Page 7 of 10 FirstFirst ... 2345678910 LastLast
Results 91 to 105 of 148

Thread: OBD2 LT1 XDF $EE EEX creation

  1. #91
    Fuel Injected!
    Join Date
    Nov 2017
    Location
    Californiacation
    Age
    57
    Posts
    811
    Hi Tom,
    I'm bad at reading the destructions first so I ran in XP, no worky, then dos cmd prompt, got nag both times that it isn't a 32bit program, duh Read your post again and then ran on my win7 x64. Of course double click and a dos window popped up and disappeared. Ran from cmd prompt and it told me it needed the input name. Put that in and it ran and showed my cmd prompt without error so checked my root folder and walah the parse worked. Please check if it looks right to you.

    p.s. even my win7 lappy has a real serial port if we need to try stuff without a usb adapter. Can do ttl or 232 via a max23x interface.
    Attached Files Attached Files
    Last edited by In-Tech; 05-29-2020 at 05:22 PM.
    -Carl

  2. #92
    LT1 specialist steveo's Avatar
    Join Date
    Aug 2013
    Posts
    4,008
    really nice work so far, just trying to figure out how it works,

    i would have assumed you could just bootstrap it with the existing flash kernel and then once it's booted, just run a flash procedure (like mine) as normal

    so i guess i'm trying to figure out why you're dumping aldl messages out to disk

  3. #93
    Fuel Injected!
    Join Date
    Nov 2017
    Location
    Californiacation
    Age
    57
    Posts
    811
    Goes to show how little LT1 stuff I have done, I never noticed this in the stock file.

    Code:
    00003C80 583A EE00 AD00 3206 3900 0045 5241 5349 X:....2.9..ERASI
    00003C90 4E47 2046 4C41 5348 204F 4E20 5449 4D45 NG FLASH ON TIME
    00003CA0 2053 4944 452E 2020 2020 2020 2020 2020  SIDE.          
    00003CB0 2020 2000 0050 524F 4752 414D 4D49 4E47    ..PROGRAMMING
    00003CC0 2046 4C41 5348 204F 4E20 5449 4D45 2053  FLASH ON TIME S
    00003CD0 4944 452E 2020 2020 2020 2020 2040 0045 IDE.         @.E
    00003CE0 5241 5345 2056 5050 2048 4920 4552 524F RASE VPP HI ERRO
    00003CF0 5220 2D20 5449 4D45 2053 4944 452E 2020 R - TIME SIDE.  
    00003D00 2020 2020 2020 2040 0045 5241 5345 2056        @.ERASE V
    00003D10 5050 204C 4F20 4552 524F 5220 2D20 5449 PP LO ERROR - TI
    00003D20 4D45 2053 4944 452E 2020 2020 2020 2020 ME SIDE.        
    00003D30 2040 0050 524F 4752 414D 4D49 4E47 2056  @.PROGRAMMING V
    00003D40 5050 2048 4920 4552 524F 5220 2D20 5449 PP HI ERROR - TI
    00003D50 4D45 2053 4944 452E 2020 2040 0050 524F ME SIDE.   @.PRO
    00003D60 4752 414D 4D49 4E47 2056 5050 204C 4F20 GRAMMING VPP LO 
    00003D70 4552 524F 5220 2D20 5449 4D45 2053 4944 ERROR - TIME SID
    00003D80 452E 2020 2040 0046 4C41 5348 2045 5241 E.   @.FLASH ERA
    00003D90 5345 2046 4149 4C45 4420 2D20 5449 4D45 SE FAILED - TIME
    00003DA0 2053 4944 452E 2020 2020 2020 2020 2040  SIDE.         @
    00003DB0 0046 4C41 5348 2050 524F 4752 414D 4D49 .FLASH PROGRAMMI
    00003DC0 4E47 2046 4149 4C45 4420 2D20 5449 4D45 NG FAILED - TIME
    00003DD0 2053 4944 452E 2020 2040 0046 4C41 5348  SIDE.   @.FLASH
    00003DE0 2046 4149 4C45 4420 544F 2050 474D 2054  FAILED TO PGM T
    00003DF0 4F20 5A45 524F 202D 2054 494D 4520 5349 O ZERO - TIME SI
    00003E00 4445 0000 464C 4153 4820 4552 4153 4544 DE..FLASH ERASED
    00003E10 204F 4B20 2D20 5449 4D45 2053 4944 452E  OK - TIME SIDE.
    00003E20 2020 2020 2020 2020 2020 2020 4000 464C             @.FL
    00003E30 4153 4820 5052 4F47 5241 4D4D 4544 204F ASH PROGRAMMED O
    00003E40 4B20 2D20 5449 4D45 2053 4944 452E 2020 K - TIME SIDE.  
    00003E50 2020 2020 2020 4000 464C 4153 4820 4D41       @.FLASH MA
    00003E60 5920 4E4F 5420 4245 2050 524F 4752 414D Y NOT BE PROGRAM
    00003E70 4D45 4420 5749 5448 2054 4845 2020 2020 MED WITH THE    
    00003E80 454E 4749 4E45 2052 554E 4E49 4E47 202D ENGINE RUNNING -
    00003E90 2050 4C45 4153 4520 5455 524E 204F 4646  PLEASE TURN OFF
    00003EA0 2045 4E47 494E 4520 4000 494D 5052 4F50  ENGINE @.IMPROP
    00003EB0 4552 204D 414E 5546 4143 5455 5245 5220 ER MANUFACTURER 
    00003EC0 2D20 5449 4D45 2053 4944 4520 2020 2020 - TIME SIDE     
    00003ED0 2020 4000 494D 5052 4F50 4552 2044 4556   @.IMPROPER DEV
    00003EE0 4943 4520 434F 4445 202D 2054 494D 4520 ICE CODE - TIME 
    00003EF0 5349 4445 2020 2020 2020 2020 4144 4452 SIDE        ADDR
    00003F00 3D20 2020 2020 2052 443D 2020 2020 5752 =      RD=    WR
    00003F10 3D20 2020 2020 2020 2020 2020 2020 2020 =
    -Carl

  4. #94
    Fuel Injected!
    Join Date
    Jan 2019
    Location
    Canada
    Posts
    477
    Quote Originally Posted by In-Tech View Post
    Hi Tom,
    I'm bad at reading the destructions first so I ran in XP, no worky, then dos cmd prompt, got nag both times that it isn't a 32bit program, duh Read your post again and then ran on my win7 x64. Of course double click and a dos window popped up and disappeared. Ran from cmd prompt and it told me it needed the input name. Put that in and it ran and showed my cmd prompt without error so checked my root folder and walah the parse worked. Please check if it looks right to you.

    p.s. even my win7 lappy has a real serial port if we need to try stuff without a usb adapter. Can do ttl or 232 via a max23x interface.
    First up, sorry bout the lack of destructions. I forgot to give any. Will do better as this all moves along.

    Second, If need be with the push of a button you could have had 32bit. Easy done, just ask.

    Last bit, I see your file size listed as 59.9K on the stuff for ALDL. Each chunk ($80 bytes has an overhead of 9 bytes. That means each time a section is loaded, 137 bytes are sent. There should be 448 frames sent which gives a total of 61376 bytes. Not more, not less. Look under file properties and see if it looks like this
    FileSize.JPG

    Should that not be the case, please let me know and I will fix my screw up. Still, I believe it is working so please check for me.

    -Tom

  5. #95
    Fuel Injected!
    Join Date
    Jan 2019
    Location
    Canada
    Posts
    477
    Quote Originally Posted by steveo View Post
    i would have assumed you could just bootstrap it with the existing flash kernel and then once it's booted, just run a flash procedure (like mine) as normal
    so i guess i'm trying to figure out why you're dumping aldl messages out to disk
    Hi,
    I did not try to describe the overall plan, because I was not sure what was possible. Ok, so here goes:

    My assumption is that a bricked module corrupted FLASH. Obviously if the unit is flooded, burned or electrically shocked there is no afterlife. In a unit where the flash is erased the only operational code resided in a small (0x200 byte) rom. With a few changes to the mode pins, that rom is enabled and permits us to download and execute up to 1K of code. I plan to use that space to initialize the resources we need and to provide a loader (now working). The loader is loosely based on some of the code Kur4o gave us. Using the download & execute mode, I plan to:

    - Turn on VPP, checking and reporting input and VPP voltages.
    - Check the ID of the FLASH part. If it ain't Intel, it MIGHT work, Intel parts will work.
    - Erase the whole FLASH. First write all locations to $00 then do the overall erase
    - Using the ALDL messages on disk, program the part

    Once done your PCM should be factory fresh & ready to mess with.

    Your thoughts?

    -Tom
    Last edited by Tom H; 05-29-2020 at 10:14 PM.

  6. #96
    Fuel Injected!
    Join Date
    Jan 2019
    Location
    Canada
    Posts
    477
    While on this posting storm, I just found one more thing. With respect to the 68HC11 noise flag, I wanted to understand what the issue is. Seems that there are problems with the baud rate in these cheep-o cables. I built a file of a few hundred $55s and sent it to the transmit. The low pulses were all one size but the high pulses had two different sizes. The high times were measured at 570 or 660us on my hobby quality scope. I had requested 1890 baud and got something like 1750. It is no wonder the 'hc11 UART was getting upset. I guess you get what you pay for (sometimes)

    I had read somewhere about folks making software available and having trouble with certain cables. Does anyone know if the driver affects the low level operation of these cables? Any suggestions?? I have five different drivers of which 3 work with the usb-serial cable and some of the others work with ELM327. Sure getting complex to configure your system with all these junk drivers.

    -Tom

  7. #97
    Fuel Injected!
    Join Date
    Mar 2013
    Posts
    1,470
    Quote Originally Posted by Tom H View Post
    While on this posting storm, I just found one more thing. With respect to the 68HC11 noise flag, I wanted to understand what the issue is. Seems that there are problems with the baud rate in these cheep-o cables. I built a file of a few hundred $55s and sent it to the transmit. The low pulses were all one size but the high pulses had two different sizes. The high times were measured at 570 or 660us on my hobby quality scope. I had requested 1890 baud and got something like 1750. It is no wonder the 'hc11 UART was getting upset. I guess you get what you pay for (sometimes)

    I had read somewhere about folks making software available and having trouble with certain cables. Does anyone know if the driver affects the low level operation of these cables? Any suggestions?? I have five different drivers of which 3 work with the usb-serial cable and some of the others work with ELM327. Sure getting complex to configure your system with all these junk drivers.

    -Tom
    I guess you have some crap 3.3v serial cable. I got one batch that hardly worked at all.
    The best ones that work flawless are ftdi based and look like this.

    Try some other standard baud rate or close to some standard. At higher rates it might work better.
    Attached Images Attached Images

  8. #98
    Fuel Injected!
    Join Date
    Nov 2017
    Location
    Californiacation
    Age
    57
    Posts
    811
    Quote Originally Posted by Tom H View Post
    First up, sorry bout the lack of destructions. I forgot to give any. Will do better as this all moves along. <<<<< No Worries

    Second, If need be with the push of a button you could have had 32bit. Easy done, just ask. <<<<< Yes please, if super simple. I have quite a few dos type software items that could prove helpful for debugging and I have doubts they will work with 64 bit Windows.

    Last bit,<<<<< I see what you did there I see your file size listed as 59.9K on the stuff for ALDL. Each chunk ($80 bytes has an overhead of 9 bytes. That means each time a section is loaded, 137 bytes are sent. There should be 448 frames sent which gives a total of 61376 bytes. <<<<< It is 61376 bytes

    -Tom
    I work from home on Mondays since it usually has the phone ringing off the hook, and just place orders too, I'll be able to play with this stuff then to more extent :)
    Last edited by In-Tech; 05-29-2020 at 11:47 PM.
    -Carl

  9. #99
    LT1 specialist steveo's Avatar
    Join Date
    Aug 2013
    Posts
    4,008
    Quote Originally Posted by Tom H View Post
    Hi,
    I did not try to describe the overall plan, because I was not sure what was possible. Ok, so here goes:

    My assumption is that a bricked module corrupted FLASH. Obviously if the unit is flooded, burned or electrically shocked there is no afterlife. In a unit where the flash is erased the only operational code resided in a small (0x200 byte) rom. With a few changes to the mode pins, that rom is enabled and permits us to download and execute up to 1K of code. I plan to use that space to initialize the resources we need and to provide a loader (now working). The loader is loosely based on some of the code Kur4o gave us. Using the download & execute mode, I plan to:

    - Turn on VPP, checking and reporting input and VPP voltages.
    - Check the ID of the FLASH part. If it ain't Intel, it MIGHT work, Intel parts will work.
    - Erase the whole FLASH. First write all locations to $00 then do the overall erase
    - Using the ALDL messages on disk, program the part

    Once done your PCM should be factory fresh & ready to mess with.

    Your thoughts?

    -Tom
    it just seems like i've done a lot of work that would assist and save you time. if you get this thing booted up and communicating with my slightly customized kernel, we can kick it out of bootstrap mode and leave that code running, and just plug the thing into my flash tool, it'll do all the rest of the work.

    maybe it's not that simple though

  10. #100
    Fuel Injected!
    Join Date
    Jan 2019
    Location
    Canada
    Posts
    477
    Quote Originally Posted by In-Tech View Post
    I work from home on Mondays since it usually has the phone ringing off the hook, and just place orders too, I'll be able to play with this stuff then to more extent :)
    Please give this a try
    Attached Files Attached Files

  11. #101
    Fuel Injected!
    Join Date
    Jan 2019
    Location
    Canada
    Posts
    477
    Quote Originally Posted by steveo View Post
    it just seems like i've done a lot of work that would assist and save you time. if you get this thing booted up and communicating with my slightly customized kernel, we can kick it out of bootstrap mode and leave that code running, and just plug the thing into my flash tool, it'll do all the rest of the work.

    maybe it's not that simple though
    It would be best if it fit into your tool. I'm not sure how to do this... If you can give me a hand I will see if we can make this happen.

    I have not yet tried the TSide. The parts I need from China are taking so long to get here. They are now in the hands of Canada Customs and will at some point move to Canada Post. Canada Post moves at a snail pace at the best of times. Hope I see this stuff some time before July. Other option is to wire wrap.

    -Tom

  12. #102
    Fuel Injected!
    Join Date
    Jan 2019
    Location
    Canada
    Posts
    477
    While debugging the ESide routine for setting VPP to 12V, I decided to modify the result codes. Should the ignition voltage be out of range OR the VPP be out of range, an error message is generated. This all is of little use to the tech trying to re-flash. I added ignition voltage and VPP voltage to the reply. I am concerned how this will affect other code that might use the routine ??steveo??

    Code works now. I made a bunch of changes to port it from the TSide example I was using to the ESide. Here is the code I am using now.
    To convert the VPP voltage, divide result by 17.5.

    Code:
    *************************************************
    * APPLY VPP 12 VOLT
    *************************************************
    VPP_12VOLT	LDAA	#$00			; START A/D CONVERTER CH0
    		STAA	CPU_ADCTL		; 
    		ASLD				; TIME DELAY TO A/D COMPLETE
    		MUL				; 
    		MUL				; 
    		MUL				; 
    		LDAA	CPU_ADR1		; READ ESIDE PCM IGNITION VOLTAGE
    
    		STAA	@IGN_VOLTAGE		; 
    
    		CMPA	#$66			; 10.2 VOLTS
    		BCS	VPP_ERR_IVOOR		; IGNITION UNDER VOLTAGE
    
    		CMPA	#$A1			; 16.1 VOLTS
    		BLS	VPP_IVIR		; IGNITION VOLTAGE IN RANGE
    
    VPP_ERR_IVOOR	LDD	#$0602			; MODE 6 MESSAGE: IGNITION VOLTAGE OUT OF RANGE
    		BRA	VPP_SEND_MSG		; SEND MESSAGE
    
    VPP_IVIR	LDAA	PRU_PA			; PRU PORT A
    		ORAA	#$80			; TURN ON VPP
    		STAA	PRU_PA			; UPDATE AND WAIT FOR VPP TO SETTLE
    
    		JSR	@D_RESET_COP		; RESET COP TIMERS
    		JSR	@D_D10MS_DELAY		; 10MS DELAY
    		JSR	@D_RESET_COP		; RESET COP TIMERS
    		JSR	@D_D10MS_DELAY		; 10MS DELAY
    
    		LDAA	#$01			; START A/D CONVERTER CH1
    		STAA	CPU_ADCTL		; 
    		ASLD				; TIME DELAY TO A/D COMPLETE
    		MUL				; 
    		MUL				; 
    		MUL				; 
    		LDAA	CPU_ADR1		; READ VPP VOLTAGE
    
    		STAA	@VPP_VOLTAGE		; 
    
    		CMPA	#$BC			; 10.5 VOLTS
    		BCS	VPP_ERR_PVOOR		; VPP UNDER VOLTAGE
    
    		CMPA	#$E9			; 13.0 VOLTS
    		BLS	VPP_PVIR		; VPP IN RANGE
    
    VPP_ERR_PVOOR	LDAA	PRU_PA			; VPP UNDER/OVER VOLTAGE
    		ANDA	#$7F			; TURN OFF VPP
    		STAA	PRU_PA			; UPDATE
    
    		LDD	#$0603			; MODE 6 MESSAGE: VPP 12V OUT OF RANGE
    		BRA	VPP_SEND_MSG		; SEND MESSAGE
    
    VPP_PVIR	LDD	#$06AA			; MODE 6 MESSAGE: APPLY VPP 12V SUCCESS
    
    VPP_SEND_MSG	PSHX				; MAKE ROOM FOR MESSAGE CONTENT ON STACK
    		PSHX				;
    
    		TSX				; MESSAGE POINTER TO IX
    
    		STD	$00,X			; SET MESSAGE CONTENT
    		LDAA	@IGN_VOLTAGE		; 
    		LDAB	@VPP_VOLTAGE		; 
    		STD	$02,X			; SET MESSAGE CONTENT
    
    
    		LDAB	#$04			; MESSAGE PAYLOAD 4 BYTES
    		JSR	@D_SEND_ALDL		; SEND MESSAGE
    
    		PULX				;
    		PULX				; RESTORE STACK POSITION
    
    		RTS				; DONE
    -Tom

  13. #103
    Fuel Injected!
    Join Date
    Mar 2013
    Posts
    1,470
    That brings a good point. The vpp is applied by tside only, I guess the relay transistor is wired there and the voltage goes to both sides. Now can we apply vpp from tside, while flashing eside. I guess we need to bootstrap both sides and than do the flashing.

  14. #104
    LT1 specialist steveo's Avatar
    Join Date
    Aug 2013
    Posts
    4,008
    yeah you cant apply vpp from the eside at all
    back to my original thought
    bootstrap the dead side with the entire kernel then just let flashhack do its normal thing over aldl. no need to bootstrap both sides
    the chances of both sides being bricked are near zero

  15. #105
    LT1 specialist steveo's Avatar
    Join Date
    Aug 2013
    Posts
    4,008
    just out of curiosity, is there any way to bootstrap the chip over the regular ttl serial pin that aldl uses? or is it a different pin entirely

    in other words can you upload the bootstrap program from the aldl port?

    I am concerned how this will affect other code that might use the routine ??steveo??
    definitely would need a tweak on the tool side of things, but otherwise looks harmless. i'd just put ignition voltage in there, since if that's out of range, that is something the user is able to solve. knowing the vpp voltage might be academic, as good battery voltage should mean good vpp voltage unless there's damage to the ECM itself. the only person that's ever reported the vpp voltage out of range error to me opened his ECM and found it full of moisture damage.

Similar Threads

  1. XDF Creation / Editing - How To????
    By B52Bombardier1 in forum OBDII Tuning
    Replies: 5
    Last Post: 02-28-2020, 02:04 AM
  2. new to obd2
    By myburb in forum OBDII Tuning
    Replies: 0
    Last Post: 05-28-2018, 05:54 AM
  3. DHP/AVT-852-002 Rev L OBD2 programmer $250
    By SappySE107 in forum Buy - Sell - Trade - Wanted
    Replies: 2
    Last Post: 02-03-2018, 09:25 AM
  4. flashing OBD2 ECU?
    By vwnut8392 in forum OBDII Tuning
    Replies: 4
    Last Post: 11-25-2017, 01:43 AM
  5. WTB TunerCats II (OBD2)
    By XRelapse13 in forum Buy - Sell - Trade - Wanted
    Replies: 0
    Last Post: 12-16-2014, 08:26 PM

Tags for this Thread

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •