Page 1 of 10 123456 ... LastLast
Results 1 to 15 of 148

Thread: OBD2 LT1 XDF $EE EEX creation

  1. #1
    Fuel Injected!
    Join Date
    Sep 2012
    Location
    Huntsville, AL
    Posts
    237

    OBD2 LT1 XDF $EE EEX creation

    I have started working on an OBD2 LT1 XDF for use in TunerPro. I know I'm not the first, and I'm looking for anyone interested in helping or contributing. I've made a lot of progress with the big tables using commercially available hex comparison software but the individual flags and scalars are going to take some time and may require looking into the disassembly.

    If you're interested, send me a PM. I can teach you.

  2. #2
    LT1 specialist steveo's Avatar
    Join Date
    Aug 2013
    Posts
    4,007
    so i've never seen an XDF specifically but i swear i did see someone had damn completed a disassembly on here. i never plan to tune one myself so i wont be much help with the XDF but i do plan to hack up its reflashing routine at some point

  3. #3

  4. #4
    Fuel Injected!
    Join Date
    Sep 2012
    Location
    Huntsville, AL
    Posts
    237
    I've thoroughly mined that thread for info but didn't want to hijack it. He's really focusing more on the hardware and comms side of it so I figured I'd work on the file definition.

  5. #5
    Fuel Injected!
    Join Date
    Jan 2019
    Location
    Canada
    Posts
    477
    I would like to offer what I can... my work is far from perfect though and I hope what I send doesn't present setbacks. I think the most digestible is perhaps my ram tables for the tside. Those can be reached with ELM327 and so on. We can start there. If you need my version of commented code, I can send that also.

    -Tom
    Attached Files Attached Files

  6. #6
    Fuel Injected!
    Join Date
    Mar 2013
    Posts
    1,470
    Making an xdf will be really awesome. Since now we have a viable method to convert raw bins to good bins, tuning the old school chip burning way will be much easier.

    First thing to do will be to define the bin format for the xdf. eside is 64kb chip and tside is 128kb chip, including the ram section.
    Tside must be first and eside second on the final bin. Than you can set the relative addressing. I think you should convert all the bins you have to that format and start the xdf with it.

    One xdf fit all won`t work here. There are at least 2-3 different bin revision that shifted data here and there, so different version of xdf will be needed.

    You can also look at the 96-97 code as 94-95 with the addition of obd2 emissions bloatware.

    Eside structure is almost identical with the 94-95 code with the addition of some extra tables and scalars.


    I suggest you start with the 94-95 xdf and change the starting addresses of the tables and scalars and mark the obd2 converted stuff so you can keep track of it. Later you can ditch the unneeded stuff. Some new tables will be added but they are not much.

    You can also edit the xdf in text editor. It is much faster, than the built in interface.

    Check bits are not that much, so you won`be having difficulties here, once understood. Find a good hex,binary calculator that can convert hex to binary and you can easily find which bits are changed. Windows calculator is doing fine with that in scientific level.

  7. #7
    Fuel Injected!
    Join Date
    Mar 2013
    Posts
    1,470
    Quote Originally Posted by Tom H View Post
    I would like to offer what I can... my work is far from perfect though and I hope what I send doesn't present setbacks. I think the most digestible is perhaps my ram tables for the tside. Those can be reached with ELM327 and so on. We can start there. If you need my version of commented code, I can send that also.

    -Tom
    You did some great work here. I have one question for the tside memory chip. How the data is written to it. The usable banks are 3 banks with 32kb with $2000 bytes added to the first bank to make it 32kb.

    How are this written to flash chip is there any offset for the third bank. Is it bank1 and 2 from 0-ffff and bank3 from 10000-18000 or bank 3 from 18000-1FFFF with 10000-18000 empty space.

  8. #8
    Fuel Injected!
    Join Date
    Sep 2012
    Location
    Huntsville, AL
    Posts
    237
    Wow that's very helpful. I've done what you suggested - started with an OBD1 BIN and then opened a OBD2 BIN, both in TunerPro, and just used the built-in XDF editor which allows me to immediately see if the tables now match. I started with an Impala (b-body) BIN since there was no options on that carline (like rear axle ratio) to mess anything up in the BIN.

    For hex editor / comparison, I'm using BeyondCompare, which is a great tool for the price. It's successfully found all of the big tables I've searched for almost instantly. The latest Windows calculator has a programmer mode that simultaneously displays hex, decimal, binary and octal, and that's been useful too.

    So far I've found all the MAF, spark and VE tables. I started working on the transmission tables but ran out of time.

    kur4o, can you send me a PM and we'll start talking over email? I'm going to need some help understanding how to read disassembly, otherwise these scalars and check bits will take a long time.

    I'd also like to better understand the interplay between RAM and EEPROM while the car's running. What's left as a EEPROM lookup, and what's brought into RAM? I haven't looked at Tom H's attachment yet but will soon.

  9. #9
    Fuel Injected!
    Join Date
    Jan 2019
    Location
    Canada
    Posts
    477
    Quote Originally Posted by kur4o View Post
    You did some great work here. I have one question for the tside memory chip. How the data is written to it. The usable banks are 3 banks with 32kb with $2000 bytes added to the first bank to make it 32kb.

