've attached the comms log to this post, as requested. However I should note that the reason why EEHack doesn't freak out the dash but Flashhack does is apparently due to the actual code uploaded to the PCM; if I just connect to the bus with the current version of flashhack and send a manual command, nothing happens to the dash at all. The whole sequence in this log resulted in zero errors on the digital dash. However once I load kernel, then the dash freaks out, and continues to do so every time flashhack performs a bus reconnect operation.

Anyway, time for more CCM goodness. This time I've got dimmer controls!

F1 04 0000 0000 0000 01 00-FF Gauge Backlight Dim
F1 04 0000 0000 0000 02 00-FF Dash LCD Backlight Dim
F1 04 0000 0000 0000 04 00-FF Climate Control LCD Backlight Dim
F1 04 0000 0000 0000 08 00-FF Climate Control LED Indicator Dim
F1 04 0000 0000 0000 10 00 00-FF Dimmer Switch Override
F1 04 0000 0000 0000 20 00 00 00-FF Ambient Light Sensor Override

The "00-FF" sections are where you can put any value between 00 and FF to control the brightness of that section, or control the value of that input.

There are also commands referring to the security system, but my first attempts to probe them resulted in nothing...nothing...and then the alarm going off and the car freaking out, forcing me to kill the key. I won't be able to probe that system until a while later, when it's not 93F outside and the middle of the day with people trying to have conference calls.

[yoheer]

I can help you too, maybe not so fast, I'm not firebird daily driver. But I can help, just say what to test

[steveo]

you will test it when you tune because its the best
and if you run into trouble the logs will help me improve

[steveo]

Nah, not tired of it at all, actually! I've been messing around with more commands anyway.

I've attached the comms log to this post, as requested. However I should note that the reason why EEHack doesn't freak out the dash but Flashhack does is apparently due to the actual code uploaded to the PCM; if I just connect to the bus with the current version of flashhack and send a manual command, nothing happens to the dash at all. The whole sequence in this log resulted in zero errors on the digital dash. However once I load kernel, then the dash freaks out, and continues to do so every time flashhack performs a bus reconnect operation.

Anyway, time for more CCM goodness. This time I've got dimmer controls!

F1 04 0000 0000 0000 01 00-FF Gauge Backlight Dim
F1 04 0000 0000 0000 02 00-FF Dash LCD Backlight Dim
F1 04 0000 0000 0000 04 00-FF Climate Control LCD Backlight Dim
F1 04 0000 0000 0000 08 00-FF Climate Control LED Indicator Dim
F1 04 0000 0000 0000 10 00 00-FF Dimmer Switch Override
F1 04 0000 0000 0000 20 00 00 00-FF Ambient Light Sensor Override

The "00-FF" sections are where you can put any value between 00 and FF to control the brightness of that section, or control the value of that input.

There are also commands referring to the security system, but my first attempts to probe them resulted in nothing...nothing...and then the alarm going off and the car freaking out, forcing me to kill the key. I won't be able to probe that system until a while later, when it's not 93F outside and the middle of the day with people trying to have conference calls.

i appreciate your playing with it.

if only the kernel freaks your dash out im not too worried about it but since the ccm controls the dash maybe we can use this mode4 junk to override it

there should be no reason to load the kernel manually ever. any routine that needs it will do that, and any other function, it should auto connect

do any of these values line up with that document i sent you?

im going to change the keepalive though since its waking your ccm up

[NomakeWan]

i appreciate your playing with it.

if only the kernel freaks your dash out im not too worried about it but since the ccm controls the dash maybe we can use this mode4 junk to override it

there should be no reason to load the kernel manually ever. any routine that needs it will do that, and any other function, it should auto connect

do any of these values line up with that document i sent you?

im going to change the keepalive though since its waking your ccm up

Sweet, thanks for the changes. I only really use the dash to monitor voltages while performing flash routines, so agreed that if it only happens during a kernel operation, it shouldn't be too huge of a deal.

As to the CCM stuff, it matches up almost exactly with that document...so far. The control stuff matched up exactly, though the sections marked as "spare" were populated by new functions. The dimmer controls also matched up, though the document was pretty cryptic about what those actually were, so I labeled them better and made sure I knew how each worked.

The security system is still a mystery. The first few commands I tried didn't seem to do anything, but the third command I tried caused the alarm to go off, so I'll need to be more careful and poke at it some more to see if there's just some nuance I'm missing, like setting a bit to 0 instead of 1 or something. That tripped me up on a few of the earlier commands too.

[NomakeWan]

Just a minor update. On the ‘94 the SYS flashing turned out to be actual CCM error codes stored in memory. When I pulled the codes, they were:

LCD data circuit open/shorted
Data clock circuit open/shorted
Data strobe circuit open/shorted
M clock circuit open/shorted
(Historical) PCM Serial Data Loss
(Historical) Fuel Enable DataStream failure

Seems the car got very, very angry. This probably happened during that failed read operation that hung the PCM in a weird state a while back. I’ve gone ahead and reset all the codes and will update once I drive back home from work to see if they reappear.

EDIT: Drove all the way home without any more errors cropping up, so it looks like they were indeed codes stored during testing in the garage. Odd to see all those digital dash open/shorted codes, but hey, that answers the question of why the '94 was blinking SYS all the time.

[spfautsch]

Sounds like you guys have been having an awful lot of CCM fun without me.

I only really use the dash to monitor voltages while performing flash routines,

I haven't read the entire thread carefully, so not sure which car is your "primary" test mule, but on my '95, all the "gauges" functionality in the DIC (the lcd / digital dash) are driven from ALDL data. When I'm logging with eehack (older versions) the DIC shows voltage, oil and coolant temp, and fuel consumption data based on the last data it received from the PCM. None of this info updates until the CCM wakes up and becomes bus master.

Interesting stuff here. The CCM is a very interesting topic b/c mine seems a bit flakey. I've had it "wig out" in the middle of a drive and start flashing the 'security' and 'passive keyless entry' lights for no apparent reason. I've also had it start popping the rear hatch repeatedly while flashing the PCM. Thankfully it's never popped the hatch while driving, but I'd really love to have a better understanding of what it does and how it does it.

[NomakeWan]

Sounds like you guys have been having an awful lot of CCM fun without me.



I haven't read the entire thread carefully, so not sure which car is your "primary" test mule, but on my '95, all the "gauges" functionality in the DIC (the lcd / digital dash) are driven from ALDL data. When I'm logging with eehack (older versions) the DIC shows voltage, oil and coolant temp, and fuel consumption data based on the last data it received from the PCM. None of this info updates until the CCM wakes up and becomes bus master.

Interesting stuff here. The CCM is a very interesting topic b/c mine seems a bit flakey. I've had it "wig out" in the middle of a drive and start flashing the 'security' and 'passive keyless entry' lights for no apparent reason. I've also had it start popping the rear hatch repeatedly while flashing the PCM. Thankfully it's never popped the hatch while driving, but I'd really love to have a better understanding of what it does and how it does it.

The voltage does update when the program upload is in progress—I can see the voltage droop on the digital dash when the fans kick on to start the process, and can watch it creep back up once they kick out.

Also, your issue with those lights and the hatch isn’t the CCM—it doesn’t control the hatch or the PKE light. Both of those are controlled by the PKE module which is connected to the CCM but separate. I would suspect that as faulty first unless you have other non-PKE things going on.

[spfautsch]

The voltage does update when the program upload...

Have you verified this on both your cars? I find this odd b/c absolutely nothing updates on mine while it's silenced except fuel level and vss / odometer related functions.

Sorry, I was under the impression the CCM handled the door locks and hatch and the PKE module just handled the RF stuff and interfaced to the CCM. I guess I need to dig it out and look it over for cold solder joints also.

I suspect the key-in switch in the column might be broken because my chime only works when I leave the car in the sun on a hot day.

[NomakeWan]

Have you verified this on both your cars? I find this odd b/c absolutely nothing updates on mine while it's silenced except fuel level and vss / odometer related functions.

Sorry, I was under the impression the CCM handled the door locks and hatch and the PKE module just handled the RF stuff and interfaced to the CCM. I guess I need to dig it out and look it over for cold solder joints also.

I suspect the key-in switch in the column might be broken because my chime only works when I leave the car in the sun on a hot day.

I've verified it on both cars, yes. A little later today I should be able to get video of the digital voltmeter reacting throughout the PCM read process.

As to the PKE, please see attached the relevant schematics. The key-in switch is indeed a good start since it's supposed to prevent the PKE from doing anything, but that still leaves the question of why it's randomly popping your hatch. It shouldn't do that even if the PKE is armed unless you're actually pressing the button. Best of luck with the diagnostics!

[spfautsch]

Don't worry about making a video, I believe you. Just curious why your '95 is different. Thinking back, aren't you the one that had to replace the CCM with one salvaged from a ZR-1? Is that your '95?

Thanks for the schematics.

PKE has always been screwy. The car was sold to me with one set of keys and zero FOBs, so I've gone through every crack and crevice looking for a lost one with a mostly dead battery. Had the seats out twice. The only thing I haven't removed completely is the console, which I'm saving for when the carpets get replaced.

Anyway, sorry to wander off-topic steveo. Nice work on the new flash tool! I look forward to building it for linux and testing sometime in the next week or two.

[NomakeWan]

Don't worry about making a video, I believe you. Just curious why your '95 is different. Thinking back, aren't you the one that had to replace the CCM with one salvaged from a ZR-1? Is that your '95?

Nah, wasn't me. I've been lucky enough to not have to replace any of the electronic components on either of my cars...yet.

[steveo]

Don't worry about making a video, I believe you. Just curious why your '95 is different. Thinking back, aren't you the one that had to replace the CCM with one salvaged from a ZR-1? Is that your '95?

Thanks for the schematics.

PKE has always been screwy. The car was sold to me with one set of keys and zero FOBs, so I've gone through every crack and crevice looking for a lost one with a mostly dead battery. Had the seats out twice. The only thing I haven't removed completely is the console, which I'm saving for when the carpets get replaced.

Anyway, sorry to wander off-topic steveo. Nice work on the new flash tool! I look forward to building it for linux and testing sometime in the next week or two.

thanks, glad you're giving it a shot, i think you'll like it. i'm confident it'll build on linux, haven't tried yet myself. if you need to make any minor changes let me know, i usually make the mistake of capitalizing some header file name or something.

go off topic all you want, that's the only way we get anywhere.