    How are this written to flash chip is there any offset for the third bank. Is it bank1 and 2 from 0-ffff and bank3 from 10000-18000 or bank 3 from 18000-1FFFF with 10000-18000 empty space.
    On the '96/7 TSide, the FLASH is set up to work in two pages. First page is enabled in the 'HC11 address space from $2000 through $FFFF, second page overlays from $8000 thru $FFFF. Address line 16 is driven by the bank switch bit (port a bit 5) and A 15. I believe the chip marked 014 P56AB 83833 is an AND gate (I need to confirm that it is not a NAND) This means that the 2nd page maintains the same code as the first in the range of $2000 thru $7FFF. The upper 32K are replaced with the 2nd page. In the FLASH chips address range, from $00000 thru $01FFF and from $10000 thru $17FFF are not used. It would be possible to add some logic and expose a 3rd page, but this is not what GM did.
    Note that if the part mentioned above turns out to be NAND the address ranges in the flash flip.

    Hope this answer is not confusing. If so, ask again and I will try to clarify. It is hard to write these things in a clear way.
    -Tom

  10. #10
    Fuel Injected!
    Join Date
    Jan 2019
    Location
    Canada
    Posts
    477
    Quote Originally Posted by Tom H View Post
    On the '96/7 TSide, the FLASH is set up to work in two pages. First page is enabled in the 'HC11 address space from $2000 through $FFFF, second page overlays from $8000 thru $FFFF. Address line 16 is driven by the bank switch bit (port a bit 5) and A 15. I believe the chip marked 014 P56AB 83833 is an AND gate (I need to confirm that it is not a NAND) This means that the 2nd page maintains the same code as the first in the range of $2000 thru $7FFF. The upper 32K are replaced with the 2nd page. In the FLASH chips address range, from $00000 thru $01FFF and from $10000 thru $17FFF are not used. It would be possible to add some logic and expose a 3rd page, but this is not what GM did.
    Note that if the part mentioned above turns out to be NAND the address ranges in the flash flip.

    Hope this answer is not confusing. If so, ask again and I will try to clarify. It is hard to write these things in a clear way.
    -Tom
    PS... The reason GM didn't overlay the lower 32K is because of interrupts. All the vectors need to point to the lower area such that if an interrupt happens, it can be serviced no matter which bank is active.

  11. #11
    Fuel Injected!
    Join Date
    Mar 2013
    Posts
    1,470
    Tom H

    The explanation says it all. So if you read the full flash chip the empty regions will be 0-1fff and 10000-17fff.

    I have some routines that will erase and write the intel chips. You can set it up for the bootstrap mode and try some flashing.

    Maybe we can move the conversation to the 96-97 lt1 thread.

  12. #12
    Fuel Injected!
    Join Date
    Jan 2019
    Location
    Canada
    Posts
    477
    Quote Originally Posted by kur4o View Post
    Tom H

    The explanation says it all. So if you read the full flash chip the empty regions will be 0-1fff and 10000-17fff.

    I have some routines that will erase and write the intel chips. You can set it up for the bootstrap mode and try some flashing.

    Maybe we can move the conversation to the 96-97 lt1 thread.
    Yes, that's what I expect. The question of if the gate is AND or NAND does come into this though and would just flip the banks. Easy to sort out if I had a working Tside (I don't at the moment). One issue gives me pause with what I wrote... the DLC interrupt seems to be in the switched bank. In the case this interrupt fires in the upper bank, the PCM will crash. Yipes did I find a bug???? or is that interrupt just not used. If not used, why provide a vector in a switched bank.

    I am getting closer to being able to help with this but still struggling with some of the basics. Also struggling with finger problems... I soldered a header strip in place of the flex cable that broke. I should have placed one on the comp side to use a standard ribbon cable. now I need to cross all the wires ^&%&^%&^%

    When I get the latest little (?) project of the schematic done, I would like to disassemble the erase and write routines. Have you already done this??

    -Tom

  13. #13
    Fuel Injected!
    Join Date
    Mar 2013
    Posts
    1,470
    Quote Originally Posted by Tom H View Post
    When I get the latest little (?) project of the schematic done, I would like to disassemble the erase and write routines. Have you already done this??

    -Tom
    I did it on 94-95 code but I am sure they use the same code. On 96-97 there might be slight difference, but when you get there I will give you a good start.
    Chip enable must be set high with vpp to enable most of the functions.

  14. #14
    LT1 specialist steveo's Avatar
    Join Date
    Aug 2013
    Posts
    4,007
    i just got what i think is a 'bricked' 1996 ecm so i'm going to try to bring it back to life and help a bit with this research too.

  15. #15
    Fuel Injected!
    Join Date
    Apr 2012
    Location
    Mt. Airy, MD
    Posts
    51
    It was bricked during a write while outside in cold weather. The laptop and cable were 30*f cold. Ive had 50/50 success with putting them in the freezer for a week or so. Some come back, some dont. Cant answer why. That one didnt. Works on vin locked hypertech tuners. Shh dont tell...

Similar Threads

  1. XDF Creation / Editing - How To????
    By B52Bombardier1 in forum OBDII Tuning
    Replies: 5
    Last Post: 02-28-2020, 02:04 AM
  2. new to obd2
    By myburb in forum OBDII Tuning
    Replies: 0
    Last Post: 05-28-2018, 05:54 AM
  3. DHP/AVT-852-002 Rev L OBD2 programmer $250
    By SappySE107 in forum Buy - Sell - Trade - Wanted
    Replies: 2
    Last Post: 02-03-2018, 09:25 AM
  4. flashing OBD2 ECU?
    By vwnut8392 in forum OBDII Tuning
    Replies: 4
    Last Post: 11-25-2017, 01:43 AM
  5. WTB TunerCats II (OBD2)
    By XRelapse13 in forum Buy - Sell - Trade - Wanted
    Replies: 0
    Last Post: 12-16-2014, 08:26 PM

Tags for this Thread

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